Selling medical devices in the EU; MDR, IVDR, importer duties, PRRC, EUDAMED

The structural difference from the rest of this site is that the MDR is not a ‘place it on the market and keep a file’ regime. It is a lifecycle regime: a quality management system under Article 10(9), a clinical evaluation that has to be updated, a post-market surveillance plan, periodic safety update reports for class IIa and above, and vigilance reporting of serious incidents and field safety corrective actions.

That has a commercial consequence people underestimate when they start importing devices as a sideline. The obligations do not end at the sale, they run for as long as the device is on the market and for years afterwards, and they require named, qualified people. If nobody in your organisation can hold that, the honest options are to distribute rather than import, or to buy the role in.

Two traps sit in the articles either side of 13. Article 16 turns you into the manufacturer, with all of the manufacturer’s obligations, if you place a device on the market under your own name or trade mark, change the intended purpose, or modify a device already on the market in a way that can affect compliance. Relabelling and repackaging are allowed under conditions, but they require a quality management system covering that activity, certified by a notified body, and 28 days’ notice to the manufacturer and the authority.

The other is that verification means verification. If you have reason to believe a device is not in conformity you may not place it on the market, and you must inform the manufacturer, the authorised representative and, where the device presents a serious risk, your competent authority. Importers also have to keep a copy of the declaration of conformity available and, on request, be able to produce it. An importer who has never seen the technical file is not doing the job Article 13 describes.

The joint and several liability in Article 11(5) is why this role is priced the way it is, and why the cheapest offer is rarely the one to take. It also explains the mandate conditions: the authorised representative can terminate the mandate where the manufacturer acts contrary to his obligations, and must inform the competent authority and the notified body when he does. A representative who has never asked you a difficult question is a representative who is not reading the file.

Do not confuse this role with the GPSR economic operator or with an importer. The authorised representative acts for the manufacturer and cannot be the same entity as the importer in the way people often assume, because the two roles carry different and partly conflicting duties. The mandate must also require the representative to have permanently and continuously at his disposal a person responsible for regulatory compliance.

What the PRRC is actually responsible for is listed in Article 15(3): that conformity of devices is appropriately checked before release; that the technical documentation and the declaration of conformity are drawn up and kept up to date; that post-market surveillance obligations are met; that vigilance reporting is done; and, for investigational devices, that the required statement is issued.

Two practical points. The person must not be disadvantaged within the organisation for properly doing that job; that is in the Regulation itself, and it is there because the role is expected to say no. And an importer or distributor who becomes a manufacturer under Article 16 acquires the PRRC requirement with it. If you are a pure importer under Article 13, the Regulation does not require you to have a PRRC, but the competence has to exist somewhere for you to perform the Article 13 verification honestly.

Classification is the decision that fixes the cost of everything downstream, and it is made by the manufacturer, not granted by anyone. Where the manufacturer and the notified body disagree, the matter goes to the competent authority of the member state where the manufacturer or the authorised representative is established.

The IVDR is where the change bit hardest. Under the old directive the large majority of in vitro diagnostics were self-certified; under the IVDR the large majority need a notified body. That single change is the reason for the extended transition periods and for the shortage of notified-body capacity that shaped the last few years. If you are importing an IVD that has a CE mark from before the IVDR, check what it is certified against before you assume it can still be placed on the market.

This is the regime most of the market is actually running on, and it is conditional, which is the part importers miss. The extension is not automatic by class: if the manufacturer did not apply to a notified body and sign an agreement by the dates above, the device fell out of the transition and cannot be placed on the market at all. Ask the manufacturer for evidence of the application and the signed agreement, not for a reassurance.

‘No significant change in design or intended purpose’ is the second condition, and it is interpreted narrowly; the Commission has published guidance on what counts. Removing the sell-off deadline means devices lawfully placed on the market before the transition ends may continue to be made available and put into service afterwards, which is good news for stock but does not extend the date by which the new certificate must exist.

It is often said flatly that the UDI must be registered in EUDAMED, as though the database had been fully mandatory all along. It has not been: EUDAMED was built and made available module by module, and Regulation (EU) 2024/1860 changed the MDR and IVDR so that each module becomes mandatory six months after the Commission publishes a notice that it is functional, rather than waiting for the whole system.

The issuing entities designated by the Commission are GS1, HIBCC, ICCBBA and IFA; you obtain the identifiers from one of them, and the choice is a data decision you live with. The manufacturer assigns the UDI and keeps a list of all UDIs assigned; the importer has to verify that one has been assigned where required, which is one of the four checks in Article 13.

What that means concretely for an importer: you register as an economic operator, obtain a single registration number (SRN) and keep your entry current. The SRN is what a manufacturer or authorised representative will ask you for, and what an authority uses to find you. Registration is validated by a competent authority, so it is not instant; start it before you need it.

Two things to keep straight. Registering in EUDAMED does not make a device compliant and is not a substitute for any national registration a member state still requires during the transition; several member states run their own device registers and they have not all switched off. And the data you enter is largely public, which is a reason to get the device descriptions right the first time.