EU Notified Bodies for medical devices and IVDs

The Notified Body is the key stakeholder in the CE-marking process for medical devices and IVDs that are not low-risk. This article helps manufacturers understand when a Notified Body is required, how to find it, and how its involvement impacts costs and timelines in the medical device or IVD certification.

Key takeaways:

• Under the EU MDR and IVDR, Notified Bodies are required not only in the conformity assessment of medical devices and IVDs that are not low-risk devices, but also in the certification of certain processes that are not conducted by the manufacturer (e.g. third-party sterilization, repackaging).
• After the disruption of the Mutual Recognition Agreement with the EU, Switzerland does not recognize certificates issued under the EU MDR or IVDR by Notified Bodies established in Turkey (i.e. non-EU/EEA country).
• Despite a legal requirement to make standard fees publicly available, Notified Body’s certification costs remain unfathomable. To compare costs meaningfully, manufacturers should request the same quotation from different Notified Bodies.

Content:

What is a Notified Body? Is it part of the Competent Authority?

Notified Bodies are not part of the competent authority. They are independent organizations that have been designated by the competent authority of a member country of the European Economic Area (EEA) to assess the conformity of products subject to CE-marking under EU legislation, where such conformity assessment requires the involvement of a third-party assessment body.

The same Notified Body can be designated for third-party conformity assessment under multiple EU Directives or Regulations that call for CE-marking of certain products. 

For example: 

• Directive 2014/53/EU on radio equipment (for wireless equipment)
• Regulation (EU) 2016/425 on personal protective equipment
• Regulation (EU) 2017/745 on medical devices (EU MDR) 
• Regulation (EU) 2017/746 on in-vitro diagnostic medical devices (IVDR)
• Regulation (EU) 2023/1230 on machinery
• Regulation (EU) 2023/1542 on batteries and waste batteries
• Regulation (EU) 2024/1689 on AI (for high-risk AI systems)

For medical devices and IVDs, a Notified Body is legally defined as:
“a conformity assessment body designated in accordance with this Regulation.” [EU MDR Art. 2(42) / IVDR Art. 2(34)]

Each EEA competent authority who designates the Notified Bodies is called the “Designating Authority”. For example, in France, the designating authority is ANSM (Agence Nationale de Sécurité du Médicament et des produits de santé) and it has designated 2 Notified Bodies under the EU MDR: AFNOR Certification (NB 0333) and GMED SAS (NB 0459).

The designating authority oversees the activities of Notified Bodies under its jurisdiction and has the legal power to suspend and withdraw their designation.

How is a Notified Body different from a Conformity Assessment Body (CAB)?

The Notified Body is a subset of the Conformity Assessment Body (CAB), which is legally defined as:
“a body that performs third-party conformity assessment activities including calibration, testing, certification and inspection.” [EU MDR Art. 2(41) / IVDR Art. 2(32)]

In addition to Notified Bodies, CABs include other certification bodies (for management systems, persons, services, or products), testing laboratories, calibration laboratories, medical laboratories, inspection bodies, and also reference material producers. CABs must be accredited by the national competent authority for their specific activity, on the basis of relevant international standards.

CABs that wish to be designated as Notified Bodies must be established in an EU Member State, an EEA member country, or in countries where the EU has specific bilateral agreements (e.g. Turkey, through the Customs Union). 

Notified Bodies are independent organizations that have been designated by the competent authority of a member country of the European Economic Area.

Switzerland and Great Britain are neither EU/EEA countries nor bound with the EU through a bilateral agreement covering the EU MDR and IVDR. This means CABs based in Switzerland or in Great Britain cannot be designated as Notified Bodies under the EU MDR or IVDR. An exception applies to Northern Ireland, a territory of the United Kingdom (not part of Great Britain) subject to a special status with respect to medical device and IVD CE-marking.

When is the involvement of a Notified Body required?

Under the EU MDR and IVDR, a Notified Body is required for the conformity assessment of devices that are not considered to be low risk (i.e. IVD class A or non-IVD class I), as well as for the certification of certain processes that are not conducted by the manufacturer (e.g. third-party sterilization, repackaging).

Certification by a Notified Body under the EU MDR and IVDR is valid for 5 years and subject to annual surveillance audits, as well as to at least one unannounced audit during the 5-year certification cycle. Hence, companies must consider not only the efforts and costs to achieve initial certification but also those to maintain certification throughout the device lifetime.

Notified Body involvement in the manufacturer’s Conformity Assessment

Conformity assessment is the process that the manufacturer must undertake to demonstrate whether the requirements of the EU MDR and IVDR that apply to a device have been fulfilled. This process may or may not require the oversight of a Notified Body.

When a Notified Body must be involved in the conformity assessment, different procedures may apply depending on the device’s risk class and the type of device. The procedures typically entail certification of the manufacturer’s quality management system coupled with some level of certification of the devices concerned. 

Notified Body’s certification of the conformity assessment is achieved through audits of the corresponding documentation and, in some cases, device testing by external laboratories. Upon satisfactory inspection, the Notified Body issues the EU Certificates, with the contents described in Annex XII of the EU MDR and IVDR.

Conformity assessment for CE-marking under the EU MDR or IVDR requires the involvement of a Notified Body in the following cases:

• For Class I medical devices that:
  • are sterile (Class Is), only for the aspects relative to sterilization,
  • have a measuring function (Class Im), only for the aspects relative to the measuring function, or
  • are reusable surgical instruments (Class Ir), only for the aspects relative to reprocessing.
• For Class IIa, Class IIb, and Class III medical devices.
• For Custom-made devices (CMDs) that are Class III medical devices only. In this case, the conformity assessment is limited to the certification of the manufacturer’s quality management system.
• For IVDs that are Class B, Class C, and Class D, including any IVD kits that would fall under these classes.

The conformity assessment of Class I medical devices that are not Class Is/Im/Ir and of Class A IVDs do not need a Notified Body. These low-risk devices can be CE-marked simply through the manufacturer’s self-declaration once all the applicable requirements in the EU MDR or IVDR are fulfilled. Self-declaration is not certification.

The EU MDR and IVDR introduced changes in the classification of devices that resulted in extended involvement of Notified Bodies from what used to be the case under the former Medical Device Directive (Dir. 93/42/EEC, MDD) and In-vitro Diagnostic Directive (Dir. 98/79/EC, IVDD). This is particularly significant for IVDs. TÜV-SÜD estimates that Notified Body involvement under the IVDD concerned about 8% of the marketed IVDs, most of them falling under the self-declared categories, whereas under the IVDR, over 80% of the IVDs will require Notified Body certification (see TÜV-SÜD’s IVDR infographic).

The conformity assessment of Class A IVDs and of Class I medical devices that are not Class Is/Im/Ir do not need a Notified Body.

Notified Body involvement in certain processes undertaken by entities that are not the legal manufacturer

Notified Body’s certification of a limited set of quality management processes is also required in the following cases:

• Any company that sterilizes Procedure Packs or Systems shall obtain Notified Body’s certification for the sterilization activities. [EU MDR Art. 22(3)]
• Any importer, distributor or other entity who repackages or relabels a medical device or IVD on its own account shall obtain Notified Body’s certification for the repackaging/relabelling activities [EU MDR/IVDR Art. 16(4)]. Guidance document MDCG 2021-23 describes in detail the requirements.

How are Notified Bodies recognized in Switzerland?

In Switzerland, Notified Bodies are called “Designated Bodies” and are governed by Chapter 5 of the Swiss Medical Device Ordinance (SR 812.213, MedDO) and Chapter 4 of the Swiss In-vitro Diagnostics Ordinance (SR 812.219, IvDO). Since Notified Bodies under the EU MDR or IVDR cannot be established in Switzerland, due to its third-country status, there are no Swiss Designated Bodies for medical devices and IVDs. 

Conversely, the Swiss competent authority, Swissmedic, recognizes EU MDR and IVDR certificates issued by Notified Bodies that are “domiciled in a state of the EU or European Economic Area (EEA)”. [MedDO Art. 25 §4 / IvDO Art. 21 §4]

Because the United Kingdom (UK) and Turkey are neither EU Member States nor EEA member countries, this means that certificates issued by Notified Bodies established in Northern Ireland (a UK territory that has a special status for CE-marking) and Turkey are not recognized in Switzerland.

While there are no Notified Bodies established in Northern Ireland, the following Turkish Notified Bodies are concerned:

How to find a list of Notified Bodies designated for the appropriate scope? What is NANDO?

Manufacturers are free to select any of the Notified Bodies designated for the type of devices to be certified. However, a manufacturer cannot lodge applications in parallel with various Notified Body for the same device-related conformity assessment procedure. As such, careful selection of the Notified Body is an important step in the success of the CE-marking journey.

The list of Notified Bodies is maintained by the EU Commission on the NANDO website (New Approach Notified and Designated Organizations). Searches are possible by country, by legislation, or through free search.

For each Notified Body, the list includes its identification number (i.e. the 4-digit code that needs to be added to the CE mark of any devices certified by the Notified Body) as well as the scope of its designation (i.e. what type of devices it is authorized to certify), which is an important aspect that manufacturers must verify when selecting a Notified Body, particularly if the manufacturer’s portfolio contains different and complex types of devices.

For medical devices (under the EU MDR) and IVDs (under the IVDR), the scope of Notified Body designation is further narrowed down per device codes. These codes are granted by the designating authority based on the Notified Body’s staff qualification.

Device codes under the EU MDR (i.e. MDR codes), described in detail in MDCG 2019-14, include:

• MDA
  Codes that reflect design and intended purpose of active devices, e.g. MDA 0315 for software.
• MDN
  Codes that reflect design and intended purpose of non-active devices, e.g. MDN 1102 for non-active osteo- and orthopedic implants.
• MDS
  Horizontal codes that reflect the specific characteristics of the device, e.g. MDS 1005 for devices in sterile condition.
• MDT
  Horizontal codes that describe technologies or processes, e.g. MDT 2006 for devices manufactured using chemical processing.

Device codes under the IVDR (i.e. IVDR codes), described in detail in MDCG 2021-14, include:

• IVR
  Codes that reflect design and intended purpose of the IVD, e.g. IVR 0402 for IVDs intended to be used to predict genetic disease/disorder risk and prognosis.
• IVS
  Horizontal codes that reflect the specific characteristics of the device, e.g. IVS 1001 for IVDs for near-patient testing.
• IVT
  Horizontal codes that describe technologies or processes, e.g. IVT 2006 for IVDs manufactured using chemical processing.
• IVP
  Horizontal codes that describe knowledge in examination procedures, e.g. IVP 3007 for IVDs that require knowledge in immunoassays.
• IVD
  Horizontal codes that describe knowledge in laboratory and clinical disciplines, e.g. IVD 4011 for IVDs that require knowledge in parasitology.

Example of a search for a Notified Body:

A manufacturer looking for a suitable Notified Body in Germany for medical device software under the EU MDR, should search the NANDO website per country (i.e. selecting Germany), then refine the search by legislation (i.e. selecting Regulation (EU) 2017/745) as well as by the corresponding product code for software (i.e. selecting MDA 0315). The results, shown below, yield 10 Notified Bodies that the manufacturer could choose from.

Screenshot of the NANDO search page:

How long does it take to obtain Notified Body’s certification under the EU MDR or IVDR?

Certification timelines are difficult to estimate as they depend on:

• the type of device (e.g. devices requiring consultation with expert panels or pharmaceutical competent authorities, IVDs requiring the involvement of EU reference laboratories), 
• the complexity of the device portfolio, and 
• the level of compliance achieved by the manufacturer both at the quality management system level and at the technical documentation level.

TÜV-SÜD’s website shows generic infographics of the steps involved in the (pre-)application phase and the assessment phase. 

• The pre-application phase is expected to take 50 working days. It runs from the manufacturer’s first pre-application submission to the point in time where the Notified Body is ready to start the assessment, and includes the application review with a positive outcome.
• The assessment phase with 2 evaluation cycles (although more or fewer cycles might be needed) is expected to take 105 working days.

Added together, this would mean approximately 8 months to obtain certification under the EU MDR. 

Yet, the EU Commission’s survey on timelines for achieving Notified Body’s certification under the EU MDR indicates significantly longer timelines:

Source: EU Commission’s Dashboard Monitoring the Availability of Medical Devices & IVDs in the EU

Although IVDR certification is not yet very frequent, due to the longer transitional periods, similarly long certification timelines appear to be necessary:

Source: EU Commission’s Dashboard Monitoring the Availability of Medical Devices & IVDs in the EU

How much does the Notified Body certification cost?

By law, Notified Bodies make their standard fees publicly available [EU MDR Art. 50 / IVDR Art. 46]. They are also required to consider fair and reasonable terms and conditions, as well as the interest of small and medium-sized enterprises (SME), as defined in Rec. 2003/361/EC [EU MDR/IVDR Annex VII 1.2.8].

Guidance document MDCG 2023-2 provides a template for the publication of fees, intended to facilitate comparison across Notified Bodies, and the EU Commission has published a file with links to each Notified Body’s standard fees webpage for the EU MDR and IVDR. The below comparison table has been compiled out of data on those webpages.

* Fees are dated 2021. Current fees cannot be located on NSAI’s website.

At first glance, it might seem that the French Notified Body, GMED, is the cheapest one.

In reality, the actual costs vary considerably, depending on the company size and sites, as well as the number and complexity of the devices to be certified. Audit time rates and assessment time rates correspond to 1 auditor and need to be multiplied times the number of auditors that will be required for the specific certification. Also, these fees do not cover special consultation processes and certification maintenance.

Regarding the special conditions for manufacturers that qualify as SMEs, MDCG 2023-2 also requires that this information be made public by each Notified Body. Yet, it is still not possible to compare the conditions as virtually no Notified Body has published them.

In brief, manufacturers should expect Notified Body’s certification costs starting at 50k €, and the only way to be able to compare costs in a meaningful manner would be to request the same quotation from different Notified Bodies. Note that the quotation process entails submitting substantial information on the company and concerned devices.

How can Decomplix help?

Because each device and each manufacturer are different, Decomplix provides targeted strategic plans, including estimated timelines and costs, to choose the most efficient regulatory pathway to CE marking of medical devices and IVDs.

Our team of experts will be happy to support you in developing the regulatory strategy including a roadmap and specific questions on Notified Body selection and relationship.

Learn more about Decomplix services here.

Further reading

• How to obtain a CE mark for a medical device
• CE marking for in vitro diagnostic devices under the IVDR
• ISO 13485 Quality Management Systems for Medical Devices
• Class I medical device manufacturers under the EU MDR
• Regulatory guide to Procedure Packs, Systems , IVD Kits, and Configurable devices