INSIGHTS: EU MDR Regulation 2017/745
EU MDR 2017/745: What the Scope and
General Provisions Actually Mean for Compliance
General Provisions Actually Mean for Compliance
Regulation (EU) 2017/745 entered into force in May 2017 and became fully applicable in May 2021. By September 2026, 33,175 applications have been submitted to Notified Bodies across the EU, but only 17,549 MDR certificates have been issued. The gap is structural, not temporary. This analysis examines what Articles 1 and 2 of EU MDR actually establish, why the scope and definitions introduced by this regulation have generated compliance challenges that persist years into implementation, and what that evidence means for medical device manufacturers, authorised representatives, and quality leaders still navigating the transition.
15,626
Applications Without Certificates
As of October 2025, 33,175 MDR applications had been submitted to EU Notified Bodies, but only 17,549 certificates issued, leaving over 15,000 applications in the pipeline across 51 active Notified Bodies.
EC 18th Notified Bodies Survey, March 2026
13-18
Months Per Certification Review
The average MDR certification review time per Notified Body. Applications submitted today face completion dates in mid-to-late 2027 at the earliest, well after December 2027 deadlines for Class III and certain Class IIb implantables.
MedTech Europe survey / MedTech Dive
123
Articles and 17 Annexes
EU MDR 2017/745 is a 175-page regulation comprising 123 articles and 17 annexes. Articles 1 and 2, scope and definitions, determine whether every other obligation in the regulation applies to a given product or manufacturer.
EUR-Lex: Regulation (EU) 2017/745
Insight Summary
1
As of October 2025, 15,626 MDR applications remain uncertified across 51 EU Notified Bodies. At 13 to 18 months per review, this backlog cannot be cleared before December 2027 transition deadlines for the highest-risk device classes.
2
Article 1 of EU MDR expanded scope beyond the previous MDD in ways that catch manufacturers unprepared: Annex XVI products without a medical purpose (contact lenses, aesthetic laser equipment) now fall under the full MDR framework despite never previously being regulated as medical devices.
3
Article 2 introduced 71 regulatory definitions. The definition of “manufacturer” now extends to any organisation that reprocesses a single-use device or substantially modifies a device already placed on the market, obligations that historically belonged only to the original equipment manufacturer.
4
The European Commission’s December 2025 Staff Working Document acknowledged systemic implementation failures: Notified Body capacity bottlenecks, high compliance costs for SMEs, duplicated reporting obligations, and uneven uptake of the EUDAMED digital infrastructure.
5
More than half of MDD-certified manufacturers reported portfolio reductions as a direct result of MDR implementation, with low-volume, niche, and legacy products at the highest risk of permanent withdrawal from the EU market.
Key Insight
Articles 1 and 2 of EU MDR are not administrative introductions, they are compliance triggers. Misreading scope determines whether your product requires Notified Body involvement at all; misreading definitions determines who bears manufacturer liability. Both errors are recurring and structurally costly.
The most consequential early-stage compliance error is classifying a product outside MDR scope when it falls within it, or failing to recognise when an organisation’s activities make it a “manufacturer” under Article 2’s expanded definition. The Notified Body backlog makes these errors more damaging: late recognition means late application, and late application means late certification in a system already running years behind deadline.
What the Data Shows
DATA
The European Commission’s 18th Notified Bodies Survey (published March 2026, data through October 2025) shows 33,175 MDR applications submitted but only 17,549 certificates issued, a net gap of 15,626 applications across 51 active Notified Bodies. Certificates grew 18% from the prior survey snapshot, but the rate of issuance remains insufficient to close the gap before transition deadlines. Source: EC 18th Notified Bodies Survey, March 2026
INTERPRETATION
An 18% growth rate in certificates sounds promising. It is not, in context. At 13 to 18 months per review, the 15,626-application backlog represents at minimum 2 to 3 more years of processing at current Notified Body capacity, which means the December 2027 deadline for Class III and certain Class IIb implantables is arithmetically out of reach for manufacturers who have not already been in active review for some time.
WHY IT MATTERS
For compliance leaders, this is not an abstract system-level problem. It is a direct business risk: manufacturers without a valid MDR certificate by their applicable transition deadline cannot legally place the device on the EU market. The data shows this risk is not concentrated in a handful of small companies, the scale of the gap involves thousands of products across all device classes.
DATA
As of April 2022, MedTech Europe survey data covering an estimated 60 to 70% of the EU device market by revenue showed that over half of manufacturers reported portfolio reductions as a direct result of MDR implementation. Out of 25,034 devices on MDD certificates at that time, more than 11,000 had either been removed from the market or already transitioned. Source: PA Consulting / MedTech Europe data
INTERPRETATION
More than half of manufacturers restructuring their EU portfolios confirms that MDR’s scope change, encoded in Articles 1 and 2, is not merely administrative. The cost of compliance for some product lines, especially low-volume niche and legacy devices, exceeds the commercial return of maintaining EU market access. The regulation is actively reshaping which devices remain available in Europe.
WHY IT MATTERS
The EU Commission’s 2025 Economic Operator Survey explicitly flags patient access risks from portfolio withdrawals, particularly for specialised and rare-condition devices where no alternative exists. This is the patient-safety consequence that Articles 1 and 2 scope decisions are now producing at scale.
DATA
The European Commission’s December 2025 Staff Working Document (SWD(2025) 1050) identified four systemic implementation failures in MDR: Notified Body capacity bottlenecks, high compliance costs particularly for SMEs, duplicated reporting obligations (especially PSUR frequency and Notified Body validation), and uneven uptake of EUDAMED digital tools. Source: EC SWD(2025) 1050, December 2025
INTERPRETATION
The Commission’s own working document is a significant admission. It acknowledges that the regulatory architecture established in 2017 has generated structural friction that was not fully anticipated. The identification of PSUR frequency as “disproportionate for stable technologies” suggests further amendment activity is likely, continuing the pattern of Regulations 2023/607 and 2024/1860 extending transition periods and adding new obligations.
WHY IT MATTERS
For compliance leaders, this means the regulatory framework for MDR is not stable. The obligations established in the base regulation are being amended, and will likely continue to be amended, faster than many compliance programmes can absorb. Monitoring the EU Commission’s MDCG guidance and amendment regulations is now a standing compliance function, not a one-time implementation activity.
What Is Driving the Trend: EU MDR 2017/745 Articles 1 and 2 in Detail
The compliance challenges the data reveals are traceable to specific structural decisions made in Articles 1 and 2 of EU MDR 2017/745. Understanding why these provisions generate so much complexity requires reading what they actually say.
Article 1: Scope, Broader Than Its Predecessor in Three Significant Ways
Annex XVI products without a medical purpose
Article 1(2) brings specific groups of products without an intended medical purpose under the full MDR framework. Annex XVI lists the categories: coloured contact lenses, high-intensity electromagnetic radiation equipment for skin or body treatment, equipment for liposuction, invasive laser equipment for non-medical purposes, and others. These products were previously outside any EU medical device regulation. They now require conformity assessment, technical documentation, clinical evaluation, and in many cases Notified Body involvement, the same pathway as a Class IIa or IIb device. Source: EU MDR Article 1(2), Annex XVI
Software as a Medical Device formalised
Article 1 and the accompanying definition in Article 2 formally incorporate Software as a Medical Device (SaMD) into the MDR framework. Under the previous MDD, software classification was handled inconsistently across member states. EU MDR, combined with MDCG 2019-11 guidance on software qualification and classification, creates a unified classification pathway that brings a substantial number of standalone software products into regulatory scope for the first time. For manufacturers of health apps, clinical decision support software, and AI-assisted diagnostic tools, Article 1 scope is the first compliance determination they must make. Source: MDCG 2019-11; EU MDR Article 2(1)
Accessories treated as devices in their own right
Under the MDD, accessories were regulated but with limited specificity. EU MDR Article 1 and the Article 2 definition of “accessory for a medical device” clarifies that accessories are subject to the same conformity assessment requirements as the devices they complement, independently, not automatically via the parent device’s certification. This affects manufacturers whose products are positioned as accessories: they must demonstrate independent compliance rather than relying on the parent device’s CE marking as cover. Source: EU MDR Article 2(2)
Regulation, not Directive: direct enforceability
A structural shift that is not apparent from the article numbers but is significant for compliance: MDR is a Regulation, not a Directive. The MDD required each EU member state to transpose the requirements into national law, creating variation in implementation. EU MDR 2017/745 is directly enforceable in all member states without transposition, creating uniform legal obligations that cannot be softened or varied at national level. Compliance strategies built around member-state-specific flexibility under the MDD require reassessment. Source: Orcanos Academy / EU MDR legal structure
Article 2: 71 Definitions, Three That Generate the Most Compliance Risk
“Manufacturer”, now includes reprocessors and substantial modifiers
Article 2(30) defines “manufacturer” to include any natural or legal person who reprocesses a single-use device for reuse within the EU, or who assembles, packages, processes, repackages, labels, or assigns a purpose to a device in a way that modifies it sufficiently to affect compliance with the original CE marking. This definition pulls healthcare institutions that reprocess single-use devices, a common practice in hospitals managing costs, directly into the manufacturer’s regulatory obligations. They are not simply using a certified device. They are manufacturing one, with all associated technical documentation, QMS, and vigilance reporting obligations. The practical implication for hospitals, compounders, and remanufacturers is substantial. Source: EU MDR Article 2(30), Article 17
“Intended purpose”, now governed by labelling, not manufacturer intent alone
Article 2(12) defines “intended purpose” as the use for which a device is intended according to the data supplied by the manufacturer on the label, in the instructions for use, or in promotional or sales materials. The practical consequence is that a device’s regulatory status can be altered by how it is marketed, not only by how it is engineered. A software product described in promotional material as supporting clinical diagnosis may fall into MDR scope even if the manufacturer intended it as a general-purpose analytics tool. This makes regulatory affairs oversight of marketing and promotional content a compliance function, not merely a sales function. Source: EU MDR Article 2(12)
“Placing on the market”, extends to digital distribution channels
Article 2(28) defines “placing on the market” to include making a device available in the EU for distribution, consumption, or use, including via websites, app stores, and other digital channels directed at EU users. A SaMD developer who distributes a health application through an app store accessible to EU users is placing a device on the EU market under this definition, even if the company has no EU legal entity and no EU distributor. This has significant implications for non-EU manufacturers who have not previously considered themselves subject to EU regulatory requirements. The obligation to appoint an Authorised Representative under Article 11 follows directly from this definition. Source: EU MDR Articles 2(28), 11
What This Means for Compliance Leaders
The scope question must be answered before the QMS question
Many compliance programmes begin with ISO 13485 and quality system preparation. Under EU MDR, the foundational question is whether Article 1 scope applies to the product and whether Article 2 definitions make the organisation a “manufacturer,” “importer,” “distributor,” or “authorised representative.” Getting the scope analysis wrong means either under-investing in compliance (leaving the product without a valid certification pathway) or over-investing (applying full Notified Body requirements to a product that is not a device). Both errors carry commercial consequences.
The Notified Body timeline must drive the programme plan, not the deadline date
Given 13 to 18 months per review and a 15,626-application backlog, waiting for deadline proximity to trigger Notified Body engagement is not a viable risk management strategy. The data implies that manufacturers who are not currently in active review for devices requiring certification by December 2027 may not receive certificates in time even if they submit applications today. Programme planning must begin from the Notified Body’s expected review completion date, working backwards to determine submission deadlines.
Marketing and labelling are compliance documents, not sales materials
The Article 2(12) definition of “intended purpose” makes promotional and marketing content a determinant of regulatory classification. Regulatory affairs must review and approve marketing claims, app store descriptions, website language, and sales materials for any product that is in or near MDR scope, not as a legal review of advertising, but as a classification decision that determines whether a Notified Body is required, which conformity assessment route applies, and what clinical evidence is needed.
Healthcare institutions reprocessing single-use devices are manufacturers under MDR
Hospitals and healthcare institutions that reprocess single-use devices for repeated use are subject to Article 17 of EU MDR and, through the Article 2(30) manufacturer definition, are expected to comply with the same obligations as a device manufacturer, subject to specific derogations in Article 17(2) for health institutions. Compliance programmes in healthcare institutions that include device reprocessing must address technical documentation, clinical evaluation of the reprocessed device, and vigilance reporting, not just procurement and sterilisation procedures.
Practical Implications
Conduct a product-level Article 1 scope review for every product in the portfolio
Every product in or near MDR scope requires a documented scope determination, is it a device, an accessory, an Annex XVI product without a medical purpose, or outside scope entirely? For borderline products, the MDCG Manual on Borderline and Classification (updated April 2026) is the authoritative guidance document. Undocumented scope determinations are not a compliance position, they are an absence of one.
Apply the Article 2 manufacturer definition to all organisations modifying or reprocessing devices
Any organisation that repackages, relabels, reprocesses, or substantially modifies a CE-marked device must determine whether those activities trigger manufacturer status under Article 2(30). If they do, the full manufacturer obligation set applies, not a reduced or simplified version. Legal counsel and regulatory affairs must jointly assess this for distributors, hospitals, and any entity downstream from the original manufacturer that handles the physical device.
Build MDCG guidance monitoring into the compliance calendar
The MDCG guidance library has been updated continuously since 2021. MDCG 2021-24 was revised in April 2026. MDCG 2025-10 on post-market surveillance was published in 2025. Each MDCG publication can affect classification, clinical evaluation, UDI, or PSUR obligations without amending the base regulation. A compliance function that is not tracking MDCG publications is working from an incomplete version of the requirements even if it is current on the regulation text.
Executive Takeaway
Three things compliance and regulatory leaders should act on now
1
If any product requiring Notified Body certification by December 2027 does not yet have a signed application with a Notified Body, the timeline risk is acute. The 13 to 18 month review window means submission today targets mid-to-late 2027 at earliest. Contact a designated Notified Body this quarter, not this year.
2
Article 1 and Article 2 scope and definition reviews should be documented at the product level. A verbal agreement that “this is not a device” or “we are a distributor, not a manufacturer” is not a compliance record. Documented determinations with regulatory affairs sign-off are the starting point of every subsequent compliance decision.
3
The EC’s December 2025 Staff Working Document signals continuing regulatory change. PSUR frequency, EUDAMED obligations, and Notified Body reporting requirements are all areas the Commission identified as candidates for reform. Compliance programmes should be built to absorb changes, not to implement a fixed 2017 text as if it were static law.
Frequently Asked Questions
What does EU MDR 2017/745 Article 1 actually cover?
Article 1 of Regulation (EU) 2017/745 defines the subject matter and scope of the regulation. It establishes that MDR applies to medical devices and accessories for medical devices, software qualifying as a medical device, and certain products without a medical purpose listed in Annex XVI. It also clarifies interactions with other EU legislation, including the pharmaceutical regulation, when a product incorporates both a medicinal product and a device component. Understanding Article 1 is the prerequisite for every downstream compliance decision under MDR.
What types of products are in MDR scope that were not under the MDD?
Three main categories: (1) Annex XVI products without a medical purpose, these include coloured contact lenses, equipment using high-intensity electromagnetic radiation for cosmetic skin treatment, liposuction equipment, and invasive aesthetic laser devices; (2) Software as a Medical Device formalised under a uniform EU framework rather than member-state discretion; and (3) accessories for devices previously regulated under AIMDD, they now require independent conformity assessment rather than relying on the parent device’s certification. Devices previously classified as Class I that have been reclassified into higher risk classes under MDR’s more detailed classification rules in Annex VIII also require Notified Body involvement they previously did not.
When does a hospital or healthcare institution become a “manufacturer” under EU MDR?
Under Article 2(30) and Article 17 of EU MDR, a health institution becomes subject to manufacturer-equivalent obligations when it reprocesses a single-use device for reuse within the institution. Article 17(2) provides specific derogations for health institutions reprocessing within the institution’s own use, they are not required to appoint an Authorised Representative or apply for CE marking, but they must comply with equivalent standards for quality management, technical documentation, and device traceability. The key threshold is institutional reprocessing for reuse versus reprocessing by a commercial entity for distribution.
How does EU MDR define “intended purpose” and why does it matter for classification?
Article 2(12) defines intended purpose based on what the manufacturer’s labelling, instructions for use, promotional materials, and sales materials state, not the manufacturer’s internal intent. A product described in marketing materials as assisting clinical diagnosis is in MDR scope regardless of how the engineering team would characterise it internally. This definition means classification is a function of what is communicated publicly, not what is designed. Regulatory affairs review of all external communications is therefore a classification risk management activity, not merely a legal review.
What are the current MDR transition deadlines?
As amended by Regulations (EU) 2023/607 and 2024/1860, the principal deadlines are: Class III custom-made devices, May 26, 2026; Class III devices and Class IIb implantables (excluding sutures, staples, dental fillings, braces, tooth crowns, and screws, wedges, plates, wires, pins, clips, and connectors), December 31, 2027; all other Class IIb, Class IIa, Class Im/Is/Ir devices, December 31, 2028. Legacy devices remaining on the market must meet specific conditions including a valid QMS and an active Notified Body engagement. Source: LFH Regulatory / EC Regulation 2023/607 and 2024/1860
What does the Notified Body capacity gap mean for a manufacturer applying for certification today?
The 18th Notified Bodies Survey (March 2026) shows 15,626 applications pending across 51 active Notified Bodies, with average review times of 13 to 18 months. A manufacturer submitting a complete application today faces a realistic certification window of mid-to-late 2027 at the earliest. For devices with December 2027 deadlines, this leaves virtually no margin for incomplete submissions, requests for additional information, or appeals. The practical implication is that applications should already be submitted and complete, and that any application not yet submitted for a December 2027 device is at significant risk of missing the deadline.
Where can manufacturers find the official EU MDR text and MDCG guidance?
The official text of Regulation (EU) 2017/745 is published on EUR-Lex. All MDCG guidance documents, including classification, clinical evaluation, UDI, post-market surveillance, and software guidance, are published by the European Commission at health.ec.europa.eu. The EUDAMED database for device registration is at eudamed.ec.europa.eu. The NANDO database lists all designated EU Notified Bodies and their scope of designation. These are the four primary reference points for any MDR compliance programme.
Sources
Government and Regulatory Sources
- Regulation (EU) 2017/745 of the European Parliament and of the Council on medical devices (EUR-Lex): primary legislative text. Articles 1 (scope), 2 (definitions), 11 (authorised representative), 15 (person responsible for regulatory compliance), 17 (reprocessing of single-use devices), 27 (UDI), and Annex XVI (products without medical purpose) cited throughout.
- European Commission SWD(2025) 1050 final, December 2025: Commission Staff Working Document identifying four systemic MDR implementation failures: Notified Body capacity bottlenecks, SME compliance costs, duplicated reporting obligations, and uneven EUDAMED uptake.
- European Commission: MDR/IVDR Implementation, MDCG Guidance and Notified Bodies Surveys: source for EC 18th Notified Bodies Survey (published March 2026, data through October 2025) cited for application and certificate volume statistics.
- Regulation (EU) 2023/607 and Regulation (EU) 2024/1860: amending regulations extending MDR/IVDR transitional provisions and introducing supply-interruption notification requirements for manufacturers.
Research and Industry Sources
- MedDeviceGuide: EU MDR Notified Body Capacity Crisis 2026-2027 (May 2026): analysis of EC 18th Notified Bodies Survey data, 33,175 applications, 17,549 certificates, 15,626 gap, 18% certificate growth; 13 to 18 month review timeline.
- MedTech Dive: Notified Bodies Have Not Yet Issued MDR Certificates for 85% of Legacy Devices (2022): MedTech Europe survey data covering 60 to 70% of EU market by revenue; 30% of smaller businesses without access to MDR-designated Notified Bodies; 13 to 18 month certification timeline.
- PA Consulting: We’re Heading Toward a Bottleneck for EU MDR Approvals (2024): MedTech Europe portfolio reduction data, over half of manufacturers reporting portfolio reductions; 25,034 MDD-certificate devices in April 2022, over 11,000 withdrawn or remediated.
- Pure Global: EU Commission 2025 Economic Operator Survey on Medical Device Availability: survey findings on certification delays, niche device withdrawal risks, and supply continuity concerns.
Related VelSafe Articles
Insights
MAPD Disenrollment: What Plans Most Often Get Wrong
Evidence-based analysis of CMS compliance patterns for Medicare Advantage organisations, a parallel regulatory evidence framework for compliance leaders in regulated industries.
Guides
MAPD Enrollment: What CMS Requires and When to Enrol
A compliance reference covering election period requirements and documentation standards for plan sponsors, useful parallel reading for those managing both EU MDR and US regulatory frameworks.
Insights
VelSafe Insights: Regulatory and Compliance Analysis
Evidence-led analysis of regulatory trends, enforcement patterns, and compliance implications across healthcare, safety, and regulated industry sectors.
EU MDR COMPLIANCE INSIGHT LIBRARY
Navigating EU MDR 2017/745?
Explore VelSafe’s regulatory compliance insight library for evidence-based analysis of EU MDR scope, transition deadlines, Notified Body strategy, and MDCG guidance updates.
Explore All Insights
