What a Notified Body Does

A notified body is an organization designated by an EU or European Economic Area national authority to perform specified conformity assessments, and for medical devices and in vitro diagnostic devices, it examines a manufacturer's quality system and device evidence when the applicable regulatory route requires third-party review. Its authority is limited to the regulations, device types, and assessment activities in its designation.

It is not the European Commission, a national competent authority, or the manufacturer. It does not place the device on the market and does not attach the CE mark; when the required assessment has been completed, the manufacturer draws up an EU declaration of conformity and affixes the mark. If a notified body participated, its four-digit identification number ordinarily appears with the CE mark.

Key takeaways#

• A notified body is a designated conformity assessment organization, not an EU regulator or a general product-approval office.
• Its review can cover the quality management system, technical documentation, clinical or performance evidence, manufacturing controls, labeling, and post-market processes.
• The exact review depends on device classification, conformity route, intended purpose, and the notified body's designated scope.
• The manufacturer retains legal responsibility for classification, evidence, compliance, the declaration of conformity, CE marking, and post-market duties.
• Certification begins an ongoing relationship that can include surveillance audits, change assessment, corrective action, and certificate restriction, suspension, or withdrawal.

Who designates and monitors a notified body#

Each participating country has an authority responsible for notified bodies. An organization seeking designation must show that it has the structure, quality system, and technical competence needed for the requested scope. It must show personnel, resources, impartiality safeguards, and procedures. The national authority assesses it with participation from European experts. Designation is therefore specific, not a general license to review every kind of device.[1]

The European Commission's NANDO database records designated organizations and their scopes. A manufacturer should not choose a body merely because it has a notified-body number. The relevant NANDO entry must cover the applicable regulation and the device codes, technologies, or assessment activities involved.

National authorities continue to monitor designated bodies. Monitoring can include document review, observed assessments, site visits, and review of performance or complaints. Designations can be limited, suspended, or withdrawn. Coordination groups seek greater consistency across organizations, but a common legal framework does not remove every difference in workload, specialty capacity, or interpretation.

The commercial arrangement sometimes causes confusion. Manufacturers generally pay notified bodies for assessments. EU rules nevertheless require notified bodies to protect impartiality, manage conflicts, and separate assessment decisions from commercial pressure. Payment does not turn the body into the manufacturer's consultant. A body can explain procedures and identify deficiencies, but it must not design the manufacturer's device or evidence program and then certify its own work.

When third-party assessment is required#

The need for a notified body starts with the applicable law, intended purpose, and classification. Under the Medical Device Regulation, many class I devices can use manufacturer self-declaration. Important exceptions include class I devices supplied sterile, devices with a measuring function, and reusable surgical instruments. In those cases, notified-body involvement is confined to the regulatory aspects that triggered it. Class IIa, IIb, and III devices generally require broader notified-body assessment.[2]

Under the In Vitro Diagnostic Medical Device Regulation, many class A non-sterile devices can be self-declared. Class A sterile devices and classes B, C, and D generally require notified-body participation, with review intensity increasing according to the applicable route and risk.

Classification is not a marketing choice. It follows legal rules applied to the intended purpose, duration and nature of contact, and invasiveness. The rules also turn on whether a device is active or implantable, on software function, and on other characteristics. A software product that informs a consequential clinical decision may fall under a higher class than its developer first expects. The explainer on MDR Rule 11 and medical device software examines that issue in more detail.

A notified body checks the claimed classification as part of accepting and assessing the application. If the class, conformity route, or code lies outside its designation, it cannot simply broaden its own authority. The manufacturer may need another organization or a revised regulatory analysis.

What the assessment can contain#

The manufacturer applies with a defined device or device group, intended purpose, and classification. The application states conformity route, sites, and quality-system scope. The notified body first checks whether the application is complete enough to accept, whether it has suitable expertise and capacity, and whether the work falls inside its designation.

The substantive assessment often has two connected tracks: audit of the quality management system and review of device documentation. Their exact depth varies, but a medical-device review may address:

• The device description, intended users, patient population, indications, contraindications, variants, accessories, and classification rationale.
• The general safety and performance requirements and the evidence mapped to each applicable requirement.
• Risk management, including hazard identification, control measures, residual-risk evaluation, and the relationship between risks, labeling, and evidence.
• Design verification and validation, which may include bench, electrical, mechanical, biocompatibility, sterilization, packaging, transport, usability, software, cybersecurity, and shelf-life evidence.
• Clinical evaluation, or for an IVD, scientific validity, analytical performance, and clinical performance.
• Manufacturing controls, critical suppliers and subcontractors, process validation, traceability, contamination controls, and release procedures.
• Labeling, instructions for use, unique device identification, promotional consistency, and language arrangements.
• Post-market surveillance, vigilance, trend reporting, periodic reporting, and follow-up plans.

The technical file is not assessed as a pile of unrelated reports. Reviewers look for a traceable argument: the intended purpose defines the needed performance; risk controls address identified hazards; verification shows the controls work; clinical or performance evidence supports benefits and limitations; labeling communicates residual risks; and post-market plans address remaining uncertainty.

The distinction between clinical evaluation and clinical investigation matters here. A clinical evaluation is the continuing appraisal of relevant clinical data. A clinical investigation is one possible source of those data. A notified body assesses whether the total evidence is appropriate for the claims and risks, and it does not automatically demand a new investigation for every device, and it does not accept literature alone merely because published articles exist.

Quality-system auditors examine whether documented procedures operate at the relevant sites. They can sample design records, complaints, and corrective actions. They can sample supplier controls, training, and manufacturing records. They can sample post-market outputs and management review. Significant suppliers or subcontractors may enter the audit plan where their work is critical to conformity.

Questions, nonconformities, and decisions#

Assessment is iterative but not open-ended product development. Reviewers may ask for clarification, request missing evidence, or issue findings against specific requirements. The manufacturer responds with corrections, root-cause analysis, corrective action, revised documentation, or additional evidence as appropriate.

Not every observation has the same consequence. A documentation inconsistency may be corrected without changing the design. A major gap in clinical evidence, a failed essential performance test, or a quality-system failure can prevent certification. The body must reach and document its own decision.

Possible outcomes include issuing a certificate for a defined scope, narrowing the requested scope, delaying a decision until deficiencies are resolved, or refusing certification. Certificates identify the manufacturer, applicable legislation, and assessment route. They identify covered device scope, conditions, and validity period. Read one no more broadly than its text.

Some high-risk products trigger added procedures involving expert panels, medicinal-product authorities, or EU reference laboratories. These mechanisms do not erase the notified body's role, and they do not apply to every device. They add another defined review or consultation where the legislation requires it.

What CE marking does and does not mean#

CE marking is the manufacturer's declaration that a product meets applicable EU requirements. For a device requiring notified-body participation, the supporting certificate is a necessary part of the route, but the manufacturer still prepares the declaration and affixes the mark.[6]

The mark permits access to the relevant European market subject to the legal framework; it is not a consumer ranking, a claim that the product is better than alternatives, or a promise to you that no defect or adverse event will emerge. It does not support uses outside the intended purpose. You should not equate it with a US authorization pathway either, because the legal tests, classifications, and institutional roles differ. See CE marking compared with FDA clearance for that comparison.

A notified body's number beside the CE mark indicates participation in conformity assessment. It does not mean the body manufactured, distributes, or endorses the product. If an organization reviewed only a limited class I aspect, the number must not be read as a full review of every design claim.

Certification is followed by surveillance#

Conformity must be maintained after a certificate is issued. Notified bodies conduct surveillance audits and periodic reassessment according to the applicable route. They can review complaint and vigilance systems, periodic safety updates, and post-market clinical or performance follow-up. They can review trend reports, corrective actions, and whether the quality system continues to work.

Manufacturers must notify the body about proposed substantial changes to the quality system or device range covered by the certificate. Changes to intended purpose, design, or software may need assessment before implementation. So may changes to materials, manufacturing, suppliers, sterilization, or evidence. Whether a change is significant depends on its regulatory effect and the certificate conditions, not merely on how small a development team considers it.

If conformity is no longer maintained, the body can require corrective action and may restrict, suspend, or withdraw a certificate. A national competent authority retains its own market-surveillance and enforcement powers. The two roles connect but are not interchangeable: the notified body manages certification within its mandate, while authorities oversee the market and public-law compliance.

EUDAMED changes certificate visibility#

The EU database for medical devices, EUDAMED, is being introduced by module. From 28 May 2026, four modules became mandatory: actor registration, unique device identification and device registration, notified bodies and certificates, and market surveillance. The vigilance and post-market surveillance module and the clinical investigation and performance study module were still under development at that point.[4]

In the notified bodies and certificates module, bodies record issued, amended, and supplemented certificates. They record suspended, reinstated, withdrawn, refused, and restricted certificates. The information is publicly searchable.[3] That improves visibility, but a database entry still needs careful reading. Check the status, the scope, and the dates. Check the manufacturer identity and the device coverage, because any one of them can change what you are entitled to conclude.

The timing is especially relevant to older products using transitional provisions. A device can remain on the market under a conditional transition without already holding a full MDR or IVDR certificate. That is not a blanket extension. Conditions include continued compliance with the earlier rules, no unacceptable risk, timely quality-system and notified-body steps, and no significant change in design or intended purpose, among other requirements.[2][5]

For eligible MDR legacy devices, current transition endpoints are generally 31 December 2027 for class III and most class IIb implantable devices, and 31 December 2028 for other class IIb and class IIa devices plus certain class I devices newly requiring notified-body review. Eligible IVDR legacy-device endpoints extend by risk class: 31 December 2027 for class D, 31 December 2028 for class C, and 31 December 2029 for class B and class A sterile devices. Application and written-agreement deadlines occur earlier and must be checked for the particular route.[2][5]

A forthcoming procedural framework#

Commission Implementing Regulation (EU) 2026/977 was adopted on 4 May 2026 to make aspects of notified-body application handling more uniform, including quotations, procedural timelines, interruptions, monitoring, and recertification.[7] Most of it applies from 25 February 2027, so it should be described in July 2026 as forthcoming rather than already operational.

The regulation addresses process consistency. It does not make review automatic and does not replace the MDR or IVDR evidence requirements. Manufacturers still need complete applications, defensible classifications, coherent technical documentation, capable quality systems, and timely responses.

A practical way to read a notified-body claim#

Start with four questions. Which regulation applies? What is the device's intended purpose and class? Is the organization designated in NANDO for the relevant scope? What exactly does the certificate cover and what is its current status?

Then distinguish legal evidence from promotional shorthand. “CE marked” is where your inquiry starts, not where it ends. It should lead you to the declaration of conformity, the notified-body certificate where one is required, the device identifiers, the intended purpose, and the current database records.

The broader research approach is useful here: define the question, identify the governing standard, trace each claim to the appropriate evidence, and preserve the limits of what the evidence can establish.

References#

1. European Commission: Notified Bodies for Medical Devices
2. Regulation (EU) 2017/745 on Medical Devices, Consolidated 1 January 2026
3. European Commission: EUDAMED Notified Bodies and Certificates Module
4. European Commission: EUDAMED Overview
5. European Commission: IVDR Transitional Provisions
6. Your Europe: CE Marking
7. Commission Implementing Regulation (EU) 2026/977