---
title: CE Marking Under MDR: The Step-by-Step Process for Startups
description: The complete step-by-step CE marking process under EU MDR 2017/745 for medical device startups. From device classification to declaration of conformity — every stage explained from the startup perspective.
authors: Tibor Zechmeister, Felix Lenhard
category: MDR Fundamentals & Regulatory Strategy
primary_keyword: 
canonical_url: https://zechmeister-solutions.com/en/blog/ce-marking-under-mdr-step-by-step-process
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# CE Marking Under MDR: The Step-by-Step Process for Startups

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

The CE mark is two letters on a label. Behind those two letters sits a regulatory process that can take a startup anywhere from 12 to 36 months, cost anywhere from tens of thousands to millions of euros, and require documentation that would fill several filing cabinets if you printed it all out. And yet, without it, you cannot sell a single medical device in the European Union.

This post walks through the entire CE marking process under the Medical Device Regulation (EU) 2017/745 — step by step, from the startup perspective. No theory without practice. No generalities without specifics.

## Step 0: Confirm That Your Product Is a Medical Device Under MDR

Before you spend a single euro on regulatory, answer this question: does your product actually fall under MDR?

This sounds obvious. It is not. MDR Article 2(1) defines a medical device based on its **intended purpose**, not its technology, form factor, or what category it feels like it belongs in. 

A medical device under MDR is any instrument, apparatus, appliance, software, implant, reagent, material, or other article intended by the manufacturer to be used for one or more specific medical purposes listed in the definition — including diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

The critical word is "intended." Your intended purpose — as communicated through your labeling, instructions for use, marketing materials, and claims — determines whether your product is a medical device. A wellness app that tracks sleep is not a medical device. The same app, if you claim it diagnoses sleep apnea, almost certainly is.

Tibor's approach with startups is direct: "Show me your marketing claims. Show me your intended purpose statement. I can tell you in 15 minutes whether you are in MDR territory. The technology does not matter. The claims do."

If your product is not a medical device, you do not need CE marking under MDR. You may need CE marking under other EU legislation (such as the Machinery Regulation, the Low Voltage Directive, or the Radio Equipment Directive), but that is a different process with different requirements.

If your product is a medical device — or could be classified as one based on your intended purpose — continue reading.

## Step 1: Classify Your Device

Every medical device under MDR must be assigned a risk class. MDR uses four classes: Class I, Class IIa, Class IIb, and Class III, with Class I being the lowest risk and Class III the highest.

The classification rules are in MDR Annex VIII and consist of 22 rules organized by the type of device: non-invasive devices, invasive devices, active devices, and special rules for specific categories. 

Classification matters enormously because it determines:
- Which conformity assessment route you must follow
- Whether you need a Notified Body (you need one for everything except most Class I devices)
- How much clinical evidence you need
- How extensive your technical documentation must be
- How long the process takes and how much it costs

**For startups, the classification step is where many make their first strategic error.** They either over-classify (choosing a higher class than necessary, which increases cost and time) or under-classify (choosing a lower class than justified, which leads to rejection by the Notified Body and wasted months).

The classification must be based on the device's intended purpose and its inherent risks, applying the rules in Annex VIII systematically. When multiple rules apply, the highest resulting class governs.

One piece of advice that Tibor gives every startup: "Do your own classification first. Go through every rule in Annex VIII, document which ones apply and why, and arrive at your answer. Then bring it to a regulatory expert and have them challenge it. If you both agree, you are on solid ground. If you disagree, dig into why — the discussion itself will teach you more about your device and the regulation than any webinar."

## Step 2: Identify the Applicable Conformity Assessment Route

Once you know your device class, you can determine which conformity assessment procedure applies. MDR Article 52 maps device classes to conformity assessment procedures described in Annexes IX, X, XI, and combinations thereof. 

Here is the simplified map:

**Class I (non-sterile, non-measuring, non-reprocessing of single-use):**
Self-certification. You prepare a technical file, draw up your EU Declaration of Conformity, and affix the CE mark. No Notified Body involvement required. This is the simplest and least expensive path. 

**Class I sterile, Class I with measuring function, Class Is/Im, reusable surgical instruments:**
Notified Body involvement required, but only for the specific aspects (sterilization validation, metrological aspects). 

**Class IIa:**
Notified Body required. Typically Annex IX (quality management system and technical documentation assessment) or a combination of Annex XI (product conformity verification) with Annex VII. 

**Class IIb:**
Notified Body required. Annex IX or Annex X (type examination) combined with Annex XI. More rigorous assessment than Class IIa. 

**Class III:**
Notified Body required. Annex IX with additional scrutiny — the Notified Body must verify the clinical evidence in detail. For Class III implantable devices, there is also a consultation procedure with expert panels. 

## Step 3: Establish Your Quality Management System

MDR Article 10(9) requires every manufacturer to establish, document, implement, maintain, and keep up to date a quality management system (QMS). 

For practical purposes, this means implementing a QMS that aligns with ISO 13485:2016, the harmonized standard for medical device quality management systems. While MDR does not explicitly require ISO 13485 certification, using the standard provides a presumption of conformity with the QMS requirements of MDR, and every Notified Body will assess your QMS against it.

For a startup, building a QMS feels like building a bureaucracy. Tibor reframes it: "A QMS is not paperwork for the sake of paperwork. It is the operating system of your company. It defines how you design products, how you manage risk, how you handle complaints, how you make decisions. A good QMS makes your company run better. A bad QMS is just a paper tiger that makes everyone miserable."

The key QMS processes you need as a startup:

1. **Design and development control** — how you develop your device, from initial concept through verification and validation
2. **Risk management** — integrated throughout the lifecycle, aligned with ISO 14971
3. **Document control** — how you manage all documents and records
4. **Purchasing and supplier management** — how you control your supply chain
5. **Production and process control** — how you manufacture consistently
6. **Corrective and preventive action (CAPA)** — how you handle problems
7. **Complaint handling** — how you capture and respond to user feedback
8. **Post-market surveillance** — how you monitor your device after it is on the market
9. **Management review** — how leadership stays engaged with quality

Do not try to build all of this from scratch. Use templates. Use electronic QMS platforms designed for startups. Start lean and build out as your company grows. But start early — a QMS cannot be bolted on at the end.

## Step 4: Prepare Your Technical Documentation

The technical documentation (often called the "Technical File") is the core regulatory deliverable. MDR Annex II specifies what must be included, and MDR Annex III covers the post-market surveillance documentation. 

Your technical documentation must include:

- **Device description and specification** — what your device is, what it does, how it works, all variants and accessories
- **Information supplied by the manufacturer** — labeling, instructions for use
- **Design and manufacturing information** — materials, components, manufacturing processes, validation
- **General Safety and Performance Requirements (GSPR) checklist** — a systematic demonstration that your device meets every applicable requirement in Annex I, with references to the standards and evidence used 
- **Benefit-risk analysis and risk management** — comprehensive risk management per ISO 14971, with the overall benefit-risk determination
- **Product verification and validation** — test reports, bench testing, biocompatibility, software validation, usability, electrical safety, and everything else relevant to your device
- **Clinical evaluation** — the clinical evidence demonstrating that your device is safe and performs as intended (more on this in Step 5)
- **Post-market surveillance plan** — how you will monitor the device after it reaches the market

For a startup, the technical documentation is the mountain. It is the single largest work product you will produce during the CE marking process. The iceberg metaphor that Tibor uses constantly applies perfectly here: "Founders see the CE mark and think it is a stamp. The technical file is the iceberg underneath. What you see on the label is 1%. What sits in the technical file is the other 99%."

## Step 5: Build Your Clinical Evidence

MDR Article 61 requires that every medical device be supported by sufficient clinical evidence to demonstrate conformity with the relevant General Safety and Performance Requirements. 

Clinical evidence can come from three sources:

1. **Clinical investigation data** — data from clinical studies conducted with your device
2. **Clinical evaluation of equivalent devices** — using clinical data from a device demonstrated to be equivalent to yours
3. **Published literature** — scientific publications relevant to your device, its intended purpose, and the clinical condition it addresses

For most startups, clinical investigations are the most expensive and time-consuming route. The regulation allows alternatives through equivalence claims and literature-based evidence, but MDR has significantly tightened the requirements for claiming equivalence compared to the old MDD. You must demonstrate technical, biological, and clinical equivalence, and for Class III and implantable devices, you typically need a contract with the equivalent device manufacturer giving you access to their technical documentation. 

Tibor's guidance on clinical evidence is consistent: "Do not default to 'we need a clinical trial.' First, understand what clinical evidence you actually need. For a Class IIa non-invasive diagnostic device, a well-executed literature review and a solid clinical evaluation report may be sufficient. For a Class III implantable, yes, you probably need clinical investigation data. But even then, smart use of equivalent device data and existing literature can significantly reduce the scope and cost of the investigation."

## Step 6: Choose and Engage a Notified Body

If your device is Class IIa or higher (or Class I with sterile/measuring/reprocessing aspects), you need a Notified Body. This is an organization designated by an EU Member State authority to assess medical devices against MDR requirements.

The Notified Body landscape is constrained. As of 2026, there are still fewer Notified Bodies designated under MDR than there were under MDD. 

Choosing the right Notified Body matters. Consider:

- **Scope:** Does the Notified Body have the technical competence and designation scope for your specific device type?
- **Capacity:** What are their current lead times? Some Notified Bodies have waiting lists measured in months.
- **Experience with startups:** Some Notified Bodies are used to working with large manufacturers and may not be patient with a startup's iterative approach. Others are more flexible.
- **Geography:** While any EU-designated Notified Body can certify your device for the entire EU market, practical considerations like language, travel for audits, and time zones matter.

The engagement process typically follows this sequence:
1. **Application submission** — you provide your device information, classification, and intended conformity assessment route
2. **Quotation and contract** — the Notified Body provides a proposal including scope, timeline, and costs
3. **Documentation review** — the Notified Body reviews your technical documentation
4. **QMS audit** — the Notified Body audits your quality management system (on-site)
5. **Technical documentation assessment** — detailed review of your technical file
6. **Resolution of findings** — you address any non-conformities or observations
7. **Certificate issuance** — if everything is satisfactory, the Notified Body issues your certificate

This process is not linear. Expect iterations. Expect questions. Expect findings that require rework. This is normal and healthy — the Notified Body is doing its job.

## Step 7: Draw Up Your EU Declaration of Conformity

Once you have your technical documentation in order, your QMS established, and (if required) your Notified Body certificate, you draw up the EU Declaration of Conformity per MDR Article 19 and Annex IV. 

The Declaration of Conformity is a formal document in which you, the manufacturer, declare that your device meets all applicable requirements of MDR. It must include specific information laid out in Annex IV, including your company details, device identification, classification, the conformity assessment procedure followed, reference to the Notified Body (if applicable), and a statement of conformity with the regulation.

This is a legal document. It is your company's formal commitment that the device is compliant. It is not a formality — it carries legal weight and personal accountability.

## Step 8: Affix the CE Mark and Register

With the Declaration of Conformity in hand, you can affix the CE mark to your device and its packaging per MDR Article 20. The CE mark must be visible, legible, and indelible, and must be accompanied by the four-digit identification number of the Notified Body (if one was involved in the conformity assessment). 

You must also register as a manufacturer and register your device in EUDAMED (the European Database on Medical Devices) before placing the device on the market. 

## Step 9: Ongoing Obligations — This Is Not the End

Getting the CE mark is not the finish line. MDR imposes extensive post-market obligations:

- **Post-market surveillance** — active and systematic monitoring of your device's performance and safety after it reaches the market (Article 83) 
- **Periodic Safety Update Reports (PSUR)** — regular reports summarizing PMS data, for Class IIa and above (Article 86) 
- **Vigilance reporting** — mandatory reporting of serious incidents and field safety corrective actions (Articles 87-92) 
- **Clinical evaluation updates** — your clinical evaluation must be updated throughout the device lifecycle
- **Notified Body surveillance** — annual surveillance audits by your Notified Body, including unannounced audits

## The Startup Perspective: What Makes This Hard

The process above is logical. It makes sense when you read it. What makes it hard for startups is the combination of three factors:

**1. Parallelism.** You cannot do these steps purely sequentially. Your QMS needs to be operational while you are still designing the device. Your clinical evidence strategy needs to be defined before you start testing. Your Notified Body needs to be selected before your documentation is complete. Everything happens in parallel, and everything affects everything else.

**2. Resources.** A large manufacturer has dedicated regulatory affairs departments with 20 or more specialists. A startup has one or two people who also handle product development, fundraising, and customer conversations. The workload is the same; the team is not.

**3. Iteration.** Startups iterate. That is their strength. But every design change potentially triggers documentation updates, risk management updates, verification re-runs, and clinical evaluation revisions. MDR requires controlled change management — you can iterate, but you must document and control every change.

Tibor's iceberg metaphor captures it perfectly: "Founders see the CE mark and think it is the project. The CE mark is the tip. The project is everything underneath — the QMS, the technical file, the clinical evidence, the post-market system. And the iceberg does not melt after certification. You maintain it for the entire life of the product."

## Your Practical Starting Checklist

If you are starting from zero, here is the order of operations:

1. Define your intended purpose precisely and in writing
2. Classify your device using Annex VIII rules
3. Determine your conformity assessment route per Article 52
4. Start building your QMS — begin with design control, risk management, and document control
5. Define your clinical evidence strategy early — do not leave this until the end
6. Research and shortlist Notified Bodies appropriate for your device
7. Budget time and money realistically (see our companion post on costs and timelines)
8. Engage a regulatory sparring partner if the complexity exceeds your team's current competence

The path to CE marking under MDR is demanding but navigable. Thousands of companies have done it. Startups with limited resources have done it. The key is understanding the full scope upfront — no iceberg surprises — and building a plan that matches your specific device, your specific risk class, and your specific resources.

It is not rocket science. But it is serious science, applied with serious discipline.

---

*This post is part of the [MDR Fundamentals & Regulatory Strategy](https://zechmeister-solutions.com/en/blog/category/mdr-fundamentals) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*