Medical Devices

The route to market for medical devices and IVDs

The intended purpose of your device determines its risk class, and the class sets the conformity route. We establish the class first, then consolidate the evidence, align your quality management system and prepare the submission with you. Where Article 15 of Regulation (EU) 2017/745 (MDR) or Regulation (EU) 2017/746 (IVDR) requires a person responsible for regulatory compliance (PRRC), we can take on that role as an outsourced service.

We work under both regulations, on medical devices, in vitro diagnostic medical devices (IVDs), software as a medical device and medical mobile apps. The route below is drawn for the EU and Portugal.

Map your device's route to market

A first map, not a regulatory conclusion.

This is the route for a medical device sold in the EU and Portugal. To map your own, talk to us about your product.

EU

  1. Qualification and classification. Is it a medical device, and in which class? (Regulation (EU) 2017/745, Annex VIII)
  2. Regulatory strategy and roadmap. The class turned into a plan: the conformity route, how far a Notified Body is involved, and the milestones to market access. You get: a roadmap, and a gap analysis against the general safety and performance requirements (GSPR) that feeds your design inputs. (Regulation (EU) 2017/745 (MDR), Annex I)
  3. Evidence and technical documentation. Technical documentation under Annexes II and III, and the clinical evaluation. Inside the CE-marking programme: risk management, usability and, for an IVD, the IVD performance evaluation. (Regulation (EU) 2017/745, Annexes II and III, Annex XIV; EN ISO 14971; EN IEC 62366-1)
  4. Notified Body and CE marking. We prepare the submission and follow the Notified Body's questions through to CE marking. The Notified Body decides. (Regulation (EU) 2017/745 (MDR))
  5. Registration and distribution. EUDAMED actor registration, with the Single Registration Number (SRN). UDI and device registration support, and guidance on implementing unique device identification (UDI), including the design of the UDI carrier. (EUDAMED (EU))
  6. Post-market and outsourced roles. Post-market surveillance, vigilance, and the person responsible for regulatory compliance. (Regulation (EU) 2017/745, Article 15) We can act as outsourced PRRC; European Authorised Representative, as an extension of the PRRC service.

runs alongside: Quality management system. An ISO 13485 system, adapted from your documents or built from a gap analysis, and audited internally.

PT · If you are a manufacturer

  1. The EU route. Portugal is in the EU, so the EU route applies. (Regulation (EU) 2017/745)

PT · If you distribute or import devices in Portugal

  1. Medical-device wholesale distribution compliance. For distributors and importers in Portugal: wholesale distribution under Portaria n.º 256/2016. (Portaria n.º 256/2016; Decreto-Lei n.º 29/2024, Article 27) We can act as Technical Manager for medical-device distribution in Portugal.

A first map, not a regulatory conclusion. Our responsibility starts when you engage us.

We send the route here, by email.

Seven steps, one of them alongside the others

Qualification and classification

Is it a medical device or an IVD, and in which class? Qualification always comes first.

You get: a qualification and classification report.

More on Qualification and classification

What you get

A qualification and classification report. One technical report that sets out:

  • whether the product qualifies as a medical device, and the reasoning behind that conclusion;
  • its risk class under Annex VIII of Regulation (EU) 2017/745;
  • for an in vitro diagnostic medical device (IVD), whether it qualifies as one and its class under Regulation (EU) 2017/746.

The report shows the reasoning behind its conclusions, so your team and ours work from the same understanding from the start.

Why this step comes first

The intended purpose and the risk class decide the conformity assessment route and how far a Notified Body is involved. The strategy, the documentation, the time and the budget you plan for all depend on this step.

For software, defining the intended purpose and qualifying the product matter even more, because not all healthcare software is a medical device.

We follow the MDCG guidance: the Manual on borderline and classification under Regulations (EU) 2017/745 and (EU) 2017/746, MDCG 2021-24 on the classification of medical devices, MDCG 2020-16 on the classification of in vitro diagnostic medical devices, and MDCG 2019-11 on the qualification and classification of software.

We start from a demonstration of the product, then write the report.

Questions on this step

Someone has already told us our product is not a device, or that it is Class I.

The reasoning matters more than the answer. We take the intended purpose you define and analyse it against the classification rules and the guidance documents. If a conclusion depends on something we cannot confirm, the report says so.

We are not sure it is a device at all. Is this the right place to start?

Yes. Qualification comes before classification and before any conformity assessment route. It starts from a defined intended purpose.

Do we need this if we are going to do a full regulatory strategy?

The regulatory strategy and roadmap is one service, and it already contains the qualification and classification rationale. If you commission it, you do not need this report as well. If you only need the answer to "is it a device, and which class", the report stands on its own.

When will we have the report?

We give you a date once we have seen the demonstration. It depends on how well the intended purpose is defined and on the product's complexity. Software, for example, can have several modules, and some may qualify as a medical device while others do not.

References and deliverable

Regulation
Regulation (EU) 2017/745, Annex VIII (risk classification)
IVDs
Regulation (EU) 2017/746
Guidance
Manual on borderline and classification under Regulations (EU) 2017/745 and (EU) 2017/746; MDCG 2021-24 (classification of medical devices); MDCG 2020-16 (classification of IVDs); MDCG 2019-11 (qualification and classification of software). These are guidance documents; none is a legal act.
Deliverable
One qualification and classification report

Regulatory strategy

Your regulatory strategy as a plan: the conformity route, how far a Notified Body is involved, and the milestones to market access.

You get: a roadmap, and a gap analysis against the general safety and performance requirements (GSPR).

More on Regulatory strategy

What you get

Regulatory strategy and roadmap (MDR/IVDR).

  • the qualification and classification rationale, with the intended purpose it rests on;
  • the conformity route and the level of Notified Body involvement;
  • a roadmap with milestones to market access;
  • a regulatory risk assessment.

For an IVD, the roadmap is prepared according to Regulation (EU) 2017/746.

GSPR checklist and gap analysis. Your device’s development status compared with the general safety and performance requirements (GSPR) in Annex I of Regulation (EU) 2017/745:

  • a GSPR checklist;
  • an Annex I gap analysis;
  • recommendations for your design inputs.

Why do it now, not at the end

The GSPR gap analysis is worth most early in the design. It is easier to treat regulatory requirements as early inputs that shape product decisions than to review compliance at the end. That is what we mean by regulatory by design.

The roadmap also gives you one plan to work to. It shows which processes can run in parallel and which work has to wait for something else.

Questions on this step

We already know our class. Do we still need a strategy?

The risk class is where the strategy starts. The strategy chooses the conformity route and sets the order of the work. The GSPR gap analysis shows where your device and your company stand today.

How long will it take to reach the market?

Time to market depends on the risk class of your device, on how far a Notified Body is involved, on the state of your technical documentation, clinical evidence above all, and on the maturity of your quality management system. The roadmap sets the milestones with you. If the date you are working to is not realistic, the roadmap says so.

Can the strategy include the US?

Not as a written roadmap. For the US and other non-EU markets we map the route with you, market by market.

References and deliverables

Regulations
Regulation (EU) 2017/745 (MDR), Annex I (general safety and performance requirements); Regulation (EU) 2017/746 (IVDR)
Deliverables
Qualification and classification rationale · conformity route · roadmap with milestones · regulatory risk assessment · GSPR checklist · Annex I gap analysis · design input recommendations

Evidence and technical documentation

Technical documentation under Annexes II and III of the MDR or the IVDR, and the clinical evaluation with its literature search. Inside the CE-marking programme: risk management, usability, post-market surveillance (PMS) and, for an IVD, the IVD performance evaluation.

You get: the technical documentation a Notified Body assesses.

More on Evidence and technical documentation

What you get

Technical documentation under Annexes II and III of Regulation (EU) 2017/745 (MDR) or Regulation (EU) 2017/746 (IVDR). Either we review what you have and advise, or we write it.

For the Annex II technical documentation, we work on:

  • the device description and specification, including variants and accessories, the intended purpose, the intended users and patients, the classification rationale, the unique device identification (UDI) and the reference to previous and similar generations;
  • the information supplied by the manufacturer, including labels and instructions for use;
  • design and manufacturing information: design stages, manufacturing processes and validation activities;
  • the general safety and performance requirements (GSPR);
  • the benefit-risk analysis and the risk management file;
  • product verification and validation, including the compilation of pre-clinical and clinical data: biocompatibility, electrical safety, software verification and validation, stability and shelf life, performance and safety testing, and the clinical evaluation.

For the Annex III technical documentation, we work on the post-market surveillance (PMS) plan, with its data sources, methods, indicators and thresholds, and on the report that follows from it. For devices under the MDR, that is a post-market surveillance report for class I and a periodic safety update report (PSUR) for class IIa and above.

Labelling and instructions for use, including electronic instructions for use and the UDI carrier, are reviewed as part of this work.

Clinical evidence. A state-of-the-art review of the scientific, clinical and technical knowledge for your device type. The clinical evaluation under Annex XIV of Regulation (EU) 2017/745: the clinical evaluation plan, the literature search protocol and the clinical evaluation report (CER), with one review round. Later, an update that uses post-market surveillance and post-market clinical follow-up (PMCF) data.

Inside the CE-marking programme we also cover risk management and usability (EN ISO 14971, EN IEC 62366-1), with cybersecurity work for software; the pre-clinical and biological evaluation (ISO 10993 plan for hardware; pre-clinical and clinical strategy for software); for an IVD, the IVD performance evaluation; and the draft EU Declaration of Conformity.

How the pieces fit

The state-of-the-art review comes first because it benchmarks the design and shapes the clinical evaluation strategy or, for an IVD, the IVD performance evaluation strategy. Risk management, usability and pre-clinical evaluation are done inside the CE-marking programme.

For software, the documentation follows the software lifecycle according to IEC 62304. We are used to working with Agile teams.

We are not a laboratory. We can write verification and validation plans, for example the biological evaluation plan, but the testing is always done by external laboratories.

The dates for this step depend on the class, on how many devices or variants the file covers, on whether clinical data already exist and, for software, on how much of the lifecycle is documented. We set them with you in the regulatory strategy.

Questions on this step

Will you understand our technology?

We have worked with a range of medical devices, IVDs and software as a medical device, across different risk classes.

We already have technical documentation. Do we need to start again?

No. We can review what you already have and advise on the gaps.

Do you support clinical investigations?

On request: a gap analysis of your procedures and study documentation, and support in contact with competent authorities where it applies.

References and deliverables

Regulations
Regulation (EU) 2017/745, Annexes II and III (technical documentation), Annex XIV (clinical evaluation); Regulation (EU) 2017/746
Standards
EN ISO 14971 (risk management); EN IEC 62366-1 (usability); IEC 62304 (software lifecycle); ISO 10993 (biological evaluation)
Deliverables
Technical documentation, labelling review included · state-of-the-art review · clinical evaluation plan, protocol and report · inside the CE-marking programme: risk analysis and benefit-risk report, usability assessment strategy, biological evaluation plan, IVD performance evaluation, draft EU Declaration of Conformity

Quality management system

Runs alongside the route

An ISO 13485 quality management system (QMS), built from scratch or adapted from your documents, and audited internally.

Role we can take on:

More on Quality management system

What you get

QMS implementation (ISO 13485). A QMS designed and implemented to comply with the harmonised standard EN ISO 13485:2016+A11:2021:

  • a gap analysis;
  • a quality manual and a process map;
  • standard operating procedures (SOPs), work instructions, forms and records;
  • one review cycle.

ISO 13485 internal audit. An on-site internal audit of your system against ISO 13485, carried out according to ISO 19011:2018. It includes an audit plan, an audit checklist, the audit itself and a report with each finding classified.

Outsourced quality assurance (QA) Director. We can run your ISO 13485 system as your outsourced quality lead and be your interface with INFARMED. This covers monthly compliance reviews, notification management in SIDM (Sistema de Informação para Dispositivos Médicos), oversight of the system and an annual summary. Read about this role →

Why build it from what you have

Every team has its own processes and way of working. If your documents already work, we adapt them to comply with ISO 13485.

When you are ready, we can carry out an internal audit. It is not a certification audit. Internal audits are a requirement of the standard and a useful source of information: they show you where your system stands before the certification audit.

The CE-marking programme for devices includes the implementation of a quality management system, so the system and the technical documentation are planned together and stay aligned.

Two people on our team are trained ISO 13485 auditors, and one has more than 15 years of experience in quality assurance and regulatory affairs.

Questions on this step

We already have documents, or another certified system. Do we start again?

No. After a gap analysis, the system can be adapted from your existing documents. We can also complement an ISO 13485 system with other quality management standards, such as ISO 9001.

When will the system be in place?

How long implementation takes depends on what already exists, on how many processes the system must cover, and on how quickly your team can review drafts and put the procedures into practice.

We do not have a full-time quality lead. What then?

An outsourced QA Director can run the system for you, under an appointment agreement.

Can you train our team?

Yes. We provide training on the MDR, the IVDR and ISO 13485.

References and deliverables

Standards
EN ISO 13485:2016+A11:2021 (quality management system); ISO 19011:2018 (audit method)
Deliverables
Gap analysis · quality manual and process map · SOPs, work instructions, forms and records · one review cycle · audit plan, audit checklist and audit report with findings classified
Role
Outsourced QA Director

Notified Body and CE marking

We prepare the submission and help you answer the Notified Body's questions through to CE marking. The Notified Body decides.

More on Notified Body and CE marking

What you get

Notified Body submission support, from selection to CE marking:

  • help choosing a Notified Body whose designation covers your device;
  • the submission package;
  • tracking of the Notified Body’s questions;
  • a plan for responding to its findings.

MDR CE-marking package (modular). The MDR CE-marking package runs in modules from strategy to post-market surveillance; the module set differs for software and hardware. What the documentation modules contain →

IVDR CE-marking package: the same structure as the MDR package, with scientific validity and IVD performance evaluation added.

What happens at this step

The submission is the first time someone outside your company reads and assesses your documentation. Questions from the Notified Body are common. What matters is that each one is tracked and answered, and that the answers are consistent with each other.

Choosing a Notified Body is part of the work. The MDR codes (MDA, MDN, MDS, MDT) determine which body is competent to assess your device, and we help you compare the options.

If you start the route here, with a file prepared elsewhere, we read it first and tell you where it stands before anything is submitted.

Questions on this step

Can you guarantee certification?

We cannot, and nobody should promise it. The decision belongs to the Notified Body. What we can promise is a file that answers the regulation clearly, and responses to findings that hold together.

How long will this take?

Each Notified Body has its own timetable. In 2025, most Notified Bodies took 13 to 18 months from the signed written agreement to the certificate. What you and we control: how complete the documentation is when it is submitted, and how quickly and consistently questions are answered. The roadmap sets the milestones, and we tell you whether your date is realistic.

Do we need the whole package?

Not necessarily. The packages are modular, and what you need depends on the class and on what already exists. Whether a Notified Body is involved at all depends on the class, which is why qualification and classification come first.

Which Notified Body do you work with?

All projects are different and we have no preferred Notified Body, but we can help you find the right fit.

References and deliverables

Regulations
Regulation (EU) 2017/745 (MDR); Regulation (EU) 2017/746 (IVDR)
Deliverables
Notified Body selection · submission package · query tracking · findings response plan
Packages
MDR CE-marking package (modular) · IVDR CE-marking package

Registration and distribution

For manufacturers: EUDAMED registration. For distributors and importers in Portugal: wholesale distribution under Portaria n.º 256/2016.

More on Registration and distribution

What you get

If you are a manufacturer

  • EUDAMED actor registration, with the Single Registration Number (SRN).
  • UDI and device registration support, and guidance on implementing unique device identification (UDI), including the design of the UDI carrier.

Registration is delivered as part of an outsourced role (person responsible for regulatory compliance (PRRC), quality assurance (QA) Director or Technical Manager) or of a monthly regulatory support retainer.

If you distribute or import devices in Portugal

  • Medical-device wholesale distribution compliance (GDP, Portaria n.º 256/2016), for device and IVD wholesalers: Good Distribution Practice (GDP) set-up and ongoing support, with the activity notification to INFARMED, a review of the technical file per device, device notification in SIDM, and a GDP quality manual and SOPs (standard operating procedures).
  • Technical Manager, medical-device distribution (Portugal) under Decreto-Lei n.º 29/2024, Article 27. We can take on the role as your outsourced Technical Manager: an appointment agreement, monthly reviews, and the contact and notifications with INFARMED through SIDM. Read about this role →

Why this step matters

Registration is where your company and your devices become visible to the public and to competent authorities: EUDAMED at EU level, SIDM in Portugal. The data must match the technical documentation.

Distribution is a separate set of obligations. Portaria n.º 256/2016 sets Good Distribution Practice for wholesale distribution of medical devices in Portugal; the quality system is what it asks of a wholesaler.

Questions on this step

Do we need a Technical Manager?

It depends on your activity in Portugal. We look at your activities and advise you.

Is the Technical Manager the same as the cosmetics Responsible Technician?

No. In Portuguese both are called Responsável Técnico, but they are two legal roles under two laws: Decreto-Lei n.º 29/2024, Article 27, for medical device distribution, and Decreto-Lei n.º 189/2008 for cosmetic products.

When will our devices be registered?

The date depends on how many devices you register, whether you already have an SRN, and what information is available for each device. We give you dates once we know the list.

Can your team train our warehouse and quality staff?

Yes. We provide remote GDP training for medical device distribution teams.

References and deliverables

Portugal, distribution
Portaria n.º 256/2016 (Good Distribution Practice for wholesale distribution of medical devices)
Portugal, role
Decreto-Lei n.º 29/2024, Article 27 (Technical Manager of a medical-device distributor)
Systems
EUDAMED (EU); SIDM (INFARMED, Portugal)
Deliverables
EUDAMED actor registration and SRN · UDI and device registration support · SIDM notification · INFARMED activity notification · technical file review per device · GDP quality manual and SOPs

Post-market

Post-market surveillance, vigilance, and the person responsible for regulatory compliance.

More on Post-market

What you get

Post-market surveillance and vigilance (PMS/PMCF):

  • a post-market surveillance plan;
  • a periodic safety update report (PSUR) template;
  • a post-market clinical follow-up (PMCF) plan;
  • a vigilance system.

This work comes with the CE-marking programme, the outsourced PRRC, or the technical documentation for software.

Outsourced PRRC (MDR/IVDR Art. 15), for MDR and IVDR manufacturers:

  • an appointment agreement;
  • verification of production control: each device is checked for conformity under the quality management system before it is released;
  • review of the documentation: the technical documentation and the EU declaration of conformity are drawn up and kept up to date;
  • the post-market surveillance plan, and a check that post-market surveillance obligations are met;
  • monitoring of incidents: serious incidents and field safety corrective actions are reported;
  • management of EUDAMED registration.

European Authorised Representative (EAR), offered only as an extension of the outsourced PRRC, not on its own.

Read about the PRRC and Authorised Representative role →

This step keeps the documentation alive

Post-market data feeds back into the evidence. The risk management file and the clinical evaluation are updated with post-market surveillance and PMCF data.

The PRRC role is where we take on responsibility, not only advice: a function named in Article 15, taken on by the firm under an appointment agreement, with the verification and monitoring work that goes with it.

An external PRRC must be permanently and continuously at your disposal. Article 15 of the MDR and of the IVDR requires the PRRC to hold one of two qualifications:

  • a degree in law, medicine, pharmacy, engineering or another relevant scientific discipline, with at least one year of professional experience in regulatory affairs or quality management for medical devices;
  • or four years of that professional experience.

Do you already have this person on your team?

Questions on this step

Can our PRRC be someone outside the company?

We offer the PRRC as an outsourced service. Whether your company may appoint one from outside its own organisation is something we verify first.

Does appointing a PRRC remove my company's legal liability?

No. Appointing a PRRC does not remove your company's legal liability. The PRRC's responsibilities under the Regulation do not change your own obligations, so you remain liable for any damage caused by defective devices.

References and deliverables

Regulations
Regulation (EU) 2017/745, Article 15; Regulation (EU) 2017/746, Article 15 (person responsible for regulatory compliance)
Deliverables
Post-market surveillance plan · PSUR template · PMCF plan · vigilance system · clinical evaluation update
Roles
Outsourced PRRC · European Authorised Representative (with the PRRC only)

The people

Liliana Teles

CEO / Regulatory Affairs & Quality Assurance Director

Medical Devices

Leads regulatory affairs and quality assurance for medical devices and cosmetics: ISO 13485 quality systems, CE-marking roadmaps, EN ISO 14971 risk management, cosmetic product safety reports and claims.

Guilherme Semedo

Medical Devices Regulatory Affairs Consultant

Medical Devices

Works on qualification and classification under the Medical Devices Regulation, clinical evaluation literature research, risk management and technical documentation.

Mariana Pinto

Medical Devices Regulatory Affairs Consultant

Medical Devices

Works on quality systems to ISO 13485, with more than 15 years in quality assurance and regulatory affairs at a manufacturer of non-active medical devices.

Questions people ask

Will you understand our technology?

Software as a medical device, medical mobile apps and IVDs are part of our scope, not an add-on. For software we work with MDCG 2019-11 on qualification, IEC 62304 on the lifecycle and EN IEC 62366-1 on usability.

Do we need every step?

That depends on the class and on what you already have. The regulatory strategy tells you which steps apply, in what order, and where a Notified Body comes in. If you only need to know whether the product is a device, start with qualification and classification.

Can you work on the UK and US routes for devices?

The route we draw is for the EU and Portugal. For the UK and the US, we map the route with you, product by product, before anything is agreed.

How long will it take?

The class, how far a Notified Body is involved, and the state of your documentation and quality system set the timeline. The regulatory strategy turns them into milestones.

What is changing for medical devices

EU

How to demonstrate equivalence under the MDR

Clinical data from an equivalent device can support your clinical evaluation, but the MDR sets a higher bar than the Directives did. The three characteristics, data access, and documentation.

Tell us about your device

Tell us what the device is, where you want to sell it, and the date you are working to. Our team replies to every enquiry. If the date is not realistic, we say so.

Follow an area

One email when an area publishes, in the language you choose. Nothing else.

Talk to us

Tell us the product, the market and the date you are working to. If the date is not realistic, we will say so.

Need a standing regulatory partner? See ongoing support →