Regulation of medical devices and diagnostics in Europe

Translation: Original published in Finnish on 9/18/2025 at 8:13 am EEST.

The EU is the world's second largest market for medical devices after the United States. The regulation of medical devices and in vitro diagnostics (IVD) differs somewhat from that in the United States. In this article, we will go through the basics of EU regulation from an investor's perspective. Regulatory policies and processes play a crucial role in the duration of the marketing authorization process, the risks involved, and the costs and timeline for market entry. 

Source: Inderes

NB = Notified Body; MDR = Medical Device Regulation; IVDR = In Vitro Device Regulation

CE marking required for selling products in the EU

Before a medical device or IVD product can be sold in Europe, it must have a CE marking. An IVD device is a medical device used to handle or analyze samples taken from humans. The CE marking proves that the product meets the EU's strict safety, quality, and performance requirements. The manufacturer must clearly indicate the intended use of the product. Based on this, the product is placed in a risk class (see below for more information on risk classes). In addition to the EU, several other international markets also accept the CE marking.

All medical devices and IVD products must meet the EU's general safety and performance requirements (GSPR). These rules cover, for example, biocompatibility, electrical and mechanical safety, clinical or performance-related evidence, as well as clear labeling and user instructions.

A manufacturer seeking CE marking must prepare a technical file demonstrating how the device meets all requirements. For simple devices, this may be brief, but for complex products such as implants, it may include thousands of pages of information, test reports, and clinical study results.

All but the lowest-risk devices must be inspected by an independent certifier, i.e., a notified body. Notified bodies are inspection bodies appointed by EU member states that assess product compliance in cooperation with the manufacturer. The notified body audits the company's quality system (how the devices are designed and manufactured) and inspects the technical files. For devices in the highest risk category, the notified body may require clinical evaluations.

Classification of medical devices

In Europe, every medical device must first be classified into a risk category before it can be placed on the market. The Medical Device Regulation (MDR) divides devices into four risk classes (I, IIa, IIb, and III). The risk class determines how thoroughly the product is assessed, how long the approval process may take, and how expensive the process will be. Higher risk classes often mean longer market entry times and higher process costs. On the other hand, once a high-risk device has been approved, it may be more difficult for competitors to enter the market.

Class I (low risk): Products that pose only minor risks. Often, the manufacturer can provide its own declaration of conformity unless the product is sterile (e.g., surgical gloves), has a measuring function (e.g., a blood pressure monitor), or is a reusable surgical instrument.

Class IIa (medium risk): Devices that may cause harm, for example due to malfunction. Class IIa devices require assessment by a notified body. Example devices: Dental fixtures, hearing aids, infusion pumps.

Class IIb (high risk): Devices that maintain vital functions or are used in critical care situations. Require more extensive technical documentation and assessment by a notified body. Example devices: Ventilators, extended-wear contact lenses, imaging devices.

Class III (highest risk): Implantable or life-sustaining devices. Assessed most strictly. The requirements for clinical studies may be on par with those for drug development. Example devices: Pacemakers, prosthetic heart valves, hip and knee replacements, breast implants.

Classification of in vitro diagnostic devices

IVD devices are covered by a separate four-level system in accordance with the In Vitro Diagnostic Regulation (IVDR):

Class A (low risk): Basic laboratory equipment and reagents. Manufacturers can usually certify these products themselves. Example devices: Sample tubes, buffer solutions.

Class B (medium risk): Routine tests with limited risk. Example devices: Pregnancy tests, urine strips.

Class C (high risk): Tests that inform important treatment decisions. Example devices: Genetic tests for cancer, blood glucose meters for diabetics.

Class D (highest risk): Tests for detecting life-threatening infectious diseases, where an incorrect result could be fatal. Require the most stringent assessment and external laboratory verification. Example devices: Blood screening for HIV, hepatitis tests, COVID-19 PCR tests.

MDR and IVDR regulations have brought improvements but also slowed down CE marking processes

The EU's new regulations for medical devices (Medical Device Regulation, MDR) and IVD devices (In Vitro Diagnostics Regulation, IVDR) aim to fix the shortcomings of the previous regulations and promote patient safety and transparency (source). The MDR took effect in May 2021, and the IVDR took effect in May 2022. The transition to the new regulations has been slow. The main reason for this has been a bottleneck in processing applications due to the small number of notified bodies. The transition period for implementing the new regulations has been extended for both the MDR and the IVDR. For instance, the transition period for high-risk MDR devices extends to the end of 2027 and for low/medium-risk devices to the end of 2028.

The MDR/IVDR regulations require stronger clinical and/or performance evidence than previous regulations. For manufacturers seeking CE marking, this increases the cost of the process, raises the bar for obtaining CE marking, and extends the duration of the process.

As a result of the regulations, old, low-margin products may also disappear from the market altogether if manufacturers do not consider the MDR/IVDR processes worthwhile in relation to the benefits. On average, timelines for bringing products to market have lengthened since the regulations took effect. On the other hand, companies that have started the process early may gain a competitive advantage and enter the market ahead of their competitors.

Post-market surveillance after CE marking

Even after approval, compliance must continue. Post-marketing surveillance and periodic safety update reports (PSURs) are mandatory. Any potential problems and safety issues must be reported to the authorities as well.

The UDI (Unique Device Identification) system enables product traceability once commercialization has begun. Device information can also be found in the EUDAMED (European Database on Medical Devices) database, which increases transparency. Consequently, these systems make it easier for competitors, investors, and authorities to identify any violations. Starting in 2024, companies must report interruptions of supply to the authorities, which could expose vulnerabilities in the supply chain.

Previously published articles in the series:

Clinical phases of drug development

Probabilities of success in drug development

Regulation of drug development

M&A and licensing agreements in drug development

Classification of medical devices and regulatory processes in the United States