EU MDR 2017/745 Compliance Consulting Services

What EU MDR 2017/745 Requires

EU MDR expands regulatory obligations across the full product lifecycle. Compliance must be demonstrable through evidence, not assumed through equivalence.

Core expectations include:

• Continuous clinical evidence supporting safety and performance

• Structured technical documentation aligned to Annex II and III

• Full product lifecycle traceability through UDI and EUDAMED

• Proactive post-market surveillance and vigilance systems

• Integrated quality management system aligned to MDR expectations

For many organizations, this requires significant restructuring of existing systems, particularly when transitioning from MDD.

EU MDR Transition Deadlines for Legacy Devices

The MDR has applied since May 26, 2021. Devices certified under the MDD or AIMDD (legacy devices) can stay on the EU market only under the transitional provisions of Article 120, which Regulation (EU) 2023/607 extended:

• December 31, 2027 for Class III devices and Class IIb implantable devices, with limited exceptions

• December 31, 2028 for other Class IIb devices, Class IIa devices, and Class I devices that require notified body involvement under MDR

The extension is conditional. Among other requirements, the device must continue to comply with the MDD or AIMDD with no significant changes in design or intended purpose, and the manufacturer must have had an MDR-compliant quality management system in place and a formal notified body application lodged by May 26, 2024, followed by a signed written agreement with the notified body by September 26, 2024. Devices that did not meet those conditions cannot rely on the extended deadlines.

Two further developments affect planning. Regulation (EU) 2024/1860 allows EUDAMED modules to become mandatory in stages, so registration and UDI data obligations are arriving in phases. In December 2025, the European Commission also proposed a targeted revision of the MDR and IVDR aimed at simpler, more proportionate requirements. Proposed changes take effect only once adopted, so remediation plans should be built against the requirements in force today.

Why EU MDR Compliance Matters

Market Access

Without MDR compliance, devices cannot maintain or obtain CE marking. This directly impacts access to the EU market.

Regulatory Scrutiny

Notified bodies now operate with increased rigor and reduced capacity. Weak systems lead to certification delays, nonconformities, or outright rejection.

Lifecycle Accountability

MDR shifts compliance from pre-market approval to continuous lifecycle responsibility. Organizations must demonstrate ongoing control—not one-time readiness.

Organizational Risk

Regulatory delays, recertification requirements, and market withdrawal create financial and operational exposure.

Organizations with complex regulatory portfolios often align MDR compliance with broader governance structures supported by enterprise risk management frameworks.

Who Must Comply

EU MDR applies to all economic operators involved in placing devices on the EU market:

• Manufacturers (EU and non-EU)

• Authorized Representatives

• Importers

• Distributors

Each role carries defined legal responsibilities related to documentation, traceability, reporting, and regulatory cooperation.

Two requirements regularly catch organizations off guard:

• Non-EU manufacturers must designate an EU Authorized Representative under a written mandate (Article 11).

• Every manufacturer must have at least one Person Responsible for Regulatory Compliance (PRRC) with documented qualifications (Article 15). Micro and small enterprises may instead use a PRRC who is permanently and continuously at their disposal.

Responsibility cannot be transferred. It must be operationalized.

MDD vs. MDR: What Changes for Your Devices

Organizations moving from the MDD often underestimate how far the new requirements reach. The most consequential differences include:

• Broader scope. Annex XVI brings certain products without an intended medical purpose, such as some aesthetic products, under the regulation.

• Reclassification. Revised classification rules in Annex VIII move some devices into higher risk classes, including much standalone software under Rule 11.

• Stricter clinical evidence. Equivalence claims face tighter conditions under Article 61, particularly for Class III and implantable devices.

• New roles and reports. The PRRC, Periodic Safety Update Reports, Post-Market Clinical Follow-Up, and Summaries of Safety and Clinical Performance for implantable and Class III devices.

• Traceability. UDI assignment and EUDAMED registration for devices and economic operators.

• Closer notified body oversight. Unannounced audits are now written into the regulation.

A device that was compliant under the MDD is not automatically compliant under the MDR. Classification should be confirmed before any remediation plan is built.

Core Elements of an MDR-Compliant System

Clinical Evaluation and Lifecycle Evidence

Clinical evidence must demonstrate safety and performance throughout the product lifecycle.

This includes:

• Clinical Evaluation Reports (CERs)

• Post-Market Clinical Follow-Up (PMCF)

• Ongoing data analysis and updates

• Justified equivalence claims

Organizations strengthening clinical and risk integration often align with ISO 14971 Risk methodologies to support defensible benefit-risk analysis.

Technical Documentation (Annex II & III)

Technical documentation must be complete, structured, and immediately available for review.

Key components include:

• Device description and specifications

• Design and manufacturing information

• Risk management documentation

• Verification and validation data

• PMS procedures and outputs

• Benefit-risk analysis

Weak technical files are one of the most common causes of certification delays.

Organizations often embed documentation controls within a broader Medical Device QMS to ensure sustainability beyond initial submission.

UDI and EUDAMED Integration

MDR requires full traceability through:

• Unique Device Identification (UDI)

• Economic operator registration

• EUDAMED database submissions

• Vigilance reporting systems

UDI impacts labeling, ERP systems, supply chain control, and technical documentation structure. This is a system-level decision—not a labeling update.

Post-Market Surveillance and Vigilance

MDR requires proactive, data-driven surveillance systems.

This includes:

• Documented PMS plans

• Active data collection and analysis

• Vigilance reporting of incidents

• Periodic Safety Update Reports (PSURs)

• Trend reporting and corrective actions

Organizations transitioning from reactive PMS models must build structured surveillance programs supported by risk-based methodologies.

Quality Management System Alignment

A robust quality management system aligned with MDR expectations is essential.

This includes:

• Lifecycle planning and control

• Supplier qualification and monitoring

• Risk management integration

• CAPA systems

• Internal audit

• Management review

Most organizations achieve this through alignment with ISO 13485 Consultant Services to ensure MDR requirements are embedded operationally.

Labeling and Instructions for Use

Labeling must meet strict regulatory requirements, including:

• Compliance with Annex I safety and performance requirements

• Clear and accurate intended use

• Multilingual considerations

• UDI integration

• Disclosure of residual risks

Labeling errors are a frequent source of nonconformity during notified body review.

High-Risk Device Oversight

Class III and implantable devices face heightened regulatory scrutiny, including:

• Expert panel review

• Pre-market consultation

• Expanded clinical requirements

• Increased post-market obligations

Regulatory strategy for these devices must be defined early and maintained continuously.

EU MDR Compliance Consulting Services

Wintersmith Advisory supports medical device organizations through structured, audit-ready MDR implementation and remediation.

Wintersmith Advisory is a consulting firm, not a notified body. We prepare your systems, documentation, and evidence for conformity assessment; the notified body performs that assessment and issues the CE certificate.

MDR Gap Assessments

We evaluate current systems against MDR requirements to identify:

• Documentation gaps

• Clinical evidence weaknesses

• PMS deficiencies

• Traceability limitations

• QMS misalignment

Findings are prioritized based on regulatory risk and certification impact. Where the quality system itself is the main concern, an ISO 13485 gap analysis can run alongside the MDR review.

Technical Documentation Development

We support development and remediation of:

• Technical files (Annex II & III)

• Clinical evaluation documentation

• Risk management files

• PMS and PMCF documentation

UDI and EUDAMED Strategy

We support:

• UDI assignment and integration

• Labeling updates

• ERP and traceability alignment

• EUDAMED registration workflows

QMS Integration and Enhancement

We design and strengthen quality systems aligned to MDR expectations, using ISO 13485 as the foundation and integrating MDR-specific requirements such as PRRC responsibilities, post-market surveillance, and UDI.

PMS and PMCF Program Design

We develop proactive surveillance systems that support ongoing regulatory compliance and lifecycle evidence expectations.

Notified Body Readiness

We prepare organizations for notified body review through:

• Internal readiness assessments

• Documentation review

• Gap remediation

• Audit preparation aligned with ISO Internal Audit Services

How an EU MDR Engagement Works

Most MDR engagements follow the same sequence, scaled to the number of device families and the state of your existing system:

1. Scope and classification. We review device classification, conformity assessment route, economic operator roles, and transition status for each device family.

2. Gap assessment. We evaluate your QMS, technical documentation, clinical evidence, post-market surveillance, and traceability against MDR requirements.

3. Prioritized remediation plan. Findings are ranked by regulatory risk and certification impact, with clear owners and sequencing.

4. Build and remediation. We work with your team to close gaps in documentation, procedures, and records.

5. Readiness review. Before notified body review, we test the system the way an auditor would.

6. Ongoing support. PMS, PMCF, and PSUR cycles continue after certification, and we can support those cycles as your system matures.

How Wintersmith Advisory Approaches MDR Compliance

We approach MDR as a systems integration problem—not a documentation exercise.

Our focus is on:

• Building defensible clinical and technical evidence

• Strengthening documentation structure and accessibility

• Integrating risk management across lifecycle stages

• Establishing proactive post-market systems

• Aligning QMS governance with regulatory expectations

• Preparing organizations for notified body scrutiny

For organizations operating across multiple regulatory frameworks, integrated management system consulting reduces duplication and improves system coherence.

Common Questions About EU MDR Compliance

Is Wintersmith Advisory a notified body?

No. Wintersmith Advisory is an independent consulting firm. Notified bodies perform conformity assessments and issue CE certificates; we help you prepare the systems, documentation, and evidence they review.

If we are ISO 13485 certified, are we already MDR compliant?

Not automatically. ISO 13485 is the usual foundation for the quality management system the MDR requires under Article 10(9), but the regulation adds obligations the standard does not fully cover, including clinical evaluation, PSURs, UDI and EUDAMED, and the PRRC role. A gap assessment shows where a certified system falls short of MDR expectations.

Does EU MDR apply to U.S. and other non-EU manufacturers?

Yes. Any manufacturer placing devices on the EU market must comply, wherever it is located. Non-EU manufacturers must also appoint an EU Authorized Representative, and importers and distributors carry their own verification duties.

Can our legacy MDD devices stay on the market until 2027 or 2028?

Only if they meet the conditions of the extended transition under Regulation (EU) 2023/607, including an MDR-compliant QMS and a signed notified body agreement by the 2024 deadlines. Devices that meet those conditions have until December 31, 2027, or December 31, 2028, depending on risk class. The extension buys time; it does not lower what the notified body will expect at assessment.

Can MDR compliance be coordinated with FDA QMSR requirements?

Yes. The FDA's Quality Management System Regulation, effective February 2, 2026, incorporates ISO 13485:2016 by reference, so one ISO 13485-based quality system can support both markets. Region-specific requirements, such as MDR clinical evaluation and EUDAMED registration, still need to be mapped and controlled separately.

Start Strengthening EU MDR Compliance

EU MDR compliance is continuous. It is not achieved once and maintained passively.

If your organization is preparing for EU market entry, notified body review, or MDR remediation, the next step is a structured evaluation of how your system performs under regulatory expectations.

Wintersmith Advisory provides disciplined, audit-ready MDR consulting designed to protect timelines, maintain market access, and strengthen regulatory confidence.

Schedule a free consultation to discuss your devices, transition status, and where to start.

If You’re Also Evaluating…

Organizations navigating EU MDR often evaluate:

• FDA QMSR Consultant

• Medical Devices & Life Sciences

• What to Expect from a Medical Device Consultant

These topics are frequently addressed together to build an integrated and defensible global medical device compliance system.