CE marking software for medical devices: a step-by-step guide

The recent introduction of EU MDR brought many changes to the CE marking certification process for medical devices. The new regulations emphasise the importance of CE marking for medical devices as a crucial requirement for selling these products within the European Union (EU). Also, there are more requirements to fulfill, which makes the process more complex and much more time-consuming.

To avoid a scenario where the only thing that stops you from releasing your Medical Device Software to the market is the ongoing CE marking certification, you should know when to take the first steps in this process and how to include it in your overall business strategy.

From this blog post, prepared based on an interview with Krzysztof Minicki, Director of Healthcare and Life Sciences, you’ll get to know the steps of the CE marking process for Medical Device Software. You’ll also learn your responsibilities as a manufacturer, and thus get a better understanding of how to plan and optimise the process to avoid possible bottlenecks.

Does your software need a CE marking certification?

Since the introduction of EU MDR in May 2021, the software is now classified as an active medical device. All Medical Device Software that is released to the EU market is required to achieve CE marking, which involves proper classification according to EU regulations and meeting the requirements for certifications by notified bodies for higher-risk devices. Otherwise, it cannot be sold within the EU.

CE MARKING AFTER BREXIT

As of January 1st, 2021, any type of business collaboration between the UK and EU countries got a lot more complicated. So did the CE marking process, which has gone into the transition period ending on January 1st, 2023 – medical companies operating on the British market will be obliged to receive UKCA certification instead of CE marking, with medical products sold in Northern Ireland still requiring the latter. Healthcare products that require to be assessed by a Notified Body will need to be check by an UK Notified Body rather than a EU one.

How to get the CE marking certification for Medical Device Software in the EU?

As a Medical Device Software manufacturer, regardless of whether or not you outsource the manufacturing process, you are responsible for acquiring the CE marking. It is crucial to obtain CE marking to ensure compliance with EU regulations and facilitate commercialization across member states.

In general, the path towards obtaining the CE marking depends on the medical device’s class. Since, in the light of the EU MDR, Medical Device Software is considered as an active medical device, the majority will undergo the upclassification and will belong at least to class IIa.

As per the EU MDR rules, medical devices from classes IIa, IIb and III, have to go through the conformity assessment conducted by a Notified Body. A Notified Body is a third-party organisation, accredited by a European Competent Authority, that checks compliance with the MDR. As a medical device manufacturer, you can select which Notified Body you want to do the assessment for you.

Now, let’s move on now to what the CE marking process for Medical Device Software looks like step by step.

How to do CE marking via self-certification?

IMPLEMENT A QUALITY MANAGEMENT SYSTEM

As you determine the classification of your Medical Device Software and appoint a person responsible for regulatory compliance in your organisation, the next step is to create and implement a Quality Management System in accordance with Annex VIII of the MDR and ISO 13485. The compliance must be assessed and certified by a Notified Body. Moreover, the Quality Management System must include Clinical Evaluation, Post Market Surveillance and Post Market Clinical Follow-up plans.

PREPARE THE TECHNICAL DOCUMENTATION

In the Technical File, you have to include the information about the Intended Use of your Medical Device Software, all the testing reports as well as the Clinical Evaluation Report, your risk management plan, and other information specified in Annex II of the MDR for general medical devices.

REGISTER IN THE EUDAMED DATABASE

Register your Authorised Representative who will handle the regulatory matters as well as your company as a medical device manufacturer in the EUDAMED database. It’s important to note that the authorised representative is mandatory only for importers outside of the EU.

You don’t necessarily have to do it at this point. It can also be done earlier or later in the process.

PREPARE A DECLARATION OF CONFORMITY

The next step for you, the manufacturer, is to prepare a Declaration of Conformity. It’s a legally binding document in which you affirm that your medical device complies with the MDR. At this stage, your product becomes officially CE marked.

REGISTER THE MEDICAL DEVICE SOFTWARE IN THE EUDAMED DATABASE

Now it’s time to register your software in the EUDAMED database. Keep in mind, that the UDI number must be placed, for example, in the “footer” or “About” section or other visible and easy-to-access places.

That’s it – your Medical Device Software is ready to be sold on the EU market. Your duty as a manufacturer is now to keep it safe and effective. In this regard, the EU MDR requires that manufacturers conduct Post Market Surveillance Activities. Also, each year you will undergo a Notified Body surveillance audit to ensure continuous compliance with the EU MDR. If you fail to pass it, your CE marking may become invalid.

During the transitional period, the manufacturers are required to perform the Clinical Evaluation and Post Market Surveillance Activities required by MDR, even though their CE marking certification for class I is still valid.

How to CE mark your software if it falls into a higher risk class?

The certification of software that belongs to a higher risk class under the EU Medical Devices Regulation (EU MDR) requires the involvement of a Notified Body. A Notified Body shall audit the quality management system to determine whether it meets all the regulatory and product requirements. If the quality management system conforms to the relevant regulatory provisions, the notified body shall issue an EU quality management system certificate. After that, the declaration of conformity can be signed. Then, the product can be registered in the Eudamed database and finally introduced into the market.

Specific requirements depend on the characteristics and the level of complexity of a product as well as the risk associated with using it, which directly translates into the scope and timeframe of the audit.

How long is the CE marking certification valid?

The CE marking certification for classes IIa, IIb and III is valid for up to five years within the European market. After the five-year period, the registration of the certification must be renewed. It’s key to have it on the radar and plan the process in advance. It’s recommended to start the registration renewal at least six months before the certification expires.

How much does it cost to get CE marking certification?

The total cost of the CE marking certification process is proportionate to a device’s class. The higher the class, the bigger the risk and the more complex the process. Hence, the cost is also higher. The CE Marking certification is the most expensive for class III devices and can reach even tens of thousands of dollars.

How long does the CE marking certification process take?

Since there are still very few Notified Bodies, conducting the conformity assessment may take quite a long time. The time to begin a Notified Body audit varies between half a year and a year. In comparison, under the MDD it was usually a quarter. The time between an audit and approval may take up from two to even seven months.

Why so long? The EU MDR brought in more requirements, especially for the QMS. This makes the whole process more complex and time-consuming.

One of the reasons why it takes so long is also that there are few Notified Bodies that got already accredited in compliance with the new MDR requirements.

Currently, the MDR requires Notified Bodies to make their price list public. However, it’s worth noting that it includes the hourly rates. It’s especially important to keep in mind when introducing a product to the market for the first time (also for the first time since the MDR came into force) as it requires more than one audit to be performed. Firstly, the Notified Body checks the readiness for certification and after a few months it conducts the certification audit. It significantly impacts the cost. The yearly surveillance or recertification audits are performed once per year.

In total, the CE marking certification process within the European Union may last more than a year. It’s important to take it into consideration when planning your business strategy. For example, you can optimise the process by creating an MVP first and start the CE marking Certification in the meantime, while at the same time developing your product further on.

Need support in the CE marking certification process?

We provide a technical file ready to be assessed for conformity by a Notified Body. Moreover, our specialists can conduct an independent conformity assessment before the official one to check what areas need improvement.

The software we create is compliant with all legal requirements, especially the IEC 62304 and ISO14971. In addition, we provide a Technical File and offer consultation and support with completing the CE marking certification process.

For more information, use the form below to contact Krzysztof Minicki, our Director of Healthcare and Life Sciences.