EU Compliance 5 min read
EU Notified Body Involvement Guide: The EU notified body involvement guide Explained
A practical guide to EU notified body involvement: triggers, modules, audits, timelines, and documentation for CE marking under MDR, IVDR, PPE, and other product rules.
What a Notified Body Actually Does
A notified body is an independent conformity assessment organisation designated by an EU member state and listed in NANDO. It does not replace the manufacturer's legal responsibility. Under rules such as Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR), the notified body reviews the quality management system, technical documentation, clinical or performance evaluation, and post-market surveillance. For CE marking, the notified body's four-digit number appears next to the CE mark only when the body is involved in production control or final verification. If the product can be self-certified, no number appears. The scope of involvement depends on the product's risk class, the chosen conformity assessment module, and whether the manufacturer uses harmonised standards. This EU notified body involvement guide focuses on practical steps, not legal theory.
When a Notified Body Must Be Involved
Notified body involvement is not automatic. It is triggered by legislation and risk classification. Under MDR Article 52, Class I devices usually follow self-declaration unless they are sterile, have a measuring function, or are reusable surgical instruments. Class IIa, IIb, and III devices require a notified body. Under IVDR Article 48, Class A devices are generally self-certified unless sterile; Class B, C, and D devices require a notified body. For PPE under Regulation (EU) 2016/425, Category II and III products need EU type-examination; Category III also requires a quality assurance route. Machinery listed in Annex IV of Directive 2006/42/EC or high-risk categories in Regulation (EU) 2023/1230 requires notified body assessment. Radio equipment under Directive 2014/53/EU needs a notified body if the manufacturer does not apply harmonised standards fully. Construction products under Regulation (EU) No 305/2011 require notified bodies for AVCP systems 1+, 1, 2+, and 3. The pattern is consistent: higher risk or incomplete standards reliance increases third-party involvement.
Risk Class and Conformity Assessment Routes
The Conformity Assessment Module Selection Guide For EU CE Marki explains how to match modules to product risk. For MDR Class IIa, the typical routes are Annex IX Chapters I and III or Annex XI. For Class IIb and III, Annex IX Chapters I and III with technical documentation assessment, or Annex X plus Annex XI. IVDR Class B uses Annex IX Chapters I and III or Annex XI; Class C and D use Annex IX Chapters I and III with technical documentation assessment, or Annex X plus Annex XI. These choices affect audit duration, sampling, and unannounced audit exposure. A wrong module can lead to a rejected application or a scope limitation.
The EU notified body involvement guide: Step-by-Step Evidence Flow
- Confirm the legal instrument and classification. Document the classification rationale.
- Select the conformity assessment module. Record why other modules are not applicable.
- Build the technical file. The EU CE Marking Technical File: A Practical Guide covers structure, version control, and traceability.
- Implement a quality management system. ISO 13485 is the usual baseline for medical devices; ISO 9001 may support other product rules.
- Submit the application to a notified body with the correct scope. Check NANDO for designation, codes, and expiry.
- Host the audit. The notified body reviews QMS processes, technical documentation, and clinical or performance evidence.
- Close findings. Non-conformities must be corrected before certificate issue.
- Maintain surveillance. Periodic audits, change notifications, and post-market surveillance reports keep the certificate valid.
- Mark the product. Apply CE marking with the notified body number where required.
- Keep evidence current. Update risk management, clinical evaluation, and post-market plans as new data arrives.
Working With a Notified Body: Timelines and Pitfalls
Designation scope matters. A body may be designated for MDR but not IVDR, or for specific codes. Always verify the code list in NANDO. Timelines vary by body and product. Initial MDR audits often take 6–12 months after a complete application; IVDR timelines can be longer for Class D. Common pitfalls include incomplete technical documentation, missing clinical evaluation reports, unclear supplier control, and late change notifications. Unannounced audits are a condition for many medical device certificates. If the manufacturer changes a critical supplier, software, or intended purpose, the notified body must be informed before the change is implemented. For digital health products, personal data processing may also trigger GDPR obligations. The GDPR Data Processing Agreement Clauses Best Practices: A Pra and GDPR Data Processing Agreement Clauses: A Practical Guide help align processor contracts with Article 28 requirements.
Documentation, GDPR, and Cross-Regulation Links
Notified body files often overlap with GDPR records. Clinical investigation data, complaint handling, and post-market surveillance can include personal data. A data protection impact assessment may be required under GDPR Article 35. The technical file should separate product safety evidence from personal data processing records. For material or component testing, standards such as ASTM D4169 for transport packaging or ASTM A36 for structural steel may appear in supplier evidence, but they do not replace the conformity assessment route. Keep standards current: ISO 9001, ISO 14001, and ISO 45001 can support broader management system integration, but the notified body assesses the product-specific QMS requirements first. The key is traceability: every claim in the technical file should link to a test report, risk control, or clinical evidence item.
Conclusion
Use this EU notified body involvement guide as a planning checklist, not a substitute for the applicable annexes. Confirm classification, module, and notified body scope early. Build the technical file before applying. Treat surveillance as a continuing obligation. When in doubt, ask the notified body for a pre-submission meeting and document the advice. That approach reduces delays and keeps CE marking defensible.
Key facts
Machine-readable statements extracted from the sources above. Each fact keeps the same identifier across all six language versions.
2017/745
The EU Medical Devices Regulation is Regulation (EU) 2017/745.
Fact ID:
MDR_regulation2017/746
The EU In Vitro Diagnostic Medical Devices Regulation is Regulation (EU) 2017/746.
Fact ID:
IVDR_regulationNANDO
Notified bodies and their designation scope are listed in the European Commission's NANDO database.
Fact ID:
nando_databaseMDR-52
Under MDR Article 52, Class I devices need notified body involvement if they are sterile, have a measuring function, or are reusable surgical instruments.
Fact ID:
MDR_class_i_exceptionsIVDR-48
Under IVDR Article 48, Class A devices generally do not need a notified body unless they are sterile.
Fact ID:
IVDR_class_a_exceptionCE+NB
When a notified body is involved in production control or final verification, its four-digit number appears next to the CE marking.
Fact ID:
CE_marking_numberGDPR-28
GDPR Article 28 sets requirements for contracts with data processors.
Fact ID:
GDPR_processor_contracts
Frequently asked questions
What is a notified body in the EU?
A notified body is an independent organisation designated by an EU member state to assess whether products meet the applicable EU legislation. It is listed in the European Commission's NANDO database with a specific scope of designation.
When is notified body involvement mandatory?
It depends on the product legislation and risk class. Under MDR Article 52, Class IIa, IIb, and III devices require a notified body, with limited exceptions for certain Class I devices. Under IVDR Article 48, Class B, C, and D devices require a notified body.
Does a notified body issue the CE marking?
No. The manufacturer issues the CE marking and takes legal responsibility. The notified body assesses conformity and issues a certificate where required. If the body is involved in production control or final verification, its four-digit number appears next to the CE marking.
How long does a notified body assessment take?
Timelines vary by product, risk class, and notified body. Initial MDR audits often take 6–12 months after a complete application. IVDR assessments, especially for Class D, can take longer because of the additional scrutiny and laboratory requirements.
Can a manufacturer change notified body?
Yes, but the transfer must follow the applicable rules. The manufacturer should notify the current notified body, agree on a transfer plan, and ensure the new body has the correct designation scope. The certificate must remain valid throughout the transition.
Sources and licencing
Every claim in this article traces back to the sources listed below. Links open the publisher directly.
