Changing a CE-Marked Medical Device: What Manufacturers Need to Check
MDR/IVDR change control, legacy devices, new notified-body timelines and an FDA comparison
9/28/20265 min read
MDR/IVDR change control, legacy devices, new notified-body timelines and an FDA comparison
A software update, a replacement component or a revised intended purpose can have very different regulatory consequences.
A change does not automatically require a new certification process. However, an existing CE marking does not remove the manufacturer’s responsibility to assess whether the modified device remains compliant. Change management is explicitly part of the quality-system requirements under MDR and IVDR.
The practical question is: What needs to be assessed, documented and approved before the changed product is released?
1. Start with the device’s regulatory status
First check whether the device is still marketed under the transitional provisions for a legacy device.
The phrase “significant change” is not one universal test for every CE-marked device. The MDCG legacy-device guidance addresses continued eligibility for transitional arrangements. Devices already conforming to MDR/IVDR follow the applicable change-control and conformity-assessment provisions.
Sources:
MDCG 2020-3 Rev.1: MDR legacy-device changes
MDCG 2022-6: IVDR legacy-device changes
2. Class I and Class A still need change control
Ordinary MDR Class I devices and non-sterile IVDR Class A devices generally do not require notified-body involvement. Their manufacturers nevertheless remain responsible for assessing changes and maintaining conformity.
Class I devices supplied sterile, with a measuring function, or qualifying as reusable surgical instruments, and sterile Class A IVDs, involve a notified body for specified aspects.
My recommended change assessment covers four questions:
Intended purpose and classification:
Does the change affect claims, intended users, patient populations, diagnostic outputs or the applicable classification rules?Safety and evidence:
What changes to risk management, clinical or performance evaluation, cybersecurity, usability, and verification or validation are needed?Manufacturing and suppliers:
Does a material, component, supplier or process change affect specifications, biocompatibility, sterility or performance?Documentation and identification:
Do the technical documentation, instructions, Declaration of Conformity, UDI identifiers, EUDAMED records or post-market plans need updating?
Not every change requires every test to be repeated. Document what remains applicable, what needs additional evidence and why. Also check whether the modification changes the device’s classification and therefore its conformity-assessment route.
For software, calling an update a “bug fix” or “security patch” does not answer these questions. Assess its actual effects on the device and its intended use.
Sources:
MDR: Article 10, Annexes II, VI and VIII
https://eur-lex.europa.eu/eli/reg/2017/745
IVDR: Article 10, Annexes II, VI and VIII
https://eur-lex.europa.eu/eli/reg/2017/746
3. When should the notified body be involved?
Where a notified body is involved, review both the applicable conformity-assessment route and its agreed change-notification procedure.
Under Annex IX Section 2.4 of both Regulations, manufacturers notify planned substantial changes to the approved QMS or its device range.
Changes potentially affecting the safety, performance or prescribed conditions of use of a device covered by an EU technical documentation assessment certificate require approval under MDR Annex IX Section 4.10 or IVDR Annex IX Section 4.11. The notified body determines whether a certificate supplement or a new conformity assessment is needed. Other assessment routes have their corresponding change provisions.
Not every modification needs a new certificate. Equally, internal approval cannot replace notified-body approval where it is required.
Sources:
MDR: Annexes VII, IX–XI
https://eur-lex.europa.eu/eli/reg/2017/745
IVDR: Annexes VII, IX–XI
https://eur-lex.europa.eu/eli/reg/2017/746
4. Can legacy devices still exist in 2026?
Yes. Extended transition periods remain available for eligible devices that continue to satisfy the conditions.
They are conditional deadlines in the referred regulations, not blanket extensions for every previously CE-marked device.
These deadlines concern placing devices on the market or putting them into service under the transitional provisions. They are not general expiry dates for the continued use of devices already lawfully put into service.
Conditions include continued compliance with the applicable Directive, no significant changes in design or intended purpose, no unacceptable risk, and meeting the relevant QMS, notified-body application and written-agreement deadlines.
Ordinary (not legacy) Class I devices remaining self-declared under MDR and non-sterile Class A IVDs do not benefit from these extensions. For new placing on the market, they have needed MDR compliance since 26 May 2021 or IVDR compliance since 26 May 2022, respectively. Conversely, some former MDD Class I software requiring a notified body under MDR can qualify for transition if all conditions are met.
For legacy-device changes, use MDCG 2020-3 Rev.1 for MDR and MDCG 2022-6 for IVDR. A significant change can prevent the modified version from continuing under the transitional route. These guidance documents do not replace the change-assessment provisions for devices already conforming to MDR/IVDR.
Sources:
Regulation (EU) 2023/607: MDR transition extensions
https://eur-lex.europa.eu/eli/reg/2023/607/oj/eng
IVDR: Article 110
https://eur-lex.europa.eu/eli/reg/2017/746
Commission explanation of IVDR transitional provisions
https://health.ec.europa.eu/medical-devices-vitro-diagnostics/transitional-provisions_en
5. New notified-body timelines: Regulation (EU) 2026/977
Commission Implementing Regulation (EU) 2026/977 entered into force on 25 May 2026 and generally applies from 25 February 2027. It also addresses quotations, cost and timeline monitoring, and re-certification.
Article 2(3) sets maximum timelines for specified changes to certified QMSs/device ranges and approved devices:
These are phase-specific limits, not an unconditional end-to-end turnaround guarantee.
Article 8(1) excludes procedures with written agreements signed before 25 February 2027 from Articles 1–3. Check the agreement for the relevant assessment procedure.
Article 3 permits defined clock stops for manufacturer responses and external consultations. A change requiring a new conformity-assessment procedure follows Article 2(2) instead.
For project planning, record the complete-documentation date, agreed timetable, information requests and clock stops. Notified-body silence is not a release authorisation.
For change assessments, interruptions for manufacturer responses are limited to five in total across the initial review and additional assessment phases. The notified body shall agree the duration of each interruption with the manufacturer and confirm it in writing.
Source:
Regulation (EU) 2026/977: particularly Articles 2, 3, 8 and 9
https://eur-lex.europa.eu/eli/reg_impl/2026/977/oj/eng
6. FDA comparison: does the change require a new 510(k)?
For a US device subject to 510(k), a new submission is required when a change could significantly affect safety or effectiveness, or represents a major change in intended use. When a new 510(k) is required, FDA clearance is needed before marketing the modified device.
FDA provides separate guidance for general device changes and software changes. The manufacturer’s US change assessment may lead to a different regulatory conclusion from its EU assessment.
Where no new submission is needed, retain the documented rationale and supporting evidence. For 510(k)-exempt Class I or II devices, check whether the modified device remains within the exemption’s limitations. Exemption is not unrestricted permission to modify the product.
Sources:
FDA: Deciding When to Submit a 510(k) for a Change to an Existing Device
FDA: Deciding When to Submit a 510(k) for a Software Change to an Existing Device
FDA: Class I and Class II Device Exemptions
One controlled change assessment, with market-specific conclusions
My recommendation is to document the proposed change for each affected device or device family, then record separate EU and US conclusions where relevant.
Connect the decision to the affected requirements, risk assessment, evidence, approvals, identifiers and release plan. Distinguish changes for future production from updates to devices already in use. Field corrections may also require a separate vigilance assessment.
“No new submission required” is a conclusion to support, not a reason to skip change control.
Need help assessing a product change, notified-body notification or its EU and US regulatory consequences?
Quality and Regulatory Consulting
Expert services in medical device regulation and quality compliance.
contact information
Karkinen Consulting Oy, Helsinki, Finland
Business ID: 3103786-9
info@karkinen.com
NATO NCAGE code A10CG
© 2026. All rights reserved.
