Under MDR Annex I Chapter III Section 23, every medical device must carry specific information on the label and in the instructions for use. The ten mistakes startups repeat. Missing mandatory Section 23.2 elements, marketing claims that exceed the technical documentation, wrong CE mark placement, undocumented symbols, missing Member State languages, malformed UDI, demo units that accidentally become "placed on the market", eIFU used without the Commission Implementing Regulation conditions met, incomplete warnings, and missing lot or serial traceability. Are all preventable if you treat the label as a regulated deliverable from day one, not a marketing asset at the end of the project.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR Annex I Chapter III Section 23 is the single legal anchor for every label and IFU claim. Every element on the label has to map to a subsection of 23.2 or 23.4.
  • Marketing claims that exceed what the technical documentation substantiates are the most common labeling nonconformity raised at audit. The website is the trap.
  • The CE mark must follow MDR Article 20 and Annex V: correct proportions, next to the four-digit notified body number for devices that require one, visible and legible on the device and its packaging.
  • Symbols are allowed if they come from a recognised standard. In practice EN ISO 15223-1:2021. And are explained where a user could reasonably miss their meaning.
  • Language coverage is set by each Member State. Demo and sample devices that carry a CE mark are treated as "placed on the market" under Article 2(28). The CE mark is not decoration.

Why labeling is the most underestimated part of the MDR

Founders treat the label as the last five percent of the project. The engineers finish the device, the regulatory lead finishes the technical file, and then. Often in the final weeks before submission. Someone opens a Word document and starts writing the IFU. That sequence is where most labeling nonconformities are born. The label is not the last five percent of the project. It is the surface where the regulation, the technical documentation, the clinical evaluation, the risk file, the intended purpose, and the marketing all meet. Every mistake below starts with treating the label as separate from the rest of the file.

The legal backbone is MDR Annex I Chapter III, which sets out the "information supplied with the device". Section 23.1 gives the general principles, Section 23.2 lists what must appear on the label, Section 23.3 governs information on the packaging that keeps the device in sterile condition, and Section 23.4 lists what must appear in the instructions for use. (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.) Article 10 makes the manufacturer legally responsible for the label; Article 20 governs the CE mark; Articles 27 to 29 govern the UDI. These are the clauses auditors open first.

Here are the ten mistakes Tibor sees most often in startup audits, each with the MDR reference it violates and the fix.

1. Missing mandatory Annex I Section 23.2 elements on the label

The regulation. Annex I Chapter III Section 23.2 lists the particulars that must appear on the label itself: the device name, the manufacturer's name and registered place of business, the details required to identify the device and its contents, where applicable the UDI carrier, an unambiguous indication of the expiry date, batch code or serial number, special storage and handling conditions, any warnings or precautions, the intended purpose where not obvious to the user, and the indication that the product is a medical device. (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.2.)

Why startups get it wrong. The label is designed by a graphic designer who has never read Annex I. The designer starts from the brand. Regulatory elements are added later, and items are missed. The indication that the product is a medical device (23.2(q)) is the most frequently forgotten element. It is new under MDR compared to MDD, and it is easy to overlook.

The fix. Build a Section 23.2 checklist before the label is designed. Every subsection gets a yes/no column and a location on the physical label. Nothing is designed until the checklist is green.

2. IFU claims exceed the technical documentation

The regulation. Annex I Section 23.1(a) requires that each device be accompanied by the information needed to identify the device and its manufacturer, and by any safety and performance information relevant to the user. Section 23.4 lists what the IFU must contain. And MDR Article 7 prohibits any claim. On the label, IFU, or advertising. That attributes functions or properties the device does not have or that creates a false impression. (Regulation (EU) 2017/745, Article 7 and Annex I, Chapter III, Section 23.)

Why it happens. Marketing drift. A company Tibor worked with had a solid technical file and a clean clinical evaluation. The auditor opened the website in a browser tab and read out loud. Several claims had been added by marketing over the months. Each one defensible in isolation, the cumulative result outside the certified scope. The nonconformity was raised against the website, not the device. The fix was to reduce the public claims to what the technical file supported, line by line. The underlying rule is simple: the label, the IFU, and the marketing must all be a strict subset of what the technical documentation substantiates, never a superset.

The fix. One named reviewer signs off on every public claim. IFU, label, website, pitch deck, demo video. Against the intended purpose and the clinical evaluation. See Misleading Claims Under MDR for the four-check process.

3. CE mark placed incorrectly or with the wrong notified body number

The regulation. MDR Article 20 requires that devices considered to be in conformity carry the CE marking of conformity set out in Annex V of Regulation (EC) No 765/2008. The CE marking must be affixed visibly, legibly, and indelibly to the device or its sterile packaging; where this is not possible because of the nature of the device, it must be affixed to the packaging. It must also appear on the instructions for use and on the sales packaging. Where a notified body is involved in the conformity assessment, the CE marking is followed by the four-digit identification number of that notified body. (Regulation (EU) 2017/745, Article 20.)

Why it happens. Class I self-certified devices sometimes appear with a four-digit number next to the CE mark. Which is wrong, because no notified body was involved. Conversely, Class IIa devices sometimes ship without the notified body number. Proportions are another recurring trap: the "CE" glyph has specific geometry set out in Annex II of Regulation (EC) No 765/2008 and cannot be compressed horizontally to fit a brand layout.

The fix. Decide the conformity assessment route first, then draw the CE block: correct geometry, correct notified body number (or no number for self-certified Class I), correct size (minimum 5 mm unless the device is too small). Place it on the device, on the sterile packaging, in the IFU, and on the sales packaging.

4. Symbols used without ISO 15223-1 reference, or with the wrong meaning

The regulation. Annex I Section 23.1(h) allows the information to be provided by means of internationally recognised symbols, and requires any symbol or identification colour used to conform to the harmonised standards or common specifications; where no harmonised standard or common specification exists, the symbols and colours must be described in the documentation supplied with the device. (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.1(h).) In practice the recognised standard for labeling symbols is EN ISO 15223-1:2021, "Medical devices. Symbols to be used with information to be supplied by the manufacturer".

Why it happens. Graphic designers copy symbols from a competitor's packaging, from a clip-art library, or from an outdated version of ISO 15223-1. The symbol shape looks right but the meaning has drifted. Or a company invents a symbol. A stylised heart, a custom exclamation mark. Without describing it in the accompanying documentation.

The fix. Use only symbols from the current edition of EN ISO 15223-1:2021, cite the standard in the IFU, and include a legend that explains each symbol used. Any non-ISO symbol must be described in writing in the IFU.

5. Language coverage missing for the target Member States

The regulation. MDR Article 10(11) requires that the information to be supplied with the device, including labels and instructions for use, be provided in one or more official Union languages determined by the Member State in which the device is made available to the user or patient. (Regulation (EU) 2017/745, Article 10(11).) Each Member State sets its own language requirement, and most require the national language for devices supplied to lay users.

Why it happens. Startups assume English is enough. For professional devices in some countries it may be; for lay users in almost all countries it is not. German Member States require German, France requires French, Italy requires Italian. Shipping an English-only IFU into a market that requires the national language is an automatic nonconformity.

The fix. Before market entry, map the target Member States to their language requirements for your device's user group (professional vs. lay). Commission the translations from a medical-device-qualified translator, not a generic service. Version-control the translated IFUs alongside the English master.

6. UDI not printed correctly or missing components

The regulation. MDR Articles 27, 28, and 29 establish the Unique Device Identification system. Article 27 requires a UDI composed of a UDI-DI (device identifier) and a UDI-PI (production identifier) assigned by an issuing entity designated by the Commission. The UDI carrier must be placed on the label of the device and on all higher levels of packaging. (Regulation (EU) 2017/745, Articles 27, 28, 29.) Annex VI Part C sets out the technical specifications for the UDI system.

Why it happens. Startups often print only the UDI-DI and forget the UDI-PI (lot, serial, manufacturing date, or expiry depending on device), or print a human-readable interpretation that does not match the machine-readable barcode, or use an issuing entity that is not on the Commission's designated list.

The fix. Pick one of the Commission-designated issuing entities (GS1, HIBCC, ICCBBA, IFA). Follow their UDI rules exactly. Print both the machine-readable carrier and the human-readable interpretation, and verify they match. Escalate UDI carriers up through the packaging hierarchy.

7. Demo or sample devices labeled as market-ready. The placing-on-the-market trap

The regulation. MDR Article 2(28) defines "placing on the market" as the first making available of a device, other than an investigational device, on the Union market. Article 5(1) prohibits placing on the market or putting into service any device that does not comply with the regulation. A CE-marked device in the hands of a potential user, even as a "demo", can meet the definition of "making available" and therefore "placing on the market". (Regulation (EU) 2017/745, Articles 2(28) and 5.)

Why it happens. A company Tibor worked with shipped prototype devices to potential customers labeled with a CE mark. Because the labeling templates had already been designed and it was easier to print them than to create a separate "not for sale" version. Legally, those devices had been placed on the market. The conformity assessment had not been completed. That is an Article 5 violation, and it is the kind of mistake that is very hard to unwind after the fact.

The fix. Prototype, demo, and sample devices must be labeled unambiguously: no CE mark, clearly marked "not for clinical use / for demonstration only" in the local language, and tracked by serial number so every unit can be recalled. Only devices that have completed conformity assessment carry the CE mark.

8. eIFU used without the Commission Implementing Regulation conditions met

The regulation. Commission Implementing Regulation (EU) 2021/2226 sets out the rules for electronic instructions for use of medical devices. It restricts eIFU to specific device categories and specific user groups (generally, devices for professional users), and imposes conditions on availability, format, and backup. Including making a paper IFU available on request within a defined timeframe. (Commission Implementing Regulation (EU) 2021/2226, as amended by Commission Implementing Regulation (EU) 2025/1234.) Manufacturers must also carry out a documented risk assessment before switching to eIFU.

Why it happens. Startups love eIFU because it removes printing cost and logistics complexity. They implement a PDF download link and consider it done. The implementing regulation requires much more: eligibility assessment, user risk assessment, paper-on-request mechanism, a stable URL, version control, accessibility standards, and specific label elements pointing to the electronic version.

The fix. Before choosing eIFU, verify your device category and user group are eligible under Regulation (EU) 2021/2226. Document the risk assessment. Build the paper-on-request workflow. Put the required information on the label. If any of these are missing, ship paper IFUs until they are in place.

9. Warnings and precautions incomplete relative to the risk management file

The regulation. Annex I Section 23.4 requires the IFU to contain, among other things, the residual risks, contraindications, warnings and precautions, and any undesirable side-effects. These elements must be consistent with the risk management file compiled under Annex I Section 3, which is informed by the standard referenced for risk management (EN ISO 14971:2019). (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.4.)

Why it happens. The IFU is written by a technical writer who has not read the risk management file. Warnings from the risk analysis. Specific patient populations, environmental conditions, interaction with other devices, residual risks that require user mitigation. Never make it onto the label. The audit finds a mismatch: risks identified in the file but not communicated to the user.

The fix. Derive the warnings and precautions section of the IFU directly from the risk management file. Every residual risk that requires user action must appear as a warning. The traceability must be documented: risk file row X → IFU warning Y.

10. Lot, serial, or batch traceability missing from the label

The regulation. Annex I Section 23.2(f) requires, where appropriate, an indication of the batch code, preceded by the word "LOT", or of the serial number. For devices with an expiry date, Section 23.2(g) requires an unambiguous indication of the date until which the device may be used safely, expressed at least as the year and month. (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.2(f)-(g).) These elements also feed the UDI-PI under Article 27.

Why it happens. Early production runs often skip serialisation because the volume is low and "we know which batch is which". When the device moves into commercial production, the labels are still printed without lot or serial numbers. A vigilance event then becomes impossible to scope. You cannot recall a specific batch if you cannot identify it on the device.

The fix. Design the label for lot or serial traceability from the first production unit, not the first commercial unit. Every device carries a lot or serial number in both human-readable and machine-readable form. The number is linked to the device history record in the QMS so a vigilance event can be scoped in minutes, not weeks.

The Subtract to Ship angle. The label is a regulated deliverable, not a marketing asset

The founder instinct on labels is to design them last, pretty them up, and treat regulation as a constraint to minimise. The Subtract to Ship move is the opposite: treat the label as one of the earliest regulated deliverables and derive everything on it. Claims, symbols, warnings, CE block, UDI, language versions. From a structured source. The sources are the intended purpose, the technical documentation, the clinical evaluation, the risk management file, and the applicable standards. Every element on the label has a named source and a named owner.

When the label is derived from the file instead of invented independently of it, eight of the ten mistakes in this post disappear by construction. The remaining two. Demo devices and eIFU conditions. Are caught by a single rule: the CE mark is legally significant, not decorative, and every device that carries one has to be backed by a completed conformity assessment and a compliant IFU mechanism.

This is the same move as the Subtract to Ship approach to the technical documentation itself. Structure beats volume. A three-person company with a labeling checklist tied to Annex I Section 23 and a single reviewer signing off public claims routinely passes audits that thirty-person companies fail.

Reality Check. Where do you stand?

  1. Do you have a Section 23.2 and Section 23.4 checklist that maps every mandatory element to a location on your physical label and a section of your IFU?
  2. Can you trace every claim on your label and IFU to a specific section of the technical documentation and the clinical evaluation?
  3. Is your CE mark block drawn to the geometry required by Regulation (EC) No 765/2008, with the correct notified body number (or no number) for your conformity assessment route?
  4. Are all symbols on your label taken from EN ISO 15223-1:2021, cited in the IFU, and explained in a legend?
  5. Have you mapped every target Member State to its language requirements for your user group and commissioned qualified medical translations?
  6. Does every device carry a correctly formed UDI with both UDI-DI and UDI-PI, from a Commission-designated issuing entity, in both machine-readable and human-readable form?
  7. Are your demo, sample, and prototype devices labeled without a CE mark and tracked unit-by-unit so they cannot drift into "placed on the market" territory?
  8. If you use eIFU, have you documented eligibility under Regulation (EU) 2021/2226, the user risk assessment, the paper-on-request mechanism, and the stable URL?
  9. Does every residual risk in your risk management file that requires user action appear as a warning in the IFU?
  10. Can you recall a single lot of your device in under one hour using only the label and your QMS records?

Frequently Asked Questions

Where does MDR actually list what has to be on a medical device label? Annex I Chapter III Section 23 is the legal source. Section 23.2 lists the label elements, Section 23.3 covers sterile packaging, and Section 23.4 lists the instructions for use contents. (Regulation (EU) 2017/745, Annex I, Chapter III, Section 23.)

Can a startup use English-only IFUs across the EU? No. MDR Article 10(11) leaves language to the Member States, and most require the national language for devices supplied to lay users. Professional-use devices in some countries may accept English. Map every target country before you ship.

What happens if my CE mark has the wrong notified body number on a Class IIa device? It is a nonconformity and the device is considered non-compliant until the label is corrected. If the device has already been placed on the market with the wrong label, a field corrective action may be required. Competent authorities can also take enforcement action under MDR Articles 93 to 95.

Is a "demo" device with a CE mark considered placed on the market? Generally yes. MDR Article 2(28) defines placing on the market as the first making available on the Union market. Handing a CE-marked device to a potential customer is making it available. Demo units should be labeled without a CE mark and clearly marked as non-clinical demonstration units.

Can I use any symbol library for my label? Only symbols from a recognised standard. In practice EN ISO 15223-1:2021. Are covered by Annex I Section 23.1(h) without further explanation. Any symbol not from a recognised standard must be described in writing in the IFU.

Do I need to print both a UDI-DI and a UDI-PI? Yes for devices that have a production identifier requirement. Articles 27 to 29 and Annex VI Part C define the composition of the UDI. The DI identifies the device model; the PI identifies the specific production instance (lot, serial, expiry). Both must appear on the label in both machine-readable and human-readable form, subject to the technical rules of the chosen issuing entity.

Can I ship an electronic IFU instead of paper? Only if your device and user group are eligible under Commission Implementing Regulation (EU) 2021/2226, you have completed the required risk assessment, you provide paper on request within the required timeframe, and you meet the labeling and accessibility conditions. If any condition is not met, paper is required.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Articles 7, 10, 20, 27, 28, 29, Annex I Chapter III Section 23, Annex VI Part C. Official Journal L 117, 5.5.2017.
  2. Regulation (EC) No 765/2008 of the European Parliament and of the Council setting out the requirements for accreditation and market surveillance relating to the marketing of products, Annex II (CE marking geometry). Official Journal L 218, 13.8.2008.
  3. Commission Implementing Regulation (EU) 2021/2226 of 14 December 2021 laying down rules for the application of Regulation (EU) 2017/745 as regards electronic instructions for use of medical devices, as amended by Commission Implementing Regulation (EU) 2025/1234.
  4. EN ISO 15223-1:2021, "Medical devices. Symbols to be used with medical device labels, labeling and information to be supplied. Part 1: General requirements".
  5. EN ISO 14971:2019, "Medical devices. Application of risk management to medical devices".

This post is part of the Technical Documentation & Labeling series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The label is where the whole file becomes visible to the user and the auditor at the same time. Get it wrong and no amount of clean technical documentation behind it will save you; get it right and the label becomes proof that the rest of the file is in order.