EU Regulation 2026/977: What Medical Device Manufacturers Need to Know About New Notified Body Rules

Background: Why the Commission Acted

Under Regulations (EU) 2017/745 (MDR) and (EU) 2017/746 (IVDR), notified bodies are central to the conformity assessment of medical devices. However, the European Commission identified wide divergences in how notified bodies operated in practice - particularly regarding cost estimates, timelines, and re-certification processes. These inconsistencies created an uneven playing field across the EU single market and caused significant delays for manufacturers, especially small and medium-sized enterprises (SMEs).

Regulation 2026/977 addresses this directly by specifying uniform, enforceable quality management and procedural requirements. It does not change the underlying conformity assessment procedures under MDR and IVDR, but it harmonises how those procedures are administered.

New Rules on Quotations (Article 1)

One of the most immediately practical changes concerns how notified bodies issue price quotations to manufacturers. Going forward, a notified body may only issue a quotation after receiving a defined minimum set of information.

Information manufacturers must provide

• Manufacturer identification (name, address, and authorised representative where applicable)
• Data to determine SME status: number of employees and annual turnover
• Details of all sites covered by the quality management system (QMS), including number of employees, work shifts, and activities per site
• Names and addresses of relevant suppliers and sub-contractors performing design or manufacturing activities
• Description of the device(s), intended purpose, specific characteristics or technologies used, and risk classification
• The conformity assessment procedure(s) applied for
• For change notifications: a detailed description of the planned change
• For re-certification: identification of affected certificates and any scope changes

For re-certification or change notifications, manufacturers only need to re-confirm unchanged information - not resubmit it - which reduces administrative burden for ongoing relationships with notified bodies.

What the quotation must contain

Quotations must now include: an estimated overall cost broken down by QMS assessment and technical documentation review, typical costs for surveillance activities and unannounced audits, an estimate of potential extra costs (hourly rates only where duration cannot be predetermined), and estimated timelines. If actual costs exceed the quoted estimate by more than 10%, the notified body must notify the manufacturer in advance with a justification.

Maximum Timelines for Conformity Assessment (Article 2)

The regulation introduces binding maximum timelines for each phase of the conformity assessment process. These timelines are clock-based - they start and stop at defined events - and apply regardless of workload at the notified body.

Phase 1
30 days - Application review and contract signature

Phase 2
120 days - QMS auditing (from first audit activity to final review)

Phase 3
90 days - Product verification / technical documentation assessment

Phase 4
20 days - Decision, certification and Eudamed entry

Where an Annex IX procedure applies (combining QMS and product verification), phases 2 and 3 must run in parallel. Both phases start the day after contract signature, unless the parties agree otherwise.

Timelines for substantial changes

For planned substantial changes to the QMS or device range - or changes to an approved device covered by a technical documentation assessment or type-examination certificate - separate timelines apply:

• 30 days to review the planned change notification and decide if additional assessment is needed
• 90 days for any additional conformity assessment activities
• 20 days to issue the supplement to the certificate(s) and enter it in Eudamed

Critically, expiry of the maximum timelines is not a valid reason for a notified body to refuse issuing a certificate. The assessment must continue until a decision - positive or negative - is made.

Timeline Interruptions (Article 3)

Notified bodies may pause timelines when they need a manufacturer to address non-compliances or respond to justified requests. However, the number of permitted interruptions per phase is now capped:

• Application review phase: 1 interruption
• QMS auditing phase: 4 interruptions (plus 2 extra per additional site to be audited on-site)
• Product verification phase: 4 interruptions
• Change assessment phases combined: 5 interruptions
• Re-certification reviews: 3 interruptions
• Decision and certification phase: 1 interruption (to verify certificate data in Eudamed)

Interruptions triggered by the need for an EMA opinion, expert panel contribution, or EU reference laboratory input are not counted against these caps. All interruptions must be communicated in writing, with duration agreed between both parties.

Re-certification Requirements (Articles 5–7)

Re-certification has historically been one of the most variable and unpredictable processes. Regulation 2026/977 significantly constrains notified body discretion here.

Product certificates (Article 5)

When renewing a product certificate, manufacturers must submit a structured package covering: all changes to the approved device since initial certification (or last re-certification), the most recent periodic safety update report (PSUR), a summary of field safety corrective actions (FSCAs), changes to the benefit-risk ratio, updates to the state-of-the-art analysis, the most recent clinical evaluation report (CER) or performance evaluation report (PER), and any changes required by new regulatory requirements or scientific findings.

The notified body must complete its assessment of this documentation within 90 days. Requests for additional technical documentation beyond what is specified in the regulation must be limited strictly to what is necessary to complete the assessment — meaning notified bodies can no longer demand comprehensive re-submissions comparable to initial certification.

QMS certificates (Article 6)

For renewal of QMS certificates, the notified body must complete its assessment within 90 days of receiving the application. The assessment focuses on verifying that all required audit elements have been covered during the certification cycle, that surveillance results remain compliant, that the audit programme and sampling plan are current, that non-compliances have been resolved, and whether the scope needs amending.

Decision and re-issuance (Article 7)

Once the final review is complete, the notified body has 20 days to make the re-certification decision and enter the renewed certificate in Eudamed. If the decision is made more than three months before the certificate expires, the 20-day window starts three months before expiry — not immediately after the final review.

Monitoring and Public Reporting (Article 4)

Notified bodies are now required to establish a formal system to monitor their performance on timelines and costs as part of their QMS. By 30 April each year, they must publish an annual report on their website covering the following metrics:

• Percentage of conformity assessment activities completed within the maximum timelines
• Median duration from application to certification (in days)
• Median total cost of completed conformity assessment activities (in euros)

These reports must also be submitted to the competent authority responsible for the notified body and to the European Commission. This creates a transparent, comparable dataset enabling manufacturers to evaluate notified body performance before selecting a certification partner.

Application Dates and Transitional Provisions (Articles 8–9)

Entry into force: 25 May 2026 (20 days after publication)

• Articles 1, 2 and 3 (quotations, timelines, interruptions): apply from 25 February 2027. They do not apply to procedures for which a written agreement was signed before that date.
• Article 4(1)–(3) (monitoring system): applies to procedures with agreements signed after 25 May 2027.
• Article 4(4) (annual reporting): applies from 1 January 2028.
• Articles 5, 6 and 7 (re-certification): apply from 25 November 2027. They do not apply to re-certification reviews for certificates expiring before that date.

Action Points for Manufacturers

Before the February 2027 application date, manufacturers should consider the following steps:

• Review your current QMS documentation to ensure it is organised to match the information requirements in Article 1, so you can provide complete pre-quotation information efficiently.
• Map your certification lifecycle against the new maximum timelines and build these into your product development and launch planning.
• Prepare a standard re-certification documentation package — PSUR, CER/PER, FSCA summary, state-of-the-art update, and change list — so you are not scrambling at renewal time.
• Engage in structured pre-application dialogues with your notified body early, as these are now formally recognised and can significantly improve the accuracy of quotations and timelines.
• Use the forthcoming annual performance reports (from 2028 onward) to benchmark notified bodies if you are considering a transfer or selecting a new body.
• SMEs in particular should ensure they have their employee count and annual turnover data readily available, as this is required for all quotation requests under Article 1(1)(b).

The full text of Regulation (EU) 2026/977 is available in the Official Journal of the European Union, L series, dated 5 May 2026.