Digital Health Regulatory: Bringing Medical Device Software and AI to the EU Market Connecting the dots: qualify the software, map the obligations, set up the non-EU manufacturer
Software is a medical device when its manufacturer intends it for a medical purpose (Art. 2(1) MDR). The manufacturer then carries the obligations of Art. 10 MDR. A manufacturer outside the EU needs an authorised representative (Art. 11); importers and distributors verify this (Art. 13, 14). For products placed on the market after 9 December 2026, software is also a product under EU product liability law (Directive (EU) 2024/2853).
The software check follows the five decision steps in MDCG 2019-11 and provisionally classifies your software under Rule 11, Annex VIII MDR. It runs entirely in your browser.
If the AI is the device itself or its safety component and a notified body must assess the device, it is a high-risk AI system. The requirements apply from 2 August 2028 and are assessed in the MDR procedure.
Serious incident? Under Art. 87 MDR, your reporting deadline runs from awareness: no later than 15 days. It is 10 days for a death or an unanticipated serious deterioration in a person's state of health, and 2 days for a serious public health threat. For in vitro diagnostics, see Art. 82 IVDR. Report directly to the competent authority, usually BfArM in Germany. An enquiry to us does not meet the deadline. For legal support, email office@kanzlei-theofunk.de with the subject “Incident” or leave a voicemail at +49 951 16099520. Enquiries are handled on German business days.
Software is a medical device when its manufacturer intends it for a medical purpose, such as diagnosing, monitoring, predicting or treating disease (Art. 2(1) MDR). What counts is the intended purpose stated in the labelling, instructions for use, promotional or sales material and clinical evaluation (Art. 2(12) MDR), not the technology. The EU guidance MDCG 2019-11 rev.1 (June 2025) tests this in five steps.
Software check · runs only in your browser
At most 11 questions, usually 5 to 8. The check follows the steps set out in the Medical Device Coordination Group's guidance MDCG 2019-11 rev.1 and estimates the class. In the purpose question, tick every purpose that applies; if parts of your product play different roles in diagnosis or treatment, check each part separately. Non-binding guidance, not legal advice; it runs only in your browser.
1 · Qualification
2 · Class
3 · Further details on AI and establishment (optional)
These answers do not change the assessment above; they only add to the notes on obligations.
No answers yet. Answer the questions; your assessment will appear here.
The five decision steps of MDCG 2019-11 rev.1
Software? An app, an algorithm or a cloud service, including as part of a larger system.
Is it part of a device? Software that drives or influences the use of a medical device falls within the same class as that device (Annex VIII, Chapter II, section 3.3 MDR). Software that belongs to an Annex XVI product or is an accessory is also covered by the MDR; accessories are classified in their own right (section 3.2). If driving software also has its own medical purpose, it is classified in its own right as well, and at least in the class of the device (section 3.5; MDCG 2019-11 rev.1, 4.1).
More than storage? Software that only stores, archives, communicates, performs a simple search on or losslessly compresses data is not medical device software.
For a specific person? The output must serve a specific individual, such as a patient or an app user. Statistics, registers, epidemiological studies and general information such as guidelines, literature or templates are not enough.
Medical purpose? Only a purpose under Art. 2(1) MDR makes the software a medical device. If it provides information from the examination of specimens derived from the human body, the IVDR applies (Art. 2(2) IVDR); where the output draws on specimen data and other data, what matters is which data substantially drive it (MDCG 2019-11 rev.1, 3.4).
Five examples, assessed under MDCG 2019-11
Software
Qualification
Reason
Fitness tracker, step counter, sleep app for well-being
not a medical device
MDCG 2019-11 expressly names well-being and fitness apps as software without a medical purpose (section 3.1)
Symptom checker that derives a suspected diagnosis or assesses urgency from user input
usually a medical device, class IIa or higher
diagnostic purpose for the individual user; MDCG 2019-11 places an app that scores depression from reported symptoms in class IIb (Annex IV)
Dose calculator, for example for insulin or chemotherapy
medical device, often class IIb or III
calculates a dose for an individual patient; the class follows the possible consequences of a wrong dose (Rule 11)
Image analysis that flags findings in X-ray, CT or skin images
medical device, class IIa to III
computer-aided detection is medical device software; MDCG 2019-11 places image analysis for treatment decisions in acute stroke in class III (Annex IV)
Practice and hospital administration: scheduling, billing, staff planning
not a medical device
administrative purpose; add-on modules with medical analysis can be medical devices in their own right (MDCG 2019-11, Annex I)
“
Whether software is a medical device is not decided by the code, but by its intended purpose: what you say about it, for example in the instructions for use and in your marketing.
Theo Funk, Rechtsanwalt (German attorney)
Borderline cases
“Helps detect atrial fibrillation” states a medical purpose; “shows your pulse” usually does not, as long as no medical monitoring is promised. Review your app store listing, website and sales material together with the instructions for use. If the qualification remains disputed, the Commission can decide it by implementing act at the request of a Member State (Art. 4 MDR).
02
Class I, IIa, IIb or III: which class applies to software?
Software that provides information used to take diagnostic or therapeutic decisions is at least class IIa. If those decisions may cause a serious deterioration of health or a surgical intervention, the software is class IIb. If they may cause death or an irreversible deterioration, it is class III (Rule 11, Annex VIII MDR). From class IIa, a notified body is involved.
Rule 11, Annex VIII MDR
Software that …
Class
provides information used to take diagnostic or therapeutic decisions
IIa
… where those decisions may cause a serious deterioration of a person's state of health or a surgical intervention
IIb
… where those decisions may cause death or an irreversible deterioration of a person's state of health
III
monitors physiological processes
IIa
monitors vital physiological parameters where variations could result in immediate danger to the patient
IIb
all other software
I
In practice, medical device software rarely stays in class I. MDCG 2019-11 applies the first limb of the rule, as a general principle, to all software with a medical purpose (section 4.2.1); the June 2025 revision clarified that limb. Software that drives or influences a device takes the class of that device; if it is independent of other devices, it is classified in its own right (Annex VIII, Chapter II, section 3.3).
IVD software: classes A to D
Software under the IVDR falls into classes A to D under the rules of Annex VIII IVDR, according to the risk of its intended purpose for the individual and for public health. Only non-sterile class A devices do not require a notified body (Art. 48(10) IVDR).
Conformity assessment with and without a notified body
Class
Route
Notified body
I
EU declaration of conformity after drawing up the technical documentation (Annexes II and III); exceptions for sterile devices, devices with a measuring function and reusable surgical instruments
no (Art. 52(7) MDR)
IIa
quality management system under Annex IX, Chapters I and III, with assessment of the technical documentation of a representative device per device category; alternatively Annex XI
yes (Art. 52(6) MDR)
IIb
Annex IX, Chapters I and III, with assessment of the technical documentation per generic device group; alternatively Annex X with Annex XI
yes (Art. 52(4) MDR)
III
Annex IX; alternatively Annex X with Annex XI
yes (Art. 52(3) MDR)
IVD class A, non-sterile
EU declaration of conformity after drawing up the technical documentation
no (Art. 48(10) IVDR)
IVD classes B, C, D
procedures under Annexes IX to XI IVDR
yes (Art. 48 IVDR)
03
What are the manufacturer's obligations?
You must ensure that your device meets the MDR requirements (Art. 10(1) MDR): risk management, clinical evaluation, technical documentation, conformity assessment, UDI and registration, a quality management system, post-market surveillance and vigilance. You need a person responsible for regulatory compliance (PRRC) (Art. 15) and financial coverage for your liability (Art. 10(16)). These obligations apply in full to manufacturers outside the EU.
Manufacturer obligations under Art. 10 MDR
Obligation
Provision
Content
Risk management
Art. 10(2), Annex I, section 3
a system across the whole life cycle; for software, including information security (Annex I, section 17.2)
Clinical evaluation
Art. 10(3), Art. 61, Annex XIV
evidence of safety, performance and clinical benefit, with post-market clinical follow-up
Technical documentation
Art. 10(4), Annexes II and III
kept up to date, including the post-market surveillance documentation
Conformity assessment, CE marking
Art. 10(6), Art. 19, 20, 52
EU declaration of conformity and CE marking under the route for the class
UDI and registration
Art. 10(7), Art. 27, 29, 31
unique device identifier (UDI); registration of device and economic operator in EUDAMED
Record-keeping
Art. 10(8)
documents available for at least ten years after the last device is placed on the market, 15 years for implants
PMS system and plan; PMS report (class I) or periodic safety update report (PSUR) from class IIa
Labelling and instructions for use
Art. 10(11)
in an official EU language set by the Member State; for Germany, German (§ 8(2) MPDG)
Corrective action and vigilance
Art. 10(12), (13), Art. 87 to 92
correct, withdraw or recall non-conforming devices; report incidents
Person responsible for regulatory compliance (PRRC)
Art. 15
at least one person with the required expertise within the organisation; micro and small enterprises must have such a person permanently and continuously at their disposal
Financial coverage
Art. 10(16)
coverage of liability for defective devices, proportionate to risk class, type of device and size of the enterprise
Notice of supply interruption
Art. 10a
notify an interruption or discontinuation of supply of certain devices at least six months in advance (since 10 January 2025)
German rules that matter if you sell into Germany
The German Medical Devices Implementation Act (MPDG) requires information for users and patients in German (§ 8(2)). It allocates responsibilities (§ 85: the federal states for market surveillance; BfArM and the Paul-Ehrlich-Institut for risk assessment of incidents) and sets criminal and administrative penalties (§§ 92 to 94).
The Medical Device User Reporting and Information Ordinance (MPAMIV) governs reports by users, operators and patients. If you receive such a report and consider it not reportable, you must give reasons within 15 days (§ 7(3) MPAMIV).
Your compliance with these obligations is checked by the authorised representative, the importer and the notified body (sections 09 and 12).
04
Transition periods and timeline
The MDR has applied since 26 May 2021, the IVDR since 26 May 2022. Legacy devices certified or declared under the former directives benefit from transition periods until 31 December 2027 or 31 December 2028 (MDR). Under the IVDR, these periods extend until 31 December 2029 at the latest. These transition periods apply only if the conditions are met. Additional changes include the new product liability rules for products placed on the market after 9 December 2026 and the AI Act for AI in medical devices from 2 August 2028.
26 May 2021MDR applies (Art. 123(2) MDR as amended by Regulation (EU) 2020/561)in force
26 May 2022IVDR applies (Art. 113(2) IVDR)in force
26 Sep 2024Last deadline for MDR legacy devices: written agreement with a notified body; quality management system and application by 26 May 2024 (Art. 120(3c) MDR)expired
10 Jan 2025Manufacturers notify an interruption or discontinuation of supply of certain devices six months in advance (Art. 10a MDR, inserted by Regulation (EU) 2024/1860)in force
28 May 2026EUDAMED: four modules mandatory, including actor registration and UDI/device registration (Decision (EU) 2025/2371; date as stated by the Commission)in force
9 Dec 2026Product Liability Directive (EU) 2024/2853: software is a product under product liability law for products placed on the market after that dateupcoming
26 Mar 2027European Health Data Space Regulation (EU) 2025/327 applies generally (Art. 105)upcoming
31 Dec 2027End of the transition period for MDR legacy devices in class III and implantable class IIb (with exceptions). Also applies to IVD legacy devices with a certificate and IVDs in class D newly requiring a notified body.running
2 Aug 2028AI Act: requirements for high-risk AI systems in products under Annex I, including medical devices (Art. 113(3)(c)(ii) as amended by Regulation (EU) 2026/1744)upcoming
31 Dec 2028End of transition for the other MDR legacy devices (including IIb, IIa and class I requiring a notified body) and for IVDs in class C newly requiring a notified bodyrunning
26 Mar 2029EHDS: requirements for medical devices and wellness applications that claim interoperability with electronic health record systems (Art. 27, 47, 105)upcoming
31 Dec 2029End of transition for IVDs in class B and sterile class A newly requiring a notified body (Art. 110(3b) IVDR)running
The MDR transition periods apply only if your legacy device continues to comply with the former directive, has no significant change in design or intended purpose and poses no unacceptable risk. You must also have had a quality management system in place and lodged an application with a notified body by 26 May 2024. You must have signed a written agreement by 26 September 2024 (Art. 120(3c) MDR). For IVDs, corresponding deadlines fall in 2025 to 2027 (Art. 110(3c) IVDR).
From prototype to CE marking
Define the intended purpose
Write down what the software does and for whom. Qualification, class, clinical evaluation and marketing all depend on it.
Qualify and classify
Apply MDCG 2019-11 and Rule 11 and, for AI, Art. 6 AI Act; document the outcome with reasons.
Quality management and life cycle
Quality management system (Art. 10(9) MDR), software life cycle, risk management and information security (Annex I, section 17).
Technical documentation and clinical evaluation
Annexes II and III MDR, clinical evaluation under Art. 61 MDR, post-market surveillance plan.
Conformity assessment
For class IIa and above, involve a notified body; allow for its lead times early.
Market access
Authorised representative if you are established outside the EU, UDI, registration in EUDAMED, EU declaration of conformity, CE marking. Post-market surveillance and vigilance follow.
05
AI in medical devices: the AI Act and the MDR together
An AI system is high-risk if both conditions are met: it is itself a medical device or the safety component of one, and the device requires assessment by a notified body. See Art. 6(1) with Annex I, Section A, points 11 and 12 AI Act. The requirements apply from 2 August 2028 and are assessed in the MDR conformity assessment (Art. 43(3) AI Act). For AI software in class IIa and above, this means one technical file, one procedure, two regulations.
Where the AI Act and the MDR meet
Topic
AI Act
MDR
Classification
high-risk where third-party conformity assessment is required (Art. 6(1))
class under Annex VIII; notified body from class IIa
Requirements
risk management, data governance, documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity (Art. 9 to 15)
general safety and performance requirements (Annex I)
Technical documentation
a single set of technical documentation for the product (Art. 11(2))
Annexes II and III
Quality management
may be integrated into the quality management system under sectoral law (Art. 17(3))
Art. 10(9)
Conformity assessment
within the MDR procedure, by the notified body (Art. 43(3))
Art. 52
Incidents
under the AI Act only breaches of obligations protecting fundamental rights (Art. 73(10) with Art. 3(49)(c))
vigilance under Art. 87
Established outside the EU
authorised representative under Art. 22, for Annex I systems from 2 August 2028
authorised representative under Art. 11
The amending Regulation (EU) 2026/1744 kept medical devices and in vitro diagnostics in Annex I, Section A and moved the application date to 2 August 2028. By 2 August 2027, the Commission adopts delegated acts that may restrict the requirements of Art. 9 to 15 and 17 to 25 for such products. This is possible where sectoral law offers an equivalent or higher level of protection (Art. 2(13) AI Act). Notified bodies under the MDR and IVDR must apply for designation under the AI Act by 28 January 2028 (Art. 43(3)). In December 2025 the Commission also proposed a revision of the MDR and IVDR (COM(2025) 1023); it is not in force.
“
A combined technical file does not mean information can be left out: for high-risk AI in a medical device, it must contain everything the MDR and the AI Act require.
Theo Funk, Rechtsanwalt (German attorney)
What belongs in the technical file
Classification under Art. 6(1) AI Act, with reasons why the AI is the device itself or its safety component
Data governance: origin, suitability and examination of training, validation and testing data (Art. 10 AI Act)
Logging capabilities and instructions for use for deployers (Art. 12, 13 AI Act)
Human oversight plan (Art. 14 AI Act)
Accuracy, robustness and cybersecurity; for learning systems, how changes after placing on the market are handled (Art. 15 AI Act)
Post-market monitoring integrated into the MDR post-market surveillance system (Art. 72 AI Act)
Guidance
In June 2025 the Medical Device Coordination Group and the AI Board published joint questions and answers on the interaction between the AI Act and the MDR and IVDR (MDCG 2025-6 / AIB 2025-1). They predate the amending Regulation (EU) 2026/1744.
06
Cybersecurity and data
For software, the MDR requires development and manufacture in line with the state of the art, with risk management including information security (Annex I, section 17.2), It also sets minimum IT security requirements, including protection against unauthorised access (section 17.4). The Cyber Resilience Act does not apply to medical devices (Art. 2(2) Regulation (EU) 2024/2847). Health data are a special category of personal data (Art. 9 GDPR).
Which security and data rules apply
Rule
Scope
Core
MDR, Annex I, sections 17.2 and 17.4; guidance MDCG 2019-16
all medical device software
life cycle, risk management with information security, verification and validation, minimum IT requirements
NIS2 (Directive (EU) 2022/2555)
manufacturers of medical devices and IVDs established in the EU above the size thresholds (Annex II, point 5)
registration, risk management, reporting of significant incidents; implemented nationally, in Germany by the BSIG
Cyber Resilience Act (EU) 2024/2847
does not apply to products under the MDR and IVDR (Art. 2(2))
security requirements follow from the MDR
GDPR
processing of personal data in the EU or personal data of people in the EU (Art. 3)
exception under Art. 9(2) for health data, data protection impact assessment (Art. 35(3)(b)), breach notification (Art. 33)
European Health Data Space Regulation (EU) 2025/327
medical devices and wellness applications that claim interoperability with electronic health record systems
requirements from 26 March 2029 (Art. 27, 47, 105)
NIS2 does not cover you if you have no EU establishment; the directive requires an EU representative only for certain digital services (Art. 26(3) Directive (EU) 2022/2555). An EU subsidiary that manufactures devices can fall under it.
If you have no EU establishment, the GDPR applies when you offer goods or services to people in the EU or monitor their behaviour (Art. 3(2)). You then generally have to designate a representative in the EU (Art. 27). The exemption for occasional processing (Art. 27(2)) does not apply where health data are processed on a large scale.
07
Which reporting deadlines apply to incidents?
You must report serious incidents immediately and no later than 15 days after becoming aware of them (Art. 87(3) MDR). For a death or an unanticipated serious deterioration in a person's state of health, the deadline is 10 days (Art. 87(5)); for a serious public health threat, it is 2 days (Art. 87(4)). You must report field safety corrective actions before undertaking them (Art. 87(8)). For in vitro diagnostics, Art. 82 IVDR sets the same deadlines.
2 days
Serious public health threat: report immediately, no later than 2 days after awareness (Art. 87(4) MDR).
10 days
Death or unanticipated serious deterioration in a person's state of health: immediately, no later than 10 days after awareness (Art. 87(5) MDR).
15 days
Other serious incident: immediately, no later than 15 days after awareness (Art. 87(3) MDR).
in parallel, 72 hours
Notification to the data protection authority if personal data are affected: without undue delay and, where feasible, within 72 hours (Art. 33(1) GDPR). This is a separate duty with its own reporting channel.
before the action
Field safety corrective action: report without undue delay before undertaking it, except in cases of urgency (Art. 87(8) MDR).
Deadline calculator · runs in your browser
Reporting steps under Art. 87 MDR and Art. 33 GDPR
Event
Deadline
Provision
serious public health threat
immediately, no later than 2 days after awareness
Art. 87(4) MDR, Art. 82(4) IVDR
death or unanticipated serious deterioration in a person's state of health
immediately, no later than 10 days after awareness
Art. 87(5) MDR, Art. 82(5) IVDR
other serious incident
immediately, no later than 15 days after awareness
Art. 87(3) MDR, Art. 82(3) IVDR
field safety corrective action
without undue delay, before the action is undertaken; except in cases of urgency
Art. 87(1)(b), (8) MDR
trend in non-serious incidents and expected side-effects
on a statistically significant increase
Art. 88 MDR
personal data breach
without undue delay and, where feasible, within 72 hours
Art. 33(1) GDPR
The 15-day deadline runs from awareness of the incident; the report is due once a causal relationship, or a reasonably possible causal relationship, with the device has been established (Art. 87(3)). If you are uncertain whether an incident is reportable, you must still report it within the deadline (Art. 87(7)); an initial report followed by a complete one is permitted (Art. 87(6)).
The GDPR breach notification under Art. 33 is a separate duty; the vigilance report does not replace it.
08
What are the sanctions?
Authorities can withdraw or recall devices or prohibit or restrict their supply (Art. 95, 97 MDR). In Germany, placing a device on the market without the required conformity assessment is a criminal offence (§ 93 MPDG). Supplying it without CE marking or failing to ensure the availability of a person responsible for regulatory compliance constitutes an administrative offence, with fines of up to EUR 30,000 (§ 94 MPDG). You may also face product liability claims and cease-and-desist letters from competitors.
Sanctions at a glance
Consequence
Basis
Examples
Market surveillance
Art. 93 to 100 MDR; in Germany § 77 MPDG
withdrawal, recall, prohibition or restriction of supply
Criminal offence (Germany)
§ 93 MPDG: imprisonment of up to one year or a fine
placing on the market or affixing CE marking without conformity assessment; misleading claims contrary to Art. 7 MDR; missing registration under Art. 29, 31 MDR
More serious offence (Germany)
§ 92 MPDG: imprisonment of up to three years or a fine
placing on the market despite a well-founded suspicion of danger; falsified devices
Administrative offence (Germany)
§ 94 MPDG: fine of up to EUR 30,000
negligent acts under § 93; supply without CE marking; failure to ensure the availability of a PRRC under Art. 15
Product liability
national product liability law; for products placed on the market after 9 December 2026, Directive (EU) 2024/2853
damages for defective products; for manufacturers outside the EU, the importer and the authorised representative are also liable (Art. 8(1)(c) of the Directive)
Cease-and-desist (Germany)
§ 3 HWG, § 3a UWG
advertising that claims unsubstantiated effects, misleading statements of purpose, offering without required CE marking
In Germany, a failure to submit a vigilance report is not itself a criminal or administrative offence under §§ 92 to 94 MPDG. In our assessment, it still weighs heavily: it triggers measures by the authorities and puts you at a disadvantage in liability proceedings.
Advertising for medical devices in Germany is subject to the Medicinal Products Advertising Act (§ 1(1) no. 1a HWG). Misleading claims about effects are prohibited (§ 3 HWG); competitors and associations enforce this through cease-and-desist letters based on § 3a UWG.
09
We are an importer, distributor or marketplace: what must we check?
Before placing a device on the market, you must, as an importer, verify the CE marking and EU declaration of conformity, the designation of an authorised representative, labelling and instructions for use and the UDI. These duties arise under Art. 13(2) MDR. You must also verify registration in EUDAMED (Art. 13(4)). Before making a device available, you must, as a distributor, verify the CE marking, declaration of conformity, manufacturer information, importer details and UDI (Art. 14(2)). Distance sales are covered by the MDR too (Art. 6); online platforms must collect information on traders (Art. 30 DSA).
Verification duties in the supply chain
Role
Verification duties
Provision
Importer
CE marking and EU declaration of conformity; manufacturer identified and authorised representative designated; labelling and instructions for use; UDI; registration of the device, supplemented with its own details
Art. 13(2) and (4) MDR
Distributor
CE marking and EU declaration of conformity; information under Art. 10(11); importer details; UDI
Art. 14(2) MDR
Distance seller
a device offered online must comply with the MDR as well
Art. 6 MDR
Online platform for distance contracts
name, address, contact details, identification details, register entry and the trader's self-certification to offer only products that comply with EU law; an interface for mandatory information such as labelling and marking
Art. 30, 31 DSA
Who becomes the manufacturer
anyone who markets a device under its own name, changes its intended purpose or modifies it in a way that may affect compliance
Art. 16 MDR
If, as an importer, you have reason to believe that a device does not conform, you must not place it on the market (Art. 13(2) MDR). A missing authorised representative for a manufacturer outside the EU is such a case. Ask to see the mandate, the single registration number (SRN) and, where applicable, the certificate issued by the notified body before the first delivery.
Guidance for platforms
In June 2025 the Medical Device Coordination Group published guidance MDCG 2025-4 on medical device software on online platforms.
10
Where do we stand? The 15-point check
The check covers 15 points from the MDR, the AI Act and the GDPR: intended purpose and class, quality management, technical file, clinical evaluation, notified body, PRRC, authorised representative, UDI and registration, post-market surveillance, vigilance, liability coverage, AI and data protection. It runs only in your browser, without transmitting data.
Readiness check · 15 items
Prioritise what blocks market access: first the intended purpose and class, then, if you are established outside the EU, the authorised representative (Art. 11(1) MDR), then the technical file, the notified body and the vigilance process.
11
Lawyer, regulatory consultant or notified body: who does what?
Three roles that complement each other. We handle your legal questions: qualification and class, supply chain contracts, proceedings with authorities and the interplay with the AI Act, the GDPR and the Data Act. Regulatory consultants prepare the technical documentation, clinical evaluation and quality management system. The notified body assesses conformity; it must not provide consultancy on the devices it assesses (Annex VII, section 1.2.3(d) MDR).
Allocation of roles
Task
Law firm
Regulatory consultant
Notified body
Qualification and classification
provides a legal assessment and issues the memo
provides product and technical knowledge
reviews in the procedure
Technical documentation, clinical evaluation
reviews intended purpose, labelling and marketing claims
assesses AI requirements as part of the procedure (Art. 43(3) AI Act)
Conformity assessment
supports in disputes over findings and classification
prepares
decides, issues the certificate
12
Established outside the EU: what applies?
If you are not established in the EU, you may place your device on the market only after designating a single authorised representative. The mandate is valid only once the representative has accepted it in writing (Art. 11(1) and (2) MDR). The authorised representative is jointly and severally liable with you for defective devices if you have not complied with your obligations under Art. 10 (Art. 11(5)). It must itself have a PRRC permanently and continuously at its disposal (Art. 15(6)). The firm does not act as authorised representative under the MDR.
What the authorised representative does under Art. 11(3) MDR
verifies that the EU declaration of conformity and technical documentation have been drawn up and the conformity assessment procedure carried out
keeps the documentation, declaration of conformity and certificates available for the authorities
registers in EUDAMED and verifies the manufacturer's registrations
cooperates with the authorities on preventive and corrective action and forwards incident reports to the manufacturer immediately
terminates the mandate if the manufacturer breaches its obligations, and then informs the authority (Art. 11(6))
If the device is imported through a company in the EU, that company has the verification duties of an importer under Art. 13 MDR. The authorised representative and the importer can be different companies. For products placed on the market after 9 December 2026, both are also liable under the new Product Liability Directive (Art. 8(1)(c) Directive (EU) 2024/2853).
Our role
Kanzlei Theo Funk does not act as authorised representative under Art. 11 MDR. We introduce you to partners that take on this role with a PRRC, review their offer and draft the representation agreement. The agreement covers the scope of the mandate under Art. 11(3), internal allocation of liability under Art. 11(5), insurance, information duties, termination and change of representative (Art. 12 MDR).
You need the authorised representative under Art. 11 MDR before you first place a device on the market. The authorised representative under Art. 22 AI Act becomes mandatory for AI in medical devices from 2 August 2028.
13
How we work together
We start with a free initial assessment of up to 20 minutes. You then receive a quote, at a fixed fee for clearly defined modules or based on time spent; we act only once you have expressly instructed us. We work in English and German, with your regulatory team and your notified body.
Free initial assessmentup to 20 minutes
You outline your product, intended purpose, target markets and status. We assess whether further review is worthwhile and what it would cover.
Qualification and classification memousually one to two weeks after receipt of documents
We review your intended purpose, labelling and marketing under the MDR, IVDR and MDCG 2019-11. Our dated memo explains qualification and class, including classification of AI components under Art. 6 AI Act.
Regulatory roadmaptwo to six weeks, depending on scope
We assign responsibilities and set the sequence of steps and deadlines up to market launch: conformity assessment and notified body, authorised representative and importer, registration, AI Act and data protection.
Implementation and contractsongoing, usually over several months
We draft supply chain contracts, support dealings with the notified body and authorities, and update your roadmap.
Service modules
Software qualification and classification
OutcomeYou receive a dated memo on whether your software is a medical device or an in vitro diagnostic and which class applies, with reasons under the MDR, the IVDR and MDCG 2019-11.
Regulatory roadmap for manufacturers outside the EU
OutcomeYou receive a plan through to EU market launch: roles, conformity assessment, registration and deadlines, with assigned responsibilities and a sequence of steps.
AI-enabled medical devices: AI Act and MDR
OutcomeYou receive the classification under Art. 6 AI Act and an outline of the joint technical file for your notified body's procedure.
Supply chain contract package
OutcomeYou receive agreements with the authorised representative, importer, distributors, OEM partners and the PRRC service provider, with clear duties under Art. 11, 13, 14 and 15 MDR and liability terms.
Data and cybersecurity
OutcomeYou receive a review under the GDPR and the Data Act, an NIS2 assessment and a legal review of your statements on Annex I, section 17 MDR.
Proceedings with authorities and defence
OutcomeWe represent you before market surveillance authorities and notified bodies, defend you against cease-and-desist letters, and support you with incidents and corrective actions.
Attorney, Bamberg — medical device software and AI
Theo Funk is a lawyer admitted to practise in Germany (Rechtsanwalt) in Bamberg advising on EU digital regulation: the Digital Services Act, the AI Act, data protection, NIS2 and medical device law for software. Whether you are established in the EU or a third country, he advises you on software qualification and classification, supply chain contracts and the interaction between the MDR and the AI Act. The initial assessment of up to 20 minutes is free of charge.
The AI Act, EU representative duties compared and how to appoint an EU representative, each with legal references. Articles on medical device software will follow.
Frequently asked questions on medical device software and AI
Is my wellness app affected?
Not as long as it only serves fitness, lifestyle or well-being; such apps are not medical device software (MDCG 2019-11, section 3.1). That changes once you market it with a medical purpose, such as detecting or preventing disease (Art. 2(1) MDR). Check your app store listing, website and advertising, not just the instructions for use. If the app claims interoperability with electronic health records, the rules for wellness applications under Art. 47 of the European Health Data Space Regulation apply from 26 March 2029.
Do I need a notified body?
You need one for class IIa and above (Art. 52 MDR); for in vitro diagnostics, you need one for class B and above and for sterile class A devices. Software that provides information for diagnostic or therapeutic decisions is at least class IIa under Rule 11. Only class I software and non-sterile class A IVDs do not require a notified body (Art. 48(10) IVDR); all other manufacturer obligations still apply.
What does the initial consultation cost?
The initial assessment, up to 20 minutes, is free. We then quote a fixed fee if the scope can be defined in advance; otherwise, we charge for time spent. For all amounts, see Fees for digital health.
Do you act as our EC REP?
No. The firm does not act as authorised representative under Art. 11 MDR. We introduce you to partners that fulfil this role with a PRRC and draft the representation agreement. Regingada UG (haftungsbeschränkt), a separate company owned by the firm's principal, provides authorised representatives and representatives under Art. 22 and 54 AI Act, Art. 27 GDPR and Art. 37 Data Act under a separate contract.
Does the AI Act apply as well?
Yes, if the AI system is itself the medical device or its safety component and a notified body must assess the device. It is then a high-risk AI system (Art. 6(1) AI Act). The requirements apply from 2 August 2028 and are assessed in the MDR procedure (Art. 43(3)). AI in class I software that does not involve a notified body is not high-risk under Art. 6(1); other AI Act duties, for example under Art. 50, may still apply.
What happens if there is an incident?
Report serious incidents to the competent authority (in Germany usually BfArM) immediately, no later than 15 days. The deadline is 10 days for a death or an unanticipated serious deterioration in a person's state of health, and 2 days for a serious public health threat (Art. 87 MDR). Report field safety corrective actions before you undertake them. An enquiry to us does not meet any deadline.
Does NIS2 apply to manufacturers?
Yes, if you manufacture medical devices or in vitro diagnostics, are established in the EU and exceed the size thresholds. NIS2 lists them in Annex II, point 5. Member States implement it; Germany does so through the BSIG. Manufacturers without an EU establishment are not covered; EU subsidiaries can be. The Cyber Resilience Act excludes medical devices (Art. 2(2) Regulation (EU) 2024/2847).
What changes on 9 December 2026?
The new Product Liability Directive (EU) 2024/2853 applies to products placed on the market after 9 December 2026. It expressly includes software as a product (Art. 4(1)). If you are a non-EU manufacturer, the importer and authorised representative are liable alongside you (Art. 8(1)(c)). Review your insurance and contractual liability terms. Member States must transpose the Directive by that date (Art. 22(1)).
29 Oct 2026 First version; law as of 29 October 2026: MDR (consolidated 19 July 2026), IVDR, AI Act as amended by Regulation (EU) 2026/1744, MPDG, MPAMIV and MDCG guidance
Enquiry
Request an initial assessment
Theo Funk, Rechtsanwalt (German attorney) · Bamberg Bar Association
Briefly describe your product and your question. The reply comes from the attorney personally, usually within a few business days. We act for you only once you have expressly instructed us.
Initial assessment of up to 20 minutes, in writing or by video
Kanzlei Theo Funk, Bamberg, Germany — medical device software and AI
