Reprocessing Single-Use Devices Under MDR Article 17: The Reprocessor Becomes the Manufacturer

Article 17 of MDR 2017/745 is the shortest route in the Regulation from providing a service to becoming a manufacturer. It is ten paragraphs long, it applies to a practice that is legal in some Member States and prohibited in others, and it operates by reclassifying the person performing the work rather than by regulating the work itself.

It matters to three groups of readers. Reprocessors, who often do not realise the scale of what they have taken on. Health institutions, which may or may not fall inside a derogation depending on where they sit. And original manufacturers of single-use devices, whose products can be reissued into the EU market under someone else's name and whose own name has to be removed from the label. This guide sets out what the article does, and where the EU authorised representative obligation lands.

The permission is national, not European

Paragraph 1 sets a condition before anything else applies. "Reprocessing and further use of single-use devices may only take place where permitted by national law and only in accordance with this Article." (MDR Article 17(1))

MDR does not authorise reprocessing. It regulates it where a Member State has authorised it. The default in a Member State that has legislated nothing is that reprocessing is not permitted, and paragraph 9 lets a Member State that does permit it go further in the restrictive direction. "A Member State that permits reprocessing of single-use devices may maintain or introduce national provisions that are stricter than those laid down in this Regulation and which restrict or prohibit, within its territory, the following: (a) the reprocessing of single-use devices and the transfer of single-use devices to another Member State or to a third country with a view to their reprocessing; (b) the making available or further use of reprocessed single-use devices." (MDR Article 17(9))

Point (a) is the provision that catches cross-border business models. A Member State may prohibit the transfer of its single-use devices to another Member State or to a third country for reprocessing, even where the reprocessing itself would be lawful at the destination. A reprocessor operating a collect-clean-return model across several countries is therefore facing a per-country legal question at both ends of each movement, not a single Union-wide answer. Member States must notify the Commission and the other Member States of those provisions, and the Commission makes the information publicly available — which is where the mapping exercise starts.

The reclassification

Paragraph 2 is the operative rule and it is worth reading slowly. "Any natural or legal person who reprocesses a single-use device to make it suitable for further use within the Union shall be considered to be the manufacturer of the reprocessed device and shall assume the obligations incumbent on manufacturers laid down in this Regulation, which include obligations relating to the traceability of the reprocessed device in accordance with Chapter III of this Regulation. The reprocessor of the device shall be considered to be a producer for the purpose of Article 3(1) of Directive 85/374/EEC." (MDR Article 17(2))

Three separate consequences are packed into that paragraph.

First, the reprocessor is the manufacturer of the reprocessed device. Not a manufacturer-equivalent, not a party subject to selected obligations: the manufacturer. Article 10 applies in full — quality management system, risk management, technical documentation, clinical evaluation, conformity assessment, declaration of conformity, CE marking, post-market surveillance, vigilance, a person responsible for regulatory compliance under Article 15. The reprocessed device is a new device placed on the market and needs its own EU declaration of conformity and its own technical documentation.

Second, Chapter III is called out by name. That is registration and UDI. The reprocessed device gets its own Basic UDI-DI and its own UDI, its own EUDAMED device record, and the reprocessor gets its own single registration number. The original device's UDI does not carry over; it identifies a different device placed on the market by a different manufacturer.

Third, and separately from MDR, the reprocessor becomes a producer under the Product Liability Directive. That is strict liability for damage caused by a defective product, sitting outside the regulatory regime and outside any contract the reprocessor has with the hospital. The original manufacturer's liability for the device as originally placed on the market is not what is in issue once the device has been reprocessed; the reprocessor's is.

What may be reprocessed, and how safely

Two paragraphs bound the input and the method. "Only single-use devices that have been placed on the market in accordance with this Regulation, or prior to 26 May 2021 in accordance with Directive 93/42/EEC, may be reprocessed." (MDR Article 17(6)) A device that reached the Union market unlawfully cannot be laundered into compliance by reprocessing it.

And: "Only reprocessing of single-use devices that is considered safe according to the latest scientific evidence may be carried out." (MDR Article 17(7)) This is a moving standard rather than a fixed one, and it is the provision under which a competent authority can challenge a reprocessing programme for a device type without pointing to a specific breach of a specification.

Paragraph 5 required the Commission to adopt common specifications for reprocessing, and provided a fallback. It states that in the event that those CS are not adopted, "reprocessing shall be performed in accordance with any relevant harmonised standards and national provisions that cover the aspects outlined in point (b) of paragraph 3. Compliance with CS or, in the absence of CS, with any relevant harmonised standards and national provisions, shall be certified by a notified body." (MDR Article 17(5))

The final sentence is the one that is routinely missed. Certification by a notified body is required either way — against the common specifications where they exist, and against harmonised standards and national provisions where they do not. There is no self-certification route for reprocessing.

The health institution derogation

Paragraph 3 opens the only relief in the article, and it is optional for Member States. "By way of derogation from paragraph 2, as regards single-use devices that are reprocessed and used within a health institution, Member States may decide not to apply all of the rules relating to manufacturers' obligations laid down in this Regulation provided that they ensure that: (a) the safety and performance of the reprocessed device is equivalent to that of the original device and the requirements in points (a), (b), (d), (e), (f), (g) and (h) of Article 5(5) are complied with." (MDR Article 17(3))

Note the shape. It is a national option, not an automatic exemption; it applies only to devices reprocessed and used within the same health institution; and the equivalence test is against the original device, which means the institution has to know what the original device's safety and performance were.

The cross-reference to Article 5(5) imports most of the in-house device regime: no transfer to another legal entity, manufacture and use under appropriate quality management systems, information to the competent authority on request with a justification, a publicly available declaration, documentation sufficient for the authority to ascertain Annex I compliance, measures to ensure devices are manufactured in accordance with that documentation, and review of clinical experience with corrective action. Points (c) — the unmet-clinical-need justification — is deliberately omitted from the list, since a reprocessed device is by definition equivalent to something already on the market. Our guide to the Article 5(5) health institution exemption covers those conditions in detail.

Point (b) then requires reprocessing performed in accordance with common specifications detailing requirements concerning risk management — including "the analysis of the construction and material, related properties of the device (reverse engineering) and procedures to detect changes in the design of the original device as well as of its planned application after reprocessing" — the validation of procedures for the entire process including cleaning steps, product release and performance testing, the quality management system, the reporting of incidents involving reprocessed devices, and traceability.

The reverse engineering requirement deserves attention. The institution has to analyse the construction and materials of a device it did not design, and maintain procedures to detect changes in the design of the original device. When the original manufacturer silently changes a material or a geometry between production runs, the reprocessing validation may no longer hold, and the obligation to notice sits with the reprocessing party.

Paragraph 4 extends the derogation, at national option, to external reprocessors: "Member States may choose to apply the provisions referred to in paragraph 3 also as regards single-use devices that are reprocessed by an external reprocessor at the request of a health institution, provided that the reprocessed device in its entirety is returned to that health institution and the external reprocessor complies with the requirements referred to in points (a) and (b) of paragraph 3." (MDR Article 17(4)) The return condition is absolute — the device in its entirety goes back to the institution that sent it. A pooled model, where devices are reprocessed into common stock and redistributed, falls outside paragraph 4 and back into paragraph 2.

Paragraph 3 closes with a patient information provision: Member States shall encourage, and may require, health institutions to provide information to patients on the use of reprocessed devices within the institution.

The labelling reversal

Paragraph 8 does something unusual. "The name and address of the legal or natural person referred to in paragraph 2 and the other relevant information referred to in Section 23 of Annex I shall be indicated on the label and, where applicable, in the instructions for use of the reprocessed device. The name and address of the manufacturer of the original single-use device shall no longer appear on the label, but shall be mentioned in the instructions for use of the reprocessed device." (MDR Article 17(8))

The original manufacturer's identity is removed from the label and demoted to the instructions for use. This is not optional and it is not a courtesy — it is a positive obligation on the reprocessor, and it is the visible signal that the device on the shelf is a different regulatory product from the one that left the original factory.

For an original manufacturer, the practical reading is that a device bearing your name on the label is your device, and one that has been reprocessed should not bear it. If reprocessed devices carrying an original manufacturer's label are circulating, either the reprocessor has breached paragraph 8 or the devices are being reused outside Article 17 entirely. Both are reportable to the competent authority, and the original manufacturer's authorised representative is normally the party that makes that report.

The label content otherwise follows Section 23 of Annex I in full, including the language requirement. Our note on label language requirements covers the Member State dimension of that.

Where the EU REP obligation lands

The reclassification in paragraph 2 carries Article 11 with it. A reprocessor established outside the Union that reprocesses devices for further use within the Union is a manufacturer not established in a Member State, and Article 11(1) requires it to designate a single authorised representative before the reprocessed devices are placed on the Union market. There is no reprocessing carve-out.

What the representative verifies is a normal Article 11(3) set, applied to a device whose file has an unusual shape:

That the reprocessed device has its own declaration of conformity and its own technical documentation, distinct from anything relating to the original device.

That the notified body certification required by paragraph 5 is in place — against common specifications or, in their absence, against harmonised standards and the national provisions of the Member States concerned.

That the reprocessed device carries its own Basic UDI-DI and UDI and its own EUDAMED record, and that the reprocessor holds its own SRN.

That the labelling complies with paragraph 8, including the removal of the original manufacturer's name from the label.

That national law in each Member State of destination actually permits both the reprocessing and the making available of the reprocessed device, and that no paragraph 9 restriction applies to the transfer route being used.

That the post-market surveillance and vigilance systems treat the reprocessed device as a distinct product with its own incident history.

The national-law mapping in the fifth item is the one that has no analogue in ordinary device work. For most products, a device lawfully placed on the market may be made available anywhere in the Union. For reprocessed single-use devices, the market is a patchwork by design, and the representative is the party positioned to keep track of it. Our guide to placing on the market versus making available explains why that distinction is doing so much work here.

What an original manufacturer should do

Designating a device as single-use does not prevent it from being reprocessed where national law permits it; it sets the baseline against which equivalence is measured. Three steps follow from that.

State the single-use designation clearly and support it. Annex I Section 23.4(i) requires the instructions for use to indicate, for a single-use device, information on characteristics and technical factors known to the manufacturer that could pose a risk if the device were to be re-used, together with the information referred to in Section 23.4(n) where applicable. A designation with no supporting rationale is weaker in a dispute than one with a documented basis.

Treat design changes as information a reprocessor may be relying on. The reverse engineering obligation in Article 17(3)(b) means reprocessors are validating against a snapshot of your device. That is their obligation, not yours, but silent material or geometry changes create a safety interface that ends up in your vigilance data.

Monitor the label. A reprocessed device correctly handled under Article 17 does not carry your name on the label. One that does is evidence of something going wrong upstream.

Reporting and review

Paragraph 10 required the Commission to draw up a report on the operation of the article by 27 May 2024 and submit it to the European Parliament and the Council, with proposals for amendment if appropriate. Reprocessing is therefore one of the parts of MDR most likely to move, and any programme built on the current text should be reviewed against whatever follows.

If you reprocess single-use devices for the EU market from outside the Union, or you manufacture single-use devices and want the reprocessing exposure on your products understood and monitored, our authorised representative service covers both positions, including the per-Member-State legality mapping that Article 17 makes unavoidable.

Medex Kurumsal as your EU authorised representative

If you place medical devices or in vitro diagnostics on the European market from outside the Union, Article 11 of MDR 2017/745 — and Article 11 of IVDR 2017/746 for in vitro diagnostics — requires a single authorised representative established in a Member State before those devices reach the market. Medex Kurumsal Danismanlik acts as EU authorised representative under both Regulations, registered in EUDAMED under SRN TR-AR-000057550.

What the mandate covers: verification of the EU declaration of conformity and the technical documentation before signature rather than after; the Article 11(3)(a) copy of the file kept available for the full retention period; EUDAMED actor and device registration and the Basic UDI-DI submission; the registered EU address printed on your label and instructions for use; handling of competent authority requests, samples and information in the language of the Member State concerned; and the vigilance interface under Articles 87 to 90.

We review the file before accepting a mandate, because Article 11(5) makes the authorised representative jointly and severally liable for defective devices where the manufacturer has not complied with Article 10. A file we have not read is a liability we cannot price. Our fee structure is published on the EU authorised representative cost page, and the scope of the service is set out under EU authorised representative. Send us the declaration of conformity and the device list and we will tell you within two working days whether the file is ready for a mandate and what is missing if it is not.