EU MDR Risk Classes and Annex VIII Classification Rules

1. Key takeaways

The MDR divides medical devices into four risk classes: Class I (low), Class IIa (medium-low), Class IIb (medium-high) and Class III (high). The classification is determined by the manufacturer itself, applying the 22 rules of Annex VIII. The risk class directly determines the conformity assessment route, the depth of notified body involvement, the clinical evidence requirements and the frequency of post-market reporting. Because the manufacturer performs the classification, the reasoning must be documented and defensible: a classification that cannot be explained rule by rule is a liability at the notified body stage, and a wrong class discovered late forces rework across the technical documentation, the assessment plan and the clinical evaluation at the same time.

2. Legal basis

3. Expert insights

Insight 1: The structure of the 22 rules is four groups of devices plus a group of special rules.

The rules of Annex VIII are grouped by device property: Rules 1 to 4 cover non-invasive devices; Rules 5 to 8 cover invasive devices; Rules 9 to 13 cover active devices; and Rules 14 to 22 are special rules, covering among others devices administering medicinal products, nanomaterials, contraceptive devices and software. Classification is therefore not a lookup in a catalogue. The manufacturer works through the rules one by one against the intended purpose of the device, records which rules apply, and reaches a conclusion only after the whole set has been considered. A report that names a single applicable rule without showing the others were examined invites the question of what was missed.

Insight 2: Duration of use is the hidden variable in most classification rules.

Annex VIII defines three duration categories: transient means continuous use for less than 60 minutes; short term means continuous use for between 60 minutes and 30 days; and long term means continuous use for more than 30 days. Continuous use includes situations in which a device is replaced immediately by another device of the same type; it is not limited to a single uninterrupted period. The practical consequence is that the same invasive device may fall into different classes depending on whether its use is short term or long term. The duration assessment therefore needs the same care and documentation as the rule selection itself, because notified bodies test both, and a duration claim without supporting records is treated as pending verification until evidence is produced.

Insight 3: The classification conclusion is borne by the manufacturer, but it can be challenged.

The classification is a self-assessment by the manufacturer. It must be written into the technical documentation together with its reasoning. Where the manufacturer and the notified body disagree on the classification, Article 51(2) provides that the dispute is referred to the competent authority of the Member State in which the manufacturer has its registered place of business. The practical effect of this provision is clear: if the classification reasoning is not solid, it may be overturned at the notified body stage, and the resulting rework cascades through the technical documentation and the assessment schedule. The referral route exists, but using it costs time that a well-documented classification would have saved.

Insight 4: The risk class propagates four results downstream.

The classification determines four things: whether a notified body is involved and how deeply; which annex applies to the conformity assessment; the strength of the clinical evidence required; and the frequency of post-market reporting, with PSUR updates annual or every 2 years depending on the class. Classification is therefore the starting point of both the cost and the timeline of the entire route. Two devices with similar technology but different classes can face assessment programmes of very different depth, and budgeting or scheduling decisions made before the classification is settled are exposed to the largest planning error in the project. This is why the classification report belongs at the very front of the project plan: every downstream workstream, from clinical evaluation to labelling and post-market planning, inherits its conclusions.

4. Practical recommendations

1. Issue a standalone classification report that works through all 22 rules and records the reasons why each non-applicable rule does not apply, rather than citing only the rule that was applied.
2. State explicitly in the reasoning the duration category and its basis, using the 60 minutes and 30 days boundaries.
3. Classify accessories separately in their own right under implementing rule 3.2; do not merge the assessment with the host device.
4. Assess software separately under Rule 11.
5. Where the notified body disagrees with the classification conclusion, initiate the Article 51(2) procedure promptly rather than leaving the project suspended.

5. Verification checklist

• □ The applicability of all 22 rules has been analysed one by one
• □ The duration category (transient, short term or long term) and its basis have been recorded
• □ Accessories have been classified separately under implementing rule 3.2
• □ The strictest rule has been adopted as the final conclusion under implementing rule 3.5
• □ The classification reasoning is included in the technical documentation (Annex II, section 1.1)
• □ The conformity assessment annex corresponding to the classification conclusion has been confirmed

Regulatory information verified as of 29 October 2026.

About GRZAN. GRZAN supports manufacturers in classifying their devices under Annex VIII of Regulation (EU) 2017/745 and in building the evidence trail notified bodies expect. We produce rule-by-rule classification reports, document duration categories and implementing rules 3.1 to 3.5, and align the classification with the conformity assessment route, so that your CE marking project in the European Union starts on the correct risk class. From the classification report to notified body submission, GRZAN provides end-to-end MDR compliance support. Contact info@grzanglobal.com.