Class IIa is the medium-risk class under the EU Medical Device Regulation. Every Class IIa device needs a Notified Body, which audits the Quality Management System and assesses the technical documentation for at least one representative device per generic device group. Conformity assessment routes for Class IIa are defined in Article 52 and the corresponding Annexes — primarily Annex IX, with Annex XI as an alternative in specific scenarios. The class is determined by the twenty-two rules in Annex VIII of Regulation (EU) 2017/745, not chosen by the manufacturer. For most startups, Class IIa is where Notified Body involvement, clinical evidence obligations, and real regulatory cost begin.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Class IIa is the medium-risk class under the EU Medical Device Regulation (MDR), Regulation (EU) 2017/745. The class is determined by the classification rules in Annex VIII — the manufacturer does not choose it.
  • Every Class IIa device requires a Notified Body. The conformity assessment routes are set out in Article 52 and carried out under Annex IX (QMS plus technical documentation assessment) or, in specific scenarios, Annex XI (production quality assurance).
  • For Class IIa, Annex IX assessment of the technical documentation is performed on at least one representative device per generic device group — the Notified Body does not review every technical file individually at this class, but it does audit the QMS in full.
  • Typical Class IIa devices include most transient surgically invasive devices under Rule 6, most active therapeutic devices that administer energy under Rule 9, and most medical device software providing information for diagnostic or therapeutic decisions under Rule 11.
  • The Quality Management System must comply with Article 10(9) of the MDR. EN ISO 13485:2016 + A11:2021 is the harmonised standard that provides presumption of conformity with the QMS obligations.
  • The gap between Class I and Class IIa is the largest single cost step in the MDR landscape. It is the point where Notified Body involvement begins, where QMS certification by a Notified Body begins, and where technical documentation is reviewed externally.
  • The smartest Class IIa lever a startup has is choosing the right Notified Body. Capacity, scope match, and communication speed vary enormously between NBs, and that variation is worth months of runway.

What Class IIa actually means

Class IIa sits in the middle of the MDR risk classes. It is more risky than Class I but less risky than Class IIb or III. The class carries a specific meaning in the Regulation: the device has a moderate risk profile, a Notified Body must be involved in conformity assessment, and the depth of Notified Body oversight covers both the Quality Management System and the technical documentation.

The class is not a label the manufacturer picks. It is the output of applying the classification rules in Annex VIII of Regulation (EU) 2017/745 to the device's intended purpose. If the rules point to Class IIa, the device is Class IIa — no matter how the manufacturer would like to position it. If two rules point to two different classes for the same device, the higher class applies under the implementing rules of Annex VIII.

For a founder, the practical meaning of Class IIa is straightforward. You need a Notified Body. You need a QMS that will survive an on-site audit. You need technical documentation that will survive a review by a qualified reviewer. You need clinical evidence under Article 61 and Annex XIV. And you need a Person Responsible for Regulatory Compliance under Article 15. None of this is optional. All of it traces to specific articles and annexes of the Regulation. The job of the Subtract to Ship framework at this class is not to cut obligations — it is to cut the work that is not actually required by those obligations.

Typical Class IIa devices

The classification rules in Annex VIII determine the class, but the rule families produce predictable patterns. Three rule families account for most Class IIa devices in practice.

Transient surgically invasive devices — Rule 6. Rule 6 covers surgically invasive devices intended for transient use. The default class under Rule 6 is Class IIa, with specific upgrades where the device is intended for use in direct contact with the heart, the central circulatory system, or the central nervous system. Reusable surgical instruments are carved out under a specific sub-rule into Class I reusable (the Ir subcategory). Typical Rule 6 Class IIa devices include single-use scalpels, surgical staples, and needles for short procedures. The full rule text is in Annex VIII and must be read in the actual Regulation before being applied.

Active therapeutic devices — Rule 9. Rule 9 covers active therapeutic devices intended to administer or exchange energy. The default class under Rule 9 is Class IIa, with an escalation to Class IIb where the administration of energy is potentially hazardous — for example, where the nature, density, and site of application of the energy could cause harm. Typical Rule 9 Class IIa devices include TENS units, certain physiotherapy stimulators, and some low-power therapeutic light devices. Whether a specific device escalates to Class IIb depends on the nature of the energy and the clinical context; this is exactly the kind of judgment call that makes Rule 9 classification non-trivial.

Medical device software — Rule 11. Rule 11 is the rule that changed software classification most dramatically under the MDR. Most software intended to provide information used for decisions with diagnostic or therapeutic purposes is Class IIa, with escalations to Class IIb where the decisions could cause serious deterioration of health or surgical intervention, and to Class III where the decisions could cause death or irreversible deterioration. Most software intended to monitor physiological processes is Class IIa, with escalation to Class IIb where the monitored parameters are vital and variations could result in immediate danger. MDCG 2019-11 Rev.1 (June 2025) is the authoritative guidance on software qualification and classification, and it should be read before applying Rule 11 to any SaMD product.

Other Class IIa patterns include contact lenses (other than corrective lenses with specific carve-outs), hearing aids, and a range of diagnostic imaging software. The specific class for any real device must be determined by reading Annex VIII, applying the rules to the actual intended purpose, and documenting the decision with a specific rule citation. Paraphrases in any blog post — including this one — exist to orient, not to classify.

The conformity assessment routes for Class IIa

Article 52 of the MDR sets out the conformity assessment procedures by class. For Class IIa, the manufacturer has options, and the choice matters for cost, time, and operational fit.

Route 1 — Annex IX (Chapters I and III). Annex IX combines a full Quality Management System assessment with an assessment of the technical documentation. For Class IIa, the technical documentation assessment under Annex IX is performed on at least one representative device per generic device group. The Notified Body does not review every single technical file — it samples across the group. The QMS, on the other hand, is audited in full. This is the most common route for Class IIa startups because it mirrors how a startup naturally operates: you build a quality system and develop products inside it, and the Notified Body assesses both in a single integrated engagement.

Route 2 — Annex XI (production quality assurance). Annex XI covers production quality assurance based conformity assessment. In this route, the manufacturer operates an approved production QMS, and the Notified Body audits the production QA system. This route is less common for startups because it is optimised for companies running established manufacturing lines with meaningful batch-level verification. For a startup with one or two products and small production volumes, Annex IX is typically the better fit.

Route 3 — Annex X type examination combined with Annex XI production verification. For some Class IIa devices, a type-examination based route combining Annex X and Annex XI is available. This is unusual at Class IIa and more typical at higher classes. It makes sense only in narrow manufacturing scenarios — for example, where the device is manufactured by multiple contract manufacturers from a certified "type."

For nearly every Class IIa startup we work with, Annex IX is the right choice. It aligns with the operating model, it produces a single integrated assessment, and it avoids the additional complexity of split type-and-production routes. The other routes exist for good reasons, but those reasons rarely apply to a resource-constrained startup shipping its first or second device.

The exact sub-paragraph of Article 52 that applies, and the exact combination of Annex chapters, should always be confirmed against the current consolidated text of Regulation (EU) 2017/745 before any conformity assessment plan is finalised. The annexes and the article are updated together, and drift between an old plan and the current text is a classic source of avoidable rework.

What the Notified Body actually checks

The conformity assessment language in the Annexes can sound abstract. In practice, a Class IIa assessment under Annex IX has a predictable shape.

QMS audit (on-site). The Notified Body visits your site and audits the Quality Management System against Article 10(9) and the harmonised QMS standard — EN ISO 13485:2016 + A11:2021. For a startup, this audit is typically focused: a small number of auditor days, a tightly scoped set of processes, and a heavy emphasis on whether the documented processes are actually the processes the company runs. The audit checks management responsibility, resource management, product realisation, measurement, analysis, and improvement. What it is really looking for is whether the QMS is real — whether the procedures match reality, whether records exist and are traceable, whether non-conformities are handled, whether CAPA is functioning.

Technical documentation review (off-site, usually). A qualified reviewer at the Notified Body goes through the technical documentation for at least one representative device per generic device group. The review covers the device description, the GSPR conformity matrix against Annex I, the design and manufacturing information, the risk management file, the verification and validation evidence, the clinical evaluation report under Article 61 and Annex XIV, the labelling and the IFU, and the post-market surveillance plan under Article 83. For Class IIa, the reviewer typically asks questions in writing, and the manufacturer answers in writing, in rounds, until the documentation is acceptable or the route is suspended.

Non-conformities and the round game. It is normal to receive non-conformities after the first audit and after the first technical documentation review. What matters is how you respond. A good Class IIa project plans for at least one round of major non-conformities and budgets time accordingly. A project that assumes zero non-conformities is either overconfident or over-documented to the point of waste.

Certificate issuance. If the QMS audit and the technical documentation assessment both pass, the Notified Body issues the certificates. The certificate is valid for a defined period, subject to surveillance audits during that period. A new product added within the same generic device group during the certificate period may or may not require a new technical documentation review, depending on the sampling logic and the nature of the change.

Timeline and cost reality

The honest timeline for a Class IIa project from QMS-ready state to certificate is typically in the order of nine to eighteen months, with wide variance driven by Notified Body capacity, scope match, and the quality of the documentation the manufacturer submits. The honest cost is in the range of high five-figure to low six-figure euros for Notified Body fees alone, before internal effort, consultants, and testing. These are rough orders of magnitude — every device and every company is different — but founders who budget on the assumption of "a few months and a few tens of thousands" are setting themselves up for a runway failure.

There is a Graz-based company we worked with on a breath sample analysis device that produced one of the fastest initial feedback loops we have seen on a Class IIa-style project. They were running out of money. They needed fast Notified Body feedback. They chose the right Notified Body — based on fit, scope match, and capacity — and submitted documentation that was good enough: not perfect, but complete and well-structured. Industry average for initial feedback is typically seven to ten months. Their feedback came back in two and a half months. Seventy-five percent faster than expected. The feedback was manageable, the fixes were straightforward, and the combination of the right NB and good-enough documentation produced a dramatically better outcome than the pursuit of documentation perfection with a mismatched NB would have. The lever that moved the needle was not documentation volume. It was Notified Body selection.

That is not a promise that every project can replicate that timeline. It is a data point showing what is possible when the two biggest Class IIa levers — NB selection and documentation quality (not volume) — are pulled at the same time.

Common Class IIa mistakes

Assuming Class IIa is "basically Class I plus a Notified Body." It is not. Class IIa brings a step change in QMS expectations, technical documentation depth, clinical evidence obligations, and ongoing surveillance burden. Treating Class IIa as a small upgrade from Class I is a budgeting error.

Inheriting Class I assumptions for software. Under Rule 11, most SaMD is Class IIa or higher. Founders who built software under MDD-era assumptions and carried those assumptions into an MDR plan often end up in a Class IIa project they did not budget for. Re-classify under MDR; do not inherit.

Choosing a Notified Body by brand or convenience. The NB decision is strategic. Capacity, scope, and communication speed vary enormously. Picking the wrong NB can cost a year. Picking the right one can save one. See the dedicated post on choosing the right Notified Body.

Over-scoping the technical documentation to "be safe." A Class IIa technical file that is twice as long as it needs to be is not twice as safe. It is twice as hard to review, twice as likely to contain internal contradictions, and twice as expensive to maintain through design changes. More documentation is not more quality.

Under-investing in the clinical evaluation. Class IIa clinical evaluation under Article 61 and Annex XIV is real work. Literature-based clinical evaluation is possible in many Class IIa cases, but it is not automatic, and the methodology has to be defensible. A weak clinical evaluation is the most common reason Class IIa projects stall at Notified Body review.

Forgetting that Annex IX sampling is per generic device group, not per product. Founders sometimes assume that adding a second device to the same certificate is free because "only one is reviewed." That is a misreading of the sampling logic. New products and significant changes can trigger additional review, and the rules on this are specific.

The Subtract to Ship angle on Class IIa

Class IIa is the class where Subtract to Ship earns its keep. At Class I, the framework mostly prevents over-engineering a project that was going to be light anyway. At Class III, the framework mostly prevents duplicate work on a project that is going to be heavy regardless. At Class IIa, the framework determines whether the project is survivable for a small team with finite runway.

The moves are specific. Classify once, correctly, with a written rule citation from Annex VIII. Pick the right Notified Body before picking the documentation strategy — the NB shapes the documentation, not the other way around. Scope the QMS to the actual operations of the actual company, not to the template a consultant happens to own. Use literature-based clinical evaluation where the evidence genuinely supports it, and use equivalence only where MDCG 2020-5 thresholds are actually met. Cut every document that does not trace to a specific GSPR, a specific Annex IX requirement, or a specific harmonised standard clause. Then ship the project that remains.

The test at the end is the same as at every other Subtract to Ship stage: can every remaining activity be defended by pointing to a specific MDR article, annex, or harmonised standard requirement? If yes, ship. If no, cut more.

Reality Check — Where do you stand on Class IIa?

  1. Have you classified your device under Annex VIII with a specific rule citation — not "probably Class IIa" but "Class IIa under Annex VIII, Rule X, paragraph Y, based on intended purpose [paragraph]"?
  2. Have you read MDCG 2021-24 (October 2021) for Annex VIII interpretation, and, if your device is software, MDCG 2019-11 Rev.1 (June 2025)?
  3. Have you selected a Notified Body whose scope covers your device, whose capacity matches your timeline, and whose communication speed matches your runway?
  4. Is your Quality Management System plan built against EN ISO 13485:2016 + A11:2021 and Article 10(9), sized for your actual team and operations rather than a generic template?
  5. Have you identified the conformity assessment route from Article 52 and the specific annex chapters of Annex IX (or Annex XI, if applicable) that will govern your project?
  6. Does your clinical evaluation plan under Article 61 and Annex XIV use the cheapest legitimate pathway that fits the evidence, rather than defaulting to new clinical investigations?
  7. Have you named a Person Responsible for Regulatory Compliance under Article 15, either in-house or via Article 15(2) arrangements?
  8. Have you budgeted for at least one round of major non-conformities after the initial audit and the initial technical documentation review?
  9. Can you defend every activity in your Class IIa plan by pointing to a specific article, annex, or harmonised standard clause?

Frequently Asked Questions

Do all Class IIa devices need a Notified Body under the MDR? Yes. Every Class IIa device requires Notified Body involvement in conformity assessment. The specific procedure depends on the route chosen under Article 52 of Regulation (EU) 2017/745, but there is no Class IIa self-certification route. Class I is the only class where standard devices can self-declare (with Is, Im, and Ir as Class I sub-categories that still require limited Notified Body involvement for specific aspects).

What is the difference between Annex IX and Annex XI for a Class IIa device? Annex IX combines a full Quality Management System audit with an assessment of the technical documentation for at least one representative device per generic device group. Annex XI is a production quality assurance based route where the Notified Body audits the production QA system. For most Class IIa startups, Annex IX is the better fit because it mirrors the startup operating model — one QMS, a small number of products, integrated assessment. Annex XI is more common for companies running established production lines where batch verification is meaningful.

How does the Notified Body sample technical documentation at Class IIa? Under Annex IX for Class IIa, the Notified Body assesses the technical documentation for at least one representative device per generic device group. It does not review every device's technical file individually at this class. The QMS, however, is audited in full. The sampling logic, the definition of "generic device group," and the consequences for new products added during the certificate period are specific and worth confirming directly with the Notified Body before a project plan is finalised.

Is most medical device software Class IIa under the MDR? A large share of SaMD ends up at Class IIa or higher under Rule 11 of Annex VIII. Software that provides information used for diagnostic or therapeutic decisions is Class IIa by default, with escalations to Class IIb or III depending on the severity of the decisions the software informs. Software that monitors physiological processes is Class IIa by default, with escalation to Class IIb for vital parameters where variations could result in immediate danger. MDCG 2019-11 Rev.1 (June 2025) is the authoritative guidance and should be read before classifying any software product.

How long does a Class IIa conformity assessment take? It varies widely. The honest order of magnitude is nine to eighteen months from QMS-ready state to certificate, driven primarily by Notified Body capacity, scope match, and the quality of the documentation submitted. Exceptional projects can move faster — we have seen initial Notified Body feedback in as little as two and a half months when the Notified Body fit and documentation quality were both strong. Slower projects can stretch to two years or more when the NB selection is wrong or the documentation needs multiple rebuild rounds. Plan for the middle of the range, not the best case.

What QMS standard applies to Class IIa devices? The harmonised standard that provides presumption of conformity with the MDR QMS obligations is EN ISO 13485:2016 + A11:2021 (Medical devices — Quality management systems — Requirements for regulatory purposes). Article 10(9) of the MDR is the statutory basis. Using EN ISO 13485:2016 + A11:2021 is not the only way to comply, but it is by far the most common and the most efficient for a startup.

What happens if a Notified Body disagrees with my Class IIa classification? The Notified Body can challenge the classification during conformity assessment and require reclassification. If the Notified Body concludes the device is actually Class IIb, for example, the manufacturer must re-scope the project to Class IIb requirements. This is a reason to classify correctly, document the reasoning with a specific rule citation, and, if the classification is disputed, be prepared to defend the decision with evidence tied to the actual text of Annex VIII and MDCG 2021-24.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10 (manufacturer obligations, including 10(9) on QMS), Article 52 (conformity assessment procedures), Annex VIII (classification rules, including Rule 6 on transient surgically invasive devices, Rule 9 on active therapeutic devices, and Rule 11 on software), Annex IX (conformity assessment based on a quality management system and on assessment of technical documentation), Annex XI (conformity assessment based on product conformity verification). Official Journal L 117, 5.5.2017.
  2. MDCG 2021-24 — Guidance on classification of medical devices, October 2021.
  3. MDCG 2019-11 Rev.1 — Guidance on Qualification and Classification of Software in Regulation (EU) 2017/745 — MDR and Regulation (EU) 2017/746 — IVDR, October 2019, Revision 1 June 2025.
  4. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.

This post is part of the Device Classification & Conformity Assessment series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. For most startups shipping their first or second device, Class IIa is where the real regulatory cost begins and where the difference between a survivable project and a runway-failure project is decided. The levers — Notified Body selection, QMS scope fit, clinical evidence pathway, documentation quality over volume — are the same levers a sparring partner who has done this across fifty-plus certifications watches first.