A new implementing regulation imposes binding maximum timelines and standardised quotation requirements on notified bodies certifying medical devices and IVDs under the MDR and IVDR. The rules apply from 25 February 2027 and directly address a documented dysfunction in the EU market access pathway: unpredictable costs, opaque procedures, and widely divergent certification timelines across the 40-plus designated bodies
Commission Implementing Regulation 2026/977, published on 5 May 2026 and applying from 25 February 2027, lays down uniform quality management and procedural requirements for notified bodies designated under the Medical Devices Regulation (EU) 2017/745 and the In Vitro Diagnostics Regulation (EU) 2017/746. The regulation is a direct response to problems that have accumulated since the MDR’s full application date of May 2021 and the IVDR’s phased application from May 2022: notified bodies have applied divergent procedures for quotations, timelines, and re-certification, creating an unlevel playing field for manufacturers — particularly SMEs — seeking to place devices on the EU market.
The regulation’s core operative provision is Article 2, which establishes four sequential maximum timelines covering the full initial certification cycle. Application review and contract signature must be completed within 30 days of receiving a complete application. Quality management system auditing — covering audit programme execution, on-site audits, follow-up of non-compliances, and final review — must be completed within 120 days. Product verification, covering technical documentation assessment for class III and IIb implantable devices and class D IVDs, must be completed within 90 days. These two phases may run in parallel under the Annex IX pathway, provided QMS audit input is available when needed. Finally, the decision and certificate issuance into the EUDAMED database must occur within 20 days of the last final review. Planned substantial changes to QMS or device scope are subject to a 30-day review, up to 90 days of additional assessment, and 20 days for certificate supplement issuance. A notified body may interrupt timelines — up to four times during QMS auditing and four times during product verification — where the manufacturer must address non-compliances or respond to duly justified information requests. Additional interruptions are permitted for EMA opinions, expert panel contributions, or EU reference laboratory input.
Article 1 standardises quotations, a practical pain point for manufacturers who have historically received wildly different cost estimates with no consistent breakdown. Notified bodies must now collect a defined minimum dataset before issuing any quotation — including device description, risk classification, intended purpose, conformity assessment procedure, QMS site details, subcontractor and supplier information, and SME status under Commission Recommendation 2003/361/EC. The quotation itself must include estimated total costs broken down between QMS assessment and technical documentation review, typical surveillance and unannounced audit costs, and a note of potential extra costs, with hourly rates only permitted where activity duration genuinely cannot be predetermined. Any cost increase of more than 10% above the quotation must be communicated to the manufacturer in advance with a justification. Article 4 requires notified bodies to publish annual performance reports covering the percentage of activities completed within maximum timelines and the median total certification cost, providing for the first time a basis for manufacturers to compare bodies on a like-for-like basis.
Articles 5 to 7 standardise re-certification, which has been among the most divergent practices across notified bodies, ranging from cursory document reviews to near-complete reassessments. Re-certification is now explicitly scoped: for product certificates, the notified body assesses post-market surveillance data, change history, updated risk analysis, and state-of-the-art evolution — but may not repeat the initial technical documentation assessment. For QMS certificates, the body verifies that all Annex VII audit requirements have been covered at least once during the certification cycle and reviews surveillance results, non-compliance status, and audit programme adequacy. Both re-certification tracks carry a 90-day maximum assessment period and a 20-day decision window. The transitional provisions protect ongoing procedures: Articles 1, 2, and 3 do not apply to certifications where a written agreement between notified body and manufacturer was signed before 25 February 2027; re-certification rules do not apply to certificates expiring before 25 November 2027; and the annual reporting obligation under Article 4 applies from 1 January 2028.
