AI-native regulatory consulting for medtech.

Classification follows the intended purpose, and for software the decisive provision is usually Rule 11. Software that provides information used to take diagnostic or therapeutic decisions is Class IIa, and it moves to Class IIb where such a decision could cause serious deterioration of health or a surgical intervention, or to Class III where it could cause death or an irreversible deterioration. Software intended to monitor physiological processes is Class IIa, or Class IIb where variations could result in immediate danger. Software that drives or influences another device is classified in its own right, but not lower than the class of that device. Class I remains only for software with no diagnostic or therapeutic decision role, which is a narrower group than most teams assume.

Yes. Self certification stops at Class I. Every Class IIa device needs a Notified Body, which assesses your quality management system and samples the technical documentation across the device categories you place on the market. Three Class I subgroups also need a Notified Body, but only for one specific aspect: sterile devices for the sterility, measuring devices for the metrological function, and reusable surgical instruments for reuse. In practice the binding constraint is capacity, not eligibility, so approach a Notified Body well before you plan to submit.

They stack rather than replace one another. If an AI enabled device already requires a Notified Body under the MDR, it is generally treated as high risk under the AI Act, so AI Act duties such as data governance, logging, transparency, human oversight, accuracy and robustness apply on top of your MDR obligations. The intent is that this is assessed through the existing medical device conformity assessment rather than a second parallel audit. The timing changed in July 2026: the Digital Omnibus on AI, Regulation (EU) 2026/1744, moved the high risk obligations for AI embedded in regulated products, which includes medical devices, to 2 August 2028, and moved standalone Annex III systems to 2 December 2027. The prohibitions and the general purpose AI rules already apply. The practical consequence is that most of the work should extend your existing QMS, risk management file and post market plan instead of creating a separate AI compliance system.

Enough clinical data to show the device achieves its intended purpose, meets the relevant general safety and performance requirements, and that its benefits outweigh its risks in normal use. That means a clinical evaluation plan written before the search, a systematic and reproducible literature search with documented appraisal of what it returned, and then either your own clinical investigation data or an equivalence claim that is technically, biologically and clinically justified and backed by contractual access to the equivalent device's technical documentation. The conclusion must tie back to the risk management file, and it cannot be a one off: post market clinical follow up feeds new data into the CER on a defined cycle. Article 61 and Annex XIV are the legal basis, and MEDDEV 2.7/1 Rev 4 is still the method most Notified Bodies expect to see.

They are separate routes with separate infrastructure, and for most manufacturers a CE mark remains the practical route into Great Britain today. The MHRA accepts devices certified under the EU MDR or IVDR until 30 June 2030, and devices still certified under the older MDD or AIMDD until the sooner of certificate expiry or 30 June 2028. UKCA requires a UK Approved Body rather than an EU Notified Body, and a UK Responsible Person if you are not established in the UK, though Class I devices that are neither sterile nor measuring can self certify. Northern Ireland continues to follow EU rules, which is why the UKNI mark exists for devices certified by a UK body. The MHRA consulted in early 2026 on recognising CE marked MDR and IVDR devices indefinitely and has not published an outcome, so confirm the current position before you build a plan around these dates.