EU MDR Regulatory Authorities: Commission, Competent Authorities and Notified Bodies

1. Key takeaways

There is no single issuing authority for medical devices in the European Union. Regulatory functions are distributed across three distinct actors: the European Commission is responsible for legislation and for the database infrastructure; the competent authorities of the Member States handle market surveillance, vigilance and the oversight of notified bodies; and the notified bodies carry out third-party conformity assessment. The obligations of manufacturers located outside the Union are not reduced or waived because of where the product is made. Understanding this three-way division of labour is the precondition for every planning decision in an EU MDR project, because each actor controls a different gate on the path to market: designation and oversight, conformity assessment and certification, and enforcement after the device has been placed on the market.

2. Legal basis

3. Expert insights

Insight 1: There is no issuing authority in the EU, and the CE marking is not granted by any government.

The CE marking is a conformity marking that the manufacturer affixes itself, on its own responsibility, once conformity assessment has been completed. It is not a certificate issued by a government. The role of public authorities operates at both ends of the process: at the front end, the competent authorities of the Member States designate notified bodies under Article 42 and supervise their activities; at the back end, they enforce market surveillance under Article 93. Much of the Chinese-language content in circulation claims that a company applies to the EU for a CE certificate, but this has no basis in the legal sources. The certificate is issued by the notified body; the government does not issue CE certificates. Any budget, timeline or contract drafted on the assumption that a ministry or commission signs the certificate is built on a false premise and will mislead procurement, sales and quality teams alike.

Insight 2: Notified body capacity is a hard constraint on route planning.

The European Commission states in COM(2025) 1023 final (2025-12-16) that 51 notified bodies have been designated under the MDR and 19 under the IVDR. The same proposal notes that conformity assessment procedures lack predictable timelines and that practices differ between Member States, and identifies this as a problem the revision is intended to solve. For a manufacturer, the practical consequence is that lead times cannot be assumed to be short or uniform. Before discussing scheduling with any notified body, a company must first verify that the scope of designation of that body actually covers the classification and the relevant codes of its product, following the code system of Implementing Regulation (EU) 2017/2185. Choosing a body first and discovering a scope gap later is one of the most expensive mistakes in the process.

Insight 3: The powers of competent authorities span both the pre-market and the post-market ends.

Under Article 93, the competent authorities of the Member States are responsible for market surveillance. Under Article 92, vigilance and post-market surveillance information is collected through an electronic system. Under Article 42, the Member State in which a notified body is situated is also responsible for its designation and for supervising its activities. A manufacturer therefore interacts with at least three categories of counterparts: the competent authority of its own country, or of the country where its authorised representative is established; the market surveillance authorities of every Member State where the device is sold; and the notified body it has selected. Each relationship carries its own registration, communication and documentation duties, and none of the three can substitute for the others.

Insight 4: The MDCG performs a harmonising function, but its documents are not law.

The Medical Device Coordination Group (MDCG) was established under Article 103. Its guidance documents, such as MDCG 2019-11 and MDCG 2021-24, carry substantial practical weight: notified bodies and regulators refer to them routinely in reviews and assessments. Nevertheless, their legal rank is below the Regulation itself. When citing them, companies must indicate the hierarchy clearly and must never present a paragraph of guidance as if it were a provision of the Regulation. In technical documentation and internal procedures, a disciplined citation practice distinguishes between what the Regulation requires and what a guidance document recommends, which protects the company when positions shift between documents.

4. Practical recommendations

1. At project initiation, draw a three-party relationship map: the notified body (assessment), the competent authority of the country of the authorised representative (registration and liaison), and the market surveillance authorities of the countries of sale.
2. Before selecting a notified body, verify its identification number, scope-of-designation codes and current status in the NANDO database; do not rely on the marketing materials of the body itself.
3. File MDCG guidance as interpretive documents; wherever internal documents conflict with the Regulation, the Regulation prevails.
4. Maintain a contact register for competent authorities, recording the country, authority name, communication channels and the date of the most recent exchange.
5. Prepare budgets and schedules on the premise that notified body capacity is constrained; do not promise delivery dates based on idealised assessment cycles.

5. Verification checklist

• □ Confirmed that the product falls within the scope of the MDR (not the IVDR and not a medicinal product)
• □ Verified the identification number and scope-of-designation codes of candidate notified bodies in NANDO
• □ Confirmed the Member State of the authorised representative and its competent authority
• □ Established a register of MDCG guidance documents, labelled as interpretive documents
• □ Confirmed the list of Member States of sale and the corresponding market surveillance authorities
• □ Recorded the status of COM(2025) 1023 final (submitted 2025-12-16, not yet adopted)

Regulatory information verified as of 29 October 2026.

About GRZAN. GRZAN supports manufacturers entering the European Union market under Regulation (EU) 2017/745. Our team maps your device to the correct classification and conformity assessment route, helps you select and approach a designated notified body, prepares technical documentation and quality management system files for review, and coordinates with authorised representatives and competent authorities after certification. From the first feasibility assessment to the CE marking and post-market obligations, GRZAN provides a single accountable partner for MDR compliance, so that timelines, evidence and regulatory communications stay aligned across the whole project. For a structured consultation on your CE marking route under the EU MDR, contact info@grzanglobal.com.