MHRA Enforcement: Compliance Notices and Restriction Notices Under Part VII

1. Key takeaways

Part VII of UK MDR 2002 equips MHRA with graduated enforcement tools: reg 61 (enforcement) provides the general authorisation, reg 62 (compliance notice) requires the responsible person to remedy a contravention within a specified period, and reg 63 (restriction notice) can directly restrict the supply of a device, its placing on the market or its putting into service. The supporting provisions include reg 64 (decision notices), reg 65 (a centralised record system) and reg 67 (review).

The graduated design matters because it gives manufacturers a visible ladder of escalation and therefore a window to intervene before the most severe tool is used. A compliance notice is not a warning letter without consequence; it is a statutory instrument with a deadline, and failing to remedy within that deadline invites the next rung on the ladder. At the same time, enforcement is not limited to these instruments: suspension or revocation of registrations and prosecution remain available where circumstances justify them. Manufacturers should therefore read any MHRA correspondence against this structure, identify which rung it represents, and respond within the statutory framework rather than treating it as routine correspondence.

2. Legal basis

• UK MDR 2002 (SI 2002/618, as amended): Part VII reg 59 (interpretation), reg 60 (status of the UKRP), reg 61 (enforcement), reg 62 (compliance notices), reg 63 (restriction notices), reg 64 (decision notices), reg 65 (centralised record system) and reg 67 (review).
• SI 2026/197 (in force on 1 April 2026): reg 3 inserts reg 53(5) — a device must not be placed on the market where fees remain unpaid.
• Official guidance: the GOV.UK publication Regulating medical devices in the UK.

3. Expert insights

Insight one: enforcement escalates in gradations rather than arriving all at once. A compliance notice under reg 62 ordinarily precedes a restriction notice under reg 63. The quality and speed of a company’s response after receiving a compliance notice directly determine whether the matter escalates. Treating a compliance notice as ordinary mail is the most dangerous possible response. The notice will specify the contravention and the period for remedying it, and that period should be treated as a project deadline with an owner, a plan and internal milestones — not as an item awaiting the next management meeting.

Insight two: unpaid fees are a self-inflicted risk. reg 53(5), inserted by SI 2026/197, provides that no device may be placed on the market where all fees due have not been paid. This turns fees into a directly triggerable contravention point that is entirely within the company’s own control — making it the highest-value risk avoidance item on the list. The exposure needs no incident, no complaint and no safety signal to activate; it needs only a missed invoice, which is why fee status should sit in the same compliance calendar as registration renewal.

Insight three: MHRA’s monitoring channels extend beyond what companies report. The official announcement states that MHRA monitors safety through mechanisms including the Yellow Card scheme and has strengthened its post-market surveillance activities. This means that reports from patients and healthcare professionals can become leads for enforcement, and a company cannot judge its safety status solely on the basis that no internal signal has been recorded. External signals may exist about the same devices while the internal complaint log stays quiet, either because users report directly to MHRA or because distributors fail to pass complaints on. PMS inputs should therefore include periodic review of publicly available MHRA safety publications.

Insight four: the UKRP’s statutory position intersects with enforcement. Part VII sets out the status of the UKRP alongside the enforcement powers, and that intersection matters in practice: where MHRA needs a point of contact for a matter concerning a manufacturer based overseas, the UKRP is the natural channel, and correspondence sent through that channel carries statutory weight. Manufacturers should therefore ensure that their UKRP agreements specify how MHRA correspondence is to be forwarded and within what period, because a notice that sits unread in the UKRP’s inbox until its compliance period has partly expired is a problem the manufacturer cannot see coming. Aligning the 48-hour internal response rule with the UKRP’s forwarding commitment closes that gap.

4. Practical recommendations

GRZAN recommends establishing an MHRA correspondence response mechanism: designate a single responsible person and a backup, set an internal response deadline of 48 hours, and pre-define three workflows — technical justification, corrective measures and external communication. Pre-defining the workflows removes the negotiation about who drafts what at the moment it matters most. A proactive monitoring of Yellow Card signals should also be established: safety information relating to the company’s own products should be retrieved on a defined cycle and used as one of the inputs to PMS, with the review results documented. As a practical estimate, companies that rehearse the compliance-notice scenario once a year respond materially faster than those that see their first notice live, because the internal escalation path — who decides, who drafts, who signs, who communicates with MHRA — is already agreed. Fee status should be reconciled against MHRA records at least quarterly so that no unpaid balance survives unnoticed into a supply decision.

5. Verification checklist

• □ A responsible person and a backup for MHRA correspondence have been designated
• □ An internal response deadline (48 hours recommended) has been set
• □ The three workflows of technical justification, corrective measures and external communication have been pre-defined
• □ The risk of unpaid fees has been reduced to zero (reg 53(5))
• □ Yellow Card and other external safety signals have been incorporated into PMS inputs

Regulatory information verified as of 29 October 2026.

• Appointment of the UK Responsible Person (UKRP) and support with signing the letter of authorisation
• Full-process MHRA registration (DORS) filing and account lifecycle management
• Device classification determination, GMDN code selection and annual registration fee calculation
• Dual-route design for Great Britain and Northern Ireland, including UK(NI) solutions
• Establishment of post-market surveillance (PMS) systems, preparation of PMSR/PSUR and submission of vigilance reports
• Emergency handling of serious adverse incidents and field safety corrective actions (FSCA)
• Monitoring of UK regulatory changes and compliance gap assessment

For post-market compliance support in the UK market — vigilance reporting, recall management and MHRA inspection response — contact GRZAN at info@grzanglobal.com.