CE Marking for Medical Devices: The 9 Steps From First Prototype to the EU Market

Every provider selling CE marking services describes the process as complicated. It is not complicated; it is sequential. Nine steps, each producing a document the next step depends on. A first-time manufacturer who takes them in order reaches the EU market. One who takes them out of order pays twice for steps four to seven.

Step 1: Confirm your product is a medical device

Article 2(1) of Regulation (EU) 2017/745 defines a medical device by its intended purpose: an instrument, apparatus, appliance, software, implant, reagent, material or other article intended for diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. The words you print in your instructions for use decide this, not the technology. Write the intended purpose down first — every later document quotes it.

Step 2: Classify the device under Annex VIII

The MDR sorts devices into class I, IIa, IIb and III through the 22 rules of Annex VIII. The class decides everything that follows: which conformity assessment route is open to you, whether a notified body is involved, and how often you must update your post-market reports. Get the class wrong and every downstream document is wrong with it. Our guide to medical device classification under the 22 rules walks through the logic.

Step 3: Build the quality management system

Article 10(9) requires a quality management system covering design, risk management, clinical evaluation and post-market surveillance. In practice this means EN ISO 13485 — and it is one of the obligations the regulation never lets you outsource. A representative or consultant can help operate it; responsibility stays with you.

Step 4: Compile the technical documentation

Annexes II and III set the file structure: device description, design and manufacturing information, the general safety and performance requirements of Annex I, risk management, verification and validation data, and the post-market surveillance plan. This file is what a notified body audits and what a competent authority asks for. See our note on technical documentation under Annex II and III.

Step 5: Run the clinical evaluation

Article 61 requires clinical evaluation for every device — including class I. The depth scales with risk, but no device is exempt from the obligation itself. The output, the clinical evaluation report, lives inside the technical documentation and is updated throughout the device lifetime by post-market data.

Step 6: Choose the conformity assessment route

Article 52 maps class to route. Plain class I devices are self-assessed — no notified body. Class I devices that are sterile, have a measuring function or are reusable surgical instruments need a notified body for those aspects only. Class IIa, IIb and III need a notified body for the full assessment. Notified bodies are listed in the Commission's NANDO database; expect a queue, so contact one early.

Step 7: Sign the EU declaration of conformity and affix the CE mark

With the assessment complete, you draw up the declaration of conformity under Article 19 and Annex IV — a document only the manufacturer may sign — and affix the CE marking under Article 20. Four common drafting errors make a DoC fail verification; our guide to the EU declaration of conformity lists them.

Step 8: Appoint your EU authorised representative and register

If your company is established outside the EU, this step is a condition of market access, not an option: "Where the manufacturer of a device is not established in a Member State, the device may only be placed on the Union market if the manufacturer designates a sole authorised representative." That is Article 11(1), verbatim. The appointment must exist before the first device ships.

Registration follows. Since 28 May 2026 the first four EUDAMED modules are mandatory: you need a Single Registration Number as an actor, your representative needs one, the mandate is confirmed by both sides in the system, and your devices are registered with their UDI data. Without the SRN chain, no device data can be filed at all. Our EUDAMED registration service covers actor and UDI filing end to end.

Step 9: Operate post-market surveillance

The CE mark is a licence to keep working, not a finish line. Article 83 requires a surveillance system for every device; class I devices owe a post-market surveillance report under Article 85, class IIa and above owe a periodic safety update report under Article 86 — at least every two years for class IIa, at least annually for IIb and III. Serious incidents run on the reporting clocks of Article 87.

The order is the method

Classification before documentation, documentation before assessment, assessment before the declaration, the representative before the first shipment. Manufacturers who reverse steps — signing distribution deals before classification, or printing labels before the representative is mandated — end up repeating work at consultant rates.

Medex acts as EU authorised representative for non-EU manufacturers under Article 11, with published class-based rates and EUDAMED registration included. Send us your device list and intended purpose, and we will respond in writing with the exact route your device takes.

Sources (official)

Regulation (EU) 2017/745, Articles 2(1), 10, 11, 19, 20, 52, 61, 83 to 87; Annexes I, II, III, IV, VIII

Commission Decision (EU) 2025/2371 of 26 November 2025 — EUDAMED modules mandatory from 28 May 2026

European Commission, NANDO database of notified bodies; EUDAMED public site

Who wrote this

Medex is a medical device manufacturer established in Ankara and a registered authorised representative in EUDAMED under SRN TR-AR-000057550. We hold CE marked devices of our own, so every step above is one we have completed for ourselves before offering it to anyone else. We are not a law firm and do not provide legal advice.