EU MDR Conformity Assessment and Notified Body Selection: Annex IX, X and XI Explained

For most medical devices above Class I, getting a CE mark under the EU MDR means going through a notified body. That is a commercial and technical relationship that can last the lifetime of the product, and the choice is rarely easy: notified bodies differ in scope, capacity, style and price, and the process takes far longer than it did under the old directives. This guide explains which conformity assessment route applies to each class, how notified bodies are designated, how to select one and how to make an application that does not stall.

Routes by class

Class	Typical route	Notified body role
I (basic)	Annex II and III technical documentation, declaration of conformity	None
Is, Im, Ir	Annex IX (Chapter I) or Annex XI, limited to sterility, measuring function or reprocessing aspects	Limited review of those aspects
IIa	Annex IX with sampling of technical documentation, or Annex XI	QMS audit and technical documentation sampling
IIb	Annex IX with assessment of technical documentation for at least one device per generic device group, or Annex X plus XI	QMS audit and technical documentation assessment; extra scrutiny for implantable devices
III	Annex IX with full technical documentation assessment, or Annex X plus XI	As IIb, with clinical evaluation consultation procedure for some devices and expert panel review for certain high-risk devices

The class itself depends on the classification rules in Annex VIII. See device classification under FDA and EU MDR and the overview of EU medical device regulations.

How notified bodies work

Notified bodies are independent organisations designated by a Member State authority and listed in the NANDO database, with a defined scope of codes for devices and procedures. There are on the order of fifty designated under the MDR and IVDR combined. They are assessed on competence, impartiality and resources, and they are subject to continuous oversight, including joint assessments. For you this has three consequences:

• A notified body may have capacity limits and prioritisation rules, and their answers on timing change over time.
• Scope matters: not every notified body can certify every technology, such as active implantables, sterilisation or devices incorporating medicinal substances.
• Expect structured dialogues, documented questions and clock stops. Review times are driven largely by the quality of the documentation you send.

Selecting a notified body

1. Check scope. Match your device and process to the codes in the notified body’s designation.
2. Ask about capacity. How long to application review, to contract, to audit and to certificate for your class? Ask for current figures and how they are managed.
3. Check experience. Ask about similar devices, similar technologies and any relevant standards experience.
4. Review the contract. Look at fees, the handling of changes, unannounced audits, subcontracting, certificate suspension and termination conditions.
5. Consider the global plan. If you need MDSAP, UKCA or other markets, ask whether the notified body can combine audits. See ISO 13485 and MDSAP audit readiness.
6. Talk to peers. Reference calls with manufacturers in your field are more informative than marketing material.
7. Do not apply to several in parallel. The MDR requires you to declare other applications and to inform the notified body about any previous refusal or withdrawal.

Preparing the application

• Actor registration: you need an SRN from EUDAMED before applying.
• QMS: a quality management system that meets Article 10(9) and ISO 13485, with the processes the notified body will audit. See ISO 13485 and QMSR training.
• Technical documentation: structured according to Annexes II and III. See EU MDR technical documentation.
• Clinical evidence: a clinical evaluation plan and report, with a defensible approach to equivalence and a PMCF plan. See clinical evaluation under EU MDR and PMCF.
• Risk management and usability files that link to each other and to the labelling.
• PRRC: a named person responsible for regulatory compliance. See EU MDR economic operators.

After certification

• Surveillance audits are periodic, and unannounced audits can occur.
• Changes to the QMS or to the device must be notified, and some need prior approval. See change control.
• Certificate validity is limited (up to five years), so plan recertification early.
• PMS, PSUR and vigilance data feed the notified body’s review. See post-market surveillance.
• Legacy devices under the MDD have transition deadlines that depend on written agreements with a notified body. Check the current conditions in the EU regulations guide.

Common mistakes

• Choosing a notified body on price without checking scope and capacity.
• Applying with an incomplete QMS or an unfinished clinical evaluation.
• Misclassifying the device and finding out at the technical review.
• Leaving the contract’s change-notification and termination clauses unread.
• Responding slowly to questions, which extends the clock stop.
• Not aligning the technical documentation with what is registered in EUDAMED.

Frequently asked questions

Can I change notified body?

Yes, but it is a managed process involving the outgoing and incoming bodies and a defined handover of certificates and files. Plan it well ahead and read the notified body contract.

What is the difference between Annex IX and Annex XI?

Annex IX is based on a quality management system audit plus assessment of technical documentation. Annex XI is based on production quality assurance or product verification and is used together with a type examination or with the manufacturer’s declaration, depending on class.

How long does certification take?

It varies by class, notified body capacity and the quality of your file. Ask each notified body for current figures and plan for many months, and for implantable and Class III devices, longer.

Do I need a notified body for Class I?

Only for Class Is, Im and Ir, and only for the specific aspects of sterility, measuring function or reprocessing. Basic Class I devices are self-declared.

Notified body scopes, capacity and the rules for application change over time. Confirm the current position on NANDO, with the notified body and with your regulatory advisers.

Related reading

• EU medical device regulations (MDR and IVDR): the full map.
• EUDAMED guide: SRN and device registration.
• IVDR guide: the notified body route for IVDs.
• Regulatory strategy for US and EU market entry: where the CE route fits.

Talk to the AptSkill team

Preparing for a notified body audit or building EU MDR skills? Send us your role and goal.