EU MDR: Regulation (EU) 2017/745 Explained

Most guides to the EU MDR describe a regulation that came into application in May 2021 and then stopped moving. It has not stopped moving. Regulation (EU) 2017/745 has been amended eight times, consolidated eight times — three of those since January 2025 — and is served by 125 MDCG guidance documents and a harmonised standards list that changes roughly twice a year.

That matters more than it sounds. A technical file built against a 2023 understanding of the MDR is wrong about EUDAMED, wrong about two delegated acts from March 2026, and possibly wrong about whether a device it covers is lawfully on the market at all. This guide covers what the Regulation requires, what changed most recently, and the four places manufacturers reliably get caught.

What the EU MDR is

Regulation (EU) 2017/745 is the European Union’s medical devices regulation. It replaced the Medical Devices Directive 93/42/EEC and the Active Implantable Medical Devices Directive 90/385/EEC, and has applied since 26 May 2021.

It runs to 123 articles and 17 annexes. Unlike a standard, it is free: EUR-Lex publishes it in all 24 official languages, so every article number in this guide can be checked in one click. Note the version, though — always read a consolidated text, which incorporates the amendments. The current one is dated 19 July 2026.

Being a regulation rather than a directive, it applies directly in every Member State without national transposition. What is not uniform is language: Article 10(11) leaves each Member State to determine the languages in which information must be supplied, which is roughly twenty-seven separate determinations rather than one.

The eight amendments, and what each one did

The last two are Commission Delegated Regulations of 20 March 2026 that took effect in the July consolidation. They are eleven weeks old at the time of writing, and almost no commercial documentation reflects them yet.

EUDAMED stopped being optional in May 2026

This is the single most consequential recent change and it is still widely described as forthcoming.

Article 123(3)(d), as amended by Regulation (EU) 2024/1860, makes the obligations relating to each EUDAMED electronic system apply six months after the Commission publishes a notice that the system is functional. Commission Decision (EU) 2025/2371 of 26 November 2025 gave that notice.

As a result, four modules became mandatory on 28 May 2026:

Three of those are direct manufacturer obligations. A manufacturer without a Single Registration Number is not behind on a project — it is non-compliant, and Article 31(7) makes registration data accessible to the public, so the gap is visible to customers, competitors and competent authorities simultaneously.

Two clocks in Article 31 catch people who are registered. Data must be updated within one week of any change, and its accuracy confirmed within one year of submission and every second year thereafter. Miss the confirmation by six months and any Member State may take corrective measures in its territory. The one-week clock is triggered by ordinary corporate events — a change of address, a rename, a departing regulatory-compliance person — which reach Legal and HR long before they reach Regulatory Affairs.

The transition deadlines, and the conditions that already closed

Article 120, as amended by Regulation (EU) 2023/607, lets devices with a valid Directive certificate stay on the market until:

• 31 December 2027 — all class III devices, and class IIb implantables other than a listed set of well-established technologies (sutures, staples, dental fillings, braces, crowns, screws, wedges, plates, wires, pins, clips and connectors);
• 31 December 2028 — other class IIb, class IIa, and class I devices placed on the market sterile or with a measuring function.

Those dates are widely known. The conditions attached to them are not.

Article 120(3c) makes the extension conditional on five things, and two had deadlines in 2024: a quality management system meeting Article 10(9) and a formal notified body application by 26 May 2024, with a signed written agreement by 26 September 2024. Both have passed. If either was missed for a device, the extension never applied to it — and continuing to supply it is not a documentation problem, it is placing a device on the market with no lawful basis.

A third condition bites continuously: there must be no significant change in design or intended purpose. For a legacy device this produces an uncomfortable asymmetry — an improvement can end the device’s right to be on the market. Where the change is necessary for safety, the honest options are to complete MDR conformity assessment or to stop supplying; characterising the change as insignificant is not one.

One clarification worth making, because overstating it causes unnecessary write-offs: the deadline governs placing on the market. Devices lawfully placed before it are not made unlawful — Regulation (EU) 2023/607 removed the sell-off deadline entirely.

Article 120(3d): legacy devices are already in the MDR post-market regime

The provision most often missed in the whole transition. Article 120(3d) applies the Regulation’s requirements on post-market surveillance, market surveillance, vigilance, and registration of economic operators and devices to legacy devices now, in place of the Directive equivalents.

So a manufacturer running MDR post-market processes only for MDR-certified devices has a gap across its entire legacy portfolio — including EUDAMED registration. It is one of the easiest things for a competent authority to check.

What the Regulation actually asks a manufacturer to produce

Article 10 is the spine, and its sixteen paragraphs are worth reading in full at least once. The documentary output falls into five groups.

1. Classification, and getting it right first

Annex VIII contains 22 classification rules in four groups — non-invasive (1–4), invasive (5–8), active (9–13) and special rules (14–22) — plus six implementing rules that govern how they are applied. Two of those decide most disputes: where several rules apply, the strictest applies; and where a device is not intended solely for one part of the body, it is classified on the most critical specified use.

The commonest error is stopping at the first plausible rule. Record the result of every candidate rule, including those found not applicable, because a “not considered” reads exactly like a blank.

For software, Rule 11 is the single most consequential rule in the annex. Software providing information used for diagnostic or therapeutic decisions is class IIa, rising to IIb where a wrong decision could cause serious deterioration or a surgical intervention, and to III where it could cause death or irreversible deterioration. The escalation turns on the impact of the decision — not on how confident the software is, and not on whether a clinician is in the loop. “All other software is class I” is the residual limb, not the starting assumption.

2. The GSPR checklist

Annex I contains 23 numbered general safety and performance requirements across three chapters: general (1–9), design and manufacture (10–22) and information supplied with the device (23). Annex II §4 requires the technical documentation to show, for each, whether it applies, how conformity was demonstrated, which standards were used, and the precise identity of the controlled documents that evidence it.

Build this first, before the folder structure. It tells you what evidence the device actually needs. Two things fail review more than anything else: rows whose evidence reference is a folder rather than a document, version and section; and “N/A” entered without a device-specific reason.

3. Technical documentation to Annexes II and III

Annex II opens with a requirement about presentation rather than content — the documentation shall be clear, organised, readily searchable and unambiguous. That is enforceable, and a file a reviewer cannot navigate fails it however complete the underlying evidence.

Its six sections are device description and specification; information supplied by the manufacturer; design and manufacturing information; the general safety and performance requirements; benefit-risk analysis and risk management; and product verification and validation.

Annex III is a separate set. The post-market surveillance plan, the PMS report or PSUR, and the trend and field-action documentation are their own annex, and folding them into Annex II §6 makes an authority request impossible to answer cleanly.

4. Clinical evaluation and PMCF

Article 61(1) contains an obligation that is skipped almost universally: the manufacturer shall specify and justify the level of clinical evidence necessary, appropriate to the device’s characteristics and intended purpose. That judgement is made before the evidence is gathered. Recording it afterwards, calibrated to whatever was found, is visible and is challenged.

If you are relying on equivalence, Annex XIV §3 requires it across technical, biological and clinical characteristics — all three. Note the asymmetry: the biological limb requires the same materials in contact with the same tissues, not merely similar. Where the equivalent device belongs to another manufacturer, Article 61(5) also requires a contract giving full access to the technical documentation on an ongoing basis. A one-off data-sharing letter does not satisfy it.

And avoiding a clinical investigation under Article 61(4) is not the cheap route it appears: the notified body must then check that the PMCF plan is appropriate and includes post-market studies.

5. Post-market surveillance and vigilance

Article 83 requires a system that actively and systematically gathers data — a system that waits for complaints does not meet it. Annex III expressly names publicly available information about similar devices as a source, which is what separates a real plan from a template.

The vigilance clocks in Article 87 are strict:

Two provisions remove the usual excuses. Article 87(6) permits an incomplete initial report followed by a complete one, so an unfinished investigation is not a reason to miss a deadline. Article 87(7) provides that where the manufacturer is uncertain whether an incident is reportable, it shall report it anyway within the applicable period.

The exception people lean on — expected side-effects — is conjunctive and strict. It applies only where the side-effect is clearly documented in the product information and quantified in the technical documentation and subject to trend reporting under Article 88. Mentioned in the instructions for use but never quantified? Then it is reportable.

What is not harmonised under the MDR

Article 8 gives a presumption of conformity to devices conforming to harmonised standards whose references have been published in the Official Journal. Three limits follow from that wording, and all three are missed routinely: a standard that is European and widely used gives no presumption unless it is cited; applying part of a standard gives a presumption for that part only; and the presumption covers only the requirements the standard addresses.

Checked against the European Commission’s own summary list generated 17 June 2026, three standards commonly described as harmonised under the MDR are not on it:

• IEC 62304 — medical device software lifecycle processes
• IEC 62366-1 — usability engineering
• EN ISO 20417 — information supplied by the manufacturer

Applying them remains the right engineering decision. They are the state of the art and notified bodies expect them. What they do not confer is a presumption of conformity, so the corresponding Annex I requirements have to be demonstrated directly. Writing “compliant with the harmonised standard IEC 62304” in a technical file is a claim anyone can check in one click, and being wrong about it invites scrutiny of every other claim in the file.

By contrast, EN ISO 13485:2016 and EN ISO 14971:2019 are harmonised, which is why they are the practical routes to Article 10(9) and Annex I §3.

Two obligations that arrived quietly

Article 10a — supply interruption. Inserted by Regulation (EU) 2024/1860. Where a manufacturer anticipates an interruption or discontinuation of supply and it is reasonably foreseeable that this could cause serious harm or a risk of serious harm, it must inform the competent authority and the operators, health institutions and healthcare professionals it directly supplies — normally at least six months in advance. Note that the trigger is anticipation, not the event, and the judgement is clinical while the decision that causes it is usually commercial.

Annex I §10.4 — endocrine disruptors. Regulation (EU) 2025/2457 added substances classified as endocrine disruptors for human health, Category 1, alongside CMR category 1A/1B. Any justification written before that amendment addresses only half the requirement. The 0.1% w/w threshold applies at the level of the device, part or material — not across the finished product’s total mass — and §10.4.5 adds a labelling duty that originates outside Annex I §23, which is why checklists built from §23 alone miss it.

A revision is on the table, but it is not law

On 16 December 2025 the Commission adopted COM(2025) 1023, a proposal amending Regulations (EU) 2017/745 and 2017/746 to simplify and reduce burden, including criteria for breakthrough and orphan devices with priority and rolling review.

It is a proposal in the ordinary legislative procedure — not law. Do not plan on the basis of it, and do not ignore it either: record the exposure and the contingency, and re-check its status on a schedule.

Where manufacturers get caught

Where to start

Four decisions come before any document is written. Decide which products are devices. Classify each one and record every rule considered. Decide which role you occupy for each device — manufacturer, authorised representative, importer, distributor. Appoint the person responsible for regulatory compliance under Article 15, and give the role the protection from disadvantage that Article 15(5) requires rather than the job title alone.

Then build the GSPR checklist before the folder structure, put the post-market system in place before launch rather than after the first complaint, and check your EUDAMED position today rather than at the next audit.

Our EU MDR Toolkit covers that sequence with 68 editable templates across twelve sections — economic operator obligations and the PRRC charter, qualification and the 22 classification rules, the GSPR checklist, Annex II and Annex III technical documentation, clinical evaluation and PMCF, conformity assessment and the declaration, UDI and EUDAMED registration, post-market surveillance and vigilance, labelling and the SSCP, the Article 120 transition, and internal audit. Every document states the consolidated text it was written against, and everything that changes on a schedule lives in one dated supplement.

For the quality system Article 10(9) requires, see the ISO 13485 Toolkit; for the risk management file Annex I §3 requires, the ISO 14971 Toolkit.

If you make in vitro diagnostic devices, none of the above applies in the form given here. Regulation (EU) 2017/746 runs on classes A to D, seven classification rules and performance evaluation rather than clinical evaluation, and its article numbers do not correspond to the MDR’s. See our guide to the EU IVDR.

Frequently asked questions

What is the EU MDR?

Regulation (EU) 2017/745 on medical devices. It replaced the Medical Devices Directive 93/42/EEC and the Active Implantable Medical Devices Directive 90/385/EEC and has applied since 26 May 2021. It contains 123 articles and 17 annexes and applies directly in every Member State.

Which version of the EU MDR should I be working from?

The consolidated text, which incorporates all amendments. The current consolidation is dated 19 July 2026 and carries eight amendments, including two Commission Delegated Regulations of 20 March 2026. A document that does not say which consolidated text it was written against cannot be verified as current.

Is EUDAMED mandatory?

Yes, in part. Following Commission Decision (EU) 2025/2371, four modules became mandatory on 28 May 2026: actor registration, UDI and device registration, notified bodies and certificates, and market surveillance. The clinical investigations and vigilance modules are still under analysis and in development respectively; each will start its own six-month clock when the Commission gives notice.

What are the EU MDR transition deadlines?

31 December 2027 for class III devices and most class IIb implantables, and 31 December 2028 for other class IIb, class IIa and class I devices placed on the market sterile or with a measuring function — provided the Article 120(3c) conditions were met, including a notified body application by 26 May 2024 and a signed agreement by 26 September 2024.

Is IEC 62304 harmonised under the EU MDR?

No. IEC 62304, IEC 62366-1 and EN ISO 20417 do not appear on the Commission’s list of harmonised standards for Regulation (EU) 2017/745. They are state of the art and expected by notified bodies, but they confer no presumption of conformity, so the corresponding Annex I requirements must be demonstrated directly.

Do I need a notified body for a class I device?

Not for a class I device that is not sterile, has no measuring function and is not a reusable surgical instrument — those are self-declared. Where one of those three applies, a notified body is involved but its scope is limited to sterility, metrology or reuse respectively. The certificate that results is correspondingly narrow.

Do I have to buy the EU MDR?

No. Regulation (EU) 2017/745 is published free on EUR-Lex in all 24 official languages. The harmonised standards it refers to are sold separately by the standards bodies.