The EU MDR (European Union Medical Device Regulation) is the law governing how medical devices are designed, manufactured, and sold across the European Union. Officially known as Regulation (EU) 2017/745, it replaced the older Medical Devices Directive (MDD) from 1993 and introduced stricter safety requirements, tighter oversight, and a more comprehensive system for tracking devices throughout their lifecycle. The regulation applies to everything from bandages and wheelchairs to pacemakers and surgical robots.
Why the EU Replaced Its Old Rules
The previous framework, the Medical Devices Directive, was written in 1993 and had fallen out of step with modern technology. Software-based medical tools, advanced implants, and digital health products simply didn’t exist when the original rules were drafted. Beyond the technology gap, there were real safety concerns. A 2016 Harvard University study found that medical devices approved first in the EU (under the old system) were associated with higher safety risks and more recalls compared to those approved in the United States.
EU policymakers identified three core problems: outdated regulations, insufficient oversight leading to safety issues, and imprecise requirements that created uneven protection for patients across member states. The MDR was designed to fix all three. It came into force in 2017, though manufacturers were given transition periods to comply.
How It Differs From the Old Directive
The shift from MDD to MDR wasn’t a minor update. The MDD had 23 articles and 12 annexes spread across about 60 pages. The MDR has 123 articles and 17 annexes spanning 175 pages. That size difference reflects a fundamentally more detailed and demanding framework.
One of the most important structural changes is the legal format itself. The MDD was a directive, meaning each EU country had to translate it into its own national law, which created inconsistencies. The MDR is a regulation, which means it applies directly and uniformly across all EU member states without national interpretation. This creates a single, consistent set of rules for the entire market.
The MDR also tightened scrutiny of Notified Bodies, the independent organizations that assess whether devices meet regulatory standards before they can be sold. Under the old system, oversight of these bodies varied. The MDR imposed stricter qualification requirements and more rigorous auditing of their work.
How Devices Are Classified
The MDR sorts medical devices into four risk classes, each with escalating regulatory requirements:
- Class I: Low-risk, non-invasive, everyday devices. Think tongue depressors, reusable surgical instruments, or simple wound dressings. Most of these can be self-certified by the manufacturer without involving a Notified Body.
- Class IIa: Low-to-medium risk devices, typically those placed inside the body for short periods (between 60 minutes and 30 days). Examples include hearing aids and short-term catheters.
- Class IIb: Medium-to-high risk devices, often those implanted for 30 days or longer. Ventilators and some orthopedic implants fall here.
- Class III: High-risk devices, including pacemakers, hip replacements, and other life-sustaining or life-supporting implants. These face the most rigorous scrutiny.
The higher the class, the more evidence a manufacturer must provide to demonstrate safety and performance, and the more involvement a Notified Body has in the approval process.
What the Regulation Covers
The MDR’s scope is broader than the old directive. It covers traditional medical devices but also extends to certain products that have no intended medical purpose but carry similar risks. Annex XVI of the regulation lists specific categories of non-medical products now subject to MDR requirements, including items like colored contact lenses worn for cosmetic reasons, liposuction equipment used for aesthetic purposes, and brain stimulation devices marketed for non-medical use.
Software is another area where the MDR expanded its reach. Applications and algorithms that analyze patient data or guide clinical decisions can qualify as medical devices in their own right, something the 1993 directive never anticipated.
Clinical Evidence Requirements
One of the MDR’s biggest changes is how much clinical evidence manufacturers must produce. Every device needs a clinical evaluation, a documented assessment showing the device is safe and performs as intended. For implantable devices and Class III devices, the bar is higher: manufacturers generally must conduct clinical investigations (essentially clinical trials) before the device can reach the market.
There are limited exceptions. A manufacturer can skip a new clinical investigation if the device is a modification of one they already sell, and they can demonstrate the modified version is equivalent to the original. Legacy devices that were lawfully sold under the old directive may also qualify for an exemption, provided the clinical evaluation is based on sufficient existing data. Certain low-risk implants like sutures, staples, dental fillings, screws, and pins have a specific carve-out as well. But in every case, the manufacturer must still provide robust clinical data supporting their claims.
Post-Market Surveillance
Getting a device to market is only half the story. The MDR requires manufacturers to actively monitor their devices after they’re being used by patients, through a structured post-market surveillance (PMS) system. This isn’t optional or informal. Manufacturers must create a documented PMS plan that includes specific procedures, timelines, and reporting obligations.
For Class IIa, IIb, and III devices, manufacturers must produce Periodic Safety Update Reports (PSURs) that compile safety and performance data. Class I devices have a lighter requirement: a PMS report rather than a full PSUR.
Post-Market Clinical Follow-up (PMCF) is another core obligation. This is an ongoing process of collecting real-world clinical data about how devices perform over time. PMCF data feeds back into the clinical evaluation, keeping it current rather than treating it as a one-time exercise. If a manufacturer determines that no specific PMCF activities are needed for a particular device, they must formally justify that decision.
Unique Device Identification
The MDR introduced a traceability system called Unique Device Identification (UDI). Every medical device placed on the EU market must carry a unique code made up of two parts: a device identifier (UDI-DI) that identifies the specific product and manufacturer, and a production identifier (UDI-PI) that tracks the individual unit or batch.
Manufacturers must assign a UDI before placing a device on the market and print the UDI carrier on the device label and all levels of packaging. The goal is straightforward: if a problem emerges with a specific device or batch, regulators and hospitals can trace exactly which products are affected and where they went.
The EUDAMED Database
Supporting all of this is EUDAMED, a centralized European database designed to bring transparency to the medical device market. It has six modules covering actor registration, device registration, Notified Body certificates, clinical investigations, vigilance reporting, and market surveillance. The first four modules will become mandatory on 28 May 2026, following a European Commission decision published in November 2025. Once fully operational, EUDAMED will give regulators, healthcare professionals, and in some cases the public access to information about devices on the market, their certifications, and any safety issues.
Transition Deadlines for Legacy Devices
The MDR originally set a single transition deadline, but recognizing the strain on manufacturers and Notified Bodies, the EU extended the timeline through Regulation (EU) 2023/607. The current deadlines depend on device risk class:
- Class III and Class IIb implantable devices: Must comply by 31 December 2027.
- All other Class IIb, Class IIa, and Class I devices (sterile or with measuring function): Must comply by 31 December 2028.
- Class III custom-made implantable devices: A separate derogation ends 26 May 2026.
Until those dates, manufacturers can continue selling devices certified under the old MDD, provided they meet certain conditions. After the deadlines pass, only devices fully compliant with the MDR will be allowed on the EU market.