The Health Institution Exemption in MDR Article 5(5): Eight Conditions, and Where It Stops

Article 5(5) of MDR 2017/745 is the provision hospitals rely on when they build something themselves: a bespoke surgical guide, a piece of clinical software, a modified accessory, a laboratory workflow tool. It is often described as the in-house exemption, and it is often read as broader than it is. The exemption is genuine, but it is conditional on eight cumulative requirements, it stops entirely at the boundary of the legal entity, and it never applies to anything made on an industrial scale.

This guide sets out each condition, the two places the exemption is cross-referenced elsewhere in the Regulation, the boundary with custom-made devices, and why it matters to a supplier and to an EU authorised representative even though neither is inside the exemption.

The starting point: in-house devices are put into service

Before the exemption, Article 5(4) settles a question that would otherwise be arguable. "Devices that are manufactured and used within health institutions shall be considered as having been put into service." (MDR Article 5(4))

An in-house device has entered the regulatory world. It is not a prototype, not an internal tool, and not outside the Regulation by default. Article 5(1) then applies: a device may be put into service only if it complies with the Regulation. Article 5(5) is what relieves that, and only on terms. Our guide to placing on the market versus making available covers the surrounding definitions, including putting into service.

The relief, and what survives it

The opening words of paragraph 5 set the shape. "With the exception of the relevant general safety and performance requirements set out in Annex I, the requirements of this Regulation shall not apply to devices, manufactured and used only within health institutions established in the Union, provided that all of the following conditions are met." (MDR Article 5(5))

Annex I is carved out of the relief and therefore always applies. Everything else in MDR — conformity assessment under Article 52, the EU declaration of conformity, the CE marking, technical documentation under Annexes II and III, UDI under Article 27, registration in EUDAMED, the person responsible for regulatory compliance under Article 15 — does not.

Two words limit it further. Only within health institutions, which is the geography of use. And established in the Union, which excludes an institution outside the EU from relying on this provision for devices reaching EU patients.

It is worth being precise about what Annex I demands, because it is not a light residue. It is the whole general safety and performance requirement set — risk management under Section 3, the benefit-risk determination under Sections 1 and 8, chemical, physical and biological properties, infection and microbial contamination, devices incorporating software, electronic programmable systems, protection against radiation, and the labelling and instructions for use requirements in Section 23, so far as each is relevant to the device. An institution relying on Article 5(5) has to be able to show Annex I compliance in the same substance as a manufacturer, without the conformity assessment scaffolding that would normally guide it there.

Condition (a): no transfer to another legal entity

"the devices are not transferred to another legal entity" (MDR Article 5(5)(a))

This is the condition that most in-house programmes eventually breach, and it is expressed in terms of legal entities rather than sites, organisations, groups or ownership. A device shared between two hospitals in the same trust or the same group is transferred if those hospitals are separate legal persons. A device provided to a research partner, an academic spin-out or a supplier for evaluation is transferred. A device sold, licensed or given away is transferred.

Software makes this harder than hardware. In-house clinical software hosted centrally and accessed by clinicians employed by a different legal entity raises the question directly, and the answer depends on the arrangement rather than on whether anything physical moved.

Once condition (a) fails, the exemption fails entirely — the conditions are cumulative — and the device is an ordinary device requiring conformity assessment, a CE marking and, where the manufacturing entity is outside the Union, an authorised representative.

Condition (b): appropriate quality management systems

"manufacture and use of the devices occur under appropriate quality management systems" (MDR Article 5(5)(b))

Note that it covers manufacture and use. The QMS scope has to extend into the clinical setting where the device is deployed, not stop at the workshop or the development team. Note also the plural: a hospital's existing accreditation for laboratory or clinical services may or may not cover device manufacture, and the condition asks whether the systems are appropriate, not whether a certificate exists.

Condition (c): no equivalent device on the market

"the health institution justifies in its documentation that the target patient group's specific needs cannot be met, or cannot be met at the appropriate level of performance by an equivalent device available on the market" (MDR Article 5(5)(c))

This is the substantive gate, and it is the reason Article 5(5) is not a route around procurement. The institution has to justify — in its documentation, in advance — that no equivalent device on the market meets the target patient group's specific needs, or that none does so at the appropriate level of performance.

The second limb matters. The test is not only availability but performance level, which allows an institution to build something where a commercial device exists but is inadequate for the specific patient group. What it does not allow is a justification based on cost, procurement timelines, supplier preference or internal capability. Those are real reasons to build something; they are not the reason Article 5(5)(c) accepts.

Because the market changes, this justification is not a one-time document. An equivalent device becoming available at an appropriate level of performance undermines the basis on which the institution is operating.

Condition (d): information to the competent authority

"the health institution provides information upon request on the use of such devices to its competent authority, which shall include a justification of their manufacturing, modification and use" (MDR Article 5(5)(d))

The word modification appears here and nowhere else in the list. It signals that Article 5(5) covers not only devices built from scratch but devices modified in-house — a category that captures a great deal of what actually happens in hospitals, including modification of a CE-marked device beyond its intended purpose.

Condition (e): the public declaration

"the health institution draws up a declaration which it shall make publicly available, including: (i) the name and address of the manufacturing health institution; (ii) the details necessary to identify the devices; (iii) a declaration that the devices meet the general safety and performance requirements set out in Annex I to this Regulation and, where applicable, information on which requirements are not fully met with a reasoned justification therefor" (MDR Article 5(5)(e))

Two features distinguish this from an ordinary EU declaration of conformity. It is publicly available — not held for authorities, but published, which in practice means a page on the institution's website. And point (iii) permits partial compliance with Annex I, provided the unmet requirements are identified and reasoned. The ordinary declaration of conformity admits no such qualification.

The publication requirement is the condition most frequently unmet in practice, because it sits with communications rather than with the clinical or engineering team that built the device.

Conditions (f) and (g): the documentation and the process

"the health institution draws up documentation that makes it possible to have an understanding of the manufacturing facility, the manufacturing process, the design and performance data of the devices, including the intended purpose, and that is sufficiently detailed to enable the competent authority to ascertain that the general safety and performance requirements set out in Annex I to this Regulation are met" (MDR Article 5(5)(f))

And: "the health institution takes all necessary measures to ensure that all devices are manufactured in accordance with the documentation referred to in point (f)" (MDR Article 5(5)(g))

This is a functional standard rather than a prescribed structure, and it is close to what Annex XIII Section 2 requires of custom-made device manufacturers. It is not Annex II technical documentation, but the outcome it has to achieve — an authority able to ascertain Annex I compliance — is the same outcome Annex II exists to produce.

Condition (h): review of clinical experience

"the health institution reviews experience gained from clinical use of the devices and takes all necessary corrective actions" (MDR Article 5(5)(h))

A post-market obligation in miniature. There is no PMS plan, no PSUR and no PMCF plan, but the substance — review experience, act on it — is present and is not optional.

Where the exemption stops

Three limits close the paragraph.

Member States may add. "Member States may require that such health institutions submit to the competent authority any further relevant information about such devices which have been manufactured and used on their territory. Member States shall retain the right to restrict the manufacture and the use of any specific type of such devices and shall be permitted access to inspect the activities of the health institutions." (MDR Article 5(5)) A national notification scheme, a national restriction on a device type, and an inspection right are all available, and several Member States use them. An institution operating across borders faces a national layer on top of the eight conditions.

And the hard stop: "This paragraph shall not apply to devices that are manufactured on an industrial scale." (MDR Article 5(5))

Industrial scale is undefined in the Regulation, which means it is assessed on the facts — volume, process automation, repeatability, whether the output is a series. A hospital workshop producing occasional patient-specific items is not manufacturing on an industrial scale. A hospital running a validated production line supplying its own network at volume may well be, whatever the internal accounting says.

Two cross-references worth knowing

Article 5(5) does not only operate on its own. Article 17(3), on the reprocessing of single-use devices, imports most of it. Where a Member State exercises the option to relieve health institutions of manufacturer obligations for devices reprocessed and used in-house, it must ensure that "the safety and performance of the reprocessed device is equivalent to that of the original device and the requirements in points (a), (b), (d), (e), (f), (g) and (h) of Article 5(5) are complied with" (MDR Article 17(3)(a)).

Point (c) is deliberately excluded from that list, since a reprocessed device is by definition equivalent to a device already on the market. Everything else carries over. Our note on reprocessing single-use devices under Article 17 covers the rest of that regime.

IVDR 2017/746 contains a parallel provision at its own Article 5(5), which is the basis on which laboratory-developed tests are used in-house in the Union. The structure is similar but the conditions are not identical, and a laboratory relying on it should read the IVDR text rather than the MDR text.

Article 5(5) is not the custom-made route

The two are regularly confused, and they are structurally different.

A custom-made device is made by a manufacturer to a prescriber's written prescription for a single named patient, follows Annex XIII, produces a per-device statement, carries no CE marking, and may be supplied to a health institution by a separate legal entity. The manufacturer stays a manufacturer with full Chapter VII post-market obligations. Our guide to custom-made devices under Annex XIII sets that out.

An Article 5(5) device is made by the health institution itself, for its own use, may not be transferred to another legal entity, and requires the institution to justify that nothing equivalent exists on the market. There is no prescription requirement and no per-device statement, but there is a public declaration.

A supplier that manufactures patient-specific devices for a hospital is in the first category and cannot use the second. A hospital that builds something itself and then supplies it to another entity is in neither.

Why this matters to manufacturers and to an EU REP

Nothing in Article 5(5) applies to a manufacturer, and no authorised representative is needed for a device that stays inside it. The relevance is at the boundary, and it runs in both directions.

For a manufacturer, condition (c) is a commercial fact. Where an equivalent device is available on the market at an appropriate level of performance, the institution's justification for building its own weakens. Suppliers whose products address a specific patient group's needs have a direct interest in that being visible.

For a supplier that provides materials, components, software libraries or manufacturing services into a hospital's in-house programme, the question is whether what is supplied is itself a device being placed on the market. If it is, the ordinary regime applies to the supplier regardless of what the hospital does downstream, and a non-EU supplier needs an authorised representative for it.

And for any in-house programme that outgrows condition (a) — where the institution starts supplying another legal entity, spins the activity into a separate company, or scales to industrial production — the exemption ends and the ordinary route begins: conformity assessment, technical documentation, declaration of conformity, CE marking, UDI, registration and, where the manufacturing entity is not established in a Member State, a designated authorised representative. That transition is a project, not an adjustment, and it is easier when it is anticipated. Our authorised representative service covers organisations making exactly that move.

Medex Kurumsal as your EU authorised representative

If you place medical devices or in vitro diagnostics on the European market from outside the Union, Article 11 of MDR 2017/745 — and Article 11 of IVDR 2017/746 for in vitro diagnostics — requires a single authorised representative established in a Member State before those devices reach the market. Medex Kurumsal Danismanlik acts as EU authorised representative under both Regulations, registered in EUDAMED under SRN TR-AR-000057550.

What the mandate covers: verification of the EU declaration of conformity and the technical documentation before signature rather than after; the Article 11(3)(a) copy of the file kept available for the full retention period; EUDAMED actor and device registration and the Basic UDI-DI submission; the registered EU address printed on your label and instructions for use; handling of competent authority requests, samples and information in the language of the Member State concerned; and the vigilance interface under Articles 87 to 90.

We review the file before accepting a mandate, because Article 11(5) makes the authorised representative jointly and severally liable for defective devices where the manufacturer has not complied with Article 10. A file we have not read is a liability we cannot price. Our fee structure is published on the EU authorised representative cost page, and the scope of the service is set out under EU authorised representative. Send us the declaration of conformity and the device list and we will tell you within two working days whether the file is ready for a mandate and what is missing if it is not.