Five years after its full application, EU MDR 2017/745 is no longer a transition challenge. It is the new standard. And Notified Bodies are running out of patience.
When the EU Medical Device Regulation 2017/745 entered full application in May 2021, the industry braced for disruption. What followed was a period of adjustment, grace periods, and extended transition timelines — most notably under EU Regulation 2023/607, which provided additional runway for certain legacy devices.
That runway is now narrowing fast.Notified Bodies across Europe are tightening their review processes, raising their documentation standards, and rejecting submissions that would have passed scrutiny just two or three years ago. For compliance teams and CROs that have not yet fully adapted to the demands of MDR, the message is unambiguous: the window to get this right is closing.
This article explains what has changed, why Notified Bodies are becoming increasingly demanding, and what the practical consequences are for Medical Device manufacturers and the CROs that support them — along with what the most forward-looking teams are doing to stay ahead.
What MDR 2017/745 Actually Changed
To understand why Notified Bodies are raising the bar, it helps to understand just how fundamentally MDR rewrote the compliance landscape. The regulation introduced six structural changes that collectively represent the most significant overhaul of EU Medical Device legislation in more than two decades.
1. Stronger Clinical Evidence
Under the predecessor Medical Device Directive (MDD), clinical evidence requirements were interpreted with considerable flexibility. Many manufacturers relied on literature reviews of variable quality, equivalence claims that were loosely substantiated, and clinical evaluations that were updated infrequently if at all.MDR closes those doors. Clinical Evaluation Reports (CERs) must now demonstrate clinical safety and performance through a systematic, reproducible, and scientifically rigorous process. The literature review must be comprehensive, methodologically sound, and documented with full traceability. Post-Market Clinical Follow-Up (PMCF) is mandatory for the vast majority of devices — not optional, not a best practice, but a legal requirement.Notified Bodies are now reviewing CERs with the same level of rigour that was previously reserved for pharmaceutical clinical trial submissions. The standard has changed. Many submissions have not.
2. Better Traceability
The introduction of Unique Device Identification (UDI) codes and the European database for Medical Devices (EUDAMED) has created a new layer of compliance obligations that must be managed continuously. Every device placed on the EU market must carry a UDI. Manufacturers must register devices, certificates, and clinical investigations in EUDAMED. The system creates end-to-end traceability across the supply chain — and makes gaps in documentation visible in ways that were previously impossible.
3. Stricter Post-Market Surveillance
Post-market surveillance under MDR is not reactive. It is a proactive, structured, and documented obligation. Manufacturers must maintain a Post-Market Surveillance system, produce Periodic Safety Update Reports (PSURs) for Class IIa, IIb, and III devices, and report serious incidents through EUDAMED. Trend reporting — the systematic analysis of non-serious incidents and expected side effects — is now also required.The practical implication is that compliance does not end at market authorisation. It is a continuous process that demands ongoing investment in data collection, analysis, and documentation.
4. More Oversight of Notified Bodies Themselves
One of the less-discussed aspects of MDR is that Notified Bodies are themselves subject to stricter designation criteria and ongoing monitoring by national competent authorities. The European Commission and national authorities are actively auditing Notified Bodies — and those that are found to be insufficiently rigorous face consequences.This creates a direct incentive for Notified Bodies to raise their standards. A Notified Body that approves a device that later causes patient harm — and that cannot demonstrate it applied appropriate rigour in its review — faces reputational and regulatory consequences of its own. The result is a systematic tightening of review standards across the board.
5. Clearer Operator Responsibilities
MDR introduces a more granular definition of economic operator responsibilities. Manufacturers, authorised representatives, importers, and distributors each have specific, legally binding obligations. The regulation makes clear that the entire supply chain shares responsibility for compliance — and that contractual arrangements between parties must reflect this.
6. The PRRC Requirement
Every manufacturer placing devices on the EU market must now designate at least one Person Responsible for Regulatory Compliance (PRRC). This individual must meet specific qualification requirements and bears personal responsibility for ensuring that devices comply with MDR before they are released to the market. For smaller organisations, this requirement has demanded structural changes that go well beyond a change in job titles.
Why Notified Bodies Are Becoming More Demanding — And What That Means for Your Submissions
The tightening of Notified Body standards is not arbitrary. It is the predictable consequence of several converging forces.
Volume pressure. MDR applications to Notified Bodies grew from 1,661 in 2020 to over 14,500 in 2023. Notified Bodies are processing a vastly larger volume of submissions with finite capacity. Incomplete or poorly structured submissions consume disproportionate reviewer time — creating pressure to reject them early rather than engage in extended back-and-forth.
Regulatory accountability. As noted above, Notified Bodies are themselves under scrutiny. The European Commission's Joint Action on Notified Bodies has made it clear that designation and ongoing monitoring will be rigorous. Notified Bodies that are seen as insufficiently demanding face the risk of losing their designation entirely.
Precedent and case law. As MDR matures, a body of precedent is developing around what constitutes acceptable clinical evidence, acceptable PMCF plans, and acceptable CER methodology. Notified Bodies are applying these standards consistently — and submissions that do not reflect current expectations are being rejected, regardless of whether they might have passed under earlier interpretations.
The consequences of getting it wrong. Under frameworks such as Italy's D.Lgs. 137/2022, non-compliance with MDR can result in fines of up to €140,000 per violation. Across EU member states, enforcement is increasing. A device that reaches the market without adequate clinical substantiation — and that subsequently causes patient harm — exposes the manufacturer, the Notified Body, and potentially the CRO to significant legal and financial liability.
The practical implication for compliance teams and CROs is stark: submissions that do not meet current Notified Body standards are not just being delayed. They are being rejected. And the cost of a rejection — in time, in resources, and in delayed market access — is substantial.
A single rejected CER can set a product launch back by six months or more. For a device with a market opportunity of €5 million per year, that delay has a direct, quantifiable cost. For a CRO whose reputation depends on the quality of its submissions, a pattern of rejections is an existential threat.
The Compliance Gap: A Growing Crisis
The cumulative effect of these changes is a compliance workload that has grown exponentially since 2021 — while the resources available to manage it have not grown at the same pace.The systematic literature review that sits at the heart of every CER is the clearest illustration of the problem.
A comprehensive search across PubMed/MEDLINE and Embase, applying appropriate MeSH terms and Boolean logic, screening thousands of abstracts against inclusion and exclusion criteria, appraising the quality of included studies, and synthesising the evidence into a structured risk-benefit analysis — this process, done properly, can consume 35% or more of the total time invested in a single CER.
At an average of 120 hours per CER, that is 42 hours of research-intensive work per document. Multiply that across a portfolio of devices, or across a CRO's client base, and the scale of the challenge becomes clear.Many organisations have responded by hiring additional regulatory affairs professionals. But the talent market is constrained, the learning curve is steep, and the cost of experienced regulatory professionals is significant. Hiring alone is not a sustainable solution to a structural problem.
What the Most Forward-Looking Teams Are Doing
The compliance teams and CROs that are managing this challenge most effectively share a common characteristic: they are not trying to solve a technology problem with more people. They are using technology to solve a process problem — freeing their people to focus on the judgment-intensive work that genuinely requires human expertise.
The systematic literature review phase of CER production is the clearest example of an area where intelligent automation can deliver immediate, measurable value. The search logic, the database queries, the screening criteria, the evidence appraisal framework — all of these follow structured, reproducible processes that are well-suited to AI-assisted execution.
The documentation structure itself — Annex XIV of MDR 2017/745 — provides a clear, regulatory-mandated template. A platform that natively structures output according to Annex XIV requirements eliminates one of the most common sources of Notified Body feedback: documentation that is technically complete but structurally non-compliant.
And the audit trail — the full traceability of every search, every screening decision, every appraisal judgment — is something that AI-assisted platforms can maintain automatically, without the risk of human error or documentation gaps that manual processes inevitably introduce.
Medea™: Built for This Moment
This is precisely the problem that Medea™ by HubMed was designed to solve.
Medea™ is an AI-powered platform purpose-built for Medical Device compliance teams and CROs navigating the demands of EU MDR 2017/745. It automates the most research-intensive phase of the CER workflow — systematic literature search across PubMed/MEDLINE and Embase, evidence appraisal, risk-benefit analysis, and Annex XIV-structured documentation — delivering output that is audit-ready from the first draft.
The impact is measurable and immediate:
| Metric | Impact |
|---|---|
| Time reduction per CER | Up to 70% on research-intensive phases |
| Hours recovered per report | ~29.4 hours |
| Annual savings (2 CERs/month) | €16,344 net |
| Annual savings (4 CERs/month) | €44,568 net |
| Annual savings (6 CERs/month) | €72,792 net |
Beyond the time and cost savings, Medea™ addresses the quality dimension that matters most to Notified Bodies: structured, traceable, reproducible evidence. Every search, every appraisal decision, every piece of included or excluded literature is documented with a full audit trail — providing the traceability that post-market audits demand and that manual processes struggle to guarantee consistently.Medea™ is available as a cloud-based SaaS platform — no installation required, free trial available — and is already live on the market, with early adopters across both CROs and Medical Device manufacturers.
The Window Is Closing
The transition period under EU 2023/607 has provided some additional runway for certain legacy devices. But that runway is finite — and the direction of travel is clear. Notified Bodies are not going to become less demanding. The regulatory environment is not going to simplify. And the volume of devices requiring CERs will only grow as legacy MDD certificates expire and manufacturers seek new market authorisations.
The teams that invest in smarter, more efficient, more technology-enabled compliance workflows today will have a structural advantage tomorrow — in the speed with which they can bring devices to market, in the quality of the submissions they produce, and in the cost at which they can deliver that quality.
The teams that do not will find themselves facing an increasingly demanding Notified Body review process with the same manual workflows they have always used — and the results will be predictable.The question is not whether to adapt. It is how quickly.
Medea™ is the first solution by HubMed, a Swiss-based technology company building AI-powered platforms for the Medical Device compliance space. Medea™ was launched in Lugano on 21 June 2026.