On 5 May 2026, Commission Implementing Regulation (EU) 2026/977 of 4 May 2026, establishing uniform quality management and procedural requirements for conformity assessment activities carried out by notified bodies designated under the MDR and IVDR, was published in the Official Journal of the EU. This act addresses one of the industry’s most frequently raised concerns: significant discrepancies between notified bodies regarding cost estimates, the duration of assessments and approaches to recertification, which for years have placed manufacturers, particularly SMEs, at a disadvantage in the internal market.
Why was the regulation created?
The practical application of the MDR and IVDR revealed that the requirements set out in Annex VII to both Regulations were being interpreted inconsistently by individual notified bodies. This concerned, in particular, cost estimates provided to manufacturers, deadlines for the completion of conformity assessment activities, and recertification procedures. The Commission noted that these discrepancies resulted in delays in innovation and risks to patient health arising from difficulties in market access. Regulation 2026/977 aims to eliminate these problems by imposing specific, binding procedural requirements on notified bodies.
Cost estimates – an end to opaque pricing
Article 1 of the Regulation requires notified bodies to have documented procedures ensuring that a cost estimate is provided to the manufacturer only after receiving a complete set of information from them. This includes the manufacturer’s identification details, information to establish SME status, a description of the products and their risk classification, the addresses of all sites covered by the quality management system, and information on suppliers and subcontractors involved in design and production. The cost estimate itself must include the estimated total costs, broken down into the assessment of the QMS and technical documentation, an estimate of potential additional costs, and the anticipated timelines. If costs increase by more than 10 per cent compared to the cost estimate, the notified body is obliged to inform the manufacturer in advance, stating the reason.
Maximum time limits from application to certification
Article 2 of the Regulation introduces binding maximum time limits for the successive stages of conformity assessment. The review of the application and the signing of the contract must take place within 30 days of receipt of the complete application. The quality management system audit must not take longer than 120 days from the start of the first activity under the audit programme. Product verification – from the start of the technical documentation assessment to the final review – is limited to 90 days. The decision and the issue of the certificate must take place within 20 days of the completion of the final review. Similar deadlines apply to the assessment of planned significant changes: 30 days to verify whether additional actions are necessary, followed by a maximum of 90 days to carry them out and 20 days to issue an amendment to the certificate. These deadlines apply to procedures where the contract is signed after 25 February 2027.
Limited and regulated interruptions
A notified body may suspend the running of a deadline where additional information from the manufacturer is required to complete the assessment. However, the number of permissible interruptions is limited: once during the application review stage, four times during the QMS audit stage, and four times during the product verification stage. The time limit is suspended by operation of law where the notified body is awaiting an opinion from the European Medicines Agency, a panel of experts or an EU reference laboratory; this suspension does not count towards the limits indicated above. Any suspension must be agreed with the manufacturer in writing, stating the reason and the expected duration.
Monitoring and annual disclosure of costs and deadlines
Article 4 requires notified bodies to implement, as part of their QMS, a system for monitoring the duration and costs of the assessments they carry out. By 30 April each year, the notified body must draw up an annual report setting out the percentage of assessments completed on time, the median time from application to certification, and the median total costs. The report is to be published on the body’s website and submitted to the supervisory authority and the Commission. This requirement will come into force on 1 January 2028, giving notified bodies time to establish the necessary measurement infrastructure. Manufacturers, meanwhile, will be able to compare the performance of individual notified bodies based on the data.
Recertification – scope and deadline
Articles 5, 6 and 7 of the Regulation specify the requirements for the recertification process for both product certificates and quality management system certificates. The maximum timeframe for assessing documentation for recertification is 90 days. The notified body is required to focus exclusively on the documentation covering the period since the last certification, including the PSUR, post-market surveillance results, changes to the risk analysis and the current state of knowledge, without repeating the assessment originally carried out. These provisions do not apply to certificates expiring before 25 November 2027.
Source: Commission Implementing Regulation (EU) 2026/977 of 4 May 2026