Introduction

Your device works. The clinical data looks solid. Engineering signed off. Now you need that two-letter mark that unlocks the €140 billion EU medical device market.

Here’s the reality: most teams underestimate CE marking by a country mile. Ask anyone who’s been through this. From the day you say “we’re ready” to the day your artwork legitimately carries CE, you’re looking at 12–18 months of grind and a spend that can swing from €50K to €500K+ depending on the class and how tight your documentation is. And that’s before you factor in the Notified Body (NB) capacity crunch that turns reasonable schedules into rolling delays—see the Commission’s ongoing NB surveys and updates here.

So let’s park the glossy brochure version. This guide gives you the real timeline, the real cost ranges, and the actual bottlenecks—the stuff you only hear from practitioners after hours, not in sanitized guidance documents.

Quick‑Start: Your First 10 Moves

• Write a one‑page intended purpose and map it to Annex VIII rules (and IVDR if applicable).
• Open NANDO; shortlist 3 NBs with your exact scope and ask for current onboarding→certificate timelines.
• Run a 2‑day ISO 13485 gap check against Article 10(9) and book fixes.
• Start the GSPR matrix (Annex I) to reveal test/evidence holes.
• Kick off a literature review using MEDDEV 2.7/1 rev 4 methodology.
• For SaMD: assign an owner for IEC 62304 and IEC 81001‑5‑1 documentation now.
• Draft PMS & PMCF plans tailored to your risks; avoid templates.
• Freeze IFU claims until CER agrees; then translate.
• Book a pre‑sub meeting with your chosen NB.
• Publish an internal month‑by‑month plan with owners and buffers.

Common Pitfalls — Fast Scan

• Borderline class not documented → NB challenges at Month 12.
• Clinical evidence thin or equivalence weak → forced investigation.
• Software validation treated like commercial QA → 62304 gaps.
• Inconsistent claims across IFU/CER/risk → weeks of rework.
• Supplier controls shallow for critical parts → audit findings.
• Generic PMS/PMCF → “not device‑specific” NCs.

What CE Marking Actually Is (Beyond the Textbook Definition)

CE marking is a legal attestation by the manufacturer that the device conforms to EU law (MDR or IVDR). It isn’t an NB “approval” or a quality prize. It’s you, as the legal manufacturer, declaring compliance—and being on the hook if that declaration doesn’t hold up.

• Unlocks: Placement on EU/EEA markets.
• Doesn’t guarantee: Reimbursement, clinician adoption, tenders.
• Enforcement: Market surveillance, NB certificate suspension/withdrawal.

EUDAMED modules roll out in phases; follow the July 2025 roadmap for when a module becomes mandatory.

Brexit caveat: Great Britain uses UKCA. CE‑marked devices continue to be accepted in GB under transitional rules currently running to June 2028 or June 2030 depending on device type/legislation—see MHRA guidance. Northern Ireland keeps CE.

The Classification Decision That Determines Everything

This is where teams stumble. MDR Annex VIII has a web of rules (21 for medical devices) applied hierarchically. Your class drives everything…

• Write a classification memo with negative rationale (why higher rules don’t apply).
• For SaMD, map Rule 11 and record your IEC 62304 safety class.
• Self‑declaration ends at Class I non‑sterile/non‑measuring; above that, an NB engages (NANDO).

Notified Body Selection: The €50K Decision Most Teams Get Wrong

The NB capacity crunch is the 2025 norm. Several NBs stepped back from MDR/IVDR scope post‑transition, and those remaining are running hot. New client onboarding windows of 18–24 months happen—especially for Class III and software‑heavy submissions. Before you fall in love with a name, verify designation and today’s capacity in NANDO and ask for a frank, dated timeline for your class.

How to select without getting burned

• Verify scope: Use NANDO; check Annexes/codes match.
• Test capacity: Ask for today’s onboarding→certificate timeline.
• Check competence: Device‑type references; in‑house SaMD/cyber.
• Compare costs: Pull fee schedules and ask about audit days.

The Real Timeline: Month‑by‑Month Breakdown

Based on observed NB reviews and recent audit data as of 2025; cross‑check with your selected NB.

Month 1–2: Classification & Strategy

• Finalize class with an Annex VIII memo; draft negative rationale.
• Select route (typically Annex IX); build a one‑page plan.
• Shortlist 3 NBs in NANDO; request scope‑matched proposals.
• ISO 13485 gap check vs. Article 10(9).

Month 3–6: QMS Build

• Author/upgrade SOPs: design control, risk, supplier, CAPA, PMS/vigilance, labeling, software lifecycle.
• Train staff; run internal audit; hold management review; close NCs.

Month 7–10: Technical Documentation Assembly

• Device description & intended purpose (keep wording consistent across IFU/CER/risk).
• Design & manufacturing controls; supplier qualification; BOM.
• Risk file per ISO 14971, including usability/cybersecurity hazards.
• V&V (ISO 10993, IEC 60601, EMC, IEC 62304, IEC 62366); create requirements→tests traceability.
• Clinical evaluation (MEDDEV 2.7/1 rev 4 + MDCG); draft PMCF plan.
• Annex I GSPR matrix as master index; labeling/UDI & translations plan.

Month 11–12: NB Application

• Submit application and TD; NB completeness check in 2–4 weeks.
• Address gaps; lock audit dates; prime owners for fast RFI responses.

Month 13–16: NB Audit & Review

• Stage 1/Stage 2 QMS audit (2–5 days total) on‑site/remote.
• TD review cycles (2–3 iterations common): software validation depth, clinical sufficiency, usability, supplier controls.
• Respond to NCs within agreed windows; re‑audit only if majors persist.

Month 17–18: Certificate & Market Entry

• NB issues certificate; you issue Annex IV DoC; affix CE.
• Complete UDI/EUDAMED steps per current roadmap; release product.

Why it stretches

• NB capacity controls the clock; queue moves unpredictably.
• Iterative findings (2–3 cycles) are normal; plan bandwidth.
• Late clinical gaps or software questions add months.
• Translations and supplier documentation frequently lag.

The Technical File: What Actually Needs to Be In There

• Cross‑reference early: build a Submission Index linked to the GSPR matrix.
• Traceability: maintain reqs→tests→results for NB review.

SaMD & Software‑Intensive Devices: The Special Circle of Hell

Based on observed NB reviews in 2025, software is where delays multiply.

IEC 62304 lifecycle (what NBs expect on file)

• Software plan, safety classification (A/B/C), and development environment description.
• Requirements, architecture & detailed design with bidirectional traceability.
• Unit, integration, and system test evidence; anomaly/defect log; release records.

SOUP (third‑party components)

• Inventory every library/OS/service; version pinning and provenance.
• Risk analysis and verification evidence for each SOUP item; update strategy.

Cybersecurity (IEC 81001‑5‑1 aligned)

• Threat model, security controls, hardening guide, and secure SDLC checkpoints.
• Pen‑test or equivalent assessment; vulnerability management and patch policy.

Clinical validation for algorithms

• Performance metrics (e.g., sensitivity/specificity) on an independent, representative dataset.
• Sub‑group analyses (as relevant to intended population) and comparison to standard of care.

Maintenance & updates

• Significant change criteria, regression testing plan, and PMPF/monitoring.
• Cloud ops considerations (data residency, uptime targets, backup/restore).

The Cost Reality: What You’ll Actually Spend

Disclosure (benchmarks, not rates): As of October 2025, most new Class IIa MDR NB certifications are quoted at €50k–€80k+. With testing, clinicals, translations, consulting, and internal effort, all‑in budgets often range €120k–€250k for IIa, €200k–€450k for IIb, and €350k–€650k+ for III (clinicals can push totals ≥€1M). Always confirm with your chosen NB.

Brexit, UKCA, and Multi‑Market Strategy

Status (Oct 2025): CE‑marked devices continue to be accepted in Great Britain under transitional rules to June 2028 / June 2030 depending on device type (see MHRA guidance). Northern Ireland follows CE. For EUDAMED phase‑in, see EC overview and the July 2025 roadmap.

Actionable Next Steps: What to Do This Week

FAQ: The Questions Everyone Asks

Core CE Marking Questions

• Q: What is CE marking in plain terms?
  A: Your legal declaration that the device complies with EU law—MDR 2017/745 (or IVDR 2017/746 for IVDs). It’s not an NB “approval”; you issue the Declaration of Conformity and own ongoing compliance.
• Q: Do I always need a Notified Body (NB)?
  A: No. Only MDR Class I non‑sterile/non‑measuring devices can self‑declare. Class I sterile/measuring and above (IIa/IIb/III) require NB assessment.
• Q: What does CE marking allow—and not?
  A: It enables sale in the EU/EEA (and NI). It doesn’t guarantee reimbursement, clinician adoption, or tender wins—those are separate market access tasks.

Classification & Intended Purpose

• Q: How do we determine class?
  A: Apply Annex VIII rules using your intended purpose (what/for whom/clinical claims). Write a rationale, including why higher‑risk rules don’t apply (negative rationale).
• Q: We have software—does Rule 11 change our class?
  A: Often. Many SaMDs move above Class I if they inform diagnosis or therapy. Map Rule 11 explicitly and state your IEC 62304 safety class (A/B/C).
• Q: Can we limit claims to keep a lower class?
  A: Yes—if claims are true and consistent across IFU, clinical evaluation, and risk files. Over‑claiming usually triggers a higher class and heavier evidence.

Technical Documentation

• Q: What must the Technical Documentation include?
  A: Content per Annex II/III: device description/intended purpose; design & manufacturing controls; ISO 14971 risk management; V&V (e.g., ISO 10993, IEC 60601, EMC, IEC 62304, IEC 62366); clinical evaluation (MEDDEV 2.7/1 rev 4 + MDCG); GSPR matrix (Annex I); labeling/IFU (with translations); PMS/PMCF plans.
• Q: Clinical evaluation vs. clinical investigation—what’s the difference?
  A: Clinical evaluation = assessment of existing evidence (literature, real‑world data, prior studies). Clinical investigation = a new study you run. NBs judge sufficiency; higher‑risk/novel tech often needs new data.
• Q: What triggers most NB questions?
  A: Inconsistent intended purpose wording, thin clinical evidence/equivalence, missing 62304 software artifacts, weak cybersecurity (IEC 81001‑5‑1), and lack of traceability from requirements → tests → results.

Costs & Timing (Oct 2025)

• Q: How much does CE marking cost by class?
  A: Typical all‑in ranges: Class I (self‑declare) €10k–€40k; Class I sterile/measuring €20k–€50k; Class IIa €120k–€250k (NB ~€50k–€80k+); Class IIb €200k–€450k (NB ~€80k–€140k); Class III €350k–€650k+ (with clinicals, totals can ≥€1M). Always confirm with your NB.
• Q: What’s included in “all‑in” cost?
  A: NB fees, test labs (biocomp/electrical/EMC), clinical evaluation or investigation, translations, consulting, internal labor, and NB annual surveillance. Add contingency for re‑testing and iterations.
• Q: How long does it really take?
  A: Common ranges: 12–18 months for IIa/IIb; 18–30 months for III. Drivers: NB capacity, submission completeness, clinical evidence depth, and software validation scope.

Notified Bodies & Strategy

• Q: How do we pick the right NB?
  A: Verify designation/scope in NANDO; ask for today’s onboarding→certificate timeline; check recent experience with similar devices; confirm in‑house SaMD/cybersecurity reviewers; compare fee structures (audit days, TD review days).
• Q: Is a pre‑submission meeting worth it?
  A: Yes. A short, paid scoping session aligns expectations on classification, clinical evidence, and software validation, preventing months of Q&A later.
• Q: Do we need ISO 13485 certification or just compliance?
  A: MDR Article 10(9) requires a compliant QMS. Third‑party ISO 13485 certification isn’t mandatory but helps with multi‑market access; your NB will audit your QMS regardless.

Software / SaMD

• Q: What extra documents do SaMD products need?
  A: Full IEC 62304 lifecycle files (plan, requirements, design, unit/integration/system tests, anomaly management, release records), SOUP inventory with risk controls, cybersecurity per IEC 81001‑5‑1 (threat model, controls, pen‑test/vuln management), and clinical performance validation with representative datasets.
• Q: Our dev team follows commercial best practices—is that enough?
  A: Usually not. NBs expect medical‑grade documentation and traceability aligned to 62304/81001‑5‑1. Good engineering must be shown with risk‑based artifacts.

Post‑Market, EUDAMED & Labeling

• Q: When do we register in EUDAMED and apply UDI?
  A: After certification and before market placement, following the phased EUDAMED rollout. Monitor the current roadmap; register actors/devices/UDI as modules become mandatory.
• Q: What makes a strong PMS/PMCF plan?
  A: Device‑specific data sources, defined trending, clear responsibilities, and action triggers. Generic templates lead to NB findings; tie activities to risk and claims.
• Q: Common labeling/IFU errors?
  A: Claims not matching the clinical evaluation, missing Annex I §23 items, and translation mistakes. Lock intended purpose before translation and use specialist vendors.

Need a Tailored Plan?

• Q: Can you review our class, costs, or NB shortlist?
  A: Yes—get a personalized consult and device‑specific budget/timeline. Talk to an RA/PRRC expert →

The Bottom Line: Your CE Marking Strategy

CE marking isn’t a sprint. It’s an 18‑month marathon with predictable obstacles and a few surprises. The teams that win respect the process and start early.

• Reality first: Document Annex VIII classification; add 6‑month buffer.
• Pick the right NB: capacity + expertise beats a small fee delta.
• Live tech file: structure early; use the GSPR as your index.