Medical devices and in-vitro diagnostics

• Regulation (EU) 2017/745 — Medical Devices
• Regulation (EU) 2017/746 — In Vitro Diagnostics
• Regulation (EU) 2019/1020 — market surveillance

Who has to appoint one

Manufacturers established outside the Union placing medical devices or in-vitro diagnostics on the EU market must designate a single authorised representative established in the Union for each device. The representative is named on the label, registered in EUDAMED, and is the entity authorities address. Importers and distributors have verification duties of their own, and a distributor that changes the intended purpose, relabels or repackages becomes a manufacturer.

Thresholds and exemptions

None. Class I devices — many software applications, non-invasive aids, reusable surgical instruments — are in scope with a lighter route, but still require registration, technical documentation, a declaration of conformity and an authorised representative for non-EU manufacturers. Custom-made devices have their own regime and are not exempt.

What must appear on the label

CE marking with the notified body's four-digit number for every class above Class I self-declared. Manufacturer's name and registered place of business. The authorised representative preceded by 'EC REP', with its registered place of business. The Basic UDI-DI and the UDI carrier on the label and packaging. Lot or serial number. Where relevant, the sterile marking, the single-use symbol, the expiry date and the MD or IVD symbol. Instructions for use, in paper unless the electronic instructions Regulation allows otherwise.

Marketplace fields

Marketplaces require the EUDAMED registration and the EC REP details before permitting a listing, and Amazon and eBay actively remove devices without them. Health claims in listings are checked separately: a wellness product that claims to diagnose or treat is treated as an unregistered medical device, which is a far more serious finding than a labelling defect.

Documentation you must hold

Technical documentation under Annexes II and III, including the device description, the intended purpose, the risk management file, verification and validation, and the clinical evaluation with its clinical evaluation report. A post-market surveillance plan and the periodic safety update report for Class IIa and above. A quality management system, in practice ISO 13485. The EU declaration of conformity. The mandate with the authorised representative, which must cover at minimum the tasks listed in Article 11(3). Registration of the manufacturer, the representative and each device in EUDAMED.

Standards and testing

Conformity assessment by a notified body for every class above Class I, with the route depending on classification. Biological evaluation under ISO 10993 for patient-contacting devices, electrical safety under IEC 60601 for active devices, usability under IEC 62366, software life cycle under IEC 62304, sterilisation validation where applicable, and clinical investigation where existing clinical data are insufficient.

Language requirements

Labelling and instructions for use in the language required by each member state where the device is supplied. Most member states require the national language even for devices used only by professionals, and several require it for the implant card and the summary of safety and clinical performance as well.

When it applies

Registration and the mandate must be in place before placing on the market. Vigilance reporting deadlines are short: serious incidents within 15 days of awareness, a serious public health threat within 2 days, and death or unanticipated serious deterioration within 10 days. Field safety corrective actions must be notified before or at the time they are implemented.

How long records are kept

Technical documentation, the declaration of conformity and the mandate for at least ten years after the last device was placed on the market, and fifteen years for implantable devices. The authorised representative must keep a copy of the technical documentation available for the same period, which is one reason the role is heavier than it looks.

What happens if you do not comply

Suspension or withdrawal of the notified body certificate, which stops sales immediately across the Union. Prohibition of making available, recalls and field safety notices. National fines. And distinctively, Article 11(5) makes the authorised representative jointly and severally liable with the manufacturer and the importer for defective devices, so the representative carries product liability exposure, not merely administrative risk.

Who enforces it

National competent authorities for medical devices, notified bodies designated under the Regulations, the Medical Device Coordination Group at EU level, and EUDAMED as the registration and vigilance backbone.

Where the boundary lies

We do not take this role, and the reason is Article 11(5): the representative shares liability for defective devices, which is a fundamentally different exposure from Article 27 GDPR or Article 16 GPSR, where liability for the product stays with the controller or manufacturer. The other decisive boundary is the intended purpose: a step counter is a consumer product, the same hardware presented as detecting arrhythmia is a medical device, usually Class IIa or higher. Software that calculates a dose, interprets an image or supports a diagnosis is a device; software that only stores or displays data usually is not.

Questions we are asked

Our app calculates a medication dose — is it a device?

Almost certainly yes, and under the MDR classification rules software driving or influencing treatment decisions is rarely Class I. That means a notified body, a clinical evaluation and a quality management system.

We market it as a wellness product — does that avoid the regime?

Only if the intended purpose, judged from your claims, labelling and marketing as a whole, really is non-medical. Authorities read the marketing, not the disclaimer, and a 'wellness' label on a diagnostic claim is treated as an unregistered device.

Can our EU distributor be the authorised representative?

It can, but it takes on joint liability for defective devices and the duty to hold the technical documentation. Most distributors decline once they read Article 11(5), and a mandate signed without understanding it is a serious risk for both sides.

Is a US FDA clearance of any use in the EU?

Not directly. The FDA route and the EU conformity assessment differ in classification, clinical evidence expectations and quality system requirements. The underlying test data can often be reused; the clearance itself cannot.