EU IVDR Market Surveillance under Articles 88-95: Enforcement Chain and Manufacturer Duties

1. Key takeaways

Section 3 of Chapter VII of the IVDR (Articles 88 to 95) forms the enforcement chain of market surveillance. Article 88 governs the market surveillance activities carried out by competent authorities; Article 89 governs the evaluation of devices suspected of presenting an unacceptable risk or other non-compliance; and Article 90 sets out the procedure for devices that do present an unacceptable risk. Articles 91 to 95 then cover, respectively, EU-level assessment of Member State measures, other non-compliance, preventive health protection measures, good administrative practice, and the electronic system for market surveillance. For manufacturers, this section defines what happens after a certificate is issued: the same authorities that granted market access retain the power to re-examine, restrict, suspend or withdraw devices on the basis of post-market evidence, and the manufacturer’s duty to cooperate is itself a legal obligation rather than a courtesy.

2. Legal basis

3. Expert insights

Insight 1: Class D devices enter the regulatory spotlight directly after certification.

Article 50(1) requires the notified body to notify the competent authority of every Class D certificate it issues, attaching the summary of safety and performance (SSP), the assessment report and, where applicable, the EURL opinion and the report of the expert panel. Article 50(2) then allows the competent authority, and where applicable the Commission, to act on justified concerns: it may initiate the procedures under Articles 40 to 43 or the Article 89 procedure, and take measures under Articles 90 and 92 where it considers necessary. Compliance for Class D devices therefore does not end with obtaining the certificate; the certificate itself hands the authorities a complete dossier with which to re-examine the product at any time. Manufacturers of Class D devices should consequently treat the certification dossier and the post-market dossier as one continuous record.

Insight 2: Article 89 evaluates suspicion, and the trigger threshold is low.

Article 89 applies where a competent authority has sufficient reasons to consider that a device presents an unacceptable risk or is otherwise non-compliant. The triggering information can come from vigilance reports, trend reports, complaints, market surveillance sampling, or even public data such as certificate status and SSP content in EUDAMED. Consistency across a company’s public data therefore carries direct compliance significance: a mismatch between a certificate status, an SSP entry and marketing claims is precisely the kind of signal that invites an Article 89 evaluation, with all the documentation burden that follows. A periodic self-audit of published data is one of the cheapest preventive controls available under the IVDR.

Insight 3: Article 92 covers other non-compliance that does not reach the level of unacceptable risk.

Article 92 addresses non-compliance other than the unacceptable risk cases handled under Article 90. In practice, a large share of enforcement cases, such as labelling errors, deficiencies in technical documentation, or inconsistencies in registration data, proceed under this provision rather than Article 90. Article 92 is also relevant to the legacy device pathway: the Commission Q&A notes that competent authorities may, under Article 92(1), require manufacturers to complete the conformity assessment procedure within a specified period. Treating Article 92 cases as minor paperwork matters is therefore risky, since the provision can still lead to ordered corrections and market consequences. A structured intake process that classifies authority letters by the provision invoked, 90 or 92, helps route the response to the right internal owners from the first day.

Insight 4: Article 10(13) turns cooperation into an enforceable duty.

Article 10(13) requires manufacturers, upon request by a competent authority, to provide all information and documentation necessary to demonstrate conformity, in an official language of the Member State concerned; the authority may also require that samples be provided free of charge or, where that is impossible, that access to the device be granted. Where a manufacturer fails to cooperate or provides incomplete or incorrect information, the authority may take all appropriate measures to prohibit or restrict the placing on the market of the device on its national territory, or to withdraw it or recall it, until the manufacturer cooperates or provides complete and correct information. Preparedness, including multilingual document packs, is thus a compliance requirement in its own right, and the response deadline should start running from receipt of the request, not from the moment the documents have been gathered.

4. Practical recommendations

1. Establish a response process with deadlines for regulatory letters, and designate a single point of contact, coordinated by the PRRC, for all authority communications.
2. Prepare multilingual document packs in advance so that the official-language requirement of Article 10(13) never delays a response.
3. Review the consistency of public EUDAMED data (certificate status, SSP, actor information) on a regular schedule.
4. For Class D products, prepare in advance the supplementary material list that would be needed if a competent authority initiates action under Article 50(2).
5. Establish contingency plans for sample provision and on-site access, covering both free provision of samples and granting access to devices where samples cannot be provided.

5. Verification checklist

• □ A response process for regulatory letters and a single point of contact are established
• □ Multilingual document packs are prepared in advance (Article 10(13))
• □ Consistency of public EUDAMED data is reviewed on a regular schedule
• □ Supplementary materials for the Article 50(2) scenario are prepared for Class D products
• □ Contingency plans for sample provision / on-site access are in place (Article 10(13))
• □ Response plans are differentiated between Article 90 (unacceptable risk) and Article 92 (other non-compliance)

Legal information verified as of 29 October 2026.

GRZAN supports IVD manufacturers facing EU market surveillance under the IVDR: building authority-response processes and single points of contact, preparing multilingual document packs and Class D supplementary dossiers, auditing EUDAMED public data consistency, and managing Article 90 and Article 92 proceedings through to closure. For support with market surveillance and authority correspondence, contact info@grzanglobal.com.