IVDR Navigator

Consolidated 10.01.2025

The full consolidated text of Regulation (EU) 2017/746, article by article — searchable, cross-referenced and citable.

Annex VII
Annex VIIC1

Requirements to be met by notified bodies

1. ORGANISATIONAL AND GENERAL REQUIREMENTS

1.1. Legal status and organisational structure

1.1.1.

Each notified body shall be established under the national law of a Member State, or under the law of a third country with which the Union has concluded an agreement in this respect. Its legal personality and status shall be fully documented. Such documentation shall include information about ownership and the legal or natural persons exercising control over the notified body.

1.1.2.

If the notified body is a legal entity that is part of a larger organisation, the activities of that organisation as well as its organisational structure and governance, and the relationship with the notified body shall be clearly documented. In such cases, the requirements of Section 1.2 are applicable to both the notified body and the organisation to which it belongs.

1.1.3.

If a notified body wholly or partly owns legal entities established in a Member State or in a third country or is owned by another legal entity, the activities and responsibilities of those entities, as well as their legal and operational relationships with the notified body, shall be clearly defined and documented. Personnel of those entities performing conformity assessment activities under this Regulation shall be subject to the applicable requirements of this Regulation.

1.1.4.

The organisational structure, allocation of responsibilities, reporting lines and operation of the notified body shall be such that they ensure that there is confidence in the performance by the notified body and in the results of the conformity assessment activities it conducts.

1.1.5.

The notified body shall clearly document its organisational structure and the functions, responsibilities and authority of its top-level management and of other personnel who may have an influence upon the performance by the notified body upon the results of its conformity assessment activities.

1.1.6.

The notified body shall identify the persons in top-level management that have overall authority and responsibility for each of the following:

(a)

provision of adequate resources for conformity assessment activities;

(b)

development of procedures and policies for the operation of the notified body;

(c)

supervision of implementation of the procedures, policies and quality management systems of the notified body;

(d)

supervision of the notified body's finances;

(e)

activities and decisions taken by the notified body, including contractual agreements;

(f)

delegation of authority to personnel and/or committees, where necessary, for the performance of defined activities;

(g)

interaction with the authority responsible for notified bodies and the obligations regarding communications with other competent authorities, the Commission and other notified bodies.

1.2. Independence and impartiality

1.2.1.

The notified body shall be a third-party body that is independent of the manufacturer of the device in relation to which it performs conformity assessment activities. The notified body shall also be independent of any other economic operator having an interest in the device as well as of any competitors of the manufacturer. This does not preclude the notified body from carrying out conformity assessment activities for competing manufacturers.

1.2.2.

The notified body shall be organised and operated so as to safeguard the independence, objectivity and impartiality of its activities. The notified body shall document and implement a structure and procedures for safeguarding impartiality and for promoting and applying the principles of impartiality throughout its organisation, personnel and assessment activities. Such procedures shall provide for the identification, investigation and resolution of any case in which a conflict of interest may arise including involvement in consultancy services in the field of devices prior to taking up employment with the notified body. The investigation, outcome and its resolution shall be documented.

1.2.3.

The notified body, its top-level management and the personnel responsible for carrying out the conformity assessment tasks shall not:

(a)

be the designer, manufacturer, supplier, installer, purchaser, owner or maintainer of devices which they assess, nor the authorised representative of any of those parties. Such restriction shall not preclude the purchase and use of assessed devices that are necessary for the operations of the notified body and the conduct of the conformity assessment, or the use of such devices for personal purposes;

(b)

be involved in the design, manufacture or construction, marketing, installation and use, or maintenance of the devices for which they are designated, nor represent the parties engaged in those activities;

(c)

engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are designated;

(d)

offer or provide any service which may jeopardise the confidence in their independence, impartiality or objectivity. In particular, they shall not offer or provide consultancy services to the manufacturer, its authorised representative, a supplier or a commercial competitor as regards the design, construction, marketing or maintenance of the devices or processes under assessment; and

(e)

be linked to any organisation which itself provides consultancy services as referred to in the point (d). Such restriction shall not preclude general training activities that are not client specific and that relate to regulation of devices s or to related standards.

1.2.4.

Involvement in consultancy services in the field of devices prior to taking up employment with a notified body shall be fully documented at the time of employment, and potential conflicts of interests shall be monitored and resolved in accordance with this Annex. Personnel who were formerly employed by a specific client, or provided consultancy services in the field of devices to that specific client prior to taking up employment with a notified body, shall not be assigned for conformity assessment activities for that specific client or companies belonging to the same group for a period of three years.

1.2.5.

The impartiality of notified bodies, of their top-level management and of the assessment personnel shall be guaranteed. The level of the remuneration of the top-level management and assessment personnel of a notified body and subcontractors involved in assessment activities shall not depend on the results of the assessments. Notified bodies shall make publicly available the declarations of interest of their top-level management.

1.2.6.

If a notified body is owned by a public entity or institution, independence and absence of any conflict of interests shall be ensured and documented between, on the one hand, the authority responsible for notified bodies and/or the competent authority and, on the other hand, the notified body.

1.2.7.

The notified body shall ensure and document that the activities of its subsidiaries or subcontractors or of any associated body, including the activities of its owners do not affect its independence, impartiality or the objectivity of its conformity assessment activities.

1.2.8.

The notified body shall operate in accordance with a set of consistent, fair and reasonable terms and conditions, taking into account the interests of small and medium-sized enterprises as defined in Recommendation 2003/361/EC in relation to fees.

1.2.9.

The requirements laid down in this Section shall in no way preclude exchanges of technical information and regulatory guidance between a notified body and a manufacturer applying for conformity assessment.

1.3. Confidentiality

1.3.1.

The notified body shall have documented procedures in place ensuring that its personnel, committees, subsidiaries, subcontractors, and any associated body or personnel of external bodies respect the confidentiality of the information which comes into its possession during the performance of the conformity assessment activities, except when disclosure is required by law.

1.3.2.

The personnel of a notified body shall observe professional secrecy in carrying out their tasks under this Regulation or any provision of national law giving effect to it, except in relation to the authorities responsible for notified bodies, competent authorities for devices in the Member States or the Commission. Proprietary rights shall be protected. The notified body shall have documented procedures in place in respect of the requirement of this Section.

1.4. Liability

1.4.1.

The notified body shall take out appropriate liability insurance for its conformity assessment activities, unless liability is assumed by the Member State in question in accordance with national law or that Member State is directly responsible for their conformity assessment.

1.4.2.

The scope and overall financial value of the liability insurance shall correspond to the level and geographic scope of activities of the notified body and be commensurate with the risk profile of the devices certified by the notified body. The liability insurance shall cover cases where the notified body may be obliged to withdraw, restrict or suspend certificates.

1.5. Financial requirements

The notified body shall have at its disposal the financial resources required to conduct its conformity assessment activities within its scope of designation and related business operations. It shall document and provide evidence of its financial capacity and its long-term economic viability, taking into account, where relevant, any specific circumstances during an initial start-up phase.

1.6. Participation in coordination activities

1.6.1.

The notified body shall participate in, or ensure that its assessment personnel is informed of any relevant standardisation activities and in the activities of the notified body coordination group referred to in Article 49 of Regulation (EU) 2017/745 and that its assessment and decision-making personnel are informed of all relevant legislation, guidance and best practice documents adopted in the framework of this Regulation.

1.6.2.

The notified body shall take into consideration guidance and best practice documents.

2. QUALITY MANAGEMENT REQUIREMENTS

2.1.

The notified body shall establish, document, implement, maintain and operate a quality management system that is appropriate to the nature, area and scale of its conformity assessment activities and is capable of supporting and demonstrating the consistent fulfilment of the requirements of this Regulation.

2.2.

The quality management system of the notified body shall address at least the following:

(a)

management system structure and documentation, including policies and objectives for its activities;

(b)

policies for assignment of activities and responsibilities to personnel;

(c)

assessment and decision-making processes in accordance with the tasks, responsibilities and role of the notified body's personnel and top-level management;

(d)

the planning, conduct, evaluation and, if necessary, adaptation of its conformity assessment procedures;

(e)

control of documents;

(f)

control of records;

(g)

management reviews;

(h)

internal audits;

(i)

corrective and preventive actions;

(j)

complaints and appeals;

(k)

continuous training.

Where documents are used in various languages, the notified body shall ensure and control that they have the same content.

2.3.

The top-level management of the notified body shall ensure that the quality management system is fully understood, implemented and maintained throughout the notified body organisation including subsidiaries and subcontractors involved in conformity assessment activities pursuant to this Regulation.

2.4.

The notified body shall require all personnel to formally commit themselves by a signature or equivalent to comply with the procedures defined by the notified body. That commitment shall cover aspects relating to confidentiality and to independence from commercial and other interests, and any existing or prior association with clients. The personnel shall be required to complete written statements indicating their compliance with confidentiality, independence and impartiality principles.

3. RESOURCE REQUIREMENTS

3.1. General

3.1.1.

Notified bodies shall be capable of carrying out all the tasks falling to them under this Regulation with the highest degree of professional integrity and the requisite competence in the specific field, whether those tasks are carried out by the notified body itself or on its behalf and under its responsibility.

In particular, notified bodies shall have the necessary personnel and possess or have access to all equipment, facilities and competence needed to perform properly the technical, scientific and administrative tasks entailed in the conformity assessment activities in relation to which they have been designated. Such requirement presupposes at all times and for each conformity assessment procedure and each type of devices in relation to which they have been designated, that the notified body has permanent availability of sufficient administrative, technical and scientific personnel who possess experience and knowledge relating to the relevant devices and the corresponding technologies. Such personnel shall be in sufficient numbers to ensure that the notified body in question can perform the conformity assessment tasks, including the assessment of the medical functionality, performance evaluations and the performance and safety of devices, for which it has been designated, having regard to the requirements of this Regulation, in particular those set out in Annex I.

A notified body's cumulative competences shall be such as to enable it to assess the types of devices for which it is designated. The notified body shall have sufficient internal competence to critically evaluate assessments conducted by external expertise. Tasks which a notified body is precluded from subcontracting are set out in Section 4.1.

Personnel involved in the management of the operation of a notified body's conformity assessment activities for devices shall have appropriate knowledge to set up and operate a system for the selection of assessment and verification staff, for verification of their competence, for authorisation and allocation of their tasks, for organisation of their initial and ongoing training, and for their assignment of their duties and monitoring of those staff, in order to ensure that personnel who carry out and perform assessment and verification operations are competent to fulfil the tasks required of them.

The notified body shall identify at least one individual within its top-level management as having overall responsibility for all conformity assessment activities in relation to devices.

3.1.2.

The notified body shall ensure that personnel involved in conformity assessment activities maintain their qualification and expertise by implementing a system for exchange of experience and a continuous training and education programme.

3.1.3.

The notified body shall clearly document the extent and limits of duties and responsibilities and the level of authorisation of to the personnel, including any subcontractors and external experts involved in conformity assessment activities and inform those personnel accordingly.

3.2. Qualification criteria in relation to personnel

3.2.1.

The notified body shall establish and document qualification criteria and procedures for selection and authorisation of persons involved in conformity assessment activities, including as regards knowledge, experience and other competence required, and the required initial and ongoing training. The qualification criteria shall address the various functions within the conformity assessment process, such as auditing, product evaluation or testing, technical documentation review, decision-making, and batch release, as well as the devices, technologies and areas, such as biocompatibility, sterilisation, self and near patient-testing, companion diagnostics and performance evaluation, covered by the scope of designation.

3.2.2.

The qualification criteria referred to in Section 3.2.1 shall refer to the scope of the notified body's designation in accordance with the scope description used by the Member State for the notification referred to in Article 38(3), providing a sufficient level of detail for the required qualification within the subdivisions of the scope description.

Specific qualification criteria shall be defined at least for the assessment of:

—
biological safety,
—
performance evaluation,
—
devices for self and near patient testing,
—
companion diagnostics,
—
functional safety,
—
software,
—
packaging, and
—
the different types of sterilisation processes.
3.2.3.

The personnel responsible for establishing qualification criteria and for authorising other personnel to perform specific conformity assessment activities shall be employed by the notified body itself and shall not be external experts or subcontracted. They shall have proven knowledge and experience in all of the following:

—
Union devices legislation and relevant guidance documents;
—
the conformity assessment procedures provided for in this Regulation;
—
a broad base of knowledge of device technologies and the design and manufacture of devices;
—
the notified body's quality management system, related procedures and the required qualification criteria;
—
training relevant to personnel involved in conformity assessment activities in relation to devices;
—
adequate experience in conformity assessments under this Regulation or previously applicable law within a notified body.
3.2.4.

The notified body shall have permanent availability of personnel with relevant clinical expertise and where possible such personnel shall be employed by the notified body itself. Such personnel shall be integrated throughout the notified body's assessment and decision-making process in order to:

—
identify when specialist input is required for the assessment of the performance evaluation conducted by the manufacturer and identify appropriately qualified experts;
—
appropriately train external clinical experts in the relevant requirements of this Regulation, CS, guidance and harmonised standards and ensure that the external clinical experts are fully aware of the context and implications of their assessment and the advice they provide;
—
be able to review and scientifically challenge the clinical data contained within the performance evaluation, and any associated performance study, and appropriately guide external clinical experts in the assessment of the performance evaluation presented by the manufacturer;
—
be able to scientifically evaluate and, if necessary, challenge the performance evaluation presented, and the results of the external clinical experts' assessment of the manufacturer's performance evaluation;
—
be able to ascertain the comparability and consistency of the assessments of performance evaluation conducted by clinical experts;
—
be able to make an assessment of the manufacturer's performance evaluation and a clinical judgement of the opinion provided by any external expert and make a recommendation to the notified body's decision maker; and
—
be able to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.5.

The personnel responsible for carrying out product-related reviews, (product reviewers), such as technical documentation reviews or type examination, including aspects such as performance evaluation, biological safety, sterilisation and software validation, shall have all the following proven qualifications:

—
successful completion of a university or a technical college degree or an equivalent qualification in relevant studies, such as medicine, pharmacy, engineering or other relevant sciences;
—
four years' professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing, or research, of which two years shall be in the design, manufacture, testing or use of devices or technology to be assessed or related to the scientific aspects to be assessed;
—
knowledge of device legislation, including the general safety and performance requirements set out in Annex I;
—
appropriate knowledge and experience of relevant harmonised standards, CS and guidance documents;
—
appropriate knowledge and experience of risk management and related device standards and guidance documents;
—
appropriate knowledge and experience of performance evaluation;
—
appropriate knowledge of the devices which they are assessing;
—
appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those assessments;
—
the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.6.

The personnel responsible for carrying out audits of the manufacturer's quality management system (site auditors) shall have all of the following proven qualifications:

—
successful completion of a university or a technical college degree or equivalent qualification in relevant studies, such as medicine, pharmacy, engineering or other relevant sciences;
—
four years' professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing or research, of which two years shall be in the area of quality management;
—
appropriate knowledge of devices legislation as well as related harmonised standards, CS and guidance documents;
—
appropriate knowledge and experience of risk management and related device standards and guidance documents;
—
appropriate knowledge of quality management systems and related l devices standards and guidance documents;
—
appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those audits;
—
training in auditing techniques enabling them to challenge quality management systems;
—
the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.
3.2.7.

The personnel with overall responsibility for final reviews and decision-making on certification shall be employed by the notified body itself and shall not be external experts or be subcontracted. Those personnel, as a group, shall have proven knowledge and comprehensive experience of all of the following:

—
devices legislation and relevant guidance documents;
—
device conformity assessments relevant to this Regulation;
—
the types of qualifications, experience and expertise relevant to device conformity assessment;
—
a broad base of knowledge of device technologies, including sufficient experience of the conformity assessment of devices being reviewed for certification, the device industry and the design and manufacture of devices;
—
the notified body's quality system, related procedures and the required qualifications for personnel involved;
—
the ability to draw up records and reports demonstrating that the conformity assessment activities have been appropriately carried out.

3.3. Documentation of qualification, training and authorisation of personnel

3.3.1.

The notified body shall have a procedure in place to fully document the qualification of each member of personnel involved in conformity assessment activities and the satisfaction of the qualification criteria referred to in Section 3.2. Where, in exceptional circumstances, the fulfilment of the qualification criteria set out in Section 3.2 cannot be fully demonstrated, the notified body shall justify to the authority responsible for notified bodies the authorisation of those members of personnel to carry out specific conformity assessment activities.

3.3.2.

For all of its personnel referred to in Sections 3.2.3 to 3.2.7, the notified body shall establish and maintain up to date:

—
a matrix detailing the authorisations and responsibilities of the personnel in respect of conformity assessment activities;
—
records attesting to the required knowledge and experience for the conformity assessment activity for which they are authorised. The records shall contain a rationale for defining the scope of the responsibilities for each of the assessment personnel and records of the conformity assessment activities carried out by each of them.

3.4. Subcontractors and external experts

3.4.1.

Notified bodies may, without prejudice to Section 3.2, subcontract certain clearly defined component parts of a conformity assessment activity.

The subcontracting of the auditing of quality management systems or of product-related reviews as a whole shall not be permitted, nevertheless parts of those activities may be conducted by subcontractors and external auditors and experts working on behalf of the notified body. The notified body in question shall retain full responsibility for being able to produce appropriate evidence of the competence of subcontractors and experts to fulfil their specific tasks, for making a decision based on a subcontractor's assessment and for the work conducted by subcontractors and experts on its behalf.

The following activities may not be subcontracted by notified bodies:

—
review of the qualifications and monitoring of the performance of external experts;
—
auditing and certification activities where the subcontracting in question is to auditing or certification organisations;
—
allocation of work to external experts for specific conformity assessment activities;
—
final review and decision-making functions.
3.4.2.

Where a notified body subcontracts certain conformity assessment activities either to an organisation or an individual, it shall have a policy describing the conditions under which subcontracting may take place, and shall ensure that:

—
the subcontractor meets the relevant requirements of this Annex;
—
subcontractors and external experts do not further subcontract work to organisations or personnel;
—
the natural or legal person that applied for conformity assessment has been informed of the requirements referred to in the first and second indent.

Any subcontracting or consultation of external personnel shall be properly documented, shall not involve any intermediaries, and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest. The notified body in question shall take full responsibility for the tasks performed by subcontractors.

3.4.3.

Where subcontractors or external experts are used in the context of a conformity assessment, in particular regarding novel devices or technologies, the notified body in question shall have adequate internal competence in each product area for which it is designated that is adequate for the purpose of leading the overall conformity assessment, verifying the appropriateness and validity of expert opinions and making decisions on certification.

3.5. Monitoring of competences, training and exchange of experience

3.5.1.

The notified body shall establish procedures for the initial evaluation and on-going monitoring of the competence, conformity assessment activities and performance of all internal and external personnel and subcontractors, involved in conformity assessment activities.

3.5.2.

Notified bodies shall review at regular intervals, the competence of their personnel, identify training needs and draw up a training plan to maintain the required level of qualification and knowledge of individual personnel. That review shall as a minimum, verify that personnel:

—
are aware of the Union and national law in force on devices, relevant harmonised standards, CS, guidance documents and the results of the coordination activities referred to in Section 1.6;
—
take part in the internal exchange of experience and the continuous training and education programme referred to in Section 3.1.2.

4. PROCESS REQUIREMENTS

4.1. General

The notified body shall have in place documented processes and sufficiently detailed procedures for the conduct of each conformity assessment activity for which it is designated, comprising the individual steps from pre-application activities up to decision making and surveillance and taking into account, when necessary, the respective specificities of the devices.

The requirements laid down in Sections 4.3, 4.4, 4.7 and 4.8 shall be fulfilled as part of the internal activities of notified bodies and shall not be subcontracted.

4.2. Notified body quotations and pre-application activities

The notified body shall

(a)

publish a publicly available description of the application procedure by which manufacturers can obtain certification from it. That description shall include which languages are acceptable for submission of documentation and for any related correspondence;

(b)

have documented procedures relating to, and documented details about, fees charged for specific conformity assessment activities and any other financial conditions relating to notified bodies' assessment activities for devices;,

(c)

have documented procedures in relation to advertising of its conformity assessment services. Those procedures shall ensure that advertising or promotional activities in no way imply or are capable of leading to an inference that their conformity assessment will offer manufacturers earlier market access or be quicker, easier or less stringent than that of other notified bodies;

(d)

have documented procedures requiring the review of pre-application information including the preliminary verification that the product is covered by this Regulation and its classification prior to issuing any quotation to the manufacturer relating to a specific conformity assessment;

(e)

ensure that all contracts relating to the conformity assessment activities covered by this Regulation are concluded directly between the manufacturer and the notified body and not with any other organisation.

4.3. Application review and contract

The notified body shall require a formal application signed by a manufacturer or an authorised representative containing all of the information and the manufacturer's declarations required by the relevant conformity assessment as referred to in Annexes IX to XI.

The contract between a notified body and a manufacturer shall take the form of a written agreement signed by both parties. It shall be kept by the notified body. This contract shall have clear terms and conditions and contain obligations that enable the notified body to act as required under this Regulation, including an obligation on the manufacturer to inform the notified body of vigilance reports, the right of the notified body to suspend, restrict or withdraw certificates issued and the duty of the notified body to fulfil its information obligations.

The notified body shall have documented procedures to review applications, addressing:

(a)

the completeness of those applications with respect to the requirements of the relevant conformity assessment procedure, as referred to in the corresponding Annex, under which approval has been sought,

(b)

the verification of the qualification of products covered by those applications as devices and their respective classifications,

(c)

whether the conformity assessment procedures chosen by the applicant are applicable to the device in question under this Regulation,

(d)

the ability of the notified body to assess the application based on its designation, and

(e)

the availability of sufficient and appropriate resources.

The outcome of each review of an application shall be documented. Refusals or withdrawals of applications shall be notified to the electronic system referred to in Article 52 and shall be accessible to other notified bodies.

4.4. Allocation of resources

The notified body shall have documented procedures to ensure that all conformity assessment activities are conducted by appropriately authorised and qualified personnel who are sufficiently experienced in the evaluation of the devices, systems and processes and related documentation that are subject to conformity assessment.

For each application, the notified body shall determine the resources needed and identify one individual responsible for ensuring that the assessment of that application is conducted in accordance with the relevant procedures and for ensuring that the appropriate resources including personnel are utilised for each of the tasks of the assessment. The allocation of tasks required to be carried out as part of the conformity assessment and any changes subsequently made to this allocation shall be documented.

4.5. Conformity assessment activities

4.5.1. General

The notified body and its personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical and scientific competence in the specific fields.

The notified body shall have expertise, facilities and documented procedures that are sufficient to effectively conduct the conformity assessment activities for which the notified body in question is designated, taking account of the relevant requirements set out in Annexes IX to XI and in particular the following requirements:

—
to appropriately plan the conduct of each individual project,
—
to ensure that the composition of the assessment teams is such that there is sufficient experience in relation to the technology concerned, and that there is continuous objectivity and independence, and to provide for rotation of the members of the assessment team at appropriate intervals,
—
to specify the rationale for fixing time limits for completion of conformity assessment activities,
—
to assess the manufacturer's technical documentation and the solutions adopted to meet the requirements laid down in Annex I,
—
to review the manufacturer's procedures and documentation relating to performance evaluation,
—
to address the interface between the manufacturer's risk management process and its appraisal and analysis of the performance evaluation and to evaluate their relevance for the demonstration of conformity with the relevant requirements in Annex I,
—
to carry out the ‘specific procedures’ referred to in Section 5 of Annex IX,
—
in the case of class B or C devices, to assess the technical documentation of devices selected on a representative basis,
—
to plan and periodically carry out appropriate surveillance audits and assessments, to carry out or request certain tests to verify the proper functioning of the quality management system and to perform unannounced on site audits,
—
relating to the sampling of devices verify that the manufactured device is in conformity with the technical documentation; such requirements shall define the relevant sampling criteria and testing procedure prior to sampling,
—
to evaluate and verify a manufacturer's compliance with relevant Annexes.

The notified body shall, where relevant, take into consideration available CS, guidance and best practice documents and harmonised standards, even if the manufacturer does not claim to be in compliance.

4.5.2. Quality management system auditing

(a)

As part of the assessment of the quality management system a, a notified body shall prior to an audit and in accordance with its documented procedures:

—
assess the documentation submitted in accordance with the relevant conformity assessment Annex, and draw up an audit programme which clearly identifies the number and sequence of activities required to demonstrate complete coverage of a manufacturer's quality management system and to determine whether it meets the requirements of this Regulation,
—
identify links between and allocation of responsibilities among, the various manufacturing sites, and identify relevant suppliers and/or subcontractors of the manufacturer, and consider the need to specifically audit any of those suppliers or subcontractors or both,
—
clearly define, for each audit identified in the audit programme, the objectives, criteria and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies and processes involved,
—
draw up and keep up to date, for class B and class C devices, a sampling plan for the assessment of technical documentation as referred to in Annexes II and III covering the range of such devices covered by the manufacturer's application. C1 That plan shall ensure that the entire range of devices covered by the certificate is sampled over the period of validity of the certificate, and ◄
—
select and assign appropriately qualified and authorised personnel for conducting the individual audits. The respective roles, responsibilities and authorities of the team members shall be clearly defined and documented.
(b)

Based on the audit programme it has drawn up, the notified body shall, in accordance with its documented procedures:

—
audit the manufacturer's quality management system in order to verify that the quality management system ensures that the devices covered conform to the relevant provisions of this Regulation which apply to devices at every stage, from design through final quality control to ongoing surveillance, and shall determine whether the requirements of this Regulation are met,
—
based on relevant technical documentation, and in order to determine whether the manufacturer meets the requirements referred to in the relevant conformity assessment Annex, review and audit the manufacturer's processes and subsystems,– in particular for:
—
design and development,
—
production and process controls,
—
product documentation,
—
purchasing controls including verification of purchased devices,
—
corrective and preventive actions including for post-market surveillance, and
—
PMPF,
—
and review and audit requirements and provisions adopted by the manufacturer, including those in relation to fulfilling the general safety and performance requirements set out in Annex I,
—
the documentation shall be sampled in such as a manner as to reflect the risks associated with the intended use of the device, the complexity of the manufacturing technologies, the range and classes of devices produced and any available post-market surveillance information,
—
if not already covered by the audit programme, audit the control of processes on the premises of the manufacturer's suppliers, when the conformity of finished devices is significantly influenced by the activity of suppliers and, in particular when the manufacturer cannot demonstrate sufficient control over its suppliers,
—
conduct assessments of the technical documentation based on its sampling plan and taking account of Section 4.5.4. for performance evaluation,
—
the notified body shall ensure that audit findings are appropriately and consistently classified in accordance with the requirements of this Regulation and with relevant standards, or with best practice documents developed or adopted by the MDCG.

4.5.3. Product verification

Assessment of the technical documentation

For assessment of the technical documentation conducted in accordance with Chapter II of Annex IX, notified bodies shall have sufficient expertise, facilities and documented procedures for:

—
the allocation of appropriately qualified and authorised personnel for the examination of individual aspects, such as use of the device, biocompatibility, performance evaluation, risk management and sterilisation, and
—
the assessment of conformity of the design with this Regulation, and taking account of Sections 4.5.4. and 4.5.5. This assessment shall include the examination of the implementation by manufacturers of incoming, in-process and final checks and the results thereof. If further tests or other evidence is required for the assessment of conformity with the requirements of this Regulation, the notified body in question shall carry out adequate physical or laboratory tests in relation to the device or request the manufacturer to carry out such tests.

Type-examinations

The notified body shall have documented procedures, sufficient expertise and facilities for the type-examination of devices in accordance with Annex X including the capacity to:

—
examine and assess the technical documentation, taking account of Sections 4.5.4. and 4.5.5, and verify that the type has been manufactured in conformity with that documentation;
—
establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility;
—
document its rationale for the selection of those parameters;
—
carry out the appropriate examinations and tests in order to verify that the solutions adopted by the manufacturer meet the general safety and performance requirements set out in Annex I. Such examinations and tests shall include all tests necessary to verify that the manufacturer has in fact applied the relevant standards it has opted to use;
—
agree with the applicant as to where the necessary tests will be performed if they are not to be carried out directly by the notified body;
—
assume full responsibility for test results. Test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.

Verification by examination and testing of every product batch

The notified body shall:

(a)

have documented procedures, sufficient expertise and facilities for the verification by examination and testing of every product batch in accordance with Annexes IX and XI;

(b)

establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility in order to:

—
verify, for class C devices, the conformity of the device with the type described in the EU type-examination certificate and with the requirements of this Regulation which apply to those devices,
—
confirm, for class B devices, the conformity with the technical documentation referred to in Annexes II and III and with the requirements of this Regulation which apply to those devices,
(c)

document its rationale for the selection of the parameters referred to in point (b);

(d)

have documented procedures to carry out the appropriate assessments and tests in order to verify the conformity of the device with the requirements of this Regulation by examining and testing every product batch as specified in Section 5 of Annex XI;

(e)

have documented procedures providing for the reaching of an agreement with the applicant concerning when and where necessary tests that are not to be carried out by the notified body itself are to be performed;

(f)

assume full responsibility for test results in accordance with documented procedures; test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.

4.5.4. Performance evaluation assessment

The assessment by notified bodies of procedures and documentation shall address the results of literature searches and all validation, verification and testing performed and conclusions drawn, and shall typically include considering the use of alternative materials and substances and take account of the packaging, stability including shelf life of the finished device. Where no new testing has been undertaken by a manufacturer or where there have been deviations from procedures, the notified body in question shall critically examine the justification presented by the manufacturer.

The notified body shall have documented procedures in place relating to the assessment of a manufacturer's procedures and documentation relating to performance evaluation both for initial conformity assessment and on an ongoing basis. The notified body shall examine, validate and verify that the manufacturer's procedures and documentation adequately address:

(a)

the planning, conduct, assessment, reporting and updating of the performance evaluation as referred to in Annex XIII,

(b)

post-market surveillance and post-market performance follow up,

(c)

the interface with the risk management process,

(d)

the appraisal and analysis of the available data and its relevance with regard to demonstrating conformity with the relevant requirements in Annex I,

(e)

the conclusions drawn with regard to the clinical evidence and drawing up of the performance evaluation report.

The procedures referred to in the second paragraph shall take into consideration available CS, guidance and best practice documents.

The notified body's assessment of performance evaluations as referred to in Annex XIII shall cover:

—
the intended use specified by the manufacturer and claims for the device defined by it,
—
the planning of the performance evaluation,
—
the methodology for the literature search,
—
relevant documentation from the literature search,
—
the performance studies,
—
post-market surveillance and post-market performance follow up,
—
validity of equivalence claimed in relation to other devices, the demonstration of equivalence, the suitability and conclusions data from equivalent and similar devices,
—
the performance evaluation report,
—
justifications in relation to non-performance of performance studies or PMPF.

In relation to data from performance studies included within the performance evaluation, the notified body in question shall ensure that the conclusions drawn by the manufacturer are valid in the light of the approved performance study plan.

The notified body shall ensure that the performance evaluation adequately addresses the relevant safety and performance requirements provided for in Annex I, that it is appropriately aligned with the risk management requirements and that it is conducted in accordance with Annex XIII and that it is appropriately reflected in the information provided relating to the device.

4.5.5. Specific Procedures

The notified body shall have documented procedures, sufficient expertise and facilities for the procedures referred to in Section 5 of Annex IX, for which they are designated.

In the case of companion diagnostics, the notified body shall have documented procedures in place that aim to fulfil the requirements of this Regulation in relation to consultation of the EMA or a medicinal products competent authority during its assessment of such types of device.

4.6. Reporting

The notified body shall:

—
ensure that all steps of the conformity assessment are documented so that the conclusions of the assessment are clear and demonstrate compliance with the requirements of this Regulation and can represent objective evidence of such compliance to persons that are not themselves involved in the assessment, for example personnel in designating authorities,
—
ensure that records that are sufficient to provide a discernible audit trail are available for quality management system audits,
—
clearly document the conclusions of its assessment of performance evaluation in a performance evaluation assessment report,
—
for each specific project, provide a detailed report which shall be based on a standard format containing a minimum set of elements determined by the MDCG.

The report of the notified body shall:

—
clearly document the outcome of its assessment and draw clear conclusions from the verification of the manufacturer's conformity with the requirements of this Regulation,
—
make a recommendation for a final review and for a final decision to be taken by the notified body; this recommendation shall be signed off by the member of personnel responsible in the notified body,
—
be provided to the manufacturer in question.

4.7. Final review

The notified body shall prior to making a final decision:

—
ensure that the personnel assigned for the final review and decision making on specific projects are appropriately authorised and are different from the personnel who have conducted the assessments,
—
verify that the report or reports and supporting documentation needed for decision making, including concerning resolution of non-conformities noted during assessment, are complete and sufficient with respect to the scope of the application, and
—
verify whether there are any unresolved non-conformities preventing issuance of a certificate.

4.8. Decisions and certifications

The notified body shall have documented procedures for decision-making including as regards the allocation of responsibilities for the issuance, suspension, restriction and withdrawal of certificates. Those procedures shall include the notification requirements laid down in Chapter V of this Regulation. The procedures shall allow the notified body in question to:

—
decide, based on the assessment documentation and additional information available whether the requirements of this Regulation are fulfilled,
—
decide, based on the results of its assessment of the performance evaluation and risk management whether the post-market surveillance plan, including the PMPF plan, is adequate,
—
decide on specific milestones for further review by the notified body of the up to date performance evaluation,
—
decide whether specific conditions or provisions need to be defined for the certification,
—
decide, based on the novelty, risk classification, performance evaluation and conclusions from the risk analysis of the device, on a period of certification not exceeding five years,
—
clearly document decision making and approval steps including approval by signature of the members of personnel responsible,
—
clearly document responsibilities and mechanisms for communication of decisions, in particular, where the final signatory of a certificate differs from the decision maker or decision makers or does not fulfil the requirements laid down in Section 3.2.7.,
—
issue a certificate or certificates in accordance with the minimum requirements laid down in Annex XII for a period of validity not exceeding five years and shall indicate whether there are specific conditions or limitations associated with the certification,
—
issue a certificate or certificates for the applicant alone and shall not issue certificates covering multiple entities,
—
ensure that the manufacturer is notified of the outcome of the assessment and the resultant decision and that they are entered into the electronic system referred to in Article 52.

4.9. Changes and modifications

The notified body shall have documented procedures and contractual arrangements with manufacturers in place relating to the manufacturers' information obligations and the assessment of changes to:

—
the approved quality management system or systems or to the product-range covered,
—
the approved design of a device,
—
the approved type of a device,
—
any substance incorporated in or utilised for the manufacturing of a device and being subject to the specific procedures in accordance with Section 4.5.5.

The procedures and contractual arrangements referred to in the first paragraph shall include measures for checking the significance of the changes referred to in the first paragraph.

In accordance with its documented procedures, the notified body in question shall:

—
ensure that manufacturers submit for prior approval plans for changes as referred to in the first paragraph and relevant information relating to such changes,
—
assess the changes proposed and verify whether, after these changes, the quality management system, or the design of a device or type of a device, still meets the requirements of this Regulation,
—
notify the manufacturer of its decision and provide a report or, as applicable, a supplementary report, which shall contain the justified conclusions of its assessment.

4.10. Surveillance activities and post-certification monitoring

The notified body shall have documented procedures:

—
defining how and when surveillance activities of manufacturers are to be conducted. Those procedures shall include arrangements for unannounced on-site audits of manufacturers and, where applicable, subcontractors and suppliers carrying out product tests and the monitoring of compliance with any conditions binding manufacturers and associated with certification decisions, such as updates to clinical data at defined intervals,
—
for screening relevant sources of scientific and clinical data and post-market information relating to the scope of their designation. Such information shall be taken into account in the planning and conduct of surveillance activities,
—
to review vigilance data to which they have access under to Article 87 in order to estimate its impact, if any, on the validity of existing certificates. The results of the evaluation and any decisions taken shall be thoroughly documented.

The notified body in question shall, upon receipt of information about vigilance cases from a manufacturer or competent authorities, decide on which of the following options to apply:

—
not to take action on the basis that the vigilance case is clearly not related to the certification granted,
—
observe the manufacturer's and competent authorities' activities and the results of the manufacturer's investigation so as to determine whether the certification granted is at risk or whether adequate corrective action has been taken,
—
perform extraordinary surveillance measures, such as document reviews, short-notice or unannounced audits and product testing, where it is likely that the certification granted is at risk,
—
increase the frequency of surveillance audits,
—
review specific products or processes on the occasion of the next audit of the manufacturer, or
—
take any other relevant measure.

In relation to surveillance audits of manufacturers, the notified body shall have documented procedures to:

—
conduct surveillance audits of the manufacturer on at least an annual basis which shall be planned and conducted in line with the relevant requirements in Section 4.5.,
—
ensure that it adequately assesses the manufacturer's documentation on, and application of, the provisions on vigilance, the post-market surveillance and PMPF,
—
sample and test devices and technical documentation, during audits, according to pre-defined sampling criteria and testing procedures to ensure that the manufacturer continuously applies the approved quality management system,
—
ensure that the manufacturer complies with the documentation and information obligations laid down in the relevant Annexes and that its procedures take into account best practices in the implementation of quality management systems,
—
ensure that the manufacturer does not use quality management system or device approvals in a misleading manner,
—
gather sufficient information to determine if the quality management system continues to comply with the requirements of this Regulation,
—
ask the manufacturer, if non-conformities are detected, for corrections, corrective actions, and where applicable preventive actions, and
—
where necessary, impose specific restrictions on the relevant certificate, or suspend or withdraw it.

The notified body shall, if listed as part of the conditions for certification:

—
conduct an in-depth review of the performance evaluation as most recently updated by the manufacturer based on the manufacturer's post-market surveillance, on its PMPF and on clinical literature relevant to the condition being treated with the device or on clinical literature relevant to similar devices,
—
clearly document the outcome of the in-depth review and address any specific concerns to the manufacturer or impose any specific conditions on it,
—
ensure that the performance evaluation as most recently updated is appropriately reflected in the instructions for use and, where applicable, the summary of safety and performance.

4.11. Re-certification

The notified body shall have documented procedures in place relating to the re-certification reviews and the renewal of certificates. Re-certification of approved quality management systems or EU technical documentation assessment certificates or EU type-examination certificates shall occur at least every five years.

The notified body shall have documented procedures relating to renewals of EU technical documentation assessment certificates and EU type-examination certificates and those procedures shall require the manufacturer in question to submit a summary of changes and scientific findings for the device, including:

(a)

all changes to the originally approved device, including changes not yet notified,

(b)

experience gained from post-market surveillance,

(c)

experience from risk-management,

(d)

experience from updating the proof of compliance with the general safety and performance requirements set out in Annex I,

(e)

experience from reviews of the performance evaluation, including the results of any performance studies and PMPF,

(f)

changes to the requirements, to components of the device or to the scientific or regulatory environment,

(g)

changes to applied or new harmonised standards, CS or equivalent documents, and

(h)

changes in medical, scientific and technical knowledge, such as:

—
new treatments,
—
changes in test methods,
—
new scientific findings on materials and components, including findings on their biocompatibility,
—
experience from studies on comparable devices,
—
data from registers and registries,
—
experience from performance studies with comparable devices.

The notified body shall have documented procedures to assess the information referred to in the second paragraph and shall pay particular attention to clinical data from post-market surveillance and PMPF activities undertaken since the previous certification or re-certification, including appropriate updates to manufacturers' performance evaluation reports.

For the decision on the re-certification, the notified body in question shall use the same methods and principles as for the initial certification decision. If necessary, separate forms shall be established for re-certification taking into account the steps to be taken for certification, such as application and application review.

This tool is provided for convenience only and has no legal effect. Only the texts published in the Official Journal of the European Union are authentic. Source: EUR-Lex, CELEX 02017R0746-20250110, © European Union. Reuse is authorised provided the source is acknowledged.