Medical Device Regulation (EU) 2017/745

Regulation (EU) 2017/745, the Medical Device Regulation, is the law governing medical devices placed on the European Union market. It applied from 26 May 2021, replacing the Medical Device Directive (93/42/EEC) and the Active Implantable Medical Device Directive (90/385/EEC).

The distinction between a regulation and the directives it replaced is not administrative. A directive had to be transposed into each member state's national law, which produced variation. A regulation applies directly and identically across all member states. There is no national interpretation to work with or around.

MDR is substantially more demanding than the MDD. It widened the definition of a medical device to include some products with no medical purpose, reclassified many devices upward, requires clinical evidence rather than equivalence claims for more device types, and moved post-market activity from an afterthought to a continuous obligation. A device that was comfortably Class I under the MDD may be Class IIa under MDR, which changes everything about the route to market.

This is the most common confusion in the field, and it costs money in both directions: companies who think an ISO 13485 certificate makes them MDR compliant, and companies who think MDR makes ISO 13485 unnecessary.

EU MDR is law. ISO 13485 is a standard. You cannot choose not to comply with MDR and sell in Europe. You can choose not to certify to ISO 13485 — it is voluntary.

The relationship is specific:

• MDR requires a quality management system. Article 10(9) obliges manufacturers to establish, document, implement and maintain one, and lists what it must cover. It does not name ISO 13485.
• ISO 13485 is how that obligation is normally met. The standard is harmonised to the regulation, so a conforming QMS carries a presumption of conformity with the QMS requirements of MDR. Notified Bodies expect it. In practice, not holding it means explaining why.
• But it is not sufficient. ISO 13485 covers the quality system. MDR additionally requires classification, conformity assessment through a Notified Body for most classes, technical documentation to Annexes II and III, clinical evaluation, post-market surveillance and PSURs, vigilance reporting, UDI assignment, EUDAMED registration, a Person Responsible for Regulatory Compliance, and an EU Authorised Representative if you are outside the Union. None of those are ISO 13485 requirements.

The practical summary: ISO 13485 is the foundation, MDR is the building. A sound 13485 system makes MDR conformity considerably cheaper, because the document control, design control, supplier control, CAPA and management review it already demands are the machinery MDR's additional obligations run on. Starting MDR work without it means building both at once.

One asymmetry worth knowing: ISO 13485 certification is issued by a certification body on a three-year cycle. MDR conformity is assessed by a Notified Body — a different designation, a different scope, and in most cases a different organisation, although some bodies hold both roles. A 13485 certificate from a body that is not a designated Notified Body gives you no MDR standing.

MDR places obligations on every economic operator in the chain, not only manufacturers — a change many distributors and importers underestimated.

• Manufacturers, wherever located, who place devices on the EU market under their own name.
• Authorised Representatives, who carry defined legal responsibilities and can be held liable for defective devices alongside the manufacturer. Any non-EU manufacturer needs one.
• Importers, who must verify CE marking, labelling, UDI assignment and the AR designation before placing a device on the market.
• Distributors, who must verify certain elements and act when they believe a device is non-conforming.

It also reaches organisations that may not consider themselves device companies: those who assemble systems or procedure packs, those who sterilise or refurbish, and anyone who relabels or repackages a device under their own name — who become the manufacturer in the eyes of the regulation.

For a company arriving from an ISO 13485 position, these are the additions that carry the work.

• Classification and conformity assessment route. Annex VIII rules, applied to intended purpose. Getting this wrong at the start invalidates everything downstream.
• Technical documentation to Annexes II and III — a structured dossier, not a folder of existing files.
• Clinical evaluation under Article 61 and Annex XIV, with equivalence much harder to rely on than under the MDD, and clinical investigation required for more devices.
• Post-market surveillance under Articles 83–86: a PMS plan, a PMS report or Periodic Safety Update Report depending on class, and post-market clinical follow-up.
• Vigilance reporting of serious incidents and field safety corrective actions, to defined timescales.
• UDI assignment and carrier application.
• EUDAMED registration of actors, devices and certificates.
• A Person Responsible for Regulatory Compliance under Article 15, with defined qualifications and permanent availability.

Several of these are continuous rather than one-off. The PMS and vigilance obligations do not end when the certificate is issued — they are the part most likely to be found wanting at a surveillance audit two years later.

A few failure patterns recur, and none of them are about effort.

Treating the technical file as a document-collection exercise. Annex II is a structure, and a reviewer reads it as an argument: this is the device, this is its intended purpose, this is the evidence that it is safe and performs. Files assembled by gathering existing documents against a checklist tend to be internally inconsistent — the intended purpose in the clinical evaluation not quite matching the one in the labelling — and inconsistency is what reviewers find.

Underestimating clinical evidence. Equivalence routes accepted under the MDD frequently are not under MDR, particularly where the equivalent device is a competitor's and the data is not accessible. Discovering that late means a clinical investigation and a year.

Assuming Notified Body capacity. Capacity is finite and demand is not evenly spread. Timelines are driven as much by queue position as by readiness.

Forgetting post-market is already live. For legacy devices under the extension, PMS, vigilance and registration obligations apply now. A company focused entirely on its 2027 conformity assessment can be non-compliant in the present while preparing diligently for the future.