EU Medical Device Regulation in 2026: A Comprehensive Analysis of EU MDR, IVDR, the AI Act, and the Reform Agenda

Quick answer

What does EU medical device regulation require in 2026?

The European Union's regulatory framework for medical devices — anchored by Regulation (EU) 2017/745 (EU MDR) and Regulation (EU) 2017/746 (IVDR) — is one of the most demanding compliance environments in global medtech. Since the MDD-to-MDR transition eliminated historical grandfathering provisions, manufacturers face a capital-intensive, lifecycle-anchored certification process with no shortcuts. Notified Body review timelines for Class IIa, IIb, and III devices routinely span 12 to 24 months; the equivalence pathway is narrowed to the point where direct clinical evidence is the practical standard; and the EU AI Act overlays a second parallel compliance obligation on every AI-enabled device classified as Class IIa or above. From 28 May 2026, EUDAMED Actor and Device registration modules are mandatory under Commission Decision 2025/2371. A landmark MDR/IVDR reform proposal published in December 2025 introduces Breakthrough Device pathways, removes fixed 5-year recertification cycles, and relaxes certain SME requirements — though current obligations remain unchanged until formally adopted.

Keywords: EU MDR 2026, EU MDR compliance, CE marking medical device, Notified Body EU MDR, EU IVDR in vitro diagnostic, EUDAMED registration, SaMD EU MDR, EU AI Act medical device, PMCF post-market clinical follow-up, PSUR EU MDR, ISO 13485 EU MDR, QMS medical device Europe, 9-milestone EU MDR journey, IVDR startup compliance, RUO research use only trap, EU MDR reform Breakthrough Device, EU MDR Class IIb timeline, FDA to EU MDR transition, PRRC person responsible regulatory compliance

Abstract

The European Union's regulatory framework for medical devices — anchored by Regulation (EU) 2017/745 (EU MDR) and Regulation (EU) 2017/746 (IVDR) — represents one of the most demanding and consequential compliance environments in the global medtech industry. Since the MDD-to-MDR transition eliminated historical grandfathering provisions, manufacturers of all sizes face a capital-intensive, lifecycle-anchored certification process with no shortcuts. The Notified Body capacity bottleneck continues to generate review timelines of 12 to 24 months or more for higher-risk devices; the equivalence pathway has been narrowed to the point where direct clinical evidence is the practical standard; and the EU AI Act now overlays a second parallel compliance obligation on every AI-enabled device classified as Class IIa or above.

Simultaneously, the European Commission has tabled a landmark reform proposal introducing Breakthrough Device pathways, removing fixed 5-year recertification cycles, and relaxing certain SME requirements — changes that, if enacted, could meaningfully reshape the compliance burden. This article synthesises practitioner expert insights and regulatory analysis published in 2025 and 2026 into a structured, academically grounded overview of the EU MDR and IVDR landscape current as of mid-2026. It covers the 9-milestone CE marking journey, the transatlantic SaMD gap, IVDR compliance for startups, the MDR/AI Act dual-track burden, post-market obligations, EUDAMED integration, and the proposed reform framework.

1. Introduction

The EU MDR (2017/745) and IVDR (2017/746) entered into full applicability in May 2021 and May 2022 respectively, ending the era of the Medical Device Directive (MDD) and In Vitro Diagnostic Directive (IVDD). Their implementation has reshaped the European medtech market in ways that continue to unfold in 2026: a smaller pool of designated Notified Bodies absorbed a vastly larger submission volume; manufacturers found that clinical evidence standards previously met under MDD were insufficient under MDR; and the lifecycle surveillance obligations — Post-Market Clinical Follow-up (PMCF), Periodic Safety Update Reports (PSURs), and vigilance reporting — transformed CE marking from a milestone into a continuous operational commitment.

Layered on top of this is the accelerating convergence of the EU AI Act with the MDR framework, creating a dual-track compliance burden for Software as a Medical Device (SaMD) developers that has no precise parallel in any other global regulatory system. And in late 2025, the European Commission tabled a reform proposal of over 200 pages that, if adopted, would alter certification timelines, SME obligations, PMCF integration, and device classification in ways that manufacturers must begin evaluating now.

For regulatory affairs professionals responsible for EU market access, the ability to navigate this multi-layered environment — understanding not just the requirements but their sequencing, cost drivers, and structural risks — is the defining professional competency of the current decade.

2. The EU MDR Framework: Structure, Classification, and Foundational Requirements

2.1 Scope and Legal Basis

EU MDR 2017/745 applies to medical devices, systems, procedure packs, accessories, and — critically — certain products without an intended medical purpose listed in Annex XVI (including cosmetic contact lenses, substances intended for liposuction, and high-intensity equipment for skin treatment). Software that meets the definition of a medical device falls within scope and is classified under the IMDRF SaMD classification logic as incorporated into MDR Annex VIII Rule 11.

The regulation enforces a lifecycle approach: obligations begin at the design phase and extend indefinitely beyond market launch through post-market surveillance, vigilance reporting, and clinical follow-up.

2.2 Risk Classification

EU MDR uses a four-tier risk classification:

• Class I (Low Risk): Self-certified by the manufacturer, with Notified Body involvement only for sterile, measuring, or reusable surgical instrument devices.
• Class IIa (Medium-Low Risk): Notified Body assessment of Quality Management System (QMS) and technical documentation sampling.
• Class IIb (Medium-High Risk): Notified Body assessment of QMS and full technical documentation review.
• Class III (High Risk): Full Notified Body assessment including design dossier examination; clinical expert panels required for certain implantable and Class III devices.

Classification is determined by applying the 22 classification rules in Annex VIII, which take into account intended purpose, invasiveness, duration of contact, and whether the device is active or passive. Classification under MDR is frequently more stringent than under the former MDD — a point of perennial surprise for manufacturers re-mapping existing portfolios.

2.3 The Person Responsible for Regulatory Compliance (PRRC)

All manufacturers (with limited exceptions for custom-made devices from sole traders) must designate at least one Person Responsible for Regulatory Compliance (PRRC) under Article 15. The PRRC must hold verifiable qualifications in law, medicine, pharmacy, engineering, or a related discipline, combined with at least one year of professional experience in regulatory affairs or quality management. The PRRC bears personal accountability for ensuring the QMS is maintained, devices are registered appropriately, post-market obligations are met, and the technical documentation is current.

The MDR Reform Proposal (discussed in Section 11) proposes to relax the "permanently and continuously available" language of Article 15 for SMEs — a significant operational relief for smaller manufacturers operating with limited dedicated regulatory resource.

3. The 9-Milestone EU MDR Compliance Journey

Expert practitioner analysis from 2026 frames the EU MDR CE marking process as a structured, sequential 9-milestone journey spanning three operational phases, applicable to a standard Class IIa or IIb device. This framework provides the clearest operational roadmap available for manufacturers entering or transitioning to EU MDR compliance.

Phase I: Engineering, Planning, and Design Freezing (Milestones 1–4)

Milestone 1 — Project Initiation and QMS Setup: Establishes the project-specific quality architecture under ISO 13485, opens the Design History File (DHF), defines product requirements, and outlines the baseline intended use specification. ISO 13485 certification is mandatory and must be in place before Notified Body engagement; it is not merely a documentation standard but the foundation of the entire certification architecture.

Milestone 2 — Concept Development and GSPR Activation: Translates user needs into technical design inputs and outputs, initiates the General Safety and Performance Requirements (GSPR) checklist from Annex I of MDR, and performs early use-related risk analyses under ISO 14971.

Milestone 3 — Detailed Design and Verification Planning: Advances engineering drawings, sterilisation validation planning, and formal strategies for design verification, shelf-life testing, and biological evaluation per ISO 10993.

Milestone 4 — Design Freeze and Validation Preparation: Finalises validation protocols, completes device and packaging verification tests, and formally executes a design freeze to stabilise the product configuration before clinical data generation begins. The design freeze is a critical control point: subsequent design changes after this milestone trigger formal change management procedures and may restart elements of the validation sequence.

Phase II: Validation, Clinical Evidence, and Technical Submission (Milestones 5–7)

Milestone 5 — Process and Usability Validation: Validates production processes and manufacturing lines, completes summative usability testing per IEC 62366-1, and initiates the Device Master Record (DMR).

Milestone 6 — Clinical Investigation Preparation (if required): Where the clinical evidence strategy requires a prospective clinical investigation, this phase involves finalising the Clinical Investigation Plan (CIP) and Investigator's Brochure (IB), securing ethics committee approvals, and obtaining authorisation from the relevant competent authority under MDR Article 62.

Milestone 7 — Clinical Evidence Compilation and Technical Submission (STED): The pivotal milestone. The Summary Technical Documentation (STED) is assembled, incorporating the Clinical Evaluation Report (CER), risk management file, validation summaries, GSPR checklist with evidence mapping, labelling and IFU, and the Post-Market Surveillance Plan. This is submitted to the Notified Body for formal conformity assessment. At this stage, EUDAMED registration of the device and economic operators must be confirmed.

Phase III: Commercialisation, Economic Operators, and Lifecycle Performance (Milestones 8–9)

Milestone 8 — Certification, UDI, and Market Launch: Covers the successful completion of the Notified Body audit, receipt of the CE mark certificate, implementation of Unique Device Identification (UDI) requirements, and activation of commercial launch logistics including authorised representative and importer onboarding.

Milestone 9 — Post-Certification Registration, Market Access, and Post-Market Compliance: Establishes the post-market surveillance infrastructure, requiring complete economic operator onboarding, active EUDAMED database registration (now mandatory from May 28, 2026 for Actor and Device modules under Commission Decision 2025/2371), and the active execution of PMS, PMCF, and PSUR reporting cycles. This is not a terminal milestone — it is a perpetual operational commitment for the life of the device.

Timeline and Cost Realities

Expert practitioners consistently estimate a 12 to 18-month total project timeline for a Class IIa or IIb device following the 9-milestone framework, exclusive of any clinical investigation which can add 12 to 24 months. For Class III devices, total timelines of 24 to 36 months or longer are common when accounting for Notified Body queue times.

Financially, CE marking under EU MDR is a multi-year capital commitment. One-time costs include Notified Body fees, ISO 13485 certification, clinical evidence generation, and technical documentation preparation. Recurring costs include PSUR updates, PMCF data collection, annual Notified Body surveillance audits, and EUDAMED maintenance. Startups planning EU market entry must treat regulatory compliance as a capital line item from founding — not a cost to be deferred until the device is ready for submission.

4. The Notified Body Bottleneck and Capacity Crisis

4.1 Structural Capacity Deficit

The most systemic operational challenge in the EU MDR landscape remains the Notified Body capacity bottleneck. The number of Notified Bodies fully designated under MDR for all device categories remains constrained relative to the volume of industry submissions. This structural imbalance drives review timelines for Class IIa, IIb, and III devices to routinely span 12 to 24 months or more from initial submission to certificate issuance.

For MedTech startups — a population constitutionally exposed to capital runway constraints — this prolonged pre-market assessment phase creates a potentially company-ending delay: the device is ready, clinical evidence is compiled, ISO 13485 is certified, yet the path to revenue is gated by Notified Body queue time. Expert commentary from 2026 is emphatic: manufacturers must engage with their selected Notified Body as early as possible, ideally at Milestone 1, not at Milestone 7 when the STED is ready.

4.2 Timeline Variability and "Clock Stoppers"

A particular source of unpredictability is the "clock stopper" mechanism — Notified Body requests for additional information that formally pause the review clock. These requests can add months to the assessment timeline and are difficult to predict in advance. The European Commission has recognised this as a systemic problem and is developing an implementing regulation requiring Notified Bodies to publish clear review timelines and define clock stopper criteria transparently. Until this regulation is in force, manufacturers should budget for clock stopper delays in project timeline planning.

4.3 Pre-Submission Engagement

Expert practitioners across all four source articles analysed in this review are consistent on one point: pre-submission engagement with Notified Bodies is not optional. Most Notified Bodies offer formal pre-submission meetings or preliminary assessments. These interactions clarify expectations on clinical evidence, risk management, and labelling before the formal clock starts — and can prevent the most expensive form of delay: a clock stopper triggered by an avoidable documentation gap discovered mid-review.

5. Clinical Evidence: The CER, PMCF, and the Equivalence Problem

5.1 The Clinical Evaluation Report (CER)

The Clinical Evaluation Report (CER) is the central clinical evidence document in the MDR technical file. It must demonstrate that the device's benefit-risk profile is favourable and that safety and performance claims are supported by evidence. The CER is not a one-time document: it is a living report updated continuously through the product lifecycle, incorporating PMCF findings, vigilance signals, and post-market data.

Under MDR, CER expectations are substantially more demanding than their MDD equivalents. Notified Bodies expect structured, systematic literature reviews, a clear clinical evaluation methodology aligned with MEDDEV 2.7/1 Rev. 4, a mapped benefit-risk determination, and — for implantable and Class III devices — a summary of the clinical investigation data underpinning the approval.

5.2 The Equivalence Barrier

One of the most consequential and often underestimated changes introduced by the EU MDR relative to the MDD is the narrowing of the equivalence pathway. Under the MDD, manufacturers could justify clinical evidence by demonstrating equivalence to a predicate device already on the EU market. Under the MDR, this pathway survives but is substantially more restrictive: the manufacturer must demonstrate technical, biological, and clinical equivalence, and must have full, unhindered access to the predicate device's complete technical documentation. This access requirement effectively means that equivalence is only available where the manufacturer controls both devices (e.g., devices from the same manufacturer with documented similarity) or has entered a formal data access agreement with a third-party manufacturer — an arrangement that is commercially rare.

For the majority of manufacturers without a same-manufacturer predicate or a data access agreement, the equivalence pathway is practically unavailable, and direct clinical evidence becomes the required standard.

5.3 Post-Market Clinical Follow-Up (PMCF)

PMCF under EU MDR is not optional for Class IIa, IIb, and III devices. It is a mandatory, proactive activity requiring the systematic collection and analysis of clinical data generated by the device after market launch. PMCF outputs feed directly into the CER update cycle and must be documented in a PMCF Plan (which specifies the methodology, data sources, and evaluation criteria) and a PMCF Evaluation Report (which documents the findings). For most higher-risk devices, PMCF involves some combination of registry participation, post-market clinical studies, literature surveillance, and structured healthcare professional feedback programmes.

The EU MDR Reform Proposal (Section 11) proposes to integrate PMCF reporting directly into the CER structure — a documentation consolidation that will simplify the output without reducing the clinical surveillance obligation itself.

6. Post-Market Surveillance Obligations: PMS, PMSR, and PSUR by Class

6.1 The PMS System

Under Articles 83–86 of EU MDR, every manufacturer must establish, maintain, and continuously improve a Post-Market Surveillance (PMS) system proportionate to the device's risk class and type. The PMS system is a proactive, systematic procedure for collecting and reviewing real-world experience from marketed devices. It feeds into risk management (ISO 14971 linkage), clinical evaluation updates, corrective and preventive actions (CAPA), and vigilance reporting.

6.2 The PMS Plan

The PMS Plan (required under Article 84 and Annex III) specifies how post-market data will be collected, analysed, and fed into the benefit-risk determination. It should describe data sources (complaints, registries, literature, field feedback, adverse event databases), analytical methods, CAPA linkage, PMCF activities, and internal reporting cadence. The PMS plan is a living document — not a submission artefact produced once at certification and filed away.

6.3 PMSR vs PSUR: Class-by-Class Requirements

The output report format and update frequency differ materially by risk class:

The PSUR content (Article 86(1)) must include: conclusions of PMS data analyses, rationale and description of corrective and preventive actions taken, main PMCF findings, benefit-risk determination conclusions, and device sales volumes and estimated user population. The MDR Reform Proposal (Section 11) proposes to reduce the PSUR update frequency for Class IIa from every two years to "when necessary" — a workload reduction for the largest volume of registered devices.

7. EUDAMED: Mandatory Registration from May 2026

7.1 The EUDAMED Architecture

The European Database on Medical Devices (EUDAMED) is the EU's centralised regulatory information system for medical devices and IVDs. Following the phased implementation accelerated by Commission Decision 2025/2371, the EUDAMED Actor Registration Module (for manufacturers, authorised representatives, and importers), the Device Registration Module (for UDI-linked device information), and the Market Surveillance Module became mandatory from May 28, 2026.

7.2 Registration Sequence and SRN

The Actor Registration Module must be completed before any other EUDAMED module, as it issues the Single Registration Number (SRN) that is prerequisite for device registration. For non-EU manufacturers, the authorised representative must register first and be linked to the manufacturer's actor record. Failure to maintain an active SRN results in the inability to legally place or make available devices on the EU market. Manufacturers that deferred EUDAMED registration pending system maturity must treat this deadline as a hard market access control point.

7.3 UDI Requirements

The Unique Device Identification (UDI) system — comprising a device identifier (UDI-DI) and a production identifier (UDI-PI) — is the linking mechanism between physical devices and EUDAMED records. UDI labels must appear on device labels and in the EUDAMED Device Registration Module. The system enables end-to-end traceability from manufacturer to patient and is a prerequisite for effective post-market surveillance and field safety corrective action management.

8. EU IVDR: Compliance Pathways and the Startup Challenge

8.1 Regulatory Framework and Classification

The EU IVDR (2017/746) governs in vitro diagnostic medical devices — a category that under the former IVDD was largely self-certified by manufacturers. The IVDR fundamentally changed this: approximately 80–90% of IVDs that were previously self-certified as Class I now require Notified Body involvement. The IVDR classification system (Classes A through D) is based on GHTF IVD risk framework principles, with Class D encompassing the highest-risk IVDs such as blood group reagents and HIV tests.

Full applicability of IVDR occurred on May 26, 2022, with transitional provisions allowing legacy IVDD-certified devices to remain on the market until expiry of their certificates, subject to Regulation (EU) 2022/112 extension provisions.

8.2 The Cost and QMS Challenge for Startups

Expert practitioner commentary focused specifically on IVDR compliance for biotech and medtech startups in 2026 highlights a fundamental strategic tension: the cost of regulatory compliance scales poorly for early-stage companies. The core elements of IVDR compliance — ISO 13485 QMS certification, technical documentation preparation, performance evaluation, and Notified Body review — represent fixed or near-fixed costs that are proportionally far more burdensome for a startup with a single IVD product and limited capital than for an established manufacturer with a portfolio spread across many products.

The recommended mitigation for startups is early QMS integration — building quality management processes into the development workflow from inception rather than retrofitting them onto a technically complete product. The compounding cost of retrofitting a QMS onto an existing product and documentation set is substantially greater than the incremental cost of building compliantly from the start. Expert practitioners describe a "snowball effect": early regulatory investment prevents a far larger remediation spend at the point of Notified Body engagement, when design changes are expensive and timeline delays are commercially catastrophic.

8.3 The Research Use Only (RUO) Combination Trap

A practitioner-identified risk of particular importance for biotech companies developing IVD software systems is the Research Use Only (RUO) combination trap. In the context of software systems that combine a commercially available analytical instrument with software modules under development, manufacturers sometimes apply an RUO label to the software component — reasoning that the instrument is already CE-marked and the software is not yet a placed-on-market product.

Under EU IVDR, this reasoning is problematic: if the software component is used in combination with the CE-marked instrument in a way that changes the overall system's intended purpose, performance, or safety profile, the combined system may constitute an IVD that requires its own conformity assessment — regardless of the RUO label on the software. Applying RUO labelling to avoid regulatory assessment of a combination that is functionally performing IVD functions is an approach that Notified Bodies and competent authorities are actively scrutinising. Manufacturers must conduct a formal intended purpose and combination assessment before relying on the RUO designation for any component in a diagnostic system.

8.4 Global Market Access from an IVDR Foundation

A positive dimension of IVDR compliance highlighted in 2026 practitioner analysis is its role as a global regulatory foundation. CE marking under IVDR, while demanding, serves as a reference approval for a growing number of jurisdictions that operate regulatory reliance programmes — including several ASEAN and Middle Eastern markets that recognise EU performance evaluation data in abbreviated submission pathways. For IVD manufacturers building multi-market portfolios, the investment in IVDR compliance is not purely a European market access exercise; it is the construction of an international regulatory asset.

9. The Dual-Track Burden: EU MDR and the EU AI Act

9.1 The EU AI Act and High-Risk AI Medical Devices

The EU AI Act, fully entered into force in August 2024 with phased application periods, classifies AI systems used as medical devices — or integrated as safety components within medical devices — as High-Risk AI Systems where the underlying device requires Notified Body conformity assessment (Class IIa and above under EU MDR). This designation is not optional: it follows automatically from the device's MDR risk classification.

The AI Act's High-Risk designation triggers a comprehensive set of compliance obligations that must run in parallel with the MDR technical file. These include: data governance requirements (training, validation, and test datasets must be relevant, representative, free of errors, and complete); algorithmic transparency and human oversight protocols; accuracy, robustness, and cybersecurity requirements; registration in an EU AI Act database; post-market monitoring of AI system performance; and requirements for technical documentation aligned with AI Act Annex IV.

9.2 The 2027 AI Act Compliance Deadline for High-Risk Medical AI

The practical deadline of significance for SaMD and AI-enabled device manufacturers is the application date for high-risk AI systems under Article 6(2) of the EU AI Act. Expert practitioner commentary from 2026 identifies this deadline as a hard compliance trigger that manufacturers are underestimating. Developers of AI-enabled IVDs and SaMD that have deferred AI Act compliance planning on the grounds that AI regulation "is still evolving" risk finding themselves non-compliant at a point when their MDR CE mark is already in place — creating a market access suspension risk for a certified device.

9.3 Data Diversity as an AI Compliance Requirement

A practitioner insight of particular technical importance is the data diversity requirement under the EU AI Act for high-risk AI systems. Training and validation datasets must demonstrate diversity across the demographic, geographic, and clinical characteristics relevant to the device's intended use. For AI-enabled diagnostic devices, this means validating model performance across patient populations with different demographic profiles, disease prevalence patterns, and comorbidities. This requirement is operationally distinct from anything in the EU MDR's CER methodology, and manufacturers cannot simply reference their MDR clinical evidence as satisfying AI Act data governance obligations.

9.4 Integrated Technical Files and Combined Conformity Assessment

The European regulatory framework is working toward enabling combined conformity assessments for devices that fall under both EU MDR and the EU AI Act, to avoid the administrative burden of entirely parallel Notified Body review processes. However, the practical integration of these assessments is still developing, and manufacturers building AI-enabled Class IIb or III devices in 2026 should plan for sequential rather than fully combined review processes, with corresponding timeline implications.

10. The Transatlantic Gap: Transitioning SaMD from FDA 510(k) to EU MDR

A practical illustration of the EU MDR compliance challenge that recurs across multiple expert analyses in 2026 is the scenario of a SaMD that has achieved US FDA 510(k) clearance and must transition to EU MDR CE marking. This scenario is common — particularly for US-based digital health companies or UK-based SaMD developers seeking European market access — and consistently generates timeline and cost surprises rooted in fundamental framework misalignments.

The four most significant remediation requirements for an FDA-cleared SaMD seeking EU MDR certification are:

QMS Transition: The FDA's Quality System Regulations (21 CFR Part 820, now largely aligned with the Quality Management System Regulation / QMSR) are structurally different from ISO 13485 in their vigilance, PRRC, and economic operator tracking provisions. Manufacturers must establish a fully ISO 13485-compliant QMS before engaging a Notified Body, and must be prepared for the Notified Body to audit the QMS directly.

Clinical Evidence Gap: A 510(k) is based on substantial equivalence to a predicate; an EU MDR CER requires direct clinical performance evidence. For most SaMD, this means expanding the clinical evidence base beyond what supported the 510(k) — incorporating real-world performance metrics, updated literature reviews, and a formal benefit-risk analysis structured per MEDDEV 2.7/1 Rev. 4.

PMCF Infrastructure: Because the US regulatory framework has no direct PMCF equivalent, transitioning firms rarely possess the structured post-market clinical data collection systems that EU MDR requires. Building a credible PMCF plan — identifying data sources, defining endpoints, and establishing collection mechanisms — is a non-trivial project that must be in place before CE mark application.

Labelling and Claims Alignment: US IFU and marketing materials frequently include claims derived from predicate device labelling or from broad clinical positioning statements. Under EU MDR, every claim in the labelling must be directly supported by clinical evidence in the technical file. This alignment process requires a systematic claim-by-claim review against the CER.

11. The EU MDR and IVDR Reform: Key Proposals

In December 2025, the European Commission published a landmark reform proposal of over 200 pages covering both MDR and IVDR. The proposal reflects an acknowledgement that the regulatory system is under structural strain, and that administrative burden reductions are necessary to prevent innovation and market access gaps — particularly for SMEs and for legacy devices that cannot be efficiently transitioned without timeline relief.

The most impactful proposed changes for manufacturing and regulatory affairs practice are:

Breakthrough Devices Pathway: The introduction of a new "Breakthrough Device" category would create an expedited conformity assessment route for innovative products addressing unmet medical needs — analogous in concept (though not identical in mechanism) to the US FDA Breakthrough Device Designation. This is potentially the most commercially significant structural change in the proposal.

Removal of Fixed 5-Year Recertification Cycles: Certificates would no longer be bound to a rigid 5-year expiry, eliminating a major source of administrative and cost burden for manufacturers with stable, well-established products. Recertification would be triggered by substantive changes rather than calendar intervals.

Predetermined Change Control Plans (PCCP): Manufacturers and Notified Bodies could agree in advance on a PCCP defining which changes to a device can be implemented without prior notification or approval — particularly significant for SaMD and AI-enabled devices where iterative algorithm updates are a commercial necessity.

PRRC Flexibility for SMEs: The "permanently and continuously available" language of Article 15 would be relaxed to simply "available" for SMEs, reducing the personnel overhead associated with the PRRC obligation for smaller organisations.

PSUR Frequency Adjustments: Class IIa PSURs would shift from "at least every 2 years" to "when necessary," reducing reporting volume for the largest category of registered devices.

Extended Vigilance Reporting Timelines: The reporting window for serious incidents not involving immediate public health threats or death would extend from 15 to 30 days.

PMCF-CER Integration: PMCF reporting would be directly integrated into the CER structure, consolidating two separate documentation obligations into one.

Classification Adjustments: Certain device categories — including reusable surgical instruments, accessories to active implantable devices, and specific software types — may see downward classification adjustments that reduce conformity assessment burden.

Manufacturers should note that the reform is a proposal as of mid-2026; the legislative timeline to adoption and implementation will add further delay before these changes take legal effect. Current compliance obligations under the existing MDR and IVDR text remain unchanged until the reform is formally adopted.

12. Strategic Implications for Regulatory Affairs Practice

12.1 Engage Notified Bodies at Milestone 1, Not Milestone 7

The single most impactful timeline intervention available to any manufacturer pursuing EU MDR or IVDR compliance is early Notified Body engagement. Notified Bodies are capacity-constrained; queue times are long; and pre-submission meetings clarify expectations that prevent the most expensive form of delay: a major clock stopper triggered by avoidable gaps in the clinical evidence or technical documentation. Regulatory strategy must be set at the project initiation stage, not when the device is technically ready.

12.2 Build a QMS Before You Build the Device (For Startups)

For early-stage companies — whether developing IVDs under IVDR or medical devices under MDR — the cost of retrofitting ISO 13485 compliance onto a technically complete product is substantially greater than building compliantly from inception. The QMS is not a regulatory bureaucracy to be tolerated; it is the quality architecture that makes the technical file auditable. Starting with it in place means every design decision, verification test, and clinical data point is generated in a form that supports — rather than requires remediation before — Notified Body submission.

12.3 Treat EU MDR CE Marking as a Global Regulatory Asset

CE marking under EU MDR is increasingly treated as a reference approval by jurisdictions operating regulatory reliance programmes — including Singapore (HSA abridged pathway), Malaysia (MDA fast track), Kazakhstan, and others. The investment in EU MDR compliance should be evaluated not only on its European commercial return, but on its value in accelerating registration in every downstream market that places reliance on EU MDR certification.

12.4 Begin AI Act Compliance Planning Now for AI-Enabled Devices

For developers of AI-enabled SaMD or IVDs classified as Class IIa or above, AI Act compliance is not a future consideration — it is a present obligation with an approaching hard deadline. Data diversity assessments, algorithmic transparency documentation, and human oversight protocol design need to be integrated into the product development programme alongside the MDR clinical evaluation and technical file. Treating them as sequential — MDR first, AI Act later — risks creating a compliance gap at a product that already carries the cost of CE marking.

12.5 Never Rely on RUO Labelling as a Regulatory Bypass in Combination Systems

Biotech and IVD developers assembling combination systems from CE-marked instruments and software under development should commission a formal intended purpose and combination assessment before applying RUO labelling to any software component. If the combination is functionally performing IVD functions in a clinical setting, RUO labelling is a regulatory risk — not a shield.

13. Conclusion

The EU medical device regulatory landscape in 2026 is simultaneously the most demanding, the most coherent, and the most consequential it has ever been. The EU MDR and IVDR frameworks enforce a rigorous lifecycle approach to device safety and clinical performance that, while administratively demanding, represents the global benchmark for evidence-based market access. The Notified Body capacity bottleneck, the narrowed equivalence pathway, the continuous PMCF obligation, and the emerging dual burden of the EU AI Act for SaMD developers are not temporary frictions — they are structural features of a framework designed for depth rather than speed.

The proposed reform offers meaningful relief in specific areas — particularly for SMEs, for legacy devices with stable safety profiles, and for AI-enabled products through PCCP frameworks — but does not alter the fundamental lifecycle philosophy of the regulation. Manufacturers who plan their EU market access strategies around the full depth of MDR and IVDR obligations, who engage Notified Bodies early, who build ISO 13485-compliant quality systems from project initiation, and who treat CE marking as a continuously maintained status rather than a one-time achievement will be the ones who sustain EU market access through the compliance challenges that the current regulatory decade presents.