The EU Commission has published its 170-page proposal on revisions of the Medical Device Regulation (EU) 2017/745 (MDR) and the In Vitro Diagnostic Regulation (EU) 2017/746 (IVDR) on 16 December 2025, which can be accessed here. After MDR and IVDR became applicable in 2021/2022, medical device manufacturers and Notified Bodies continued to struggle with the challenges resulting from the new regulatory framework. The transitional periods under the MDR and IVDR have been extended several times due to ongoing capacity bottlenecks of the Notified Bodies. This has not, however, been sufficient to tackle the remaining challenges.
The EU Commission’s proposal aims to streamline and future-proof the regulatory framework for medical devices and IVDs in order to prevent supply shortages and products being taken from the EU market, while still maintaining a high level of public health protection.
Key aspects of the proposal include:
Measures to simplify regulatory requirements and to reduce administrative burden
- Validity of certificates: The current maximum validity of Notified Body certificates of conformity of five years would be removed so that certificates are generally not limited in time. Notified Bodies would, however, still be entitled to define a maximum validity based on duly justified grounds and would carry out periodic reviews proportionate to the risk class of the respective device.
- Classification rules: The proposal includes changes to the classification rules under the MDR. For example, the proposal suggests that all reusable surgical instruments are classified as Class I, regardless of the body part with which they come into contact. Furthermore, the classification rule for software would be amended, which could lead to significantly more software being classified as Class I.
- PRRC: Requirements regarding the person responsible for regulatory compliance (PRRC) would be alleviated. In particular, the detailed qualification requirements for the PRRC would be removed and micro and small enterprises (less than 50 employees and less than EUR10 million in turnover or balance sheet) would not be required to have their external PRRC “permanently and continuously” available.
- Post-market surveillance: The frequency with which the PSUR has to be updated, would be decreased (for example for Class III or IIb devices from at least annually at present to once in the first year after certification and every two years thereafter). The reporting timeline for serious incidents that are not related to public health threats, death or serious deterioration of health would be expanded from 15 days to 30 days.
- Well-established technology devices: The proposal suggests more proportionate requirements for “well-established technology devices” (defined based on certain criteria such as having a simple, common and stable design and not being associated with safety issues in the past). Such devices would, inter alia, be exempted from the requirements to draw up a summary of safety and clinical performance as well as to have the periodic safety update report (PSUR) reviewed by a notified body.
Measures to support innovation
- In-house devices: The proposal suggests providing more flexible conditions for in-house devices. In particular, in-house IVDs would no longer be subject to the condition that no equivalent device is available on the market, certain documentation requirements would be removed and the transfer of in-house devices to another health institution would be possible in duly justified cases. Furthermore, the proposal intends to expand the scope of in-house devices to cover laboratory-developed tests of central laboratories exclusively used for clinical trials.
- Breakthrough and orphan devices to be prioritized: The proposal introduces criteria for breakthrough devices (devices with a high degree of novelty and a significant clinical impact for a life-threatening or irreversibly debilitating disease) and orphan medical devices (intended for the treatment, diagnosis, or prevention of a disease or condition that affects not more than 12,000 individuals in the Union per year and for which either (i) insufficient alternatives are available or (ii) the device provides a significant clinical benefit). Once designated by an expert panel, breakthrough devices and orphan devices could benefit from prioritized conformity assessment procedures and the option of a rolling review. Orphan devices CE marked under the previous Directives would benefit from additional grandfathering provisions.
- Derogations from conformity assessment procedures: In addition to the current possibility for national competent authorities to authorize the placing on the market of non-CE-marked devices in the interest of public health or patient safety or health, the proposal would entitle the EU Commission to authorize the placing on the market in the event of a public health emergency at Union level and the national competent authorities to authorize deviations from the requirements related to changes to manufacturing, design or intended purpose in the event of serious cross-border health threats, disasters or crises.
- Regulatory sandboxes: The proposal suggests the introduction of regulatory sandboxes (controlled environments for the development, testing, validation and use of innovative products or technologies under regulatory supervision). These sandboxes can be established by the EU Commission or the Member States to address the needs of innovative and emerging health technologies.
Measures to ensure availability of devices
- Critical devices: The proposal suggests establishing an IT tool for information exchange regarding the interruption or discontinuation of supply of critical devices. The European Medicines Agency (EMA) would create a list of critical devices which are subject to such an information obligation.
- International cooperation: The proposal provides for increased international cooperation, for example through the EU Commission participating in international programs such as the Medical Device Single Audit Program (MDSAP) and in bilateral or multilateral reliance mechanisms or reliance programs, potentially providing significant benefits for medical device manufacturers.
Measures to increase predictability and cost-efficiency
- Notified body timelines and fees: The proposal suggests Notified Body fee reductions for micro and small enterprises as well as for orphan devices. In addition, the EU Commission has recently published another draft Implementing Regulation (see here) to create uniform requirements for conformity assessment procedures including cost transparency and maximum timelines.
- Notified body involvement: Overall, the proposal intends to reduce notified body involvement in the conformity assessment procedures for medium-risk devices (e.g., by reducing the assessment of the technical documentation to one representative device of a category of devices/ generic device group for Class IIa/IIb medical devices and Class B/C IVDs). Notified Bodies would be entitled to carry out remote audits instead of on-site audits.
Measures to improve interplay with other EU legislation
- AI Act: Under the proposal, most requirements for high-risk AI systems under Regulation (EU) 2024/1689 (AI Act) would become inapplicable for AI medical devices to avoid overlaps. The EU Commission would, however, be entitled to lay down specific requirements for AI-based devices via implementing or delegated acts, leaving some uncertainties.
- Combined studies: The proposal provides for a single application and coordinated assessment for clinical studies involving medicinal products, medical devices and/or IVDs.
- Cybersecurity: The proposal clarifies the interplay with Regulation (EU) 2024/2847 (Cyber Resilience Act). Currently, cybersecurity-related incidents that do not concern public health or patient safety are not reported, as medical devices are exempted from the scope of the Cyber Resilience Act. According to the proposal, cybersecurity vulnerabilities and severe incidents would have to be reported to the computer security incident response teams (CSIRTs) and to the European Union Agency for Cybersecurity (ENISA). Cybersecurity requirements would become part of the general safety and performance requirements.
Conclusion
The long-awaited proposal by the EU Commission constitutes a crucial step towards a future-proof regulatory framework for medical devices in the EU which maintains the high level of public health protection introduced by MDR/IVDR but avoids an unnecessary regulatory burden for the medical device industry which largely consists of small and medium-sized enterprises.
The proposal will have to pass the EU Parliament and the Council of the EU before it can enter into force. The forthcoming negotiations between the European Parliament and the Council might refine several aspects of the proposal, particularly those relating to classification rules or the interactions with the AI Act. However, since the EU Parliament had already asked the EU Commission to propose “a systematic revision” of MDR/IVDR in a resolution in October 2024, it can be expected that the proposed amendments to the regulatory framework will be generally aligned with the legislators’ expectations.
Manufacturers, Notified Bodies, and health institutions should begin assessing how the proposed amendments may affect their regulatory strategies, including device classification, pathways and timelines for conformity assessment as well as post market surveillance systems.
The EU Commission currently expects the new regulatory framework to be adopted and to become applicable by Q2 2027.
