EU Class III Medical Device Registration: Requirements, Timeline and Notified Body Process

Class III is the highest-risk tier under the EU Medical Device Regulation 2017/745 (MDR), in force since 26 May 2021. There is no self-certification and no shortcut: every Class III device must pass a notified body conformity assessment before it can bear the CE mark and be placed on the EU market. This guide walks through the full route — classification, quality system, clinical evidence, the notified body process, realistic timelines, and what happens after certification.

This is planning intelligence, not legal or regulatory advice. It summarizes MDR articles and annexes, MDCG guidance, and European Commission data as of September 2026. Timelines and costs vary by device and notified body — confirm every detail with your notified body and qualified regulatory counsel before committing a calendar or a budget. Nothing here guarantees certification.

First, the vocabulary: the EU does not “register” devices like the FDA

Under the MDR there is no premarket “registration” application to a central agency. Market access comes from CE marking after a successful conformity assessment, plus registration of the economic operator and the device in EUDAMED, the European database on medical devices. When people say “EU Class III registration,” they mean the full CE-marking route described below.

What counts as Class III (MDR Annex VIII)

Classification follows 22 rules in Annex VIII. The manufacturer makes the classification call, and the notified body validates it — getting the class wrong is one of the most common reasons assessments stall. The rules that most often land devices in Class III:

Edge cases exist — for example, certain screws, plates, wedges, and instruments used with the spinal column are carved out of Rule 8. Treat the table as orientation; the Annex VIII rule text and your notified body have the final word.

The conformity assessment route: Annex IX first

Article 52 of the MDR fixes the route by class, and for Class III a notified body is mandatory in every case. The standard route is Annex IX: assessment of the full quality management system plus assessment of the technical documentation for every device — not a sample. The legal alternative is Annex X (EU type-examination) combined with Annex XI (product conformity verification or production quality assurance). In practice, most Class III manufacturers go through Annex IX.

• The full quality management system: design controls, production, suppliers, and post-market surveillance
• The technical documentation for each device — every device, not a representative sample (Annex II and III)
• The clinical evaluation and the clinical data behind it
• Surveillance including unannounced audits at the manufacturer and critical suppliers

Step 1 — Quality management system (Article 10, ISO 13485)

Article 10(9) requires a quality management system proportionate to the risk class and device type. Under Annex IX the notified body audits that QMS in depth — typically anchored on ISO 13485, which as a harmonized standard gives presumption of conformity with the corresponding MDR requirements. A mature, already-certified QMS shortens the assessment; building one from scratch is usually a multi-month project of its own, so start it before the technical file is finished.

Step 2 — Technical documentation and the GSPR (Annex I, II, III)

Annex II and III define the technical documentation: device description and variants, labeling and instructions for use, design and manufacturing information, a General Safety and Performance Requirements (GSPR) checklist mapping every applicable requirement in Annex I to evidence, benefit-risk analysis, verification and validation data, and the clinical evaluation. For Class III the notified body reviews this file per device — depth, consistency, and traceability decide how many question rounds you go through, and question rounds decide the timeline.

Step 3 — Clinical evidence: evaluation, and usually an investigation

Article 61 and Annex XIV require a clinical evaluation for every device. For implantable devices and Class III devices the default is stronger: a premarket clinical investigation is expected unless a narrow exception applies — for example, a modification of the manufacturer's own already-marketed device that does not adversely change the benefit-risk profile, or demonstrated equivalence to a device already on the market where the manufacturer has full access to that device's technical documentation (Article 61(4)–(6)). Equivalence claims for Class III and implantable devices face strict conditions, so most first-time Class III devices run their own investigation.

The clinical evaluation report (CER), the investigation plan, and the post-market clinical follow-up (PMCF) plan all sit inside the technical documentation the notified body assesses — clinical evidence is not a side document, it is the core of the file.

The extra layer: expert-panel scrutiny (Article 54)

Implantable Class III devices face one more gate that lower classes do not. Under Article 54, the notified body must submit its clinical evaluation assessment report to an independent EU expert panel — the Clinical Evaluation Consultation Procedure (CECP). The panel issues a scientific opinion that the notified body must duly consider before granting the certificate (Annex IX, Section 5.1). The same applies to Class IIb active devices intended to administer or remove medicinal products. MDCG 2019-3 exempts certificate renewals and modifications that do not adversely affect the benefit-risk ratio — but a first certification of an implantable Class III device should budget time for this step.

Step 4 — Choose the notified body and run the assessment

Only designated notified bodies can certify Class III devices, and designation is scoped by device codes — a body must be designated for your device type. The European Commission reported 51 designated bodies in February 2025 handling roughly 28,500 applications, with about 43% certified. Choose on scope coverage, experience with your device type, and honest timelines — not on price alone. The sequence is: application and contract, QMS audit (often staged), technical documentation review with question rounds, expert-panel consultation where applicable, then the certification decision.

How long does it take?

The MDR sets no statutory clock for the assessment itself, so treat every figure below as an industry estimate, not a promise. European Commission data from February 2025 put the average certification process at 13–18 months per application; industry guides commonly cite 12–18 months end to end for Class III, with the notified body assessment phase itself running about 6–12 months depending on file quality and question rounds.

The legacy-device transition adds urgency for recertifications: under the current transition rules, Class III devices covered by old MDD/AIMDD certificates must complete MDR certification by 31 December 2027. Demand on notified bodies rises as that date approaches, so late applications face longer queues.

What does it cost?

There are no official or statutory fees for MDR certification — unlike some national registration systems, the EU publishes no fee schedule. Notified bodies quote commercially based on audit days, manufacturing sites, device complexity, and technical documentation volume. Treat any single number you see online as anecdote: get written quotes from two or three bodies designated for your scope, and budget for question rounds and surveillance audits, not just the initial certificate.

After the certificate: EUDAMED, UDI, and post-market duties

• Certificate validity: up to five years (Article 56), with ongoing surveillance audits — certification is the start of oversight, not the end
• EUDAMED: register as an economic operator and register the device; certificates are recorded there (Articles 27, 31, 33)
• UDI: assign the device identifier and carry it on the label (Article 27)
• Summary of safety and clinical performance (SSCP): mandatory for implantable and Class III devices, made public via EUDAMED (Article 32)
• Periodic safety update report (PSUR): at least annually for Class III and implantable devices, with notified body evaluation (Article 86)
• Implant card for patients receiving implantable devices (Article 18)
• Vigilance: incident and field safety corrective action reporting to the competent authorities
• A person responsible for regulatory compliance (PRRC) inside the organization (Article 15)
• Non-EU manufacturers: appoint an EU authorized representative established in the Union (Article 11)

Do I need a clinical trial for every Class III device?

Not always a new trial, but clinical data is mandatory and a premarket clinical investigation is the default for implantable and Class III devices. The exceptions are narrow — own-device modifications without benefit-risk change, or strict equivalence with full technical documentation access (Article 61). Assume you need an investigation until a qualified evaluator tells you otherwise.

Can I self-certify a Class III device?

No. Article 52 requires notified body involvement for every Class III device. Self-declaration exists only for Class I devices without special characteristics.

How long does the CE certificate last?

Up to five years (Article 56), renewable, with surveillance audits and annual PSUR review in between. Letting post-market duties slip is the most common way to lose a certificate.

Readiness checklist before you approach a notified body

Where does GHMAP's pathway page fit in?

For the structured pathway view of this route — regulator, conformity route, and document logic for the EU's highest-risk class — see the EU Class III regulatory pathway page on ghmap.io.