IVDR Regulation: Risk Classes, Deadlines, and Penalties

The IVDR regulation, formally the In Vitro Diagnostic Regulation (EU) 2017/746, is the European Union’s legal framework for the safety and performance of in vitro diagnostic medical devices. It entered into force on May 26, 2017, became applicable on May 26, 2022, and replaced the older In Vitro Diagnostic Directive (98/79/EC) with substantially stricter obligations across a device’s entire life.¹ If you make, import, distribute, or use IVDs in the EU, the regulation reaches you, and its transition deadlines will continue rolling out through 2029.

Which Products Fall Under the IVDR

The IVDR governs devices used to examine human specimens outside the body, including blood, urine, and tissue samples, to provide medical information. That information may concern a physiological or pathological condition, a predisposition to disease, the safety and compatibility of a donation with a recipient, or the likely response to a treatment. In practice the scope covers reagents, calibrators, control materials, test kits, instruments, diagnostic software, and specimen receptacles such as blood collection tubes.

One boundary worth flagging: laboratory-developed tests, sometimes called in-house tests, are no longer outside the rules. Health institutions that manufacture and use their own diagnostic tests must comply with the general safety and performance requirements, maintain a quality management system, and keep lifecycle documentation available for competent authorities. These obligations have been phasing in since 2022, and the requirement to justify that no equivalent commercial device exists has been delayed until December 31, 2030.

The Four Risk Classes

The old directive classified devices by whether they appeared on a specific list. The IVDR replaces that with a risk-based system set out in Annex VIII, and every IVD now falls into one of four classes:²

Class A is the lowest risk tier and includes general laboratory instruments, buffer solutions, and specimen receptacles with no anticoagulant or preservative.
Class B covers low-to-moderate risk devices such as pregnancy self-tests, cholesterol monitoring devices, and certain clinical chemistry analyzers.
Class C is moderate-to-high risk and includes companion diagnostics, tests for sexually transmitted infections (other than those in Class D), and blood glucose self-testing devices.
Class D is the highest risk tier, reserved for tests used to screen blood donations for HIV, hepatitis B, or hepatitis C, blood grouping tests for transfusion, and tests detecting life-threatening infectious agents with a high risk of propagation.

Classification drives almost everything that follows, including whether a Notified Body must be involved. Around 85% of all IVDs now require Notified Body oversight under the IVDR, compared to a small fraction under the old directive.² Class A devices can be self-certified by the manufacturer unless sold sterile; Classes B, C, and D all require Notified Body assessment.

Performance Evaluation You Have to Show

The IVDR raised the bar for proving a device works as claimed. Performance evaluation has three components, and you need evidence for all three.

Scientific validity is proof that the analyte you detect or measure has a well-established association with a particular clinical condition, usually supported by peer-reviewed literature or clinical guidelines. Analytical performance is evidence that the device can accurately and reliably detect or measure that analyte, covering sensitivity, specificity, repeatability, and similar metrics. Clinical performance is evidence that the device produces results that are clinically meaningful for a specific patient population, including diagnostic sensitivity and specificity in real-world use.

You document this work in a Performance Evaluation Plan before conducting studies, then compile results into a Performance Evaluation Report. For higher-risk devices the depth of evidence required increases considerably, and clinical performance data is expected to come from dedicated studies rather than literature alone.

Technical Documentation

Every IVD placed on the EU market requires technical documentation following the structure set out in Annexes II and III. The file must be clear, organized, and readily searchable, covering the device’s description and specifications, design and manufacturing information, risk management outputs, performance evidence, and proof of conformity with the general safety and performance requirements.

This is not a one-off task. The file has to stay current throughout the device’s life, updated as new performance data, post-market findings, or design changes arise. For Class B, C, and D devices, a Notified Body reviews the technical documentation as part of the conformity assessment.

UDI and EUDAMED

Every IVD must carry a Unique Device Identifier with two parts: a device identifier (UDI-DI) specific to the manufacturer and product, and a production identifier (UDI-PI) that tracks the unit or batch. The UDI appears on the device label or its packaging.³

UDI data feeds the European Database on Medical Devices (EUDAMED), the centralized platform for device information. EUDAMED has been available on a voluntary basis for several years. On May 28, 2026, the first four modules become mandatory: actor registration, UDI/device registration, Notified Bodies and certificates, and market surveillance.⁴ Manufacturers who have not yet registered should treat that date as urgent.

Post-Market Surveillance and Vigilance

Placing a device on the market is not the end of your obligations. The IVDR requires an active, systematic post-market surveillance system that continuously gathers data on quality, performance, and safety. Each device needs a PMS plan, and manufacturers of Class C and D devices must prepare Periodic Safety Update Reports (PSURs) summarizing surveillance findings and any corrective actions. The current requirement is an annual PSUR for those classes, though a December 2025 Commission proposal would reduce that to every two years.⁵

Vigilance reporting runs on strict clocks that start as soon as the manufacturer becomes aware of a serious incident:⁶

Death or unanticipated serious health deterioration must be reported within 10 calendar days.
A serious public health threat must be reported within 2 calendar days.
Other serious incidents must be reported within 15 calendar days.

“Immediately” in this context means without any delay that is intentionally or negligently caused. Where a field safety corrective action is needed, the manufacturer notifies the relevant competent authority without delay and issues a field safety notice to affected users. Authorities have 48 hours to review a draft notice before it goes out, unless the urgency of the situation demands faster action.

Who Has to Do What

Manufacturers

Manufacturers carry the primary burden. Before placing a device on the market, you must establish and maintain a quality management system covering the whole product lifecycle. The IVDR does not explicitly mandate ISO 13485, but that standard is widely used as the foundation for an IVDR-compliant QMS. Beyond the QMS, you conduct risk management, compile and maintain technical documentation, apply for conformity assessment (with Notified Body involvement for Classes B, C, and D), and issue an EU Declaration of Conformity before affixing the CE marking.

You also have to designate a Person Responsible for Regulatory Compliance (PRRC), with appropriate qualifications in a relevant scientific discipline or equivalent professional experience. The PRRC ensures devices are properly evaluated, technical documentation stays current, and reporting obligations are met. Micro and small enterprises that cannot keep a PRRC on staff may satisfy the requirement through a permanent arrangement with an external person.

Notified Bodies

Notified Bodies are independent organizations designated by EU member states to assess whether devices conform to the IVDR. They audit quality management systems, review technical documentation, and issue CE certificates. Capacity has been a practical bottleneck of the transition: the number of designated bodies remains limited, and as of early 2026 at least one major Notified Body reported lead times of four months or more for IVD technical documentation assessments, with QMS audits generally scheduled within two months. Build these timelines into your planning.

Authorized Representatives, Importers, and Distributors

Authorized representatives serve as the EU contact point for manufacturers based outside the EU, holding compliance documentation and liaising with regulatory authorities. Importers must verify that devices carry the CE marking, are registered in EUDAMED, and meet labeling requirements before placing them on the EU market. Distributors are responsible for keeping devices compliant during storage and transport and for cooperating with authorities on corrective actions. National competent authorities in each member state oversee enforcement and market surveillance within their territory.

Transition Deadlines for Legacy Devices

The EU built in staggered transition periods for devices that were lawfully on the market under the old directive. A legacy device can remain available during its grace period only if there are no significant changes to design or intended purpose, the device continues to comply with the old directive, and the manufacturer has had an IVDR-compliant quality management system in place since May 26, 2025.⁷

The end dates vary by class and certification history:⁸

Class D devices with an existing Notified Body certificate: transition ends December 31, 2027.
Class C devices: transition ends December 31, 2028.
Class B and sterile Class A devices: transition ends December 31, 2029.

Self-declared legacy devices (those that did not need a Notified Body under the old directive but do under the IVDR) face additional interim deadlines. Class C self-declared devices must have a formal application for conformity assessment lodged with a Notified Body no later than May 26, 2026, and a written agreement with that Notified Body signed by September 26, 2026.⁷ Missing an intermediate deadline can end the transition period early and force the device off the market, which is where many manufacturers are most at risk of a misstep in 2026.

Penalties for Non-Compliance

The IVDR itself does not set specific fines. Article 106 directs each EU member state to establish its own penalties for violations, requiring only that they be effective, proportionate, and dissuasive.⁹ Consequences vary across the EU, but common enforcement tools include quarantine notices preventing a device from being sold, compliance notices requiring corrective action within a set timeframe, prohibition orders that can force a recall or destruction, and court injunctions halting a manufacturer’s operations. Manufacturers convicted of offences can also be ordered to reimburse the full cost of the investigation and prosecution.

Simplification Proposal on the Horizon

In December 2025, the European Commission published a proposal to amend both the MDR and the IVDR (Proposal 2025/0404), aiming to reduce regulatory burden while maintaining safety standards. The proposal is still moving through the legislative process. Provisions relevant to IVD manufacturers include reducing PSUR frequency for Class C and D devices from annual to every two years, removing the fixed five-year validity period for Notified Body certificates in favor of a risk-based approach to recertification, and expanding the scope of Article 5(5) to allow the transfer of in-house devices between health institutions.⁵ The proposal would also extend electronic instructions for use to professional-use IVDs for near-patient testing and introduce new regulatory pathways for orphan devices and breakthrough technologies. Nothing here is final, but it signals the direction the Commission intends to take.

1
European Commission. New Regulations
2
European Commission. Factsheet for Manufacturers of In Vitro Diagnostic Medical Devices
3
European Commission. Unique Device Identifier – UDI
4
European Commission. The EUDAMED Four First Modules Will Be Mandatory to Use as From 28 May 2026
5
European Commission. Commission Staff Working Document – Cost-Savings Accompanying the Proposal Amending Regulations 2017/745 and 2017/746
6
Medical Device Coordination Group. Q&A on Vigilance Terms and Concepts as Outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746
7
European Commission. Extension of the IVDR Transitional Periods – Q&A on Practical Aspects
8
European Commission. IVDR Dates of Application
9
European Commission. Rolling Plan for ICT Standardisation – Medical Devices