Healthcare institutions and professionals under IVDR & EU MDR

Under the IVDR and the EU MDR, healthcare institutions and professionals must comply with new responsibilities – from handling in-house devices to post-market activities for CE-marked devices.  This article outlines key obligations and offers practical insights, including self-assessment checklists, to help clinical stakeholders and healthcare institutions identify their regulatory role and responsibilities and stay compliant under the IVDR and EU MDR.

Key takeaways

• IVDR and EU MDR affect not only manufacturers but also hospitals, labs, and clinicians.
• “In-house devices” are permitted only under strict exemption conditions. [Art. 5(5) IVDR/EU MDR]
• Healthcare professionals play an active role in device maintenance, vigilance and post-market surveillance (PMS).
• Healthcare institutions must ensure traceability, proper documentation, and collaboration with manufacturers for IVDs and medical devices.

Content

“In-House devices” under the IVDR & EU MDR: Limitations and conditions

In vitro diagnostic devices (IVDs) or medical devices manufactured and used within a healthcare institution (known as “in-house devices”) are exempted from manufacturer duties and most CE-marking requirements but only under narrowly defined conditions. [EU MDR/IVDR Art. 5(5)]

The exemption under Article 5(5) IVDR/EU MDR is intended as an exception, not the rule, and is subject to strict interpretation by regulators. It is designed to allow hospitals and laboratories to meet specific patient needs that cannot be addressed by commercially available CE-marked products, while maintaining equivalent levels of safety and performance.

Key criteria include:

• The patient group’s needs cannot be met by an equivalent CE-marked device.
• The device is manufactured and used only within the same legal entity of the healthcare institution.
• The device is manufactured and used under an appropriate Quality Management System (QMS) that ensures design control, validation, and traceability.
• Transparency obligations are fulfilled, including publishing a public declaration confirming compliance with applicable safety and performance requirements.
• Comprehensive documentation is maintained to justify design, safety, and performance, and to demonstrate equivalence to IVDR/EU MDR Annex I (GSPR) requirements.
• The device is not produced on an industrial scale, and use remains limited to the institution’s own patients.

Guidance document MDCG 2023-1 requires healthcare institutions to review at least once per year whether an equivalent CE-marked device has become available on the market. If so, the in-house device may no longer qualify for the exemption. Authorities expect documented evidence of this periodic review.

MDCG 2023-1 also clarifies that the concept of legal entity can differ across healthcare institutions. For example: 

• One hospital can be one legal entity when there is only one health institution (one organiser) within the hospital. 
• One hospital can accommodate several legal entities when there are different health institutions (different organisers) within the same hospital. The different health institutions can have different organisational numbers and different quality management systems. 
• Several hospitals can belong to the same legal entity when they are all part of one health institution (one organiser). They share the same organisational number, quality goals and quality management systems and the same healthcare strategy, even though they might be spread over different locations.

Risks of non-compliance:

• Competent authorities may withdraw the in-house exemption and classify the institution as a full manufacturer under EU MDR or IVDR, triggering all conformity assessment obligations for device CE-marking.
• Non-compliance can lead to targeted audits or inspections, corrective actions, or suspension of device use.
• Failure to meet transparency or documentation obligations can expose institutions to regulatory sanctions and reputational risks.
• In Switzerland, Swissmedic may request evidence of compliance with the relevant provisions of Art. 9 IvDO or Art. 9 MedDO and take enforcement actions if the exemption conditions are not met.

In practice, both EU MDR and IVDR in-house exemptions require healthcare institutions to act with the same level of diligence as commercial manufacturers. Even when devices remain internal, regulators expect documented risk management, performance monitoring, and continuous improvement—reflecting the shared goal of ensuring patient safety and maintaining confidence in healthcare innovation.

When do Healthcare Institutions become Economic Operators under IVDR and EU MDR?

Under the IVDR and EU MDR, healthcare institutions may unintentionally assume regulatory roles that carry specific legal obligations. While both regulations primarily target manufacturers, they also define and regulate other economic operators such as importers and distributors.

In practice, hospitals, laboratories, and even clinical departments may fall into one or more of these categories—sometimes without realising it.

The distinction between using a device and placing it on the market is decisive. Institutions that simply purchase CE-marked devices for their own use, act as end users. However, if the institution redistributes medical devices or IVDs to other legal entities, it becomes an economic operator (importer, distributor or even manufacturer) with corresponding compliance duties.

Healthcare institutions can become economic operators—often without realising it.

When do healthcare institutions become manufacturers?

A hospital or laboratory qualifies as a manufacturer if it makes available in-house devices beyond the same healthcare institution. If in-house devices are shared across legally distinct entities, provided externally, or used commercially, the healthcare institution becomes a manufacturer in the full regulatory sense, with all obligations under the EU MDR or IVDR, including conformity assessment, registration, and post-market surveillance.

Note that custom-made devices (CMDs) are excluded from the scope of EU MDR Article 5(5). This means that any healthcare institution that manufactures CMDs for their own use, even if not made available beyond the healthcare institution, becomes a manufacturer under the EU MDR and must abide by the requirements for CMDs, mainly:

• compliance with the manufacturer duties in Article 10.
• CMD conformity assessment following Annex XIII.
• Notified Body certification of the quality system if the CMD corresponds to a Class III implantable device.

CMD manufacturers are exempted from the requirements relative to UDI assignment, labelling and registration in EUDAMED.

When do healthcare institutions act as importers?

Institutions that procure medical or in vitro diagnostic devices directly from outside the EEA/Turkey (or from outside Switzerland under the IvDO/MedDO) do not act as importers, unless they make those devices available on the market beyond the healthcare institution.

If so, as importers, they must:

• verify CE-marking and the validity of the EU Declaration of Conformity and any Notified Body certificates,
• check whether a EU Authorized Representative (or a Swiss Authorised Representative, for Switzerland) has been designated by the manufacturer,
• ensure that the  importer details and labelling are correct, and
• register themselves as importers in the “actors” module of the EU database for medical devices, EUDAMED. In Switzerland, it is swissdamed.

Direct sales of medical devices and IVDs from outside the EEA/Turkey (or Switzerland under the the IvDO/MedDO) for end use at the healthcare institution are not considered to be placed on the market, and, as such, there is no importer. In this scenario, healthcare institutions must carefully ensure that a EU Authorized Representative (or a Swiss Authorized Representative, for Switzerland) has been designated by the manufacturer to avoid endorsing responsibility over compliance, vigilance, and liability, which would entail duties closer to those of an Authorized Representative. 

When do healthcare institutions act as distributors?

If a EEA/Turkey-based hospital or laboratory obtains devices from EEA/Turkey-based suppliers and then redistributes or resells them to other EEA/Turkey-based legally distinct entities, such as within a hospital group, university network, or to partner clinics, it assumes the role of a distributor.

If so, as distributors, they must:

• verify that CE-marking and labelling are present and legible,
• ensure proper storage and transport conditions, and
• maintain traceability and vigilance records.

Clarifying the role

Many institutions rely on in-house devices developed and used exclusively within their own facilities. As already explained, while Article 5(5) EU MDR/IVDR allows this practice, the exemption is narrow and conditional. Before invoking it, institutions should carefully assess: Which role are we actually taking on under the EU MDR or IVDR — manufacturer, importer, or distributor?

Recognising and correctly categorising these roles is essential to ensure compliance, maintain patient safety, and prevent unintended regulatory exposure.

📋 CHECKLIST: Which regulatory role do you assume under IVDR or EU MDR?

Ask yourself:

A Look at Switzerland (IvDO and MedDO)

While the IVDR and EU MDR apply across the EU, Switzerland has implemented its own national framework through the In-vitro Diagnostic Medical Devices Ordinance (IvDO) and the Medical Devices Ordinance (MedDO). For healthcare institutions in Switzerland, this means that most IVDR and EU MDR requirements apply in practice—but with additional Swiss-specific obligations and separate oversight by Swissmedic.

Key points for Swiss institutions

No automatic EU recognition: Since the Mutual Recognition Agreement (MRA) between Switzerland and the EU has not been updated to cover the IVDR and EU MDR, formal EU–CH equivalence no longer exists. CE-marked devices are still accepted on the Swiss market, but direct supply from a EU (or any foreign) manufacturer to a Swiss healthcare institution without a Swiss Authorised Representative (CH-REP) is only possible in justified exceptional cases, according to Swissmedic’s Information Sheet on the procurement of devices by health institutions.

Import obligations:

Hospitals and laboratories that procure medical devices or IVDs directly from outside Switzerland become Swiss importers under MedDO or IvDO if they make available those devices to other legal entities. 

In such a case, they must verify CE-marking, labelling, Declarations of Conformity, Notified Body certificates, and ensure that the Swiss authorised representative (CH-REP) is clearly identified on the device labelling when required. Read more on Swiss importers duties.

Swissmedic notification:

In specific cases — such as custom-made devices [Art. 19 MedDO] or in-house manufactured devices [Art. 9 IvDO / Art. 8 MedDO] — healthcare institutions must notify Swissmedic before using the device. This includes providing:

• the intended purpose and justification for in-house manufacture,
• details of the applied quality management system (QMS), and
• supporting documentation on design and performance.

Documentation and inspections:

Swissmedic has the authority to inspect healthcare institutions acting as manufacturers, importers, or distributors under both ordinances. Institutions must be able to provide full documentation at any time, including design and risk files for in-house products, supplier verification records, and vigilance reports.

Parallel obligations and quality systems:

Even for healthcare institutions that are already accredited (e.g. under ISO 15189 or ISO 13485), the IvDO and MedDO require additional regulatory alignment—especially concerning post-market surveillance, vigilance, and traceability. 

For in-house devices, the exemption conditions of Article 9 IvDO and Article 8 MedDO merely cross-reference Article 5(5) EU MDR/IVDR, but Swissmedic expects transparent documentation and continuous review.

In practice, Swiss hospitals and laboratories face the same fundamental regulatory requirements as their EU counterparts—plus additional reporting duties, documentation expectations, and direct oversight by Swissmedic. This dual alignment can increase administrative effort but ensures that patient safety and regulatory traceability are maintained at an equivalent level to the EU.

Direct procurement from foreign manufacturers can turn hospitals into Swiss importers.

Device maintenance obligations under the IvDO and MedDO

In Switzerland, healthcare institutions are not only responsible for the safe procurement and use of medical devices and IVDs, but also for their ongoing maintenance. Proper upkeep ensures that devices remain safe, effective, and compliant throughout their lifecycle.

Legal framework:

• MedDO (Art. 71) – sets maintenance obligations for medical devices (EU MDR equivalent).
• IvDO (Art. 64) – sets maintenance obligations for in vitro diagnostic devices (IVDR equivalent).
• Both ordinances reference the Swiss Good Maintenance Practice (Schweizerische Gute Praxis für die Instandhaltung von Medizinprodukten, GPI) as the binding guideline for hospitals. It is only available in the Swiss mandatory languages: German, French, and Italian.

The GPI was developed by Swissmedic together with the professional associations Infrastruktur Hospital Schweiz (IHS) and Interessengemeinschaft für Wiederaufbereitung im Gesundheitswesen (IG WiG). It describes practical requirements for device maintenance and must be applied by all hospitals.

Key obligations:

• Mandatory application of GPI: Any deviations must be assessed, corrected, or documented with justification.
• Documentation: Maintenance procedures, schedules, and corrective measures must be fully recorded.
• Inspection by Swissmedic: Implementation of GPI is reviewed during administrative proceedings, including on-site inspections.
• Continuous improvement: Hospitals are expected to review GPI application regularly and adapt processes accordingly.

Ask yourself:

• Do we maintain medical devices and IVDs strictly according to GPI requirements?
• Are all deviations from GPI documented, justified, and corrected?
• Do we have clear records of maintenance intervals, corrective actions, and responsibilities?
• Are we prepared for Swissmedic inspections focusing on maintenance processes?

Example risks:

• A hospital delays scheduled maintenance of infusion pumps, leading to device malfunctions. Swissmedic inspection reveals missing documentation and orders corrective action.
• A laboratory modifies its maintenance procedures for in-house IVD equipment but fails to document the deviation from GPI. Inspectors classify this as non-compliance.

📋 CHECKLIST: Maintenance obligations under the MedDO and IvDO (GPI)

The following self-assessment checklist, derived from Swissmedic’s GPI inspection tool, helps hospitals and laboratories evaluate their own maintenance practices and identify gaps before an official inspection.

Role of Healthcare Professionals in Post-Market Surveillance and Vigilance (IVDR & EU MDR)

Healthcare professionals (HCPs) play a pivotal role in ensuring that in-house and commercial IVDs remain safe and effective in real-world use. Their input is essential for building a reliable post-market surveillance (PMS) and vigilance system.

Moreover, HCPs have a duty to report serious incidents to competent authorities.

Why it matters:

Encouraging feedback loops:

• Hospitals and labs should be integrated into PMS plans with clear reporting channels.
• Structured feedback systems (complaints, internal audits, incident forms) help ensure that issues are documented and escalated.
• Effective communication between clinical staff and quality/regulatory teams allows early detection of safety signals.

Ask yourself:

• Do our clinicians and lab staff know how and where to report incidents?
• Are feedback channels for in-house documented in our PMS plan?
• Are PMCF obligations under EU MDR and performance monitoring obligations under IVDR clearly integrated into our QMS?

Example risk:

• IVDR: A hospital lab observes recurring false-negative PCR results but does not escalate them formally. The issue only surfaces through external complaints, leading to regulatory investigation for vigilance failure.
• EU MDR: A clinic using a custom-made implantable device fails to update its clinical evaluation with observed complications. Regulators identify this gap during inspection, resulting in corrective action orders.

Read more about Post-market Surveillance duties and Vigilance requirements.

Who audits Healthcare Institutions and When?

Healthcare institutions are not routinely audited like manufacturers, but may still be subject to targeted inspections by:

National competent authorities (e.g. Swissmedic, BfArM, ANSM) 

• IVDR: National authorities (e.g., Swissmedic, BfArM, ANSM) can audit institutions acting as manufacturers of in-house IVDs, or when importing/distributing IVDs directly.
• EU MDR: The same applies for medical devices — authorities may inspect hospitals producing custom-made devices or acting as importers/distributors. For high-risk custom-made devices (e.g., Class III implants), audits often focus on the adequacy of technical documentation and the manufacturer’s statement.

Notified Bodies

• IVDR: May become involved if the institution sponsors a performance study or collaborates in a conformity assessment.
• EU MDR: For custom-made Class III implantables, Notified Bodies must review the Statement of Compliance before placing the device on the market. This adds an additional layer of oversight compared to IVDR in-house devices.

Health system regulators or accreditation bodies

Applies under both IVDR & EU MDR:

Inspection triggers include:

• Incident reports or complaints involving the institution’s devices
• Evidence of non-CE-marked products in clinical use
• Lack of public documentation for in-house diagnostics (under IVDR Article 5(5))
• National surveillance campaigns or joint enforcement actions

EU MDR-specific triggers:

• Failure to provide adequate technical documentation for custom-made devices. Improper use of the “custom-made” exemption to avoid CE-marking.

IVDR-specific triggers:

• Use of in-house IVDs beyond the scope of Article 5(5).
• Lack of justification that no CE-marked equivalent exists.

Consequences of non-compliance

• IVDR: Withdrawal of exemption, forced reclassification as a full IVD manufacturer, corrective actions, suspension of device use.
• EU MDR: Prohibition of placing custom-made devices on the market, invalidation of Manufacturer’s Statements, enforcement actions against responsible staff.
• Both: Reputational damage if inspection results become public.

Common Pitfalls in Practice (IVDR&EU MDR)

A frequent mistake is the uncritical use of non-CE-marked products, especially in research, pilot studies, or early clinical deployment, without realising that this may fall outside the exemption clauses of the IVDR or EU MDR.

Another common issue arises when healthcare institutions import devices directly, without an Authorized Representative, and unknowingly endorsing compliance, vigilance and liability duties similar to those of the Authorized Representative.

Authorities may withdraw exemptions, reclassify institutions as full manufacturers, or impose corrective actions and fines.

Other risks include:

• Repackaging or relabelling CE-marked devices and altering the label, instructions, or packaging without authorization.
• Using devices beyond their intended purpose (off-label use) without conducting a documented risk assessment or updating the clinical/performance evaluation.
• Failing to justify the use of in-house devices, as required under Article 5(5) IVDR/EU MDR.
• Relying on outdated conformity documentation, e.g., IVDD or MDD certificates that are no longer valid after the transition deadlines.
• Overlooking vigilance obligations—for example, not reporting performance or safety issues observed during clinical use.

In all these cases, healthcare institutions risk not only regulatory non-compliance but also civil and reputational liability.

Authorities may withdraw exemptions, reclassify institutions as full manufacturers, or impose corrective actions and fines.

Maintaining clear internal procedures for procurement, documentation, and post-market oversight is therefore essential to ensure continued compliance under both EU MDR and IVDR.

Conclusion

The IVDR and EU MDR significantly extend the responsibilities of healthcare institutions. What was once the sole domain of manufacturers is now also a concern for hospitals, laboratories, and clinicians—especially when they take on roles as manufacturers, importers, or distributors, sometimes without realising it.

Depending on their activities, healthcare institutions may assume roles as manufacturers, importers, distributors, or users of in-house or custom-made devices, often without realising that these roles carry formal legal obligations. Likewise, institutions must meet requirements for post-market surveillance, vigilance, traceability, maintenance, and documentation, whether devices are in-house or commercially supplied.

For both regulations, the key message remains the same:

• Exemptions are the exception, not the rule.
• Healthcare institutions must implement robust QMS processes, ensure transparency, maintain comprehensive documentation, and integrate PMS and vigilance activities into daily practice.
• Non-compliance can lead to withdrawal of exemptions, enforcement actions, liability risks, and reputational damage.
• Institutions should therefore approach IVDR and EU MDR obligations proactively, not reactively. By identifying their role early—whether as manufacturer, importer, distributor, or user of in-house or custom-made devices—they can establish appropriate compliance structures and avoid costly surprises during inspections.

How Decomplix can help

Decomplix has extensive regulatory and quality expertise in medical devices and IVDs. We help healthcare institutions and professionals understand their roles and implement the requirements of the IVDR and EU MDR, respectively the IvDO and MedDO in Switzerland. We provide expert assessment of your specific situation and a clear roadmap towards achieving and maintaining compliance.

Our team of experts will be happy to support you in developing the necessary processes within your quality management system, aligning in-house practices with Article 5(5) IVDR/EU MDR. We also address all regulatory questions related to post-market surveillance, vigilance, and audits.

You can learn more about our services here.

If you wish to discuss your specific needs with us, please contact us for a non-binding quote.

Further reading

• Swiss medical device importers – regulatory requirements

• Requirements for medical device and IVD distributors in the EU

• ISO 13485 Quality Management Systems for Medical Devices

• Post-market Surveillance (PMS) for medical devices under EU MDR and IVDR

• Medical Device and IVD Vigilance in the EU and Switzerland