Medical device regulation determines which devices may be sold, what evidence must support them, who verifies that evidence, and what obligations continue once a device is in clinical use. Unlike medicines regulation, which applies a broadly uniform review process to all products, device regulation is explicitly proportionate: a wound dressing and an implantable defibrillator are governed by the same legislation but face entirely different requirements.

The result is a system organised around risk classification. Nearly every practical question about how a device reaches the market — what evidence is needed, who assesses it, how long it takes — follows from what class the device falls into.

Why Device Regulation Works Differently

Several characteristics of devices explain the structure of their regulation. Devices span an enormous range of risk within a single legal category. They are frequently iterated during their commercial life, so a fixed pre-market assessment of a static product does not match reality. Their performance depends substantially on the operator, so outcomes reflect training and technique as well as design. And blinded randomized trials are frequently impractical or unethical for procedures and implants.

Regulation therefore relies more on classification, quality systems, standards conformity, and post-market surveillance, and comparatively less on pre-market clinical trials, than medicines regulation does.

Risk Classification

Classification rules consider how invasive a device is, how long it remains in contact with the body, whether it is active or powered, whether it delivers energy or substances, and what the consequences of malfunction would be.

United States

  • Class I — low risk, subject to general controls including establishment registration, device listing, labelling requirements, and quality system obligations. Many are exempt from premarket submission.
  • Class II — moderate risk, subject to general plus special controls such as performance standards, mandatory guidance, or specific labelling. Most require premarket notification.
  • Class III — high risk, typically life-sustaining, life-supporting, or implantable, generally requiring premarket approval supported by valid scientific evidence.

European Union

Devices are classified as Class I, IIa, IIb, or III under the Medical Device Regulation, with in vitro diagnostics classified A to D under the In Vitro Diagnostic Regulation. Class I devices may generally be self-declared by the manufacturer, except where they are sterile, have a measuring function, or are reusable surgical instruments. All higher classes require notified body involvement.

Classification rules differ between the two systems, so the same device may be Class II in one and Class III in the other, and manufacturers frequently prepare different evidence packages for each market.

Routes to Market in the United States

Premarket Notification (510(k))

The route for most Class II devices. The submission argues that the device is substantially equivalent to a legally marketed predicate in intended use and technological characteristics, or that any differences do not raise new questions of safety and effectiveness. Clinical data are required in a minority of submissions. The pathway allows incremental improvements to reach patients efficiently.

It is also the most criticised element of the American system. Objections centre on chains of predicates that can distance a currently marketed device from any original clinical evidence, and on the use as predicates of devices that were themselves subsequently recalled. The FDA has taken steps to address this, including encouraging the use of more recent predicates and expanding programmes based on objective performance criteria.

De Novo Classification

For novel devices of low to moderate risk with no suitable predicate. A successful De Novo request classifies the device into Class I or II with special controls, and it may then serve as a predicate for subsequent 510(k) submissions.

Premarket Approval

The most stringent route, required for most Class III devices. Applications include clinical investigation results, manufacturing information, and proposed labelling. Advisory panel review and facility inspection may form part of the process. Approval may carry post-approval study requirements and conditions of use.

Other Mechanisms

Humanitarian device exemptions provide a route for devices addressing very rare conditions, where demonstrating effectiveness through conventional trials is impractical. Investigational device exemptions permit clinical study of unapproved devices. Breakthrough device designation offers enhanced interaction for devices addressing serious conditions with unmet need.

The European Union System

Conformity Assessment and CE Marking

Rather than an agency approving each device, the EU operates a conformity assessment model. Manufacturers must demonstrate that a device meets the general safety and performance requirements set out in the Medical Device Regulation, supported by technical documentation including a clinical evaluation, risk management file, and evidence of conformity with harmonised standards.

For all classes above the lowest, an independent notified body — a private organisation designated and monitored by a member state authority — assesses the technical documentation and audits the manufacturer's quality management system. Successful assessment permits the manufacturer to affix CE marking and place the device on the market throughout the Union. Certificates are time-limited and subject to surveillance audits.

What the MDR Changed

The Medical Device Regulation replaced earlier directives and tightened several areas: clinical evidence expectations, particularly for higher-risk and implantable devices; restrictions on claiming equivalence to another manufacturer's device without access to its technical documentation; scrutiny procedures for certain high-risk devices involving expert panels; expanded post-market surveillance and periodic safety reporting obligations; requirements for a person responsible for regulatory compliance within manufacturers; implant cards for patients; and traceability through unique device identification and the EUDAMED database.

The transition has been demanding in practice. Notified body capacity, the volume of legacy devices requiring recertification, and the cost of generating additional clinical evidence have raised documented concerns about availability of niche and paediatric devices, prompting extended transition arrangements.

Clinical Evidence for Devices

Clinical evaluation assembles and appraises the evidence that a device achieves its intended performance and that risks are acceptable. Sources include bench and simulated-use testing, biocompatibility assessment, animal studies, published literature on the device or genuinely equivalent technologies, and clinical investigations conducted for the device itself.

Methodological constraints are real. Blinding is often impossible for procedures and implants; sham controls raise ethical issues; outcomes depend on operator learning curves; and devices are modified during their commercial life, so a trial may evaluate a version no longer on the market. Frameworks developed for staged evaluation of surgical and device innovation address when in a technology's development a comparative trial is appropriate. Registries have become central for long-term evidence, particularly for implants, where they have repeatedly detected failures earlier than passive reporting.

Software and Artificial Intelligence

Software intended for a medical purpose is regulated as a device in both systems, whether embedded in hardware or standalone. The International Medical Device Regulators Forum provides a shared risk framework for software as a medical device based on the seriousness of the condition and the significance of the information the software provides.

Machine-learning-enabled devices raise a specific problem: conventional regulation assumes a fixed product, while models may be retrained or updated. Responses include predetermined change control plans, which specify in advance what modifications may be made and how they will be validated, allowing updates within agreed boundaries without a new submission for each change. Expectations regarding training data description, validation populations, subgroup performance, and post-deployment monitoring are increasingly explicit. In the EU, the AI Act adds obligations for high-risk systems alongside device requirements.

Post-Market Obligations

  • Post-market surveillance. Systematic collection and analysis of data on device performance in use, with periodic safety update reporting for higher-risk classes and post-market clinical follow-up where required.
  • Vigilance reporting. Serious incidents and malfunctions must be reported to authorities within defined timelines.
  • Field safety corrective actions. Safety notices, corrections, and recalls, classified by hazard severity and overseen by regulators.
  • Unique Device Identification. Standardised identifiers supporting traceability, recall execution, and registry linkage.
  • Registries. Implant and procedure registries providing long-term outcome data across large populations.

International Coordination

Device regulation remains national or regional. Coordination operates through the International Medical Device Regulators Forum, which develops harmonised approaches; the Medical Device Single Audit Program, under which one audit can satisfy several participating regulators; international standards such as those covering quality management and risk management; and WHO work supporting regulatory capacity and prioritisation of essential devices in lower-resource settings.

Sources

  • U.S. Food and Drug Administration — device classification; 510(k), De Novo, premarket approval, and breakthrough device pathways; software as a medical device guidance; Unique Device Identification
  • European Commission — Medical Device Regulation; In Vitro Diagnostic Regulation; EUDAMED; notified body designation
  • International Medical Device Regulators Forum — software as a medical device framework; Medical Device Single Audit Program
  • International Organization for Standardization — ISO 13485 quality management; ISO 14971 risk management
  • World Health Organization — medical devices and health technology guidance