EU revised device rules rebalance compliance towards simplification and proportionality

The European Commission has published its long-awaited proposal to amend the Medical Devices Regulation (MDR) and the In Vitro Diagnostic Medical Devices Regulation (IVDR) and to provide a legislative initiative to correct structural shortcomings since the regulations' gradual application in May 2017.

The stated goal of the draft proposal, which was published on 16 December, is to pursue simplification and proportionality. The ambition is to facilitate economic operators' planning around regulatory strategies while maintaining compliance over the full lifecycle of their technologies.

Objectives and architecture

The explanatory memorandum to the proposal sets out the core objective as simplifying current device rules, reducing administrative burden and enhancing the predictability and cost‑efficiency of notified body certification, while maintaining the key safety goals of the MDR and IVDR.

The Commission's targeted evaluation launched in 2024 confirmed that numerous MDR and IVDR requirements are "overly complex, burdensome, lengthy and costly" and not always proportionate to the risks posed by particular devices. Stakeholders, including small and medium-sized enterprises (SMEs), called for risk‑based approaches, more flexible pathways for innovation and a higher degree of digitalisation.

To respond to those concerns, the proposal keeps the decentralised model based on national competent authorities and notified bodies, but introduces targeted amendments to the MDR and IVDR. These include revised rules on the person responsible for regulatory compliance (PRRC), the validity and surveillance of certificates, clinical and performance evidence, the concept of "well‑established technologies", adapted classification rules, streamlined post‑market surveillance (PMS) and reporting obligations, and simplified arrangements for repackaging and relabelling.

Article 15 (person responsible for regulatory compliance) of both regulations currently sets detailed qualification criteria for the PRRC. Those include specific combinations of formal education and professional experience, and requires micro- and small enterprises that rely on an external PRRC to ensure that that person is "permanently and continuously" at their disposal. This has proved challenging for smaller manufacturers and start‑ups, particularly where regulatory expertise is sourced externally.

The proposal amends the current provision by removing parts of the detailed qualification requirements, while maintaining that the PRRC should have the "requisite expertise" in the field of the relevant devices. It also deletes the obligation for SMEs using an external PRRC to ensure permanent and continuous availability, replacing this with a requirement that the PRRC should be "available" to the manufacturer. The change is expected to reduce disproportionate burdens on smaller operators without lowering standards of regulatory oversight.

In practice, manufacturers would remain responsible for being able to demonstrate that their PRRC has appropriate regulatory experience, but the proposal no longer prescribes rigid degree‑and‑experience combinations. It is hoped that this will create more flexibility to engage specialists with non‑traditional career paths and to structure arrangements with external consultants.

Certificates and risk‑based reviews

Under the current MDR and IVDR, certificates issued by notified bodies are valid for a maximum of five years, after which recertification is required. This fixed five‑year cap has contributed to capacity bottlenecks, as large volumes of devices require full reassessment within similar timeframes.

The proposal removes that hard limit. It provides that the validity of certificates "shall not be limited in time, unless in exceptional cases where the notified body considers it necessary to limit the period of validity based on duly justified grounds". In those exceptional cases, the notified body should indicate the period of validity on the certificate, and may extend it upon assessment.

At the same time, a new regulatory provision requires notified bodies to carry out "appropriate surveillance activities, including periodic reviews taking into consideration developments of the state of the art", with those reviews being proportionate to the risk class of the device. The result is a shift from cycle‑based recertification to continuous risk‑based surveillance: the certificate remains valid unless there is a reasoned decision to limit, suspend or withdraw it.

For manufacturers, the change has the potential to remove the artificial pressure of five‑year recertification deadlines. At the same time, it signals that the quality of ongoing PMS data, vigilance and change management will likely be central to maintaining certification.

Clinical data and evidence

The Commission's evaluation identified that strict MDR and IVDR expectations on clinical evidence and reliance on equivalent device data have been a major challenge for "legacy" devices and for SMEs. The proposal offers to resolve this issue by allowing a broader range of data to qualify as clinical evidence and to relax certain conditions on equivalence.

For medical devices, the proposed amendments broaden what may constitute clinical data and clinical evidence. The revised article 61 (clinical evaluation) explicitly allows manufacturers, in defined cases, to demonstrate conformity with the relevant general safety and performance requirements based on non‑clinical data alone. In that case, such data should be sufficient to demonstrate safety and performance in light of the device's characteristics and intended purpose. The proposal also promotes the use of methodologies such as in silico testing, as part of the non‑clinical evidence base.

On equivalence, the proposal makes the conditions more workable. It eases certain requirements for direct access to data of an equivalent device where that device belongs to another manufacturer, while still requiring scientific justification.

For in vitro diagnostics, the amendments re‑emphasise that the manufacturer should define and justify the level of clinical evidence required, taking into account the characteristics of the device and its intended purpose. The performance evaluation should remain methodologically sound, but there is clearer scope to calibrate the evidence package to the diagnostic's actual risk profile.

Well‑established technologies

The proposal introduces a new legal definition of "well‑established technology" (WET) devices into article 2 (definitions) of the MDR, and uses this concept throughout the conformity assessment provisions. A WET device is described as a device with a well‑known technology, a long history of safe clinical use, and well‑characterised risks and benefits, as detailed in the amended text.

This definition replaces the MDR's static lists of device categories (such as sutures, dental fillings and similar products) which were eligible to specific reduced requirements. Instead of relying on closed lists, the WET concept allows the EU legislator and, where necessary, the Commission – via delegated acts – to adapt the scope to technical and scientific progress.

Practical implications for conformity assessment are potentially significant. For example, the amended MDR would now provide that class III devices that are WET are subject to conformity assessment under annex IX (conformity assessment based on a quality management system and on assessment of technical documentation), including an assessment of the technical documentation of "one representative device per generic device group" rather than every single variant. A similar principle applies to class IIb devices: for non‑implantable class IIb WET devices the notified body would need only assess one representative device per category of devices. This would create a more efficient assessment model for portfolios built around established technologies.

In addition, the proposal links the WET concept to summary of safety and clinical performance obligations under article 32 (summary of safety and clinical performance) of the MDR. It limits the scope of devices for which the summary is required to those for which the notified body should conduct a technical documentation assessment. This may lead to reduced documentation demands for low‑risk WET devices, while keeping transparency obligations for higher‑risk, more innovative technologies.

Adapted classification 

The Commission explicitly recognises that some MDR classification rules have resulted in "unnecessary up‑classification" that have contributed to disproportionate burdens for certain device types. The proposal therefore amends annex VIII (classification rules) of the MDR, with a corresponding empowerment for the Commission to further adapt the classification rules by delegated acts.

A key amendment is the targeted down‑classification of specific categories. The Commission's explanation notes that this concerns, in particular, certain reusable surgical instruments, accessories to active implantable medical devices and selected digital products.

For instance, amended rule 6 and related provisions in annex VIII are expected to clarify that reusable surgical instruments remain in class I, with notified body involvement limited to aspects relating to reuse where appropriate. Accessories that do not themselves present the same direct risks as active implantables may be assigned to class IIa or IIb rather than class III. For medical device software , the intent is to better distinguish between applications whose incorrect output could lead directly to death or irreversible deterioration of health, and those whose contribution to clinical decisions is more indirect or limited in impact, allowing a lower class where proportionate. 

The proposed classification changes aim to align regulatory burden more closely with real‑world risk, freeing up notified body capacity without lowering patient protection.

PMS and vigilance

PMS and vigilance were identified in the targeted evaluation as areas where reporting obligations could risk overwhelming both manufacturers and authorities. The proposal offers targeted adjustments to reduce administrative burden while maintaining the flow of meaningful safety information.

For medical devices, periodic safety update report (PSUR) requirements are amended to reduce the frequency of mandatory updates. Currently, manufacturers of class IIb and III devices should update the PSUR at least annually. Under the amended text, the PSUR should still be updated in the first year after certificate issuance but, thereafter, at intervals that are less frequent (for example, every two years) unless there is a significant change in the benefit‑risk determination or in the acceptability of the benefit‑risk ratio.

For IVDs, the legislative amendments are similar. Manufacturers of class C and D devices are set to update the PSUR "in the first year after the certificate is issued and every two years thereafter or when there is a significant change in the benefit‑risk determination or in the acceptability of erroneous results".

The proposal also amends the MDR and the IVDR to extend the reporting deadline for certain serious incidents that do not involve public health threats, death, or serious deterioration in health, from 15 to 30 days. The intention is to ease pressure on manufacturers' vigilance teams while preserving rapid reporting for the most critical events.

New repackaging and relabelling rules

Across both regulations, article 16 (cases in which obligations of manufacturers apply to importers, distributors or other persons) currently imposes stringent conditions on importers and distributors who repackage or relabel devices. Critically, those include an obligation to obtain a certificate from a notified body and to notify the manufacturer and competent authority in advance. Stakeholders have argued that these requirements are disproportionate where activities do not affect the integrity of the device.

The proposal responds by amending this provision  to remove the requirement for a notified body certificate and the prior notice obligation for certain relabelling and repackaging operations, provided that specific conditions are met. The amended text maintains the core obligation that such activities should not compromise the original condition of the device and should be carried out under an appropriate quality system. On the other hand, it eliminates external certification and notification steps that reportedly added cost and delay without clear safety benefits.

Competent authorities remain able to intervene under market surveillance powers where repackaging or relabelling gives rise to non‑compliance or safety concerns.

Osborne Clarke comment

The Commission's proposal offers a carefully calibrated response to legitimate concerns about disproportionate burden under the MDR and IVDR. The removal of the five‑year cap on certificate validity, combined with mandatory risk‑based periodic reviews, could over time reduce the recertification "cliff edge" that has contributed to capacity constraints. The relaxation of PRRC qualification prescriptiveness and availability obligations for SMEs could make it more feasible for smaller manufacturers to maintain robust regulatory governance structures without excessive fixed costs.

The introduction of a legally defined WET concept and its integration into classification and conformity assessment rules may be particularly valuable for portfolios centred on more mature device technologies and this could help those products remain economically viable in the EU. At the same time, reduced PSUR frequencies and streamlined vigilance timelines can be expected to free regulatory teams to focus on analysis and corrective action rather than purely on reporting mechanics.

If the proposal is passed into law, manufacturers may nevertheless wish to proceed cautiously when planning transitions to WET‑based or down‑classified pathways. The proposal relies heavily on risk‑based judgments by notified bodies and competent authorities, and it remains to be seen how consistently these will be applied across the EU.

In due time, early engagement with notified bodies on how they intend to operationalise WET determinations, representative device sampling and periodic review strategies may prove beneficial. For economic operators, the simplified repackaging regime can reduce compliance friction, but it suggests that internal quality systems should be sufficiently robust to withstand market surveillance scrutiny in the absence of notified body certification.

This is the first in a series of Insights written by Vladimir Murovec, Counsel at Osborne Clarke Belgium, on MDR and IVDR legislative proposals published by the European Commission.