EU IVDR

This topic is part of the SG Systems Global medical device lifecycle, vigilance & regulatory compliance glossary.

Updated December 2025 • EU MDR 2017/745, CE Marking, ISO 13485 Requirements, ISO 14971 Risk Management, Postmarket Surveillance, UDI, Labeling Medical Devices, Data Integrity, Audit Trail, Medical Device QMS, V5 QMS, V5 MES

EU IVDR is the European Union’s in‑vitro diagnostic regulation: Regulation (EU) 2017/746. If your product tests a specimen taken from the human body (blood, saliva, swabs, tissue, urine, etc.) to generate information used for diagnosis, screening, monitoring, prognosis, therapy selection, or disease predisposition, IVDR is the rulebook that decides whether you can legally place it on the EU market with a CE mark.

The practical impact is blunt: IVDR turns “diagnostics compliance” from a paperwork exercise into an evidence and lifecycle discipline. Under the old IVDD regime, many IVDs were effectively self‑declared with inconsistent levels of clinical evidence and external review. Under IVDR, far more products fall under notified‑body scrutiny, performance evaluation expectations are stronger and more explicit, and post‑market obligations (including performance follow‑up) are treated as mandatory lifecycle work—because diagnostics can harm patients just as effectively through a wrong result as a device can through a mechanical failure.

“If your clinical evidence is ‘we’ve sold it for years and nobody complained’, IVDR will eventually remove your CE mark. Sales history is not a performance evaluation.”

1) What EU IVDR Actually Is

IVDR is a directly applicable EU Regulation (not a Directive) that defines:

• what qualifies as an in vitro diagnostic medical device (IVD),
• how IVDs are classified by patient and public‑health risk (classes A–D),
• how conformity is assessed (including when a Notified Body must be involved),
• what technical documentation must exist and be maintained,
• what manufacturers and other “economic operators” must do before and after market placement, and
• how post‑market surveillance, vigilance, and corrective actions must run over the product lifecycle.

Think of IVDR as the diagnostic equivalent of EU MDR: a lifecycle framework that expects a manufacturer to prove performance and keep proving it as evidence accumulates, variants evolve, suppliers change, and software updates ship.

2) Why IVDR Exists (And Why It Feels Harder Than IVDD)

IVDR exists because diagnostics are high‑leverage: one wrong result can trigger a cascade—wrong treatment, missed treatment, unnecessary surgery, or uncontrolled spread of infection. The old IVDD environment allowed too many devices to reach the market with uneven levels of external review and uneven definitions of “clinical evidence.”

IVDR is a correction. It forces manufacturers to answer three uncomfortable questions with real evidence:

• Does the biomarker or measurand actually mean what you say it means? (scientific validity)
• Does your test measure it reliably in the real world? (analytical performance)
• Do the results actually support the intended clinical decision in the intended population? (clinical performance)

If you have a mature evidence base, IVDR is mostly a structured packaging exercise. If your product lives on weak literature, loose claims, and tribal knowledge, IVDR is not “extra documentation”—it’s a forced redesign of how you justify your business.

3) Scope: What Counts as an IVD Under IVDR

In practice, IVDR captures more than just “test kits.” IVDs can include reagents, calibrators, control materials, specimen receptacles, instruments, software, and systems intended to be used to examine specimens derived from the human body. IVDR also distinguishes use contexts that raise risk and evidence expectations:

• Self‑testing: used by lay persons (usability, labeling clarity, and fail‑safe design matter more).
• Near‑patient / point‑of‑care: used outside controlled lab environments (robustness and user error tolerance matter more).
• Companion diagnostics: used to determine patient eligibility for specific medicinal products (the stakes are high, and coordination with medicines regulation becomes unavoidable).
• Software‑heavy tests: algorithms, interpretation engines, and data pipelines can be the “device” as much as the reagent is.

One common mistake is pretending a product is “research use only” (RUO) while selling it into clinical decision‑making. Regulators and notified bodies look at actual intended purpose and marketing behavior, not what you wish your label implied. If clinicians use your results to decide treatment, you’re in IVDR territory—whether you like it or not.

4) Classification Under IVDR (Classes A–D)

IVDR uses four risk classes: A (lowest), B, C, and D (highest). The logic is not only “risk to one patient” but also risk to public health (e.g., infectious disease screening of blood donations).

A simplified way to think about it:

• Class D: highest risk; wrong results can drive serious harm at scale (public health) or catastrophic harm to individuals. Classic examples are blood and tissue donation screening for serious transmissible agents.
• Class C: high individual risk and/or meaningful public‑health impact; includes many infectious disease and oncology‑related assays where wrong results can be life‑changing.
• Class B: moderate risk; still meaningful, but typically not “systemic catastrophe” if wrong.
• Class A: lowest risk; generally lab‑use items that are unlikely to drive direct clinical harm. Class A sterile is a special case because sterility claims raise risk.

Why this matters: classification controls your path to CE marking, notified‑body involvement, and the ongoing burden of PMS reporting. If you get classification wrong, everything downstream is wrong—technical documentation structure, evidence depth, labeling claims, and your entire regulatory strategy.

The more your intended purpose language drifts into “screening/diagnosis of serious conditions” without tight boundaries, the more likely you are to get classified higher. Under IVDR, ambiguous claims are a self‑inflicted wound.

5) Conformity Assessment: When a Notified Body Gets Involved

Under IVDR, notified body involvement expands dramatically compared with IVDD. The rough operating reality is:

• Class A (non‑sterile): may be self‑declared (but still must meet IVDR requirements; “self‑declared” does not mean “uncontrolled”).
• Class A sterile: notified body involvement is required for the sterility aspects.
• Class B, C, D: notified body involvement is expected as part of conformity assessment.

Notified bodies are not consultants. They don’t design your evidence strategy, fix your technical file, or clean up your QMS. They judge what you present. If your file is weak, they will ask questions you can’t answer quickly. If your QMS is “policy perfect” but execution‑weak, they will find it in sampling—complaints, CAPA, training, supplier controls, and labeling versioning.

For high‑risk IVDs (especially class D), additional layers can apply in the EU ecosystem (e.g., EU reference laboratory involvement for specific device categories, heightened scrutiny on performance claims, and stronger expectations for post‑market performance follow‑up). The strategic takeaway is simple: plan for more external review and more evidence than you think you need.

6) Performance Evaluation: The Three Pillars You Must Prove

IVDR forces a structured performance evaluation built on three pillars. This is where many legacy IVD portfolios discover they were living on borrowed time:

• Scientific validity: the association between a biomarker/analyte and a clinical condition or physiological state (i.e., the underlying “this marker actually means something” argument).
• Analytical performance: how well the device detects or measures what it claims (sensitivity/specificity, precision, LoD/LoQ, interference, cross‑reactivity, robustness, traceability of calibrators, etc.).
• Clinical performance: how well results correlate with the clinical condition or decision in the intended population and setting (real samples, real users, real prevalence, real confounders).

The mistake is treating performance evaluation as a one‑time “submission artifact.” Under IVDR it’s lifecycle work: you plan it, execute it, document it, and update it as new evidence arrives through studies, complaint trends, literature, registries, and field performance.

If your device is software‑driven (interpretation algorithms, AI classifiers, decision support), performance evaluation becomes even more sensitive to data drift, intended population definition, and change control. A model update that changes performance characteristics is not “just a software patch”—it can be a regulatory‑relevant change that must be justified in your performance evaluation and technical documentation.

7) Performance Studies (Clinical Studies for IVDs): Where Reality Bites

When literature, bench data, or retrospective evidence isn’t enough—or when your intended purpose is high‑risk—you’ll need performance studies. Under IVDR, performance studies are not casual “we ran some samples in a partner lab” activities. They require controlled planning, documented protocols, proper ethics and consent handling where applicable, and traceable data integrity.

In practice, performance study rigor rises when:

• the test result directly drives treatment decisions,
• the condition is serious or time‑critical,
• the population is vulnerable (e.g., neonates, immunocompromised),
• the setting is uncontrolled (self‑testing, point‑of‑care), or
• the product is novel (new biomarkers, new technology, new clinical pathways).

Poor study governance doesn’t just risk rejection; it creates audit‑grade problems later. If your raw data, specimen traceability, or consent chain is weak, your performance evidence becomes fragile in exactly the moment a notified body or competent authority starts asking hard questions.

8) Technical Documentation and QMS: What “Good Enough” No Longer Means

IVDR technical documentation is not a brochure—it is the structured evidence that the device meets general safety and performance requirements (GSPRs), is manufactured under control, performs as claimed, and is monitored after launch.

That documentation only works if it sits inside a functioning quality system. A credible IVDR‑ready setup usually includes:

• QMS structure aligned to ISO 13485 (most manufacturers use it as the backbone), plus EU‑specific extensions.
• Design and change control discipline connecting requirements to verification/validation and then to manufacturing and labeling release evidence (see DHF and Change Control).
• Document and record control that prevents “shadow IFUs,” uncontrolled translations, and obsolete performance claims (see Document Control System).
• Supplier controls that treat critical reagents, calibrators, and software components as regulated dependencies—not just purchasing items.
• Post‑market surveillance and CAPA integration that demonstrates you learn from reality (see PMS and CAPA).

The uncomfortable truth: if your organization can’t reliably control label versions, calibrator lots, and software releases, you are not “almost compliant.” You are one field issue away from a forced, expensive remediation.

9) Risk Management for IVDs: Wrong Results Are a Hazard

IVD risk management is not just “reagent safety.” The dominant hazards are often clinical harms driven by incorrect results:

• false negatives that delay treatment or allow spread of infection,
• false positives that trigger unnecessary treatment or anxiety,
• misinterpretation due to unclear labeling or UI workflows,
• interference/cross‑reactivity that only shows up in certain populations,
• sample stability and transport conditions that corrupt results.

This is why IVDR compliance pushes you toward tight coupling between ISO 14971 risk management, labeling/IFU control, and performance evaluation. Your risk file must reflect your performance limitations, and your labeling must reflect your actual risk controls—otherwise your “controls” are imaginary.

If you sell into multiple EU markets, translation and localization become risk controls too. A mistranslated limitation or specimen requirement is a safety defect, not a marketing typo.

10) PMS, Vigilance, PSUR, and PMPF: The Lifecycle Engine

Under IVDR, post‑market surveillance is expected to be systematic and proactive, not reactive. It typically spans:

• Complaint intake and investigation with clear triage and escalation (see Customer Complaint Handling).
• Trending and signal detection (false positives/negatives, QC drift, invalid rates, user errors, interferences).
• Vigilance decision‑making and reporting where required, plus field safety corrective actions when risk justifies it.
• CAPA linkage that shows systemic fixes, not case‑by‑case patching.
• Post‑market performance follow‑up (PMPF) where needed to confirm performance over time, in real settings, across real users.

Higher‑risk devices are expected to produce more formal PMS outputs. For many manufacturers, the practical implication is a new operating cadence: scheduled evidence reviews, structured PMS reports, and management review inputs that treat performance drift as a business risk.

If you cannot trace a field complaint back to a specific device configuration, reagent lot, calibrator lot, and software version, your investigation quality will be slow and shallow—exactly when speed and depth matter.

11) UDI and EUDAMED: Traceability, Transparency, and Data Discipline

IVDR embeds UDI as the identity system that connects labeling, registrations, certificates, and lifecycle records. UDI only works if your master data and execution data match reality:

• UDI master data must align with the actual device configuration being manufactured and sold.
• UDI on labels must be correct, controlled, and linked to the right versions (see Label Verification).
• Lot/serial traceability must let you reconstruct what happened for any shipped unit or batch (see Lot Traceability and eDHR).

EUDAMED is the EU’s database ecosystem intended to make device information, certificates, and (eventually) vigilance and performance study information more transparent and more interconnected. Even when specific modules roll out in phases, the direction is clear: EU compliance is becoming data‑first.

This is where data integrity stops being a “GxP slogan” and becomes commercial survival. If you can’t trust your own records, no regulator—or hospital customer—will.

12) Economic Operators and PRRC: Responsibility Is Distributed, Liability Is Not

IVDR explicitly assigns obligations across the supply chain: manufacturer, authorized representative, importer, and distributor. That matters because diagnostics often move through complex commercial channels, and the EU expects checks to happen before products reach patients.

• Importers and distributors are expected to verify basic compliance signals (CE marking, labeling/IFU presence, storage conditions, traceability information).
• Manufacturers must maintain the system: technical documentation, QMS, PMS, vigilance, and change control.
• Responsibility roles must be real (resourced, trained, empowered), not decorative names on an org chart.

Operationally, this pushes manufacturers toward tighter agreements, better downstream traceability, and explicit control of storage/transport conditions—because poor distribution can create “device failures” that are actually logistics failures.

13) In‑House Devices: The Health Institution “Exemption” Is Not a Free Pass

IVDR includes provisions that allow certain in‑house devices manufactured and used within health institutions under strict conditions (often discussed in the context of laboratory developed tests). The common misunderstanding is thinking this is a loophole that replaces IVDR. It isn’t.

The core reality:

• in‑house devices are constrained by conditions and documentation expectations,
• industrial scale, commercial distribution, or “selling in‑house devices” is not the model,
• justification, governance, and quality controls still matter, and the bar tightens over time.

If you are a commercial manufacturer, this matters for two reasons: (1) it changes competitive dynamics in certain niches (especially rare diseases and specialized assays), and (2) it raises expectations for the evidence you must provide to show why your CE‑marked product is the appropriate “equivalent” option.

If you are a health institution, the message is equally direct: treat in‑house device controls as a regulated quality system, not a research workflow, or you will eventually collide with enforcement.

14) Transitional Provisions: The Dates That Decide Whether You Stay on the Market

IVDR applies from 26 May 2022. However, EU law includes conditional transitional provisions for certain “legacy” devices—devices covered by an IVDD certificate and/or declaration of conformity issued before 26 May 2022 that require notified body involvement under IVDR.

The key “tell it like it is” point: transition is not automatic. The extended timelines only apply if conditions are met—no significant design/intended purpose changes, no unacceptable risk, and concrete progress toward IVDR certification under a notified body.

As of the latest transitional framework (including 2024 amendments), the headline “placing on the market” end dates for eligible legacy devices are:

• 31 December 2027 for Class D devices,
• 31 December 2028 for Class C devices,
• 31 December 2029 for Class B devices and Class A sterile devices.

But those end dates only help you if you also hit the operational deadlines that prove you’re not just coasting:

• By 26 May 2025: you must have an IVDR‑compliant QMS in place if you want to rely on the extended transition.
• By 26 May 2025: you must lodge an IVDR conformity assessment application with a notified body for devices covered by an IVDD certificate and for Class D devices that were self‑declared under IVDD.
• By 26 May 2026: application deadline for Class C devices that were self‑declared under IVDD.
• By 26 May 2027: application deadline for Class B and Class A sterile devices that were self‑declared under IVDD.
• Written agreement deadlines: the manufacturer and notified body must have a signed written agreement by 26 September 2025 (IVDD‑certified devices & Class D self‑declared), 26 September 2026 (Class C self‑declared), and 26 September 2027 (Class B and Class A sterile self‑declared).

Translation: if you miss the application/agreement deadlines, you don’t “lose some time”—you lose legal access to the market. This is why IVDR planning is now a portfolio governance problem, not a regulatory affairs side project.

15) Practical Implementation Roadmap (What Actually Works)

The fastest way to fail IVDR transition is to treat it as “convert the file.” What works is treating it as a structured program with portfolio triage and ruthless clarity on claims and evidence. A practical roadmap:

• 1) Define intended purpose with discipline. Tighten claims, populations, specimen types, and clinical use pathways. Ambiguity inflates risk class and evidence burden.
• 2) Confirm classification early. Class drives your conformity route, evidence depth, PMS outputs, and notified body capacity planning.
• 3) Build the performance evaluation plan. Map what you have (literature, analytical studies, clinical performance data) vs what IVDR will expect; decide what studies are unavoidable.
• 4) Upgrade the QMS before you upgrade the PDF. Document control, change control, complaint handling, PMS trending, CAPA, supplier controls, labeling control, and data integrity must work in practice.
• 5) Engage a notified body like a scarce resource. Because it is. Lock application timelines, submission quality, and response capacity. Plan for iterative questions.
• 6) Make traceability real. Connect UDI master data to labeling and to production/distribution evidence (eDHR quality matters here).
• 7) Operationalize lifecycle reviews. Don’t wait for an audit to read your own complaint trends. Schedule them and record decisions.

If you run a portfolio, triage is essential. Some legacy devices will not be worth the evidence build. Keeping everything “because it sells a bit” is a strategy that burns resources until you fail the higher‑value products too.

16) What EU IVDR Means for V5

IVDR compliance is fundamentally an evidence‑and‑traceability problem across the lifecycle. That’s exactly where disconnected spreadsheets and siloed quality tools collapse.

On the V5 platform, the IVDR‑relevant work becomes easier to run (and easier to prove) because the data are connected:

• V5 QMS: complaint handling, vigilance triage, CAPA, change control, audit trails, and management review—linked to device families, intended purpose claims, and evidence packages.
• V5 MES: execution evidence at batch/lot level that supports investigations (which lots, which parameters, which operators, which materials, which test results).
• V5 WMS: distribution genealogy—who received what, where it went, and what must be notified if a field action is required.
• V5 Connect API: structured integration with external portals, LIMS, service systems, and regulatory‑reporting workflows where data exchange is required.

Net effect: IVDR stops being a “file maintenance panic” and becomes a controlled lifecycle system. When a notified body asks “show me the link between field signals, CAPA decisions, labeling updates, and released product history,” you can answer with traceable records instead of detective work.

FAQ

Q1. Is IVDR basically “EU MDR for diagnostics”?
Yes in the lifecycle sense, no in the technical specifics. Like MDR, IVDR expects a QMS‑driven lifecycle system, stronger evidence, and tighter post‑market obligations. But IVDR’s performance evaluation structure (scientific validity + analytical + clinical performance) and the A–D classification model are diagnostic‑specific and reflect public‑health risk in a way MDR classification does not.

Q2. Do Class A IVDs still need a QMS and technical documentation?
Yes. “Self‑declared” does not mean “unregulated.” You still need compliant technical documentation, controlled labeling, risk management, and post‑market handling. The difference is mainly whether a notified body must review and certify you. Also remember: Class A sterile brings notified body involvement for sterility aspects.

Q3. Can ISO 13485 certification replace IVDR compliance work?
No. ISO 13485 is the backbone structure, not the complete EU rule set. IVDR adds EU‑specific obligations (performance evaluation structure, PMS/PSUR expectations, EU declarations/certificates, UDI/EUDAMED‑aligned data readiness, and specific technical documentation structures). An ISO 13485 certificate with weak PMS execution will still fail an IVDR review in practice.

Q4. What’s the most common IVDR failure pattern?
Over‑claiming with under‑evidence. Teams write broad intended purposes to maximize market size, then discover the evidence doesn’t support the claim across populations, settings, specimen types, and confounders. Under IVDR, the fix is usually painful: narrow the claim, generate new evidence, or exit the product.

Q5. What should we do first if we’re behind?
Start with portfolio triage and classification, then build a performance evaluation gap map per device family. In parallel, harden the operational spine: document control, complaint handling, PMS trending, CAPA, labeling control, and data integrity. If the operational system is weak, even strong evidence will be hard to defend because you won’t be able to prove control after market launch.

Related Reading
• EU & Market Access: CE Marking | EU MDR 2017/745 | UDI | Labeling Medical Devices
• Quality & Risk: Medical Device QMS | ISO 13485 Requirements | ISO 14971 Risk Management | CAPA
• Lifecycle & Vigilance: Postmarket Surveillance | Customer Complaint Handling | Change Control
• Data & Traceability: Data Integrity | Audit Trail | eDHR | Lot Traceability
• V5 Platform: V5 Solution Overview | V5 QMS | V5 MES | V5 WMS | V5 Connect API