Over the past two years, what has frustrated companies most about the MDR/IVDR has not been “demanding requirements” but “blocked processes”: limited notified body capacity, duplicated reviews, frequent re-certifications and piling documentation burdens have caused a chain reaction of certificate backlogs, product withdrawals and supply shortages.
The amendment proposal (COM(2025) 1023) put forward by the European Commission on 16 December 2025 is essentially a systematic “unblocking”: without lowering the safety baseline, it shifts regulatory resources away from “formalistic repetitive work” and back to “real risk points”.
The key messages of the proposal can be summed up in three points:
-
Certificate management shifts from “fixed-cycle re-certification” to “risk-proportionate continuous review”;
-
The scope of notified body involvement is reduced and audit methods become more flexible (including remote audits);
-
“New risk areas” such as digitalisation, cybersecurity and security of supply are strengthened and institutionalised.
Important: this is a “proposal” and still has to be adopted by the European Parliament and the Council through the legislative procedure before it takes effect as an amending regulation.
1. The most closely watched change: the 5-year certificate validity is to be abolished
The proposal would abolish the maximum 5-year validity of certificates. Instead, during the certificate’s validity the notified body would carry out periodic reviews proportionate to risk, rather than a full re-certification on expiry.
What it means:
-
For companies: if your product is lower risk and has a good track record, in theory you will see a significant reduction in repetitive work and costs of “re-certification for its own sake”; real compliance pressure will focus more on “continuous compliance” capabilities such as PMS/PMCF, change control and risk trending.
-
For notified bodies: capacity can be freed from “periodic major re-certifications” and redirected to more targeted reviews and surveillance (more like a “going concern” regulatory model).
2. Notified body audits become more risk-based: less involvement + remote audits + potentially lower surveillance frequency
The proposal sets out a very clear set of “burden reduction” measures for certification:
-
Less intensive notified body review of technical documentation for medium- and low-risk products: for Class IIa/IIb (and IVD Class B/C), review would shift to “sampling representative devices / groups / categories, or even a representative of the whole product portfolio”; and systematic technical documentation review of representative products would no longer be required during surveillance.
-
Remote audits may replace on-site audits (under certain conditions).
-
Where there are no safety issues, surveillance audits may be held every two years.
-
Unannounced audits would tend to become “for-cause” only.
-
Sterile Class A IVDs would no longer require notified body involvement.
What it means:
-
The relief for certificate backlogs is very direct: notified body review resources will be concentrated on high-risk products, problem products, significant changes and signal alerts.
-
The capabilities companies need to strengthen in return are change control and the “predetermined change control plan”.
3. A more “open” clinical evidence system: more data types, more flexible equivalence and encouragement of in silico methods. The proposal states that:
-
The scope of “clinical data” is broadened, and the conditions for relying on clinical data from equivalent devices become more flexible.
-
Under MDR Article 61, the route of demonstrating safety and performance based solely on non-clinical data is widened; and new methodologies (such as in silico testing) are explicitly promoted.
What it means:
-
This will significantly affect the evidence strategy for “well-established technologies and iterative products”: from “you must do more clinical studies” to “build a more sensible evidence package”.
-
It also means regulators will place more weight on the “quality of the chain of evidence”: what models you use, how they are validated and how you demonstrate comparability and applicability will become audit focal points.
4. Lighter compliance roles and documentation burden: changes to the PRRC, SSCP, PSUR, vigilance timelines and more
Some very “practical” changes include:
-
Simplified PRRC (Person Responsible for Regulatory Compliance) requirements: for SMEs relying on an external PRRC, the requirement to be “permanently and continuously available” would be changed to “available”.
-
Narrower scope for the SSCP (Summary of Safety and Clinical Performance): limited to devices for which “the notified body must review the technical documentation”; and the draft SSCP, as part of the submission, would no longer need separate validation by the notified body.
-
Less frequent PSUR (Periodic Safety Update Report) updates, with notified body review of the PSUR integrated into surveillance activities. For certain serious incidents (not involving a serious public health threat, death or serious deterioration), the reporting deadline would be extended from 15 days to 30 days.
What it means: together these changes point to one trend: freeing companies from “compliance paperwork” while pushing resources towards “real risk management and continuous compliance operations”.
5. Classification rules may be “lowered”: reusable surgical instruments, certain accessories and software are named
The proposal states that some classification rules in MDR Annex VIII will be adjusted and certain devices may move to a lower risk class; examples include reusable surgical instruments, accessories for active implantable devices, and software.
What it means:
-
If the final text is adopted, the depth of notified body involvement, review route and cost structure could be rewritten for some companies.
-
But a word of caution: “down-classification” often comes with “clearer boundaries and conditions”; software products in particular need to watch closely how the final provisions are worded.
6. Innovation and security of supply are institutionalised: in-house devices, breakthrough/orphan devices, shortage reporting and regulatory sandboxes. The proposal makes big moves on access and innovation:
-
More flexible conditions for in-house devices; under the IVDR, the condition that “no equivalent device is available on the market” would be removed, and transfer of in-house devices would be allowed in the interest of patient safety/public health.
-
Criteria and pathways for breakthrough devices and orphan devices are introduced: once “designated” by an expert panel, they can receive priority and rolling review and expert advice.
-
An IT tool is established for supply interruptions/discontinuations of critical devices, with reporting and information exchange via EUDAMED or interoperable systems.
-
A new regulatory sandbox mechanism is added to support the needs of emerging technologies.
7. Notified body fees and system governance: adjustable fees, reductions for SMEs/orphan devices and an “ombudsperson” for disputes. The proposal provides for:
-
Notified body fees: fee reductions for micro and small enterprises and for orphan devices; and empowering the Commission to set fee levels and structures.
-
More “joint” designation and monitoring of notified bodies, abolition of the full re-assessment every five years, and the creation of an “ombudsperson” role at competent authority level for disputes between manufacturers and notified bodies.
.
8. Digitalisation and cybersecurity: eDoC/eIFU, digital labelling, and links with the CRA/ENISA/CSIRTs
Digitalisation is a “burden reduction tool”, while cybersecurity is a “new baseline”. The proposal includes:
-
The EU Declaration of Conformity (DoC) may be electronic; some labelling information may be digital; electronic IFUs (instructions for use) may be provided for near-patient tests; technical documentation may be submitted digitally, and more.
-
Cybersecurity is written explicitly into the GSPR (General Safety and Performance Requirements), and certain cybersecurity incidents must be linked to CSIRTs (Computer Security Incident Response Teams) and ENISA (the EU Agency for Cybersecurity) via mechanisms such as EUDAMED.
Conclusion: the overall impact on the MDR is to “move regulatory resources to the real risk points”.
To sum up the direction of this reform in one sentence: the MDR/IVDR will not become “looser”, but “more precise and more workable” – certificates and audits will no longer run mechanically on fixed cycles but continuously around risk, signals and real-world performance.
More articles:
Understanding the FDA’s Stricter EMC Requirements for Common Sources of Electromagnetic Emissions
How to Avoid Conflict Minerals Risk: A Complete Guide to the CMRT | EVERBIZ Compliance Class
Why Is Amazon Full of “Home Nebulizers”? The Truth Hidden Between FDA Regulations and Amazon Policy
The CE-MID Directive Explained: Don’t Mistake Laboratory Instruments for Legal Metrology Equipment
Key Changes in China’s New Medical Device GMP: Effective 2026 – A Must-See Comparison Table