Custom-Made Devices Under MDR: The Annex XIII Statement, No CE Marking, and the Authorised Representative's Named Role

Custom-made devices sit in a part of MDR 2017/745 that most compliance material skips. They are not exempt from the Regulation, they are not lightly regulated, and they are not a residual category — dental laboratories, orthotic and prosthetic workshops, patient-specific surgical guides and made-to-measure ocular prostheses are all real product lines that reach EU patients in volume. What they are is differently regulated: a separate conformity route, a separate documentation set, no CE marking, no UDI, and a separate retention clock.

For a non-EU manufacturer this creates a specific problem. The obligations that trigger the need for an EU authorised representative apply in full, but almost none of the usual evidence — a declaration of conformity, a certificate, a UDI record — exists to hand over. This guide sets out what does exist, and what the authorised representative actually holds and checks.

What counts as custom-made

The definition is in Article 2(3) and it is narrow by design. "'custom-made device' means any device specifically made in accordance with a written prescription of any person authorised by national law by virtue of that person's professional qualifications which gives, under that person's responsibility, specific design characteristics, and is intended for the sole use of a particular patient exclusively to meet their individual conditions and needs." (MDR Article 2(3))

Four elements have to be present together: a written prescription; a prescriber authorised by national law on the basis of professional qualifications; specific design characteristics given under that prescriber's responsibility; and a single identified patient.

The second subparagraph then removes the two categories that manufacturers most often try to put in. "However, mass-produced devices which need to be adapted to meet the specific requirements of any professional user and devices which are mass-produced by means of industrial manufacturing processes in accordance with the written prescriptions of any authorised person shall not be considered to be custom-made devices." (MDR Article 2(3))

This is the sentence that decides most borderline cases. A device that is manufactured industrially — including additively, from a patient scan, on a validated series process — and merely parameterised per patient is not custom-made. It is a patient-matched device, and it goes through ordinary conformity assessment with a CE marking, a UDI and technical documentation. The prescription does not change that; the manufacturing method does. A workshop that mills a single crown to a dentist's written prescription is making a custom-made device. A company that runs a patient-specific cutting guide through a standard, validated, repeatable production line is not, however individual the output looks.

The distinction matters commercially, because getting it wrong in the permissive direction means placing an uncertified device on the EU market. Our note on technical documentation covers the file that a patient-matched device would then have to carry.

The Annex XIII procedure

Article 52(8) sets the route. "Manufacturers of custom-made devices shall follow the procedure set out in Annex XIII and draw up the statement set out in Section 1 of that Annex before placing such devices on the market." (MDR Article 52(8))

Annex XIII has five short sections. Section 1 is the statement, and its opening line is the sentence that concerns anyone reading this from outside the Union. "For custom-made devices, the manufacturer or its authorised representative shall draw up a statement containing all of the following information." (MDR Annex XIII, Section 1)

This is the only conformity procedure in the Regulation where the authorised representative is named in the alternative as the party that may draw up the document. Everywhere else — the EU declaration of conformity under Article 19, the technical documentation under Article 10(4) — the drafting is the manufacturer's alone and the authorised representative verifies and holds a copy. Section 1 is drafted differently. That does not mean an authorised representative should routinely issue it: the statement asserts conformity with the general safety and performance requirements and identifies the prescriber, and only the manufacturer holds that information. But it does mean the option exists in law, and it means an authorised representative that signs one is signing a conformity statement rather than a receipt.

What goes in the statement

Section 1 lists eight items and requires all of them. The statement carries the name and address of the manufacturer and of all manufacturing sites; if applicable, the name and address of the authorised representative; data allowing identification of the device; "a statement that the device is intended for exclusive use by a particular patient or user, identified by name, an acronym or a numerical code"; the name of the prescriber and, where applicable, the health institution; and the specific characteristics of the product as indicated by the prescription.

The seventh item is the conformity assertion, and it is drafted to permit partial non-conformity with a reason. "a statement that the device in question conforms to the general safety and performance requirements set out in Annex I and, where applicable, indicating which general safety and performance requirements have not been fully met, together with the grounds." (MDR Annex XIII, Section 1)

That clause has no equivalent in the ordinary declaration of conformity, where partial compliance is not an option. It reflects the reality that a device made for one patient may deliberately depart from a requirement written for series production. The grounds have to be stated, not implied.

The eighth item covers devices incorporating a medicinal substance, a human blood or plasma derivative, tissues or cells of human origin, or material of animal origin as referred to in Regulation (EU) No 722/2012.

Note the second permitted identifier in the fourth item. The patient may be identified by an acronym or a numerical code rather than by name. A statement that travels with the device and carries a named patient is a data protection problem in most Member States; the Regulation anticipates that and allows a code, provided the manufacturer can resolve it.

Article 21(2) then places the statement in the supply chain. "Custom-made devices shall be accompanied by the statement referred to in Section 1 of Annex XIII, which shall be made available to the particular patient or user identified by name, an acronym or a numerical code." (MDR Article 21(2)) The same article adds that Member States may require the manufacturer to submit a list of custom-made devices made available in their territory — a national obligation that varies and that the authorised representative is usually the party to discharge.

The documentation set instead of technical documentation

Article 10(4) is explicit that custom-made devices do not carry technical documentation under Annexes II and III. "Manufacturers of custom-made devices shall draw up, keep up to date and keep available for competent authorities documentation in accordance with Section 2 of Annex XIII." (MDR Article 10(4))

Section 2 describes what that documentation has to achieve. "The manufacturer shall undertake to keep available for the competent national authorities documentation that indicates its manufacturing site or sites and allows an understanding to be formed of the design, manufacture and performance of the device, including the expected performance, so as to allow assessment of conformity with the requirements of this Regulation." (MDR Annex XIII, Section 2)

It is a functional test rather than a checklist. The file has to let an inspector understand design, manufacture and performance well enough to assess conformity. In practice that means: the prescription, the design record and any patient scan or impression data, the material and supplier records, the process records for the individual device, the release check, and the Annex I compliance rationale.

Section 3 requires the manufacturer to take all the measures necessary to ensure that the manufacturing process produces devices manufactured in accordance with that documentation — the custom-made equivalent of process control.

The retention clock

Section 4 is where custom-made devices diverge sharply from the rest of the Regulation. "The statement referred to in the introductory part of Section 1 shall be kept for a period of at least 10 years after the device has been placed on the market. In the case of implantable devices, the period shall be at least 15 years." (MDR Annex XIII, Section 4)

Note what the clock attaches to. For an ordinary device, Article 10(8) runs the retention period from the last device covered by the declaration of conformity being placed on the market — one period per product family. Here the period runs per statement, and there is one statement per device. A dental laboratory placing a thousand devices a year is running a thousand independent ten-year clocks. That is a records management design problem, not a filing problem, and it is the single most common gap found when a custom-made manufacturer is inspected.

The authorised representative's own retention duty under Article 11(3)(d) runs in parallel and is the reason the mandate has to be explicit about which records the representative holds and which it can call for. Our guide to the EU authorised representative mandate agreement covers how that is drafted.

Post-market obligations do not fall away

Section 5 keeps custom-made devices inside the post-market system. "The manufacturer shall review and document experience gained in the post-production phase, including from PMCF as referred to in Part B of Annex XIV, and implement appropriate means to apply any necessary corrective action, In that context, it shall report in accordance with Article 87(1) to the competent authorities any serious incidents or field safety corrective actions or both as soon as it learns of them." (MDR Annex XIII, Section 5)

Post-market clinical follow-up applies. Vigilance applies in full. Article 86 places the periodic safety update report on custom-made devices too, but files it in a different place: "For custom-made devices, the PSUR shall be part of the documentation referred to in Section 2 of Annex XIII." (MDR Article 86(1)) There is no technical documentation to put it in, so it goes into the Annex XIII file. Article 84 handles the post-market surveillance plan the same way, requiring it to be part of the Annex II technical documentation only for devices other than custom-made devices.

The practical effect is that a custom-made manufacturer needs a working post-market surveillance system, a PMCF approach and a PSUR discipline — the whole Chapter VII apparatus — with none of the Annex II structure that normally carries it. Our guides to the periodic safety update report and the PMCF plan and report set out what those documents contain.

The class III implantable exception

One category of custom-made device does need a notified body. Article 52(8) continues: "In addition to the procedure applicable pursuant to the first subparagraph, manufacturers of class III custom-made implantable devices shall be subject to the conformity assessment as specified in Chapter I of Annex IX. Alternatively, the manufacturer may choose to apply a conformity assessment as specified in Part A of Annex XI." (MDR Article 52(8))

Chapter I of Annex IX is quality management system assessment — the notified body audits the QMS, it does not assess each device. Part A of Annex XI is production quality assurance. Either way there is a certificate, an annual surveillance audit and a notified body relationship, even though the individual devices still carry no CE marking and still go out on an Annex XIII statement.

A transitional provision allowed these devices to continue without that certificate for a period. Article 120(3f) provided that "class III custom-made implantable devices may be placed on the market or put into service until 26 May 2026 without a certificate issued by a notified body", conditional on a formal application having been lodged by 26 May 2024 and a written agreement signed with the notified body by 26 September 2024. That window has closed. A class III custom-made implantable device placed on the EU market now requires the certificate.

Labelling and the PRRC

Annex I labelling carries a specific mark for these devices. Section 23.2 requires that "if the device is custom-made, the words 'custom-made device'" appear on the label, and Section 23.4 repeats the requirement for the instructions for use. It is a two-word entry that is very often missing, and it is visible on inspection without opening a file.

Article 15 also relaxes the qualification route for the person responsible for regulatory compliance in this sector. "Without prejudice to national provisions regarding professional qualifications, manufacturers of custom-made devices may demonstrate the requisite expertise referred to in the first subparagraph by having at least two years of professional experience within a relevant field of manufacturing." (MDR Article 15(1)) A custom-made manufacturer does not need the degree-plus-one-year or four-years-experience combination that Article 15 otherwise requires. Two years in the relevant manufacturing field is sufficient. Our guide to the person responsible for regulatory compliance covers the general rule that this derogates from.

What the authorised representative actually does here

Article 11 applies to custom-made devices without modification, but the evidence it points at is different. The verification the representative performs before accepting the mandate is not "has the EU declaration of conformity been drawn up and has the CE marking been affixed" — neither exists. It is:

That the device genuinely meets the Article 2(3) definition, and is not a patient-matched device being routed through Annex XIII to avoid conformity assessment. This is the assessment that carries the real exposure, and it is a technical judgement about the manufacturing process, not a documentary one.

That the Annex XIII Section 1 statement template contains all eight items and is actually issued per device, not per order or per customer.

That the Section 2 documentation exists, is retained per device, and can be produced to a competent authority on request in the language that authority requires.

That, where the device is a class III custom-made implantable, the Annex IX Chapter I or Annex XI Part A certificate is current.

That the post-market surveillance system, PMCF and PSUR discipline exist and file into the Annex XIII documentation rather than into a technical file that was never created.

That the label and instructions for use carry the words custom-made device.

The representative is also the party that receives the competent authority's request under Article 21(2) for a list of custom-made devices made available in a given territory, and the party that fields the Article 11(3)(c) sample and information requests. Because there is no UDI and no EUDAMED device record for these products, the representative's own records are, in several Member States, the only structured trace of what entered the market. Our note on authorised representative liability explains why that matters when something goes wrong.

Common failures

The statement is issued per batch or per clinic rather than per device. Section 1 requires identification of a particular patient or user; a statement covering forty crowns for one dental practice does not do that.

The patient identifier is a name, printed on a document that travels with the device across borders, when a numerical code would have satisfied the Regulation and avoided the data protection exposure.

The device is industrially produced and merely parameterised, and the Annex XIII route has been chosen because it is faster. This is the failure that converts a compliance question into an uncertified-device question.

The ten- or fifteen-year retention is implemented as a single period from the year of first supply rather than per device.

PSUR and PMCF are absent because the manufacturer read the words except in the case of custom-made devices in Article 86 as an exemption rather than as a redirection to a different file.

Medex Kurumsal as your EU authorised representative

If you place medical devices or in vitro diagnostics on the European market from outside the Union, Article 11 of MDR 2017/745 — and Article 11 of IVDR 2017/746 for in vitro diagnostics — requires a single authorised representative established in a Member State before those devices reach the market. Medex Kurumsal Danismanlik acts as EU authorised representative under both Regulations, registered in EUDAMED under SRN TR-AR-000057550.

What the mandate covers: verification of the EU declaration of conformity and the technical documentation before signature rather than after; the Article 11(3)(a) copy of the file kept available for the full retention period; EUDAMED actor and device registration and the Basic UDI-DI submission; the registered EU address printed on your label and instructions for use; handling of competent authority requests, samples and information in the language of the Member State concerned; and the vigilance interface under Articles 87 to 90.

We review the file before accepting a mandate, because Article 11(5) makes the authorised representative jointly and severally liable for defective devices where the manufacturer has not complied with Article 10. A file we have not read is a liability we cannot price. Our fee structure is published on the EU authorised representative cost page, and the scope of the service is set out under EU authorised representative. Send us the declaration of conformity and the device list and we will tell you within two working days whether the file is ready for a mandate and what is missing if it is not.