EU Notified Body Involvement Requirements: When And How To Engage Them

Why Notified Bodies Matter in EU Compliance

Notified bodies are independent organizations designated by EU member states to carry out conformity assessment under specific product laws. They do not write rules; they verify compliance. Many products can be self-certified with CE marking. For higher-risk products or where legislation requires third-party assessment, EU notified body involvement requirements apply. The legal basis is product-specific: Regulation (EU) 2017/745 for medical devices, Regulation (EU) 2017/746 for IVDs, Regulation (EU) 2016/425 for PPE, and Directive 2006/42/EC for machinery. The European Commission's Blue Guide explains the framework.

A notified body's approval is not a general EU certificate. It is a decision within a defined scope. NANDO lists each body's legislation, annexes, product categories, and status. Before engaging a body, confirm its notification covers your product and route. A certificate from a body without the right scope is not valid for CE marking.

What a Notified Body Actually Does

Notified bodies perform tasks in the applicable annexes. They audit quality management systems, review technical documentation, conduct type examinations, verify batches, and carry out surveillance. Under Regulation (EU) 2017/745, a body may assess QMS under Annex IX and technical documentation under Annex IX or Annex X. Under Regulation (EU) 2017/746, routes differ by class and may involve Annex IX, X, or XI. For PPE under Regulation (EU) 2016/425, modules such as B+C2, B+D, or B+E may apply.

An ISO 9001 certificate does not equal notified body approval. ISO 9001 is voluntary; it can support a QMS audit but does not satisfy legal conformity assessment. ISO 13485 is more relevant for medical devices, yet it also does not replace the legal assessment. ISO 14001 and ISO 45001 are management tools, not CE marking routes.

Designation, Scope, and NANDO Checks

Use NANDO to check four things: the body's four-digit number, the legislation, the annexes or modules in scope, and whether the notification is active. A body may be notified for Regulation (EU) 2017/745 but not Regulation (EU) 2017/746, or for certain classes only. If subcontractors are used, the notified body remains responsible. Document the scope check in your technical file or quality records.

When EU Notified Body Involvement Requirements Apply

The scope of EU notified body involvement requirements is set by legislation, not preference. Mandatory involvement usually arises for:

• Medical devices under Regulation (EU) 2017/745: Class IIa, IIb, III; Class I sterile, measuring, or reusable surgical instruments; certain companion diagnostics.
• IVDs under Regulation (EU) 2017/746: Class B, C, D; Class A sterile.
• PPE under Regulation (EU) 2016/425: Category II and III. Category I generally allows self-declaration.
• Machinery under Directive 2006/42/EC: Annex IV machinery where harmonized standards are not applied or only partly applied.
• ATEX under Directive 2014/34/EU: certain equipment categories, depending on risk and route.
• Other laws: construction products, pressure equipment, gas appliances, lifts, measuring instruments, and radio equipment may require a notified body when harmonized standards cannot be used or the chosen route needs third-party assessment.

Even when not mandatory, a manufacturer may voluntarily involve a notified body. That can help market access, but it does not change the legal route. If self-declaration is allowed, a voluntary certificate is not a substitute for the manufacturer's own conformity assessment.

If the notified body processes personal data, GDPR applies. Clinical or post-market data may include patient information, so a data processing agreement with suitable clauses is often needed. See GDPR Data Processing Agreement Clauses Best Practices: A Pra.

Choosing the Right Conformity Assessment Route

The route determines the depth of notified body involvement. For medical devices, common combinations include Annex IX QMS assessment plus technical documentation review, or Annex X type examination plus Annex XI product conformity verification. For PPE, Module B type examination can combine with Module C2, D, or E. For machinery, Annex IV requires a procedure such as EC type examination or full quality assurance.

Route selection affects cost, timeline, evidence, and surveillance. A cheaper route at the start may create more audits later. Use our Conformity Assessment Module Selection Guide For EU CE Marki to compare modules. Then confirm the chosen route is within the notified body's scope in NANDO. In practice, EU notified body involvement requirements are not a single checklist; they follow the chosen route. The technical file must match that route. For structure, see EU CE Marking Technical File: A Practical Guide.

The Assessment Process: From Application to Surveillance

A typical process has several stages. The manufacturer applies with product details, intended use, classification, and proposed route. The notified body checks scope and provides a quotation. A pre-assessment may follow. Next comes the QMS audit, covering design and development, risk management, supplier control, production, and post-market surveillance. For medical devices, ISO 14971 risk management and clinical evaluation are central. For IVDs, performance evaluation and scientific validity are central. The technical documentation review then checks evidence against the General Safety and Performance Requirements or other legal requirements.

If successful, the notified body issues a certificate, often valid up to five years. After certification, surveillance audits and unannounced audits may occur. The manufacturer must notify the body of significant changes to the product, QMS, or intended use. Failure to do so can suspend or withdraw the certificate.

Technical Documentation and Evidence

The notified body expects a well-organized technical file. For medical devices, include device description and classification, a GSPR checklist, risk management file, clinical evaluation report, post-market surveillance plan, PMCF plan, UDI and labeling evidence, and instructions for use. For IVDs, include performance evaluation, analytical and clinical performance data, and scientific validity. For PPE, include test reports, risk assessment, and production control evidence. Where transport packaging or sterile barrier systems matter, standards such as ASTM D4169 may support validation. Keep version control tight; auditors compare the submitted file with current QMS records.

Common Pitfalls and How to Prepare

The most common mistake is engaging a notified body too late. MDR and IVDR assessments can take many months, and notified body capacity is limited. Start early. Another pitfall is choosing a body without checking NANDO. A scope mismatch can force a new application and delay market entry.

Manufacturers also underestimate surveillance. A certificate is not the end. You need change control that triggers notified body review when required. Keep clinical, performance, and post-market data current. If the notified body accesses personal data, align GDPR documentation with the processing. Remember that ISO 9001, ISO 14001, and ISO 45001 certificates do not replace legal conformity assessment. They may support your management system, but they are not notified body approvals.

A practical preparation plan: confirm the legal route, verify the notified body's scope, build the technical file to the relevant annex, run an internal gap audit, and agree a realistic timeline. Document every scope check and correspondence. This reduces the risk of a negative decision.

Notified bodies are essential for many CE marking routes, but their role is defined by EU product law and notification scope. Identify whether EU notified body involvement requirements apply, choose the correct conformity assessment module, and prepare evidence that matches the legal text. Check NANDO, read the applicable regulation or directive, and engage early. With the right preparation, the process becomes a predictable part of market access.