Regulation · EU · Reg. 2017/745 & 2017/746
MDR & IVDR
The regimes that decide whether medical AI reaches a patient. Software with a medical purpose is a medical device.
- Status
- In force
- MDR since
- 26 May 2021
- IVDR since
- 26 May 2022
- AI Act integration
- 2 Aug 2028
In brief
When Software Becomes a Medical Device
If software is intended for diagnosis, prevention, monitoring, prediction, or treatment, it is a medical device under the MDR, or an in-vitro diagnostic device under the IVDR, and it must be classified by risk, backed by clinical or performance evidence, and CE-marked before it goes to market. Most clinical AI falls in a class that requires a notified body to review it.
The two regimes are separate: a device is one or the other. But for AI, they now converge with the AI Act. A medical AI device that is high-risk under the Act carries the Act's requirements through the existing MDR or IVDR conformity assessment, from 2 August 2028, so the goal is one assessment that satisfies both, not two parallel files.
- Class I
- Lowest risk. Largely self-certified. Few AI devices qualify once they inform a clinical decision.
- Class IIa
- Medium risk. Notified-body review begins. Much diagnostic and monitoring AI sits here.
- Class IIb
- Higher risk. Heavier scrutiny of clinical evidence and the quality system.
- Class III
- Highest risk. Most demanding route: full clinical evaluation and continuous oversight.
Where it meets the others
Where MDR and IVDR Meet the Other Regimes
One fact about a system, and each regime that asks for it.
- One incident
- MDRreports a serious incident (Art. 87)15 days
- EU AI Actreports a serious incident (Art. 73)15 days; 2 days if widespread; 10 days on a death
- GDPRnotifies a personal-data breach (Art. 33)72 hours
- NIS2reports a significant incident (Art. 23)24 h warning, 72 h notice, one month
- DORAreports a major ICT incident (Art. 19)time limits set under Art. 20
Art. 73(10) limits the AI Act's report on an MDR or IVDR device to fundamental-rights infringements. Check the consolidated text before relying on a date.
- One monitoring plan
- EU AI Actpost-market monitoring plan (Art. 72)may fold into the device's plan (Art. 72(4))
- MDRpost-market surveillance (Art. 83)already required for the device
Who owes what
The Device Supply Chain and Its Gatekeeper
Duties attach along the chain, with a notified body as the independent check for all but the lowest-risk devices.
- Manufacturer
- You place the device on the market. The primary duties: classification, clinical or performance evidence, technical documentation, a quality system, and post-market surveillance.
- Authorised representative
- You represent a non-EU manufacturer. The EU point of contact, holding documentation and cooperating with authorities on the manufacturer's behalf.
- Notified body
- The independent conformity check. Reviews the evidence and quality system for medium and higher-risk devices before a CE mark can be applied.
- Importer & distributor
- You make it available in the EU. Verify the CE marking, documentation, and registration are in place, and keep traceability through the chain.
A Qualified Person Must Answer for Compliance
Every manufacturer must designate a person responsible for regulatory compliance, with defined qualifications, who answers for conformity, technical documentation, post-market surveillance, and vigilance reporting. It is a named accountability, held inside the organisation or, for micro and small manufacturers, permanently at its disposal.
Timeline
In Force, With Legacy Devices Phasing Over
Both regulations apply now. Extended transition periods let compliant legacy devices continue while they move across, and the AI Act's requirements arrive in 2028.
- 26 May 2021
- MDR applies, replacing the Medical Devices Directive.
- Live
- 26 May 2022
- IVDR applies, replacing the IVD Directive.
- Live
- 2027–2028
- Extended deadlines for legacy MDR devices, staggered by risk class.
- Transition
- 2 Aug 2028
- AI Act high-risk duties apply to devices under Union product law (Annex I).
- Upcoming
Source: Official Journal of the EU · MDR and IVDR as amended, including the transition extensions of Reg. 2023/607 · Check the consolidated text before relying on a date.
Penalties
National Penalties, Immediate Market Risk
The regulations leave fines to member states, but the operational exposure, losing the market and facing liability, is uniform.
- National
- Member states set penalties for MDR and IVDR breaches (MDR Art. 113, IVDR Art. 106); they must be effective, proportionate, and dissuasive.
- Withdrawal
- Non-conforming devices can be withdrawn or recalled, and a defect exposes the manufacturer to strict liability under the Product Liability Directive.
Penalties are set by each member state's law (MDR Art. 113).
The regimes alongside it
The Regimes That Apply Alongside It
- Reg. 2024/1689
EU AI Act
Applies across every sector. Obligations by risk tier for providers and deployers, phasing in to December 2027.
Full guideRead the guide - Reg. 2016/679
GDPR for AI
Data protection. Lawful basis, impact assessments (DPIAs) and people's rights, wherever AI uses personal data.
In forceRead the guide - Dir. 2024/2853
Product liability
Software, AI included, becomes a product under EU liability law.
Applies 9 Dec 2026Read the guide
FAQ
Common Questions
If your software has a medical purpose, such as diagnosis, prevention, monitoring, prediction, prognosis, or treatment, it is likely Software as a Medical Device and falls under the MDR (Regulation (EU) 2017/745), or the IVDR (Regulation (EU) 2017/746) where it drives an in-vitro diagnostic. General wellness or administrative software is typically out of scope.
The MDR applied from 26 May 2021 and the IVDR from 26 May 2022. Staggered transitional deadlines run later. For the IVDR, Regulation (EU) 2024/1860 extended the transition to 31 December 2027 (class D), 31 December 2028 (class C), and 31 December 2029 (class B and class A sterile). For the MDR, Regulation (EU) 2023/607 extended deadlines to 31 December 2027 and 31 December 2028 by device class.
CE marking certifies conformity with the regulation's requirements. Depending on the device's risk class (I, IIa, IIb, or III under Annex VIII), it requires a conformity assessment, technical documentation, a quality management system, clinical evaluation, and, for higher classes, involvement of a Notified Body. Class III and implantable devices face the most stringent scrutiny.
The MDR requires a proactive post-market surveillance system (Articles 83-86), including a PMS plan and, for higher-risk devices, periodic safety update reports and post-market clinical follow-up (PMCF). Manufacturers must also report serious incidents and field safety corrective actions through vigilance reporting, and register devices and actors in EUDAMED.
No. An AI system that is a medical device is generally treated as high-risk under the EU AI Act, and the two regimes stack. The AI Act obligations apply alongside MDR/IVDR conformity, though the Act aims to align conformity-assessment procedures to avoid full duplication. Both sets of documentation are required.
The rollout is staged. The first EUDAMED modules become mandatory from 2026, with the four initial modules mandatory from 28 May 2026 and legacy-device registration required by 27 November 2026.
Intended purpose is what counts. If the software is meant to inform a diagnosis or treatment decision, it is very likely a device and needs a conformity assessment.
Post-market surveillance, clinical follow-up, and vigilance reporting continue for the device's life, and updates to a learning model can require re-assessment.
From 2028 the AI Act's high-risk requirements are additional, though satisfied through the same conformity assessment. The assessment gets deeper, not duplicated.
Your next step