EU MDR (2017/745) & IVDR (2017/746) Audit-Readiness Rubric — CE-Marking / Notified-Body Regime
What this is: Regulation (EU) 2017/745 on medical devices (MDR) and Regulation (EU) 2017/746 on in vitro diagnostic medical devices (IVDR) — the legal EU market-access regime for devices and IVDs, enforced by Notified Bodies and national Competent Authorities. This is distinct from ISO 13485 (see iso13485-rubric.md): ISO 13485 certifies the quality management system a manufacturer runs; MDR/IVDR is the statutory regime that actually grants the CE mark and EU market access. A manufacturer can be fully ISO 13485-certified and still be unable to legally sell in the EU because it lacks a valid MDR/IVDR Declaration of Conformity, EUDAMED registration, UDI assignment, or (where required) a Notified Body certificate. This rubric focuses on the requirements that are distinct from QMS content already covered: risk classification, conformity assessment route, clinical/performance evaluation, UDI/EUDAMED, PMS/PMCF/vigilance, and technical documentation as legal deliverables — not the QMS processes that produce them (ISO 13485 already scores those).
Sourcing note: MDR and IVDR full text is public EU law (Official Journal L 117/1 and L 117/176, 5 May 2017), not copyrighted the way ISO 13485 is. However, direct fetch of the full regulation text via EUR-Lex this session was truncated at approximately Article 10 on every attempt (preamble + Articles 1–10 only, regardless of which article/annex the fetch prompt targeted) — the fetch tool appears to cap ingestion length before reaching the annexes, so Annex VIII (classification rules), Annex II/III (technical documentation), Annex XIV (clinical evaluation), and the full text of Articles 27–92 were never read verbatim this session. What follows for those sections is structural/paraphrased content, cross-checked as well-established, widely-published public knowledge (the 22 MDR classification rules and 4-tier A/B/C/D IVDR classification structure are near-universally described identically across BSI, TÜV SÜD, Johner Institute, and EC-adjacent consultancy sources), not a verbatim primary-source read — flagged explicitly per section below, and it should be re-verified against the actual Annex text (e.g. via a direct PDF/Official Journal fetch, which this session's tooling could not perform) before being used in customer-facing compliance scoring. Article numbers and high-level requirement descriptions were confirmed from the EUR-Lex preamble/recitals and Article 1–10 text that did load successfully. The MDCG guidance document list (titles, numbers, dates) was fetched directly from the European Commission's own guidance-document listing page (health.ec.europa.eu) and is a direct read, not paraphrase — though it was not independently cross-checked against a second source, so a small number of dates/rev-numbers could have summarization drift and are worth spot-checking before customer-facing use.
Rubric legend
Each row: Requirement (plain language) → Citation → Evidence that demonstrates compliance → Common failure pattern
Failure patterns here are drawn from consultancy/Notified-Body-adjacent write-ups on MDR/IVDR transition experience (2021–2026), not a named quantified regulator deficiency database — same sourcing caveat as the ISO 13485 rubric's failure-pattern section, flagged rather than fabricated.
Part A — Risk Classification (determines everything downstream)
Sourcing flag: the rule numbers/subject matter below (Annex VIII, MDR; Annex VIII, IVDR) are paraphrased from well-established secondary description, not a verbatim read of the Annex text this session — see sourcing note above.
| # | Requirement (plain language) | Citation | Evidence of compliance | Common failure pattern |
|---|---|---|---|---|
| 1 | Every device must be assigned to one of four risk classes — Class I, IIa, IIb, III — using the classification rules set out in Annex VIII, applied per the device's intended purpose and mode of action (duration of contact, invasiveness, whether active, whether it administers/removes a medicinal substance, body part contacted, etc.). Widely-described rule groups: non-invasive devices (Rules 1–4), invasive devices (Rules 5–8), active devices (Rules 9–13), and special rules covering devices incorporating medicinal substances, devices of animal/human-derived materials, contraceptives, disinfectants, devices for recording diagnostic images, nanomaterials, and devices for administering medicines by inhalation (Rules 14–22) — rule count and grouping paraphrased, not verified verbatim this session. | MDR Annex VIII (Regulation (EU) 2017/745) | Documented classification rationale citing the specific Annex VIII rule(s) applied, with justification tied to intended purpose/mode of action; classification signed off by the Person Responsible for Regulatory Compliance (PRRC, Article 15) | Classification rationale missing or asserting a class without citing the specific rule applied; classification not re-assessed after an intended-purpose or design change that could shift the device to a higher class; reliance on the pre-MDR (MDD) class where MDR's stricter rules (e.g. reclassified software, reusable surgical instruments) would now assign a higher class |
| 2 | IVDs are classified into Class A, B, C, D (lowest to highest risk) per Annex VIII of the IVDR, based on the risk to the individual and to public health — general principle: Class A = low individual/public-health risk (e.g. general lab equipment); Class D = high risk to both (e.g. blood-borne transmissible-agent screening, ABO blood grouping). This is a materially different risk logic from the old IVDD's device-list-based (Annex II list A/B) approach — IVDR classification is rule-based and risk-driven, not a fixed product list, meaning many previously self-certified IVDs (legacy Annex II-negative/general IVDs) moved into higher-scrutiny classes requiring Notified Body involvement for the first time. | IVDR Annex VIII (Regulation (EU) 2017/746) | Documented classification rationale citing the applicable Annex VIII rule and risk-to-individual/risk-to-public-health justification, PRRC-signed | Classification defaulting to the device's old IVDD list category rather than re-running the IVDR risk-based rules; failure to recognize that a device previously requiring no Notified Body under IVDD now falls into Class B/C/D requiring one under IVDR — one of the most commonly cited IVDR-transition gaps industry-wide |
| 3 | Classification disputes between manufacturer and Notified Body, or borderline device/medicinal-product or device/IVD qualification questions, are addressed through Member State Competent Authority consultation and MDCG guidance (the "Helsinki Procedure" / Manual on Borderline and Classification) rather than self-resolution. | MDR Article 51(2); MDCG Manual on Borderline and Classification v5; Helsinki Procedure (Sept 2021) | Documented borderline/classification consultation record with the relevant Competent Authority or MDCG reference cited, where classification is ambiguous | Manufacturer self-resolving an ambiguous borderline classification without documenting the rationale or seeking the available MDCG/Competent-Authority reference resource |
Part B — Conformity Assessment Route
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 4 | Class I devices (MDR) and Class A IVDs (IVDR) may generally be self-certified by the manufacturer under its sole responsibility — no Notified Body involvement — except Class I devices that are sterile, have a measuring function, or are reusable surgical instruments ("Is/Im/Ir" sub-categories), which do require Notified Body involvement for the sterility/measuring/reprocessing aspects specifically. Similarly, Class A IVDs that are sterile require Notified Body involvement for the sterility aspect. | MDR Article 52(7); IVDR Article 48(2); MDCG 2019-15 rev.1 (Class I manufacturer guidance) | Self-declared Declaration of Conformity for pure Class I/Class A; for Is/Im/Ir or sterile-A devices, a Notified Body certificate covering specifically the sterility/measurement/reprocessing aspect, alongside manufacturer self-declaration for the rest | Treating an entire device as "self-certified Class I" when it is actually Class Is/Im/Ir and requires partial Notified Body sign-off — a well-documented gap where manufacturers correctly identify the base class but miss the sub-category trigger |
| 5 | Class IIa, IIb, III devices (MDR) and Class B, C, D IVDs (IVDR) require an "appropriate level of involvement" of a Notified Body, escalating with risk class — ranging from representative sample audits of technical documentation (IIa) to full quality-system audit plus technical documentation review of every device/device-family (III / Class D). | MDR Article 52(1)–(6), Annexes IX–XI; IVDR Article 48(1),(3)–(8), Annexes IX–XI | Valid, in-date Notified Body certificate(s) referencing the specific conformity assessment annex/route used and the devices/device-groups covered; certificate scope matching the actual product range sold | Notified Body certificate scope not covering a variant/accessory actually placed on market; certificate lapsed/expired with product still being sold; conformity assessment route mismatched to actual class (e.g. a IIb route used for what is actually a III device post-reclassification) |
| 6 | Class III implantable devices and Class IIb active devices intended to administer/remove a medicinal product trigger mandatory expert panel scrutiny of the clinical evaluation assessment report by the Notified Body (with limited exceptions), adding an extra independent-review layer beyond the Notified Body's own assessment. Class D IVDs similarly may trigger EU reference laboratory involvement and/or expert panel consultation. | MDR Article 54; IVDR Article 48(6) | Documented expert panel consultation record/opinion (or documented, justified exemption) in the technical documentation for qualifying high-risk devices | Expert panel consultation step skipped or undocumented for a device that meets the mandatory-consultation criteria, without a documented exemption rationale |
| 7 | Notified Bodies must themselves be designated and monitored by Member State authorities against MDR/IVDR-specific criteria (a materially stricter designation regime than under the old Directives) — a manufacturer's chosen Notified Body must hold current designation scoped to the specific device category/technology being certified. | MDR Articles 35–50; IVDR Articles 31–46; MDCG 2022-13 rev.1 | Confirmation of Notified Body's current designation and scope (via the NANDO database) matching the device category certified | Using a Notified Body whose designation scope does not actually cover the specific device technology/category — a documented cause of certificate validity challenges during the MDR/IVDR transition |
Part C — Clinical Evaluation (MDR) / Performance Evaluation (IVDR)
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 8 | Manufacturers must conduct clinical evaluation (MDR) — "a systematic and planned process to continuously generate, collect, analyse and assess clinical data...to verify safety and performance, including clinical benefits" (Article 2(44)) — and produce a Clinical Evaluation Report (CER), following a documented clinical evaluation plan, updated throughout the device's lifecycle (not a one-time pre-market exercise). | MDR Article 61, Annex XIV Part A; MDCG 2020-13 (CER template) | Clinical Evaluation Plan; current, dated Clinical Evaluation Report referencing the specific clinical evidence sources (clinical investigation data, equivalence data, literature, PMCF data) and updated at a defined frequency proportional to risk | CER produced once at initial CE marking and not meaningfully updated with PMCF/PMS data on the required cycle; CER relying on "equivalence" claims to another device without the data-access justification MDR Article 61(4)-(6)/MDCG 2023-7 requires |
| 9 | IVDR equivalent is performance evaluation, built on three pillars — scientific validity, analytical performance, clinical performance — documented in a Performance Evaluation Report (PER), following a Performance Evaluation Plan. | IVDR Article 56, Annex XIII Part A; MDCG 2022-2 (general principles of clinical evidence for IVDs) | Performance Evaluation Plan; current PER addressing all three pillars with evidence sources cited per pillar | PER addressing only analytical performance while treating clinical performance/scientific validity as inherited from a predicate/legacy device without documented justification |
| 10 | Equivalence claims (MDR/IVDR alike) — relying on clinical/performance data from an "equivalent" device rather than the manufacturer's own device — require documented technical, biological, and clinical/scientific-validity equivalence, and (per MDCG 2023-7 for MDR) a documented basis for having sufficient access to that other manufacturer's technical data, not merely public-domain claims. | MDR Article 61(4)-(6); MDCG 2020-5, MDCG 2023-7 | Equivalence justification table (technical/biological/clinical characteristics) plus documented data-access basis | Equivalence asserted against a competitor's device with no documented data-access agreement — a frequently cited MDR CER weakness since the access bar tightened relative to the old MDD approach |
| 11 | PMCF (Post-Market Clinical Follow-up) for devices, and its IVDR analogue PMPF (Post-Market Performance Follow-up) for IVDs, must be planned and executed as a proactive continuation of clinical/performance evaluation — not merely reactive to complaints — with a PMCF/PMPF Plan and periodic PMCF/PMPF Evaluation Report feeding back into the CER/PER. | MDR Article 61(11), Annex XIV Part B; IVDR Article 56, Annex XIII Part B; MDCG 2020-7 (PMCF plan template), MDCG 2020-8 (PMCF evaluation report template) | PMCF/PMPF Plan; periodic PMCF/PMPF Evaluation Report demonstrably feeding conclusions back into the CER/PER and risk management file | PMCF/PMPF treated as a paperwork exercise disconnected from the actual CER conclusions; PMCF plan silent on a device with high uncertainty/novel technology where proactive follow-up is precisely what's expected |
Part D — UDI (Unique Device Identification) and EUDAMED Registration
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 12 | Manufacturers must assign a UDI (Device Identifier + Production Identifier) to every device except custom-made devices, obtained from an EU-recognized Issuing Entity, and place the UDI carrier on the label/packaging, with implementation timelines that were staggered by device class (higher-risk classes first). | MDR Articles 27–29, Annex VI; IVDR Articles 24–26, Annex VI; MDCG 2018-1 rev.4 (Basic UDI-DI) | UDI-DI/UDI-PI assignment records; label/packaging evidence of UDI carrier placement; Issuing Entity registration confirmation | UDI assigned but not actually reflected on physical label/packaging artwork actually shipped; Basic UDI-DI (the higher-level grouping identifier used in technical documentation and certificates) confused with or omitted alongside the device-specific UDI-DI |
| 13 | Manufacturers, authorised representatives, and importers must register themselves as economic operators and register their devices in EUDAMED, the central EU database integrating device, certificate, clinical-investigation/performance-study, vigilance, and market-surveillance data. EUDAMED has been undergoing a "gradual roll-out" with modules becoming mandatory on a staggered timeline (per amending Regulation (EU) 2024/1860), rather than all-at-once mandatory use from MDR/IVDR's original application dates — meaning obligations vary module-by-module and manufacturers must track which modules are currently mandatory versus voluntary/transitional. | MDR Articles 29–34; IVDR Articles 26–31; MDCG 2021-1 rev.1, MDCG 2022-12 (interim admin practices pending full EUDAMED functionality); Q&A on gradual roll-out (Nov 2024, per Reg. 2024/1860) | Economic-operator registration record (SRN — Single Registration Number); device/UDI-DI registration in EUDAMED (or, for modules not yet mandatory, evidence of compliance with the interim/alternative administrative practice per MDCG 2021-1/2022-12) | Treating EUDAMED as "not yet required" wholesale rather than checking which specific module has actually become mandatory under the gradual roll-out timeline; SRN obtained but device-level UDI-DI registration not kept current after a device change |
| 14 | An economic operator (not established in the EU) must appoint an Authorised Representative, and importers/distributors have defined verification obligations (checking CE marking, Declaration of Conformity, UDI, labeling) before placing devices on the EU market. | MDR Articles 11, 13, 14; IVDR Articles 11, 13, 14; MDCG 2022-16 (AR guidance), MDCG 2021-27 rev.1 (Art. 13/14 Q&A) | Authorised Representative mandate/agreement naming specific responsibilities; importer/distributor verification checklist records | Authorised Representative mandate not updated after a change in the device range covered, or not naming the specific PRRC-equivalent liability split required under Article 11 |
Part E — Post-Market Surveillance (PMS), PSUR, and Vigilance
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 15 | Manufacturers must maintain a PMS system proportionate to risk class, built on a documented PMS Plan, systematically and actively gathering data from post-market experience (complaints, PMCF/PMPF data, literature, incident/trend data), feeding back into technical documentation, risk management, and CER/PER updates. | MDR Article 83–84, Annex III; IVDR Article 78–79, Annex III; MDCG 2025-10 (PMS guidance) | PMS Plan document; PMS system procedure showing data-source coverage and defined feedback loop into technical documentation/risk file/CER-PER | PMS Plan generic/templated with no device-specific data sources identified; PMS data collected but not demonstrably closing the loop back into the CER/PER or risk management file — directly analogous to the ISO 13485 §8.2.1 gap this rubric's sibling document flags, but here it is a distinct legal deliverable (the PMS Plan/Report), not just a QMS process |
| 16 | A PMS Report (lower-risk Class I devices / Class A-B IVDs) or a PSUR — Periodic Safety Update Report (higher-risk Class IIa/IIb/III devices and Class C/D IVDs) must be produced, summarizing PMS findings, conclusions on benefit-risk, and PMCF/PMPF findings, at a frequency proportional to risk (PSUR: at least annually for Class III/IIb implantable-equivalent and Class D; at least every 2 years for Class IIa and Class B/C, per general practice) and — for higher classes — submitted to/available to the Notified Body and, where EUDAMED requires, uploaded centrally. | MDR Article 85 (PMS Report), Article 86 (PSUR); IVDR Article 80 (PMS Report), Article 81 (PSUR); MDCG 2022-21 (PSUR guidance) | Current PMS Report or PSUR (as applicable to device class) with defined update frequency evidenced by version history; Notified Body acknowledgment/review record for PSUR-tier devices | PSUR frequency not actually matched to the device's real risk class (e.g. an annual-cycle device updated only every two years); PSUR conclusions not visibly informing CER/PER updates or risk file changes — a "PSUR as compliance artifact, not a live safety signal" failure mode |
| 17 | Vigilance reporting — manufacturers must report serious incidents and Field Safety Corrective Actions (FSCAs) to the relevant Competent Authority within defined timelines (immediately/without undue delay for serious incidents; specific shorter timelines for incidents involving death/serious public-health threat), via the vigilance module of EUDAMED (or interim national reporting pending full EUDAMED functionality), and issue Field Safety Notices to affected users where an FSCA is initiated. | MDR Articles 87–92, Annex III Part B; IVDR Articles 82–87; MDCG 2023-3 rev.2 (vigilance terms/concepts), MDCG 2024-1 (device-specific vigilance template) | Vigilance/incident-reporting procedure naming jurisdiction-specific timelines and thresholds; incident/FSCA log with reporting timestamps demonstrating compliance with the applicable timeline; Field Safety Notice records for any FSCA issued | Reporting procedure not distinguishing "serious incident" from ordinary complaint per the Article 2 definitions, causing under-reporting; FSCA issued without a corresponding, retrievable Field Safety Notice record; reporting timeline missed because the trigger event (e.g. "became aware") was not clearly defined internally |
Part F — Technical Documentation
| # | Requirement | Citation | Evidence | Common failure pattern |
|---|---|---|---|---|
| 18 | Manufacturers must compile and keep current Technical Documentation demonstrating conformity — device description/specification, design/manufacturing information, General Safety and Performance Requirements (GSPR) checklist with evidence references, benefit-risk analysis, verification/validation data, and (per Annex III) the PMS-related documentation described in Part E above — structured per Annex II (general technical documentation) and Annex III (PMS-specific technical documentation). | MDR Articles 10(4), Annex II & III; IVDR Articles 10(4), Annex II & III | Technical Documentation file structured to Annex II/III headings, with a GSPR (MDR Annex I) / General Safety and Performance Requirements (IVDR Annex I) checklist mapping each applicable requirement to specific supporting evidence | GSPR/checklist referencing evidence documents that, on inspection, don't actually substantiate the specific requirement claimed (a "checklist theatre" pattern Notified Bodies have flagged repeatedly during MDR/IVDR technical documentation audits); technical documentation not updated after a design change, leaving it out of step with the actual manufactured device |
| 19 | A Declaration of Conformity (DoC) must be drawn up by the manufacturer, listing the device(s)/device-group covered, applicable regulation and conformity assessment route/annex used, and (where applicable) the Notified Body identification number and certificate reference. | MDR Article 19, Annex IV; IVDR Article 17, Annex IV | Signed, current Declaration of Conformity naming the correct devices, correct conformity assessment route, and Notified Body number/certificate where applicable | DoC not re-issued after a device-range change (new SKU/variant added without updating the DoC's device list); DoC citing an expired or superseded Notified Body certificate number |
| 20 | The CE marking itself, and (for Notified-Body-assessed devices) the Notified Body's four-digit identification number displayed alongside it, must correspond to a currently valid certificate — CE marking without a valid, in-scope Notified Body certificate for a device requiring one is a fundamental non-conformity, not a documentation gap. | MDR Article 20; IVDR Article 18 | CE mark + NB number on device/label matched against a live, in-scope Notified Body certificate record | CE mark carried over from a legacy MDD/IVDD certificate past its transitional validity window (see MDCG 2022-18 / Article 120 MDR & Article 110 IVDR legacy-device provisions) without a valid MDR/IVDR certificate actually in place — the single most commonly cited MDR/IVDR "transition cliff-edge" risk across MDCG's own position papers |
Documents/evidence needed for an MDR/IVDR gap analysis
Classification & conformity assessment: documented classification rationale citing the specific Annex VIII rule(s); Notified Body certificate(s) (scope, expiry, route) or self-declaration basis for Class I/Class A; NANDO designation-scope confirmation for the chosen Notified Body; expert panel consultation record where mandatory.
Clinical/Performance evaluation: Clinical Evaluation Plan + Clinical Evaluation Report (MDR) or Performance Evaluation Plan + Performance Evaluation Report (IVDR); equivalence justification + data-access basis where equivalence is claimed; PMCF/PMPF Plan and Evaluation Report.
UDI/EUDAMED: UDI-DI/UDI-PI assignment records and Basic UDI-DI; label/packaging artwork evidencing UDI carrier placement; economic-operator SRN and device-level EUDAMED registration (or documented interim/alternative practice per MDCG 2021-1/2022-12 for modules not yet mandatory); Authorised Representative mandate (non-EU manufacturers).
PMS/PSUR/Vigilance: PMS Plan; PMS Report or PSUR (per risk class) with version history; vigilance/incident-reporting procedure; incident/FSCA log with reporting timestamps; Field Safety Notice records.
Technical documentation & DoC: Technical Documentation file per Annex II/III headings; GSPR/General Safety and Performance Requirements checklist mapped to evidence; Declaration of Conformity naming devices/route/Notified Body; CE mark + NB-number validity cross-check against the live certificate.
Common gap patterns (cross-cutting, qualitative — not a named regulator deficiency database)
- ISO 13485 certification mistaken for market access. The most consequential category error this rubric exists to catch: a fully ISO 13485-certified manufacturer with no valid MDR/IVDR Declaration of Conformity, no current Notified Body certificate for its actual risk class, or no EUDAMED registration cannot legally place devices on the EU market — QMS certification and legal conformity are separate deliverables.
- Legacy-device transitional cliff-edge (MDCG 2022-18, MDCG 2021-25 rev.1, MDCG 2022-8): devices carried over under MDD/AIMDD/IVDD certificates past their transitional validity window without a valid MDR/IVDR certificate in place — repeatedly flagged by MDCG as the single biggest systemic MDR/IVDR transition risk.
- IVDR reclassification blind spot: IVDs previously self-certified under the old IVDD's list-based approach that now fall into Class B/C/D under IVDR's risk-based rules, requiring Notified Body involvement for the first time, discovered late.
- Equivalence claims without documented data access for CER/PER purposes, post-MDCG 2023-7 tightening.
- PSUR/PMS as static compliance artifacts rather than a live feedback loop into CER/PER and the risk management file.
- GSPR checklist "theatre" — a completed-looking checklist whose cited evidence doesn't actually substantiate the specific requirement, surfaced during Notified Body technical documentation sampling.
- EUDAMED module confusion — treating all EUDAMED obligations as "not yet mandatory" without tracking which specific module has gone live under the gradual roll-out.
Gaps / follow-ups
- Annex VIII (MDR and IVDR) verbatim rule text was never read this session — every EUR-Lex fetch attempt truncated at approximately Article 10 regardless of the specific article/annex targeted in the prompt, suggesting a hard content-length cap in the fetch pipeline rather than a URL/anchor problem. The classification rule structure above (22 MDR rules in 4 groups; IVDR risk-to-individual/risk-to-public-health A/B/C/D logic) is well-established secondary-source paraphrase, not a primary-source read. Recommend a follow-up pass using a source that can serve the Annexes in smaller chunks (e.g. a paginated Official Journal PDF fetch, or a Notified Body's own published classification-rule summary table) before this is used in customer-facing scoring.
- Full article text for Articles 27–92 (both regulations) was similarly never read verbatim — the requirement descriptions above are built from confirmed article numbers (via preamble cross-references that did load) plus well-corroborated MDCG guidance titles/topics, not verbatim article text.
- MDCG guidance list dates/rev-numbers were fetched directly from the EC's own listing page in one pass, not cross-checked against a second source — a small number of entries (particularly 2025/2026-dated revisions) are worth spot-checking against the live page before being cited as current to a customer, since guidance is revised frequently and this rubric will age.
- No named, quantified Notified Body or Competent Authority deficiency database was located/attempted this session (parallel to the ISO 13485 rubric's equivalent gap) — the "common gap patterns" section above is qualitative, drawn from MDCG's own position papers (which are primary-source, unlike the ISO 13485 rubric's consultancy-only sourcing) plus general industry write-ups.
- EUDAMED's gradual roll-out timeline specifics (which modules are mandatory as of the current date vs. still voluntary/transitional under Regulation (EU) 2024/1860) were identified as existing but the specific module-by-module current status was not verified this session — flagged as a live-tracking item since it changes over time and directly affects what "EUDAMED registration evidence" should look like for a given customer engagement.
- Notified Body capacity/availability (MDCG 2022-14) — not researched in depth this session; potentially relevant context for why a customer's Notified Body process is delayed, but not a rubric-scoring item itself.
- Interplay with the EU AI Act for AI/software-containing devices (MDCG 2025-6) was identified in the MDCG list but not researched — flagged as a possible future rubric extension given Regscribe's SaMD-adjacent customer base (paralleling the ISO 13485 rubric's IEC 62304 flag).
Suggested integration note (not implemented — flagging for a decision, not doing it unasked)
Following the same precedent as the ISO 13485 rubric: this document is not yet wired into lib/rubrics.ts (the RUBRICS registry currently only lists part11 and gmp-gdp). If MDR/IVDR is meant to become a selectable rubric in the product, the follow-up is: add an mdr-ivdr entry to RUBRICS in /Users/khando/Khando/Dev/Projects/regscribe/lib/rubrics.ts pointing at eu-mdr-ivdr-rubric.md, plus whatever test coverage lib/__tests__/rubrics.test.ts expects for a new rubric ID. Given MDR/IVDR and ISO 13485 are frequently needed together for a device manufacturer, also worth deciding (with Khando, not unilaterally) whether these should be exposed as one combined "EU Medical Device" rubric selection or two separate selectable rubrics — flagging the product decision rather than making it.