A notified body is an independent organization designated by an EU member state to evaluate whether medical devices meet safety and performance standards before they can be sold in Europe. Think of it as a specialized auditor sitting between the manufacturer and the market: the company builds the device, the notified body checks the work, and only then can the product carry a CE mark and reach patients. As of March 2025, 50 organizations hold this designation for medical devices under the EU’s Medical Device Regulation (MDR).
What a Notified Body Actually Does
A notified body’s core job is conformity assessment, which breaks down into three main activities. First, it audits the manufacturer’s quality management system, typically through on-site visits to the company’s facilities. These audits examine how the company controls its production processes, manages suppliers, and handles complaints. Second, it reviews technical documentation, the detailed file a manufacturer compiles to prove a device is safe and performs as intended. This review often involves multiple specialists (biocompatibility experts, clinicians, cybersecurity reviewers) working off-site to evaluate clinical evidence and verify the device meets EU general safety and performance requirements. Third, it may test devices directly when needed.
Once a notified body determines the manufacturer has met all requirements, it issues a CE certificate. That certificate is the manufacturer’s ticket to selling the device across the European Economic Area.
Which Devices Need a Notified Body
Not every medical device requires notified body involvement. The EU classifies devices into risk tiers, and the higher the risk, the more scrutiny applies.
- Class I (standard): Low-risk devices like simple bandages or tongue depressors. Manufacturers self-certify without a notified body.
- Class I (sterile, measuring, or reusable surgical): Still low-risk, but if the device is sold sterile, has a measuring function, or is a reusable surgical instrument, a notified body must certify those specific aspects.
- Class IIa: Low-to-medium risk devices, often placed inside the body for short periods (up to 30 days). Full notified body assessment required.
- Class IIb: Medium-to-high risk devices, frequently implanted for longer than 30 days. Similar process to Class IIa, with additional technical documentation review for implantable devices.
- Class III: The highest-risk category, covering devices like heart valves and implantable defibrillators. These undergo the most rigorous conformity assessment.
In practical terms, most devices that enter or interact with the human body require a notified body’s sign-off.
How an Organization Becomes a Notified Body
A notified body isn’t a government agency. It’s typically a private organization, such as TÜV SÜD or BSI, that applies to a member state’s competent authority for designation. The competent authority (a governmental body responsible for implementing EU regulations at the national level) evaluates whether the applicant has the right expertise, staff, independence, and infrastructure to perform conformity assessments. The designation process itself is rigorous, and the number of organizations that hold it reflects that: only 50 are currently designated for medical devices under the MDR, down significantly from the larger number that operated under the older directive system.
Each notified body is also designated for specific device types or categories. A body qualified to assess orthopedic implants may not be authorized to certify software-based diagnostic tools. Manufacturers need to check that their chosen notified body’s scope of designation covers their product.
Notified Bodies vs. Competent Authorities
These two terms come up together frequently, and the distinction matters. A competent authority is a government body within each EU member state. It writes national law implementing EU regulations, designates notified bodies, and handles post-market issues like adverse event reports. It’s the regulator. A notified body, by contrast, is the independent assessor. It evaluates devices against the rules but does not write or decide on those rules. Manufacturers choose which notified body to work with (provided it covers their device type), but they don’t choose their competent authority.
Ongoing Surveillance and Unannounced Audits
Certification isn’t a one-time event. Notified bodies conduct periodic surveillance audits of manufacturers to confirm they continue meeting standards. Beyond scheduled visits, unannounced audits are now mandatory for all CE-certified manufacturers at least once every three years. For lower-risk device classes (IIa and some non-implantable IIb), the interval may extend to five years.
The frequency of unannounced audits can increase if a device carries especially high risk, if the manufacturer has a history of noncompliance, or if there is evidence suggesting a serious problem. This ongoing oversight is one of the more significant changes the MDR introduced compared to the older regulatory framework, where manufacturers were more commonly subject to just initial audits, routine surveillance, and recertification.
Timeline and Cost of Certification
The conformity assessment process typically takes 9 to 24 months from start to finish, though complex or novel devices can push beyond that range. The timeline depends on the device’s risk level, how novel the technology is, the completeness of the manufacturer’s documentation, and how much capacity the notified body has available. With only 50 designated bodies serving the entire EU market, capacity constraints have been a real bottleneck for manufacturers.
Costs vary widely for the same reasons. Notified bodies are required under Article 50 of the MDR to publish their standard fee schedules, so manufacturers can compare pricing before selecting a body. These fees cover the initial assessment, annual surveillance audits, and any additional reviews triggered by device modifications or noncompliance findings.
How to Verify a Notified Body
The European Commission maintains a public database called NANDO (New Approach Notified and Designated Organisations) where anyone can look up a notified body’s designation status, the member state that designated it, and the specific device categories it’s authorized to assess. If you’re a manufacturer selecting a notified body, or a buyer verifying that a device’s CE certificate is legitimate, NANDO is the authoritative source.