In this article, the Standards and Quality team examines the current requirements for the certification of medical devices: from determining the risk class to obtaining CE marking for export to the EU.
What is considered a medical device under Ukrainian law
Technical regulations for medical devices define them as any instruments, apparatus, devices, software, materials, or other products intended by the manufacturer for the diagnosis, prevention, monitoring, treatment, or alleviation of disease. The key phrase here is “intended by the manufacturer.” It is the intended purpose, not the physical characteristics, that determines whether a product is a medical device.
This means that the same pulse oximeter can be a medical device or a consumer gadget, depending on what the manufacturer specifies in the documentation. If the instructions or labeling refer to medical use, the product automatically falls under the scope of the regulation, with all the consequences in terms of certification and control.
Risk classes: from bandages to implants
All medical devices are divided into four classes according to the degree of risk to the patient and user. The class determines the complexity of the conformity assessment procedure and the amount of documentation required.
Class I — minimal risk. This includes bandages, plasters, medical beds, crutches, and non-reactive sterile containers. For such products, the manufacturer can independently draw up a declaration of conformity without involving a notified body. The exception is sterile Class I products and products with a measuring function: these require the involvement of a third party.
Class IIa — moderate risk. Surgical gloves, diagnostic equipment, hearing aids, disposable syringes. Conformity assessment must include an audit of the quality management system or type examination of the product by a notified body.
Class IIb — increased risk. Ventilators, defibrillators, X-ray equipment, infusion pumps. The procedure involves a full audit of the manufacturer’s quality system and a detailed review of technical documentation.
Class III — maximum risk. Pacemakers, joint endoprostheses, stents, implants. The most stringent procedure is required: a full production audit, inspection of each batch or each product, clinical evaluation with evidence base.
Correct classification is the first and most important step. Incorrect classification leads to the selection of the wrong assessment procedure, which invalidates all subsequent documentation.
Required documentation: manufacturer’s technical file
Regardless of the risk class, the manufacturer is required to compile a technical file—a set of documents confirming the safety and effectiveness of the product. This is not a single document, but a structured folder that must be available to regulatory authorities throughout the entire period of product circulation.
The technical file includes: a general description of the product and its variants; intended purpose and indications for use; results of risk analysis in accordance with ISO 14971; design and manufacturing documentation; results of preclinical and clinical studies; list of standards applied; copy of the declaration of conformity; samples of labeling and instructions for use.
Clinical evaluation deserves special mention. For Class IIb and III devices, it must include the results of clinical studies or justification of equivalence with existing devices. This is one of the most complex elements of the documentation, requiring the involvement of medical specialists.
The role of the quality management system
For Class IIa, IIb, and III medical devices, having a certified quality management system is not a recommendation but a mandatory requirement. The basic standard is ISO 13485, which is based on the principles of ISO 9001 but adapted to the specifics of the medical industry.
The development of management systems for medical device manufacturers involves the implementation of procedures for risk management, component traceability, sterility control (if applicable), production process validation, and complaint management. Implementation begins with a GAP analysis of existing processes and the development of documentation.
If a company already has a certified ISO 9001 system, this greatly simplifies the transition to ISO 13485. A significant portion of the procedures—document management, internal audits, corrective actions—are common to both standards. The difference lies in the specific requirements for risk management, clinical evaluation, and post-market surveillance.
CE marking for export to the EU
Ukrainian manufacturers planning to supply medical devices to European Union countries are required to obtain CE marking. Since May 2021, Regulation MDR 2017/745 has been in force in the EU, replacing the previous Directive 93/42/EEC and significantly tightening requirements.
The main changes in the MDR compared to the old directive are: an expanded list of products classified as medical devices; stricter requirements for clinical evidence; mandatory identification of devices through the UDI system; increased responsibility for authorized representatives in the EU; and stricter requirements for post-market surveillance and incident reporting.
The procedure for obtaining a CE certificate for medical devices includes selecting and engaging a Notified Body, preparing technical documentation in accordance with the MDR, undergoing a quality system audit, and obtaining a certificate, on the basis of which the manufacturer draws up a declaration of conformity and affixes the CE marking.
Features for manufacturers of in vitro diagnostic devices
In vitro diagnostic medical devices—tests, reagents, analyzers—are regulated by separate technical regulations. In the EU, Regulation IVDR 2017/746 has been in force since May 2022, introducing a new classification system and significantly expanding the list of devices requiring the involvement of a notified body.
For the Ukrainian market, IVD manufacturers must also undergo a conformity assessment procedure and issue a declaration of conformity. The complexity lies in the fact that the requirements for clinical evidence for diagnostic tests differ from those for therapeutic devices: here, the key indicators are sensitivity, specificity, and reproducibility of results.
Safety management and related management systems
Manufacturers of medical devices that simultaneously work with materials of biological origin or sterile solutions may need to implement additional management systems. For example, if the manufacturing process involves working with biological media, it is advisable to implement the principles laid down in ISO 22000 concerning hazard analysis and critical control points.
Developing management systems in the medical industry is always a complex project. In addition to ISO 13485, procedures may be required in accordance with ISO 14971 (risk management), IEC 62304 (software), and IEC 60601 (electrical safety of medical equipment). Integrating these requirements into a single system requires experience and careful planning.
How to prepare: a step-by-step strategy
For manufacturers who are just planning to enter the medical device market or are preparing to re-register their documentation, we recommend the following sequence of actions. First, determine the risk class of your device and the appropriate assessment procedure. Next, audit your existing documentation: technical file, quality system, test reports. Then fill in the gaps: develop or update documentation, conduct the necessary tests, implement or refine your management system.
Standards and Quality has experience in supporting medical device manufacturers at all stages, from classification and development of ISO 9001 documentation to preparation of technical files for CE marking. Contact us for a preliminary consultation to help you assess the scope of work and plan your budget before you begin the process.
