The IVDR (In Vitro Diagnostic Regulation) is EU Regulation 2017/746, a comprehensive legal framework governing the manufacture, sale, and use of in vitro diagnostic medical devices across the European Union. It replaced the older In Vitro Diagnostic Directive (IVDD) from 1998, bringing significantly stricter requirements for safety testing, clinical evidence, and ongoing monitoring. The regulation’s central goal is to ensure the highest possible level of patient health protection and user safety through harmonized requirements that apply uniformly across all EU member states.
What the IVDR Covers
In vitro diagnostic medical devices, commonly called IVDs, are tests and instruments used to examine samples taken from the human body, such as blood, urine, or tissue. These range from simple home pregnancy tests and blood glucose monitors to complex genetic sequencing systems and laboratory analyzers used in hospitals. If a product is designed to provide information about a physiological or pathological process, a congenital condition, or the safety and compatibility of a treatment, it falls under the IVDR’s scope.
The regulation recognizes two broad categories of compliant devices. The first is CE-marked IVDs from commercial manufacturers and other economic operators. The second is in-house IVDs, which are tests developed and used within health institutions like hospital laboratories. Both categories face regulatory obligations, though the specifics differ considerably.
How the Classification System Works
One of the IVDR’s biggest changes from the old directive is its risk-based classification system. Devices are sorted into four classes: A (lowest risk), B, C, and D (highest risk). Under the previous directive, most IVDs were effectively self-certified by manufacturers. Under the IVDR, the vast majority now require review by an independent notified body before reaching the market.
Class D includes the highest-risk devices, such as tests for blood-borne infections like HIV and hepatitis that are used in transfusion screening. Class C covers devices like genetic tests and companion diagnostics used to guide treatment decisions. Class B includes common clinical chemistry and hematology tests, while Class A covers general laboratory instruments and low-risk products. The higher the class, the more extensive the documentation, clinical evidence, and third-party oversight required.
Performance Evaluation Requirements
Manufacturers must generate clinical evidence demonstrating that their device works as intended. This evidence has three components: scientific validity, analytical performance, and clinical performance. Scientific validity establishes that the thing being measured (a biomarker, a genetic mutation, an antibody) has a genuine, documented association with a clinical condition or physiological state. Analytical performance proves the device can accurately and reliably detect or measure that target in a sample. Clinical performance demonstrates that the device’s results actually correspond to real clinical outcomes in the intended patient population and care pathway.
This three-part framework is far more rigorous than what the old directive required. Manufacturers must define their intended use precisely, specify the target population, and show that the device performs against predefined benchmarks rather than vague claims.
Obligations for Manufacturers and Supply Chain
The IVDR places distinct legal responsibilities on every entity in the supply chain. Manufacturers carry the heaviest burden: they must maintain a quality management system, compile extensive technical documentation, assign a Unique Device Identifier (UDI) to their products, conduct post-market surveillance, and report serious incidents to regulators.
Every manufacturer must also designate a Person Responsible for Regulatory Compliance (PRRC). This individual needs either a relevant university degree (in law, medicine, pharmacy, engineering, or another scientific discipline) plus at least one year of experience in regulatory affairs or quality management, or four years of professional experience in those fields without a degree. The PRRC is responsible for verifying device conformity before release, keeping technical documentation current, ensuring post-market surveillance obligations are met, and fulfilling incident reporting requirements. Importantly, the regulation protects the PRRC from retaliation within the organization for carrying out these duties.
Small and micro enterprises are not required to employ a PRRC directly but must have one permanently and continuously available to them, such as an external consultant.
Distributors must verify that devices carry CE marking, have a valid EU declaration of conformity, include required manufacturer information, and bear a UDI where applicable. They must also maintain proper storage and transport conditions and forward any complaints or suspected incident reports from healthcare professionals or patients to the manufacturer immediately. Importers who bring devices from outside the EU into the market have their own verification and record-keeping duties.
Unique Device Identification and EUDAMED
The IVDR introduces a device identification system based on a Unique Device Identifier, or UDI. Each device receives a standardized code that allows it to be traced throughout the supply chain, from factory to patient. Manufacturers must submit UDI and device information into EUDAMED, the European Database on Medical Devices.
EUDAMED is designed to be a centralized, publicly accessible system covering device registrations, certificates, clinical investigations, post-market surveillance, and vigilance reporting. Manufacturers have been able to enter UDI data voluntarily since October 2021, and the UDI/Devices module becomes mandatory to use from 28 May 2026. The database uses a standardized European Medical Device Nomenclature (EMDN) so that devices are categorized consistently across all member states.
Post-Market Surveillance and Reporting
Placing a device on the market is not the end of the regulatory process. Manufacturers must operate a post-market surveillance system that actively collects and analyzes data on device performance throughout its entire lifecycle. For higher-risk devices (Class C and D), this includes submitting Periodic Safety Update Reports (PSURs) that summarize safety and performance findings over defined intervals.
When serious incidents occur, manufacturers must report them to competent authorities and take field safety corrective actions when needed. Distributors and importers also play a role here: any complaints or suspected incidents they learn about must be passed along to the manufacturer without delay. This layered reporting structure is meant to catch safety signals early and ensure that problems with a device anywhere in Europe are visible to regulators everywhere.
Rules for In-House (Laboratory-Developed) Tests
Before the IVDR, laboratory-developed tests created and used within a single hospital or health institution were largely unregulated at the EU level. The IVDR changes this through Article 5(5), which allows health institutions to manufacture and use their own IVDs, but only under strict conditions.
The exemption applies when no equivalent CE-marked device is available on the market, or when available devices cannot meet the specific needs of the target patient group at the appropriate performance level. The health institution must document this justification. Manufacturing must happen on a non-industrial scale, and the device cannot be transferred to another legal entity. The institution must operate under an appropriate quality management system, produce documentation covering the manufacturing process, design, performance data, and intended purpose, and make a public declaration about its in-house devices.
In-house devices must still comply with the general safety and performance requirements laid out in Annex I of the regulation. Health institutions are also required to review their clinical experience with these devices and take corrective actions when necessary. These conditions bring laboratory-developed tests under a regulatory umbrella for the first time in EU law, though the requirements are less extensive than those for commercially manufactured IVDs.
Why the IVDR Matters
The practical impact of the IVDR is enormous. Under the old directive, roughly 80% of IVDs could be self-certified by manufacturers with no independent review. Under the new classification rules, the majority now require notified body involvement. This has created significant capacity challenges, as the number of notified bodies designated to review IVDs under the IVDR has been limited, and manufacturers have faced long timelines for certification.
The regulation also affects clinical laboratories, pathology departments, and research hospitals that develop their own tests. For the first time, these institutions must formally document their justification for using in-house tests, maintain quality management systems specifically for those tests, and make their activities transparent through public declarations. For manufacturers, importers, distributors, and healthcare institutions alike, the IVDR represents a fundamental shift toward greater accountability, traceability, and evidence requirements for every diagnostic test used in European healthcare.