ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Most guides to the EU IVDR are medical device guides with the words changed. That is the single most expensive mistake an in vitro diagnostic manufacturer can make, because the two regulations diverge exactly where the work is: classification, clinical evidence and the structure of the technical file. Article numbers do not correspond either — Article 56 of the IVDR is performance evaluation, Article 56 of the MDR is something else entirely.
Regulation (EU) 2017/746 has applied since 26 May 2022, has been amended four times, and is currently consolidated at 10 January 2025. This guide covers what it actually requires, where it differs from the medical device regime, and the four places IVD manufacturers reliably get caught.
Regulation (EU) 2017/746 is the European Union’s in vitro diagnostic medical devices regulation. It replaced Directive 98/79/EC and has applied since 26 May 2022.
An in vitro diagnostic medical device is, broadly, a reagent, calibrator, control material, kit, instrument, apparatus, software or system used in vitro to examine specimens from the human body to provide information on a physiological or pathological state, a congenital condition, predisposition, safety and compatibility with potential recipients, treatment response, or to define or monitor therapeutic measures.
The practical scope is wider than people expect. Specimen receptacles are devices. Software that interprets results is a device. Calibrators and control materials are devices. Accessories are covered too.
Under Directive 98/79/EC, most IVDs were self-declared. The Directive worked from lists — Annex II List A and List B — and anything not on a list, and not for self-testing, could be CE marked by the manufacturer without anyone else looking at it.
The IVDR abandoned that model. Annex VIII sets seven risk-based classification rules that sort every device into class A, B, C or D, and only class A non-sterile devices are self-declared. Everything else needs a notified body.
That is why Article 110(3b) exists at all: it is a transitional bracket built specifically for devices that lawfully self-declared under the Directive and now require notified body involvement. If you are a manufacturer who has never worked with a notified body, that provision is about you, and it has a deadline.
The IVDR uses four classes, not the medical device regulation’s I, IIa, IIb and III. Class D is the highest risk.
| Class | Broad character | Conformity assessment |
|---|---|---|
| D | Highest risk — for example detection of transmissible agents in blood intended for transfusion or transplantation | Annex IX Chapters I, II (except Section 5) and III, or Annex X with Annex XI. Plus EU reference laboratory verification and batch verification |
| C | High individual risk or moderate public health risk — including companion diagnostics | Annex IX Chapters I and III plus technical documentation assessment for at least one representative device per generic device group |
| B | Moderate individual risk, low public health risk — and the residual rule | Annex IX Chapters I and III plus technical documentation assessment for at least one representative device per category of devices |
| A | Low risk — instruments, specimen receptacles, general laboratory products | Self-declared on Annexes II and III technical documentation. If placed on the market sterile, a notified body is involved for sterility only |
The seven rules, the ten implementing rules that govern how they are applied, and what each class then determines are covered in IVDR classification.
Two details decide more programmes than the class itself. Self-testing and near-patient testing devices at class B, C or D go through an additional technical documentation assessment under Annex IX Section 5.1, which requires results of studies carried out with intended users. And companion diagnostics go through Annex IX Section 5.2, under which the notified body must consult a medicines competent authority or the EMA — and for class C companion diagnostics that happens for every device, not on a representative basis.
This is the structural difference that decides whether an IVD file survives review.
The medical device regulation asks for a clinical evaluation and a clinical evaluation report. The IVDR does not. Article 56(3) requires a defined and methodologically sound procedure demonstrating three separate things:
Each has its own report. Annex XIII Section 1.3.2 then requires the performance evaluation report to contain all three plus an assessment of them. It is not a report that cites three others; it contains them.
Each limb has its own permitted sources and its own failure modes, covered in IVDR performance evaluation.
A file that answers analytical and clinical performance and takes scientific validity as read is the commonest shape of an inadequate IVD performance evaluation. The association between the marker and the condition is a demonstration in its own right, with its own permitted sources — including consensus expert opinions or positions from relevant professional associations, which Annex XIII Section 1.2.1 names expressly and which almost nobody uses.
Annex XIII Section 1.2.2 sets a hierarchy worth knowing before a programme is costed:
An analytical shortfall escalating into a mandatory clinical study changes the timeline, the cost, and possibly whether Articles 57 to 77 and an ethics committee are engaged. It is discovered late far more often than it is planned for.
Annex I Section 9.3 requires the metrological traceability of values assigned to calibrators and control materials to be assured through suitable reference measurement procedures or reference materials of a higher metrological order — and, where available, to certified reference materials or reference measurement procedures.
There is no counterpart to this anywhere in the medical device regulation. It also has a labelling consequence most manufacturers miss: Annex I Section 20.4.1(u) requires the instructions for use to state the traceability and the maximum self-allowed batch-to-batch variation, with figures and units. That published number is one your manufacturing process then has to hold.
The IVDR calls them performance studies, not clinical investigations, and the gate that matters is Article 58(1). Three categories attract the full authorisation regime in Articles 59 to 77 and Annex XIV:
Studies involving companion diagnostics are subject to the same requirements — except where they use only left-over samples, in which case they must still be notified to the competent authority.
Two conditions in Article 58(5) set the sequence of an entire evidence programme: analytical performance must be demonstrated before a clinical performance study, and analytical performance and scientific validity before an interventional one. A programme planning to establish all three limbs in parallel has a problem the Regulation will surface at authorisation.
The IVDR states no date for its EUDAMED obligations. Article 113(3)(f) ties them to a notice published under Article 34(3) of the medical device regulation — plus six months.
So Commission Decision (EU) 2025/2371, an MDR instrument, started the clock for IVD manufacturers too, and the same four modules became mandatory on 28 May 2026: actor registration, UDI and device registration, notified bodies and certificates, and market surveillance. An IVD manufacturer reading only its own regulation will not find the decision that binds it.
Article 113(3)(fa) then adds a staged follow-on that is easy to miss: manufacturers have six months from that date to enter Article 26 device information — expressly including devices still on the market under the Article 110 transition. Legacy devices get registered.
Registration data is public under Article 28(7), so a manufacturer without a Single Registration Number is visible as such to customers, competitors and competent authorities at the same time. The mechanics are the same ones covered in our guide to EUDAMED registration; the trigger and the timetable are not.
Article 113(3)(e) phases in the UDI carrier obligation in Article 24(4) by class: class D from 26 May 2023, classes B and C from 26 May 2025, and class A from 26 May 2027. That last one is the only carrier deadline still in the future, and it lands on the devices whose manufacturers are least likely to be watching — artwork, printing and verification all have to be planned backwards from it.
Article 110, as rewritten by Regulation (EU) 2024/1860, lets legacy devices continue on the market until 31 December 2027 (devices with a Directive certificate, and class D devices that self-declared), 31 December 2028 (class C) or 31 December 2029 (class B, and class A placed on the market sterile).
Those end dates are not the deadlines that catch people. Article 110(3c) makes the whole extension conditional on six things, two of which have their own earlier dates — a formal notified body application, and a signed written agreement four months later. For class C devices the application deadline was 26 May 2026 and the agreement deadline is 26 September 2026.
Miss a condition and the extension never applied to that device. There is no remediation procedure and no grace period. We cover the full calendar in IVDR transition deadlines.
One provision inside the transition is routinely missed in the other direction. Article 110(3d) applies the Regulation’s post-market surveillance, market surveillance, vigilance and registration requirements to legacy devices instead of the Directive’s. A legacy device is Directive conformity with IVDR surveillance — not a device you can leave alone until 2028.
Article 2(67) defines an incident as any malfunction or deterioration in performance, any use error due to ergonomic features, any inadequacy in the information supplied by the manufacturer — and then adds a limb the medical device regulation does not contain:
and any harm as a consequence of a medical decision, action taken or not taken on the basis of information or result(s) provided by the device.
The device does not have to fail. If it returns a result within its stated performance, a clinician acts or declines to act on it, and harm follows, that is an incident. If the harm meets Article 2(68) — death, serious deterioration of health, or a serious public health threat — it is a reportable serious incident on the ordinary clocks: 15 days generally, 10 days for death or unanticipated serious deterioration, 2 days for a serious public health threat.
A vigilance procedure carried over from a medical device programme looks for device failures and will systematically under-report this class of event.
Article 82(1)(a) excludes expected erroneous results from serious incident reporting. It is conditional on four things, cumulatively: they must be documented and quantified in the product information, and in the technical documentation, and subject to trend reporting under Article 83.
A manufacturer who never quantified a false negative rate in the instructions for use has no exclusion to rely on — and nothing to trend against either, because Article 83’s second limb compares real-world erroneous results to the performance stated under Annex I Section 9.1.
IEC 62304, IEC 62366-1 and EN ISO 20417 are widely described as harmonised under the IVDR. Checked against the European Commission’s own summary list for Regulation (EU) 2017/746, generated 17 June 2026, none of them is.
Applying them is still the right engineering decision — they are the state of the art and notified bodies expect them. What they do not give is a presumption of conformity, so conformity with the corresponding Annex I requirements has to be demonstrated directly rather than asserted through the standard.
Two standards on the IVDR list have no medical device counterpart at all and matter disproportionately: EN ISO 17511 on metrological traceability of assigned values, and EN ISO 20916 on clinical performance studies — the IVDR’s analogue of ISO 14155.
For class D devices with a designated EU reference laboratory, Article 48(5) requires the notified body to ask that laboratory to verify the claimed performance and compliance with the applicable common specifications by laboratory testing. Annex IX Section 4.9 gives the laboratory 60 days — and provides that the notified body shall not deliver the certificate if the scientific opinion is unfavourable. It is the one point in the Regulation where a third party can veto certification outright.
Class D also carries ongoing batch verification under Annex IX Section 4.12: tests on every manufactured batch, reports to the notified body, samples made available. Section 4.13 then allows release by default unless the notified body says otherwise within the agreed timeframe, but not later than 30 days after reception of the samples. That clock runs from receipt, not despatch, which is worth knowing before finished-goods holding is planned.
Article 9(3) is stricter than the usual standards regime: manufacturers shall comply with common specifications unless they can duly justify solutions that ensure a level of safety and performance that is at least equivalent. Departure is permitted but is a justified exception — and for class D devices it is tested by an EU reference laboratory whose unfavourable opinion blocks the certificate.
In this order: establish qualification and classification with written reasoning, because everything downstream depends on the class; fix the intended purpose in the nine-part Annex II 1.1(c) form and quote it verbatim everywhere; then build the performance evaluation plan before generating data, because Annex XIII Section 1.1 asks for the metrological traceability position and the statistical methods up front.
If you are relying on Article 110, do the condition audit first and separately. It is the only workstream where being late is unrecoverable.
Our EU IVDR Toolkit provides 74 editable templates covering all of the above — performance evaluation across all three limbs, the Annex I GSPR checklist, Annex II and Annex III technical documentation, UDI and EUDAMED, post-market surveillance and vigilance, and the Article 110 transition tracker. For the quality management system underneath it, see the ISO 13485 Toolkit, and for the risk management file, the ISO 14971 Toolkit.
Regulation (EU) 2017/746 on in vitro diagnostic medical devices. It replaced Directive 98/79/EC, has applied since 26 May 2022, and sets requirements for classification, general safety and performance, technical documentation, performance evaluation, conformity assessment, UDI and EUDAMED registration, post-market surveillance and vigilance.
Classes A to D rather than I to III; seven classification rules rather than twenty-two; performance evaluation under Article 56 and Annex XIII rather than clinical evaluation; performance studies rather than clinical investigations. The IVDR adds EU reference laboratories and batch verification for class D, metrological traceability of assigned values, and a definition of “incident” that reaches harm caused by a clinical decision taken on a result. Article numbers do not correspond between the two.
The consolidated text. As at this writing that is Regulation (EU) 2017/746 as consolidated on 10 January 2025 (CELEX 02017R0746-20250110), which includes Regulation (EU) 2024/1860 — the amendment that inserted the Article 10a supply-interruption obligation and rewrote the Article 110 transition into its current staggered form.
Yes. Four modules became mandatory on 28 May 2026 following Commission Decision (EU) 2025/2371 — an MDR decision that binds IVD manufacturers through Article 113(3)(f) of the IVDR. Manufacturers then have six months from that date to enter Article 26 device information, including for devices on the market under the Article 110 transition.
No, but most do. Only class A devices that are not placed on the market in sterile condition are self-declared. Class A sterile devices need a notified body for sterility aspects, and classes B, C and D all require notified body involvement. That is a substantial change from Directive 98/79/EC, under which most IVDs were self-declared.
Placing on the market ends 31 December 2027, 2028 or 2029 depending on the device category — but only if all six Article 110(3c) conditions are met throughout. The condition deadlines fall much earlier, and the signed written agreement with a notified body is the one that most often fails.
No. IEC 62304, IEC 62366-1 and EN ISO 20417 do not appear on the Commission’s list of harmonised standards for Regulation (EU) 2017/746. They remain the state of the art and are expected by notified bodies, but no presumption of conformity arises from them.
August 13, 2026
August 13, 2026
August 13, 2026
August 13, 2026
August 13, 2026