The IVDR (In Vitro Diagnostic Regulation) is a European Union law, officially known as Regulation 2017/746, that governs how diagnostic tests are designed, manufactured, and sold across Europe. It covers everything from home pregnancy tests and blood glucose monitors to genetic screening panels and companion diagnostics that guide cancer treatment. The regulation replaced an older directive (the IVDD) and introduced significantly stricter requirements for safety evidence, ongoing monitoring, and traceability.
What the IVDR Covers
The regulation applies to any medical device designed to examine specimens taken from the human body, including blood, urine, and tissue samples, to provide diagnostic or monitoring information. That scope is broader than many people expect. Genetic tests that reveal predisposition to a medical condition, companion diagnostics that predict how a patient will respond to a specific drug, and even software that interprets diagnostic data all fall under the IVDR.
The core aim is to ensure a high level of health protection for patients and users while keeping the EU market functioning smoothly for manufacturers, including small and medium-sized companies. In practice, that means every diagnostic product sold in Europe must meet defined safety and performance standards before it reaches a hospital lab or pharmacy shelf.
How Devices Are Classified
The IVDR sorts products into four risk classes: A (lowest risk), B, C, and D (highest risk). Class A includes simple items like specimen containers, while Class D covers tests for life-threatening infections like HIV or hepatitis, as well as blood-typing reagents. The higher the risk class, the more rigorous the review process before a product can be sold.
This risk-based classification was one of the biggest changes from the old directive. Under the previous system, roughly 80% of diagnostics could be self-certified by the manufacturer without any independent review. Under the IVDR, a much larger share of products requires assessment by an independent organization known as a notified body.
The Role of Notified Bodies
Notified bodies are independent organizations, such as TÜV SÜD, authorized by EU member states to evaluate whether diagnostic devices meet regulatory requirements. For Class B, C, and D devices, manufacturers cannot simply declare their own compliance. They must go through a formal conformity assessment conducted by one of these bodies.
The process has several stages. It begins with a pre-application review, where the notified body checks whether the manufacturer’s documentation is complete and confirms the device’s risk classification. From there, the notified body audits the manufacturer’s quality management system, typically through on-site visits. It also assesses the technical documentation to verify that the device meets general safety and performance requirements, and it may perform independent product testing covering areas like electrical safety, biocompatibility, and cybersecurity. Only after all findings are resolved and corrective actions are verified does the notified body issue an EU certificate, allowing the manufacturer to place the product on the market.
Three Pillars of Performance Evidence
One of the IVDR’s defining features is its structured approach to proving a diagnostic test actually works. Manufacturers must build a performance evaluation resting on three pillars.
- Scientific validity: Evidence that the thing being measured (an antibody, a genetic marker, a protein) is genuinely associated with the clinical condition the test targets.
- Analytical performance: Proof that the device can accurately and reliably detect or measure that target substance in a sample.
- Clinical performance: Demonstration that the test results correlate with real clinical outcomes in the intended patient population.
Together, these three elements establish whether a diagnostic’s benefits outweigh its risks compared to other options available on the market. This framework is more demanding than what the previous directive required, particularly for lower-risk devices that previously faced minimal scrutiny.
Ongoing Monitoring After Market Launch
Getting a product certified is not the end of the process. The IVDR requires manufacturers to conduct continuous post-market surveillance (PMS) to track how their devices perform in real-world use. For higher-risk devices (Class C and D), manufacturers must produce Periodic Safety Update Reports summarizing the data they have collected and any actions taken as a result.
A related requirement called Post-Market Performance Follow-up (PMPF) goes further. Manufacturers must proactively collect and analyze clinical data throughout a device’s expected lifetime. The goals include confirming long-term safety and performance, identifying previously unknown risks or performance limitations, spotting emergent risks based on real-world evidence, and detecting patterns of systematic misuse. If a manufacturer determines that no specific PMPF activities are necessary, they must formally justify that decision in writing.
Traceability Through UDI and EUDAMED
The IVDR introduced a Unique Device Identification (UDI) system that assigns a standardized code to every diagnostic product. Manufacturers must submit UDI and device information to EUDAMED, the EU’s central database for medical devices. The intention is to make it possible to trace any device from manufacturer to patient, improving the speed and accuracy of safety investigations or recalls.
EUDAMED also serves as a public-facing transparency tool, giving regulators, healthcare professionals, and patients access to information about registered devices, certificates, and safety reports. Manufacturers use a standardized naming system called the European Medical Device Nomenclature (EMDN) when registering their products.
Who Has Legal Obligations
The IVDR assigns specific responsibilities to every company in the supply chain, not just manufacturers. There are four categories of “economic operators” with distinct legal duties.
Manufacturers carry the broadest obligations: designing safe products, building and maintaining technical documentation, running post-market surveillance, and reporting safety incidents. If a manufacturer is based outside the EU, it must appoint an authorized representative within the Union. That representative must verify that conformity documentation exists, keep copies of technical files available for authorities, and cooperate with regulators on any corrective actions. Notably, if the manufacturer fails to meet its obligations, the authorized representative can be held jointly and severally liable for defective devices.
Importers and distributors also have defined duties, including verifying that devices carry proper markings and that registration requirements have been met. Any entity that modifies a device or repackages it in a way that affects compliance can be reclassified as a manufacturer, inheriting all corresponding obligations.
The Person Responsible for Regulatory Compliance
Every manufacturer and authorized representative must designate at least one Person Responsible for Regulatory Compliance (PRRC). This is a legally mandated role under Article 15 of the IVDR, not just an internal quality position. The PRRC must have documented qualifications in a relevant field and is personally responsible for ensuring devices are properly checked before release, that technical documentation and EU declarations of conformity are maintained, that post-market surveillance is carried out, and that safety incidents are reported through the vigilance system.
The Exception for In-House Lab Tests
Hospital and health institution laboratories that develop their own diagnostic tests, often called laboratory-developed tests (LDTs), are not fully exempt from the IVDR, but they do get a conditional carve-out under Article 5(5). To qualify, a lab must meet several requirements simultaneously: the test cannot be transferred to another legal entity, it must not be manufactured on an industrial scale, and the lab must document why no equivalent commercial product on the market can meet the specific needs of its patient population at the required performance level.
The lab must also operate under an appropriate quality management system and comply with the ISO 15189 standard (or equivalent national accreditation requirements). It must continuously review its clinical experience with the test and take corrective action when needed. These conditions are designed to permit genuine innovation in hospital labs while preventing manufacturers from using the in-house exemption to bypass the regulation entirely.
Transition Timeline
The IVDR formally took effect on May 26, 2022, but the EU recognized that the industry and notified body infrastructure were not ready for an overnight switch. A staggered transition allows devices certified under the old directive to remain on the market based on their risk class: the highest-risk devices (Class D) must fully comply by December 31, 2027, Class C devices by December 31, 2028, and Class B devices by December 31, 2029. Manufacturers using these extended deadlines must still meet specific conditions, including having had a valid certificate or declaration of conformity under the old directive before the May 2022 cutoff.
These extended timelines reflect a practical reality: the number of notified bodies designated to review IVDs under the new regulation has grown slowly, creating a bottleneck. Manufacturers that have not yet begun the transition process face increasing pressure as these deadlines approach, since notified body capacity remains limited relative to the volume of devices that need recertification.