Consulting for medical device manufacturers

From prototype to CE marking: consulting for medical device manufacturers.

Quality ISO 13485, risk management, and MDR compliance: three disciplines that medical device manufacturers cannot treat in silos. ISOFAC GROUP integrates them from the outset.

Talk to us →

Where do you stand?

Three situations, three paths

First CE marking

You are developing a device and approaching MDR for the first time. Device class scoping, QMS, technical file, notified body audit.

MDD to MDR transition

You are migrating an MDD certificate to MDR, sometimes with reclassification. Gap analysis, CER strengthening, PMS overhaul.

Returned file, insufficient notified body audit

You have received major non-conformities. Root cause analysis, CAPA, formal response to the notified body.

At which stage are you?

Risk management runs across the entire lifecycle. Hover or click a node to see the associated deliverables and ISOFAC GROUP services.

ISO 13485 QMS — lifecycle foundation Risk Management Design & Planning Regulatory Classification Verification & Validation Technical File Clinical Evaluation CE Marking & Conformity Post-Market Surveillance
Deliverables
ISOFAC Services

Lifecycle stage detail

Risk management (ISO 14971) is transversal: it runs through every phase, from the initial DHF to post-market surveillance, continuously fed.

1. Design & Planning

Upstream phase

  • Product requirements specification
  • Design History File (DHF)
  • GSPR analysis (MDR Annex I)
  • ISO 14971 risk management plan
  • Usability engineering IEC 62366-1
  • Software IEC 62304 (if applicable)

2. Regulatory Classification

MDR Annex VIII

  • Classification report (Annex VIII)
  • Notified body selection and conformity route
  • Regulatory roadmap
  • Class / procedure / NB matrix

3. Verification & Validation

Critical phase

  • Device and process validation
  • Usability (IEC 62366-1)
  • Software validation (IEC 62304)
  • Documented technical reviews

4. Technical File

MDR Annexes II & III

  • Technical file (MDR Annex II)
  • EU Declaration of Conformity
  • IFU and MDR labelling
  • Annex I traceability matrix
  • Risk management report

5. Clinical Evaluation

Article 61 MDR

  • Clinical Evaluation Plan (CEP)
  • CER report (MDCG 2020-1, MEDDEV 2.7/1 rev4)
  • SSCP for Class III and implantables
  • PMCF plan and protocols

6. Conformity Assessment & CE Marking

MDR Annexes IX–XI

  • NB certificate (if applicable)
  • EUDAMED registration
  • UDI code assigned
  • EC REP designated (non-EU manufacturers)

7. Post-Market Surveillance

PMS · Vigilance · CAPA

  • PMS plan (Art. 83–86 MDR)
  • PSUR for Class IIa, IIb, III
  • PMS Report for Class I
  • Vigilance and FSCA procedure
  • Incident register
  • CAPA plan and effectiveness follow-up
Our services

Six areas of expertise, available individually or as a package

01

Classification & regulatory strategy

Deliverable

Reasoned classification note (Annex VIII)

Indicative timeline — 2 to 4 weeks

02

ISO 13485 QMS

Deliverable

Operational quality system ready for certification

Indicative timeline — 4 to 8 months

03

Risk management ISO 14971

Deliverable

Risk management file integrated into the lifecycle

Indicative timeline — 4 to 12 weeks

04

MDR Technical File (Annexes II & III)

Deliverable

Structured technical file ready for NB submission

Indicative timeline — 4 to 8 months (Class IIa)

05

Clinical Evaluation (Art. 61, MEDDEV 2.7/1 rev4)

Deliverable

CER + PMCF plan compliant with MDCG 2020-1

Indicative timeline — 6 to 16 weeks

06

Post-market surveillance & vigilance

Deliverable

PMS plan + first PSUR (MDCG 2022-21)

Indicative timeline — 3 to 6 weeks

FAQ

Frequently asked questions

In most cases, yes. A notified body return is not a final rejection: it is a list of non-conformities to be addressed. The priority is to analyse the nature of the gaps, whether formal or substantive, before deciding on a response strategy. Major non-conformities on clinical evaluation or risk management require targeted rework, not a complete rewrite of the file. We have taken over returned files with NB response timelines of 8 to 16 weeks depending on the depth of the gaps.
Between 12 and 24 months for a Class IIa device, depending on the state of the existing file and the chosen notified body.
Article 15 MDR requires that at least one person responsible for regulatory compliance be permanently available. For a micro or small enterprise, this does not necessarily mean a new hire: the PRRC role can be outsourced, provided the service provider holds the required qualifications and is formally designated. Note: MDCG 2019-07 Rev.1 prohibits a person from simultaneously holding the PRRC role for the EC REP and for the manufacturer for the same device. The arrangement must be documented and verifiable at audit.
From the design stage, without question. A classification error made upstream can invalidate the entire regulatory strategy. An undocumented material choice against ISO 10993 will delay validation by several months. The most costly interventions we handle are those where the consultant arrives after the product is finalised. Engaging at the planning stage costs less and reduces the risk of non-conformity at the NB audit.
Three practical criteria: the NB's MDR designation for your device type, its published review timelines under Article 50 MDR, and its current workload. Some notified bodies currently publish submission-to-review timelines exceeding nine months. The choice of NB directly determines your time-to-market. We help our clients cross-reference these criteria against market realities before any application. The list of notified bodies designated under the MDR is available on the European Commission portal.
It depends on the device's initial classification and the regulatory basis on which it is currently on the market. If the device was placed on the market under the MDD Directive as Class I and MDR reclassification places it in Class IIa, transitional provisions may apply under strict conditions. The situation must be analysed device by device: a general answer here would be inaccurate and potentially risky. This is precisely the type of scoping we carry out in a first engagement.
Post-Market Clinical Follow-up (PMCF) is the clinical component of the Post-Market Surveillance (PMS) system. PMS covers all post-market data, including complaints, vigilance, and field data. PMCF focuses specifically on the proactive collection of clinical data after market placement, to confirm device safety and performance over time. A PMCF plan and a PMCF evaluation report are documents distinct from the PMS report or the PSUR. Applicable references: MDCG 2020-7 · MDCG 2020-8

First file, MDR transition, or file to rescue: describe your situation.

Tell us about your device and its intended purpose. We will respond within 48 hours with a firm, costed mission scoping, through to the notified body audit.

Talk to us →