Obligations applicable to medical device manufacturers

The manufacturer must designate in its organisation a person responsible for regulatory compliance (Article 15 of the Regulation on medical devices). This person shall be in charge of:

• verification of the conformity of the devices;
• the establishment and updating of the technical documentation and the EU declaration of conformity (see below); 
• compliance with post-market surveillance obligations; 
• compliance with notification obligations.

They shall also ensure that the necessary formalities for clinical investigations are fulfilled, where applicable.

The risk management system is detailed in Annex I, Chapter I.3 of the Regulation on medical devices.

The risk management system is a set of operational and organisational procedures and measures implemented by the manufacturer, aimed at identifying, controlling and continuously minimising risks associated with a medical device. It must cover the entire life cycle of the device and be systematically and periodically updated. The system must be documented and take into account not only known and foreseeable risks associated with normal use of the device in light of the state of the art, but also those arising from “reasonably foreseeable misuse “ (See Annex I, Chapter I-3 et seq. of the Regulation on medical devices)

The risk management system is also part of the Quality Management System (QMS) (Article 10(9)(e) of the Regulation on medical devices).

The risk management in the field of medical devices is covered by a harmonised international standard (ISO 14971:2019 - Medical devices — Application of risk management to medical devices), along with guidance (ISO/TR 24971:2020 – Medical devices — Guidance on the application of ISO 14971). Compliance with this standard gives rise to a presumption of conformity with the requirements relating to the risk management system.

3.1 Clinical evaluation

In order to demonstrate the conformity of a medical device with the relevant general requirements and to assess undesirable side effects and the acceptability of the benefit-risk ratio, the manufacturer shall rely on clinical data providing sufficient clinical evidence. It shall take into account the characteristics and intended purpose of the medical device in order to determine and justify the level of evidence required for such demonstration. The clinical evaluation shall be planned, conducted continuously, and documented in accordance with Annex XIV, Part A of the Regulation on medical devices. The principles and procedures governing clinical evaluation are set out in Article 61 and Annex XIV, Part A of the Regulation on medical devices.

In practice, clinical evaluation is divided into two or even three phases

Phase 1: The collection and evaluation of existing data for the establishment of a clinical evaluation plan.

A first phase, conducted during the development of the medical device, involving the collection of data on known benefits and risks, the establishment of the state of the art, the assessment of the need for additional data, etc. These data include preclinical data (toxicity, mechanical and chemical testing, animal studies, etc.) and a review of the literature relating to the medical device or to an equivalent device. On the basis of the data collected, it is also necessary to determine whether a clinical investigation is required, as described below, (except for Class III medical devices for which a clinical investigation is in any case mandatory), or to establish equivalence with a device already placed on the market. This initial (preliminary) assessment thus serves as the basis for the clinical evaluation plan setting out the modalities of the second phase.

Phase 2: Implementation of the clinical evaluation plan for the assessment of the medical device’s conformity with the general requirements.

This second phase corresponds to the actual assessment of the conformity of the medical device with the general requirements referred to above, with a view to obtaining CE marking for the placing of the device on the market. Its purpose is to update and verify the quality of the data collected, to verify and demonstrate the conformity of the medical device in light of those data, and, where appropriate through the conduct of a clinical investigation, to address the various issues identified as remaining unresolved during the first phase.

The conduct of a clinical investigation may be waived (except, in principle, for Class III medical devices) when the manufacturer is able to demonstrate the equivalence of its medical device (from a technical, biological and clinical perspective), with another medical device already placed on the market. In such a case, the manufacturer may rely on the clinical data relating to the already CE-marked device in order to establish the conformity of its own medical device. (Article 61(3)(a) of the Regulation on medical devices and MDCG 2020-5: Clinical Evaluation - Equivalence A guide for manufacturers and notified bodies)
Although manufacturers of Class III medical devices are, in principle, required to conduct a clinical investigation, they may also demonstrate the equivalence of their device with other medical devices already marketed in order to support and strengthen their clinical evaluation.

Furthermore, exceptionally (except for Class III medical devices), it is possible to demonstrate conformity of a medical device with the general requirements on the basis of non-clinical data alone, provided that such an assessment, based inter alia on risk management and on technical and preclinical data, is duly justified in the technical documentation. (Article 61(10) of the Regulation on medical devices)

Finally, it is also during this second phase that the manufacturer determines and justifies the need for updates to clinical data. This conformity assessment must also serve to establish Post-Market Clinical Follow-Up (PMCF), the third phase of clinical evaluation, which falls more broadly within post-market surveillance. (Article 61(11) of the Regulation on medical devices)

Phase 3: Implementation of the Post-Market Clinical Follow-Up (PMCF)

All of these data, results, justifications and conclusions are compiled in a final report (clinical evaluation report, based on the template available here in PDF or Word format – Clinical Evaluation Assessment Report Template), which is included in the technical documentation and intended for notified bodies.

Although published prior to the adoption of the Regulations on medical devices and in vitro diagnostic medical devices, MEDDEV 2.7/1 Rev 4 - Guidelines on medical devices continues to provide manufacturers with a number of relevant indications regarding the conduct of clinical evaluation. This is supplemented by the guidance issued by the International Medical Device Regulators Forum (IMDRF), IMDRF MDCE WG/N56FINAL:2019.

3.2 Clinical investigation

What is a clinical investigation?

When the clinical data obtained through the literature review prove insufficient to establish a favourable benefit-risk ratio and/or when no equivalence can be demonstrated, the conduct of one or more clinical investigations becomes necessary.

Clinical investigation for medical devices is equivalent to clinical trials for medicines (see Clinical trials for ATMPs). It therefore consists of one or more studies conducted on human participants, with the aim of demonstrating the performance, effectiveness and safety of the medical device. The results are then incorporated into the body of clinical data supporting the clinical evaluation. As with a clinical trial for a medicinal product, a clinical investigation of a medical device must comply with a number of regulatory requirements: informed consent of participants, protection of their rights, dignity and safety, prior assessment by an ethics committee, etc. (Articles 62 to 80 and Annex XV of the Regulation on medical devices).

Clinical investigation: a mandatory requirement for Class III medical devices, subject to exceptions

As mentioned above, a clinical investigation is mandatory as part of the clinical evaluation of Class III medical devices (Article 61(2) of the Regulation on medical devices).

By way of exception, a clinical investigation is not required when 3 cumulative conditions are met:

1. The device consists of a modification of a medical device already placed on the market by the same manufacturer; 
2. The manufacturer demonstrates that the modified device is equivalent to the already marketed device. This demonstration must be subject to approval by a notified body; and 
3. The clinical evaluation of the already marketed device is sufficient to demonstrate conformity of the modified device with the relevant safety and performance requirements (Article 61(4) of the Regulation on medical devices).

The exemption from the requirement to conduct a clinical investigation may also apply when the manufacturer of the modified device is not the manufacturer of the already marketed device. In addition to the previous conditions, 3 additional conditions must be met:

1. “the two manufacturers have a contract in place that explicitly allows the manufacturer of the second device full access to the technical documentation on an ongoing basis”; 
2. “the original clinical evaluation has been performed in compliance with the requirements of [the] Regulation”; and 
3. the manufacturer of the second device provides the notified body with clear evidence that conditions 1 and 2 are fulfilled 

(Article 61(5) of the Regulation on medical devices).

There is also an exemption from the requirement to conduct a clinical investigation for the devices referred to in Article 61(6) of the Regulation on medical devices.

These exemptions from the requirement to conduct a clinical investigation for Class III medical devices are addressed in MDCG guidance: MDCG 2023-7 Guidance on exemptions from the requirement to perform clinical investigations pursuant to Article 61(4)-(6) MDR and on sufficient levels of access’ to data needed to justify claims of equivalence.

In practice, although a clinical investigation may exceptionally not be required for Class III medical devices, it is often necessary for innovative devices, as their novelty prevents reliance on existing data relating to an equivalent device.

Submission of a clinical investigation application to the Member States concerned

The submission of a clinical investigation application by its sponsor is made to the competent national authorities (See EuroGCT | Actors and Networks). Pending the deployment of the Clinical Investigations & Performance Studies module of the EUDAMED platform, intended to provide sponsors with a single EU-wide entry point (Article 70(1) of the Regulation on medical devices), applications shall be submitted directly to the competent national authorities in accordance with national procedures.

It is then for the competent national authorities to assess the application in light of the requirements set out in Article 62 of the Regulation on medical devices.

The favourable opinion of an ethics committee in the relevant Member State is always required before a clinical investigation may commence.

However, the Regulation on medical devices distinguishes between two situations:

• Non-invasive Class IIa and IIb devices, for which validation of the application (complete dossier and clinical investigation falling within the scope of the Regulation) permits the clinical investigation to start immediately (Article 70(7)(a) of the Regulation on medical devices)
• All other medical devices, for which authorisation of the clinical investigation is required (Article 70(7)(b) of the Regulation on medical devices). 

The Regulation on medical devices also allows Member States to adopt, to a certain extent, specific national rules concerning clinical investigations. The European Commission provides a list of links to the websites of competent authorities that have implemented such specific national rules.

Possibility of a single application and coordinated assessment for clinical investigations conducted in several Member States

The Regulation on medical devices also provides for the possibility for a sponsor to submit a single application for clinical investigations conducted in several Member States. In such cases, the assessment referred to in Article 78 of the Regulation on medical devices is subject to a coordinated procedure between the Member States concerned, one of which is designated as the coordinating Member State.

As the single application is intended to be submitted via the EUDAMED platform, its effective implementation must await the deployment of the Clinical Investigations & Performance Studies module.

However, in February 2025, the European Commission launched a call for applications to participate in a Pilot coordinated assessment of clinical investigations and performance studies.

“This pilot will allow sponsors to submit a single application for pilot coordinated assessments, assuring more harmonised interaction with the Member States approving the clinical investigation or performance studies. Additionally, participant sponsors will help the competent authorities of Member States with building a fast and fit for purpose EU system for coordinated assessment once its mandatory operation starts as required”.

18 EU countries (Austria, Belgium, Czechia, , Estonia, Finland, France, Germany, Greece, Ireland, Latvia, Luxembourg, Poland, Portugal, Romania, Slovenia, Spain, Sweden and The Netherlands) and Norway are participating.

Recording and reporting of adverse events occurring during clinical investigations

During the clinical investigation, the sponsor shall record any adverse event or device deficiency occurring with the investigational device and shall notify the relevant Member State(s) in the event that the occurrence is serious (Article 80 of the Regulation on medical devices). Here again, notification shall be made directly to the competent national authorities pending the deployment of the Clinical Investigations & Performance Studies module of the EUDAMED platform.

The quality management system may be defined as the set of measures, procedures and organisational arrangements (including those relating to human and material resources) implemented by the manufacturer in order to ensure compliance with the requirements laid down in the Regulation on medical devices regarding the quality of processes, procedures and devices. The quality management system shall at a minimum cover the following aspects:

“- a strategy for regulatory compliance (…);
- identification of applicable general safety and performance requirements and exploration of options to address those requirements;
- responsibility of the management;
- resource management (…);
- risk management (…);
- clinical evaluation (…);
- product realisation (…);
- verification of the UDI assignments (…) to all relevant devices (…);
- setting-up, implementation and maintenance of a post-market surveillance system (…);
- handling communication with competent authorities, notified bodies, other economic operators, customers and/or other stakeholders;
- processes for reporting of serious incidents and field safety corrective actions in the context of vigilance;
- management of corrective and preventive actions and verification of their effectiveness;
- processes for monitoring and measurement of output, data analysis and product improvement. » (Art. 10(9) of the Regulation on medical devices)

The quality management system shall be established, documented, implemented, maintained, kept up to date and continuously improved. (Article 10(9) of the Regulation on medical devices)

It shall be subject to continuous documentation (Article 10(9) of the Regulation on medical devices). Such documentation must be made available to notified bodies in the context of the conformity assessment of the medical device (Annex IX, Section 2.1 of the Regulation on medical devices) and to competent authorities upon request. (Article 10(8) of the Regulation on medical devices)

The quality management system is also governed by the harmonised standard ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes.

Finally, the quality management system is subject to assessment by a notified body as part of the certification procedure for Class III medical devices (Annex IX-2, and Annex XI-6 of the Regulation on medical devices). In addition to this initial assessment, the manufacturer’s post-market obligations include periodic and unannounced controls carried out by the notified body. These controls are intended to ensure continued compliance with the regulatory requirements and with the objectives of the QMS, including post-market surveillance measures. They take the form of periodic audits conducted at least annually (Annex IX-3.3, and Annex XI-7 of the Regulation on medical devices) and unannounced audits conducted at least every five years (Annex IX-3.4, and Annex XI-7 of the Regulation on medical devices), including on-site visits to the manufacturer and, where applicable, its suppliers and/or subcontractors.

Manufacturers of medical devices shall establish and keep up to date the technical documentation relating to their devices in order to enable assessment of the conformity of those devices with the requirements of the Regulation on medical devices.

This technical documentation shall contain the elements provided for in Annex II (technical documentation) and Annex III (technical documentation on post-market surveillance) of the Regulation on medical devices (Article 10(4) of the Regulation on medical devices).

For medical devices based on human or animal tissues and cells, the use of such raw materials must be justified within the technical documentation.

Upon completion of the applicable conformity assessment procedure and once conformity with the applicable requirements has been demonstrated, the manufacturer of medical devices (other than custom-made devices or investigational devices) shall draw up an EU declaration of conformity (Article 19 of the Regulation on medical devices) and affix the CE marking to each medical device (Article 20 of the Regulation on medical devices) prior to placing them on the European Union market. 

(Article 10(5) of the Regulation on medical devices)

Manufacturers shall comply with the obligations relating to the identification and traceability of medical devices, namely those arising under the Unique Device Identification system (“UDI system”, Article 27 of the Regulation on medical devices), as well as those concerning the registration of devices (Article 29 of the Regulation on medical devices) and of manufacturers, authorised representatives and importers (Article 31 of the Regulation on medical devices). (Article 10(6) of the Regulation on medical devices)

All documentation (technical documentation, EU declaration of conformity and, where applicable, a copy of any relevant certificate issued, including any amendments and supplementary documentation) shall be retained and made available to competent authorities for:

• at least fifteen years from the placing on the market of the last device covered by the declaration of conformity, in the case of implantable medical devices; 
• at least ten years from the placing on the market of the last device covered by the declaration of conformity, in the case of other medical devices. (Article 10(8) of the Regulation on medical devices)

The manufacturer must also ensure that compliance with the essential requirements relating to reliability, safety and performance is maintained after the medical device has been placed on the market. To this end, even prior to the conformity assessment procedure, it shall design, establish and document a post-market surveillance system appropriate to the risk class and type of device. It shall then implement, maintain and update this system once the device is placed on the market. (Article 10(10) of the Regulation on medical devices)

This post-market surveillance system is part of the quality management system (Article 83(1) of the Regulation on medical devices). It aims both to collect, record and analyse, in an active and systematic manner throughout the entire lifetime of the device, data relating to its quality, performance and safety, and to define, implement and monitor any necessary preventive or corrective actions (Article 83(2) of the Regulation on medical devices).

The uses of the data collected by the manufacturer under the post-market surveillance system are specified in Article 83(3) of the Regulation on medical devices.

This system is based on a post-market surveillance plan (Article 84 of the Regulation on medical devices), as detailed in Annex III of the Regulation on medical devices. It also includes a post-market surveillance report for Class I devices (Article 85 of the Regulation on medical devices) and a periodic safety update report for other devices (Article 86 of the Regulation on medical devices).

8.1. Post-market clinical follow-up (PMCF) within the framework of the post-market surveillance plan (Annex XIV, Part B of the Regulation on medical devices)

Post-market clinical follow-up (PMCF) is a central element of the post-market surveillance plan established by the manufacturer. It is set out in Part B of Annex XIV of the Regulation on medical devices.

PMCF consists in the continuous updating of clinical evaluation data aiming at “confirming the safety and performance throughout the expected lifetime of the device, of ensuring the continued acceptability of identified risks and of detecting emerging risks on the basis of factual evidence”. (Annex XIV, Part B.5 of the Regulation on medical devices)

PMCF must be planned and documented prior to the conformity assessment procedure for the medical device.

The PMCF plan, specifying the methods and procedures to be followed for the proactive collection and evaluation of clinical data (See Annex XIV, Part B.6 of the Regulation on medical devices), shall be included in the technical documentation (Annex II, Section 6.1(d) of the Regulation on medical devices). The analysis of the data thus collected feeds into a PMCF evaluation report, which is an integral part of the clinical evaluation report and the technical documentation (Annex XIV, Part B.7 of the Regulation on medical devices).

PMCF therefore constitutes the continuation of clinical evaluation in the post-market phase.

8.2. Post-market surveillance report and Periodic safety update report (PSUR) (Articles 85 and 86 of Regulation on medical devices)

Post-market surveillance gives rise to the drafting of reports whose modalities vary depending on the device class.

• For Class I devices, a post-market surveillance report summarises the results and conclusions of the analysis of collected data, as well as any preventive or corrective actions taken. The manufacturer shall update this report at intervals it deems appropriate based on needs. It shall also make it available to the competent authority upon request (Article 85 of the Regulation on medical devices). 
• For other devices, the periodic safety update report (PSUR) contains the same information as the post-market surveillance report for Class I devices. However, it shall also provide more detailed information on the benefit-risk determination, PMCF findings, and data relating to market experience and device usage (including sales volume, frequency of use, characteristics of the user population). For Class III devices, the PSUR shall be updated at least annually. It shall also be submitted, via the EUDAMED platform, to the notified body responsible for the conformity assessment, which shall review it and record its assessment of the PSUR on the EUDAMED platform.

Manufacturers shall establish a system for the recording and reporting of incidents and field safety corrective actions. (Article 10(13) of the Regulation on medical devices)

Vigilance refers to the measures taken by the manufacturer in the event of incidents involving medical devices. 

It entails the obligation for the manufacturer to notify the competent national authorities of serious incidents involving its medical device, as well as the corrective actions taken under the conditions and within the timelines set out in Article 87 of the Regulation on medical devices.

It further entails the obligation to analyse any such notified serious incident and to define and implement appropriate corrective actions. (Article 89 of the Regulation on medical devices)

The manufacturer shall also prepare a trend report concerning less serious incidents and expected undesirable side effects, where an increase in their frequency could affect the benefit-risk determination. (Article 88 of the Regulation on medical devices)

Manufacturers have an obligation to cooperate with the competent authorities (Article 10(14) of the Regulation on medical devices), in particular by making available to them the technical documentation relating to the medical devices. (Article 10(8) of the Regulation on medical devices).

Manufacturers must ensure that their medical devices are accompanied by accessible information (indelible, easily legible and clearly understandable indications) for the intended patient or user, in the official language(s) of the Member State in which the device is made available. (Article 10(11) of the Regulation on medical devices)

Manufacturers are liable under the EU product liability framework for defective products (Directive 85/374/EEC, and Directive (EU) 2024/2853 for devices made available after 9 December 2026). They must have sufficient financial coverage in respect of their potential liability under this framework. (Article 10(16) of the Regulation on medical devices)