--- title: The Conformity Assessment Procedure for Class IIa Devices: Step-by-Step description: Class IIa conformity assessment under MDR involves a Notified Body. Here is the step-by-step procedure from QMS preparation to certificate issuance. authors: Tibor Zechmeister, Felix Lenhard category: Device Classification & Conformity primary_keyword: conformity assessment Class IIa step by step canonical_url: https://zechmeister-solutions.com/en/blog/conformity-assessment-class-iia-step-by-step source: zechmeister-solutions.com license: All rights reserved. Content may be cited with attribution and a link to the canonical URL. --- # The Conformity Assessment Procedure for Class IIa Devices: Step-by-Step *By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.* > **The conformity assessment procedure for a Class IIa device under Regulation (EU) 2017/745 runs through seven ordered steps on the Annex IX route: Notified Body selection, contract and scope definition, application package submission, Quality Management System audit under Annex IX Section 2, technical documentation assessment on a representative sample per generic device group, certificate issuance, and annual surveillance. Article 52 is the legal basis that restricts the available routes for Class IIa to Annex IX or, in specific scenarios, Annex XI. EN ISO 13485:2016+A11:2021 is the harmonised QMS standard that provides presumption of conformity with the Article 10(9) QMS obligations audited under Annex IX.** **By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.** --- ## TL;DR - Article 52 of Regulation (EU) 2017/745 sets out the conformity assessment procedures available for Class IIa. The primary route is Annex IX (quality management system plus technical documentation assessment). Annex XI (production quality assurance) is an alternative in specific scenarios. - The Annex IX procedure has seven ordered steps, each with a specific output the Notified Body can audit against. Running them out of order is the single most common reason Class IIa projects stall. - Under Annex IX for Class IIa, the technical documentation is assessed on a representative basis. At least one representative device per generic device group. While the QMS is audited in full. - EN ISO 13485:2016+A11:2021 is the harmonised standard that provides presumption of conformity with the Article 10(9) QMS obligations the Notified Body audits under Annex IX Section 2. - The Annex IX certificate is valid for up to five years, with annual surveillance audits that re-sample both the QMS and the technical documentation throughout the certificate cycle. - The two levers that decide whether a Class IIa project finishes on runway or stalls are Notified Body selection at Step 1 and documentation quality (not volume) at Step 3. --- ## Why a step-by-step walkthrough for Class IIa Class IIa is the class where Notified Body involvement begins in earnest. At Class I standard, the manufacturer self-declares and a competent authority may never ask. At Class IIa, a Notified Body audits the Quality Management System, reviews the technical documentation, issues a certificate, and comes back every year for surveillance. The cycle is predictable, the roles are defined, and the steps have a specific order. But the order is only obvious once you have walked through it. Founders approaching Class IIa for the first time tend to treat the Notified Body engagement as a single event rather than a sequence, and the result is work done in the wrong order against a moving target. This post walks through the Annex IX route step by step because Annex IX is where most Class IIa startups end up. The Annex XI alternative is covered briefly at the end. The order of the steps matches how a Notified Body actually runs a Class IIa assessment, not a theoretical ideal. Each step has an output, and each output is what the next step depends on. For the broader route decision across Annex IX, Annex X, and Annex XI, see [Choosing the Right Conformity Assessment Route for Your Startup's Device Class](/blog/choosing-conformity-assessment-route-startup). For the Class I counterpart to this checklist, see [The Conformity Assessment Procedure for Class I Devices: A Startup Checklist](/blog/conformity-assessment-class-i-checklist). For the conceptual overview of what Class IIa means, see [Class IIa Medical Devices Under MDR: Requirements and Conformity Routes](/blog/class-iia-medical-devices-under-mdr). ## Step 1. Notified Body selection The first real step of the Class IIa conformity assessment is choosing a Notified Body. This is not the paperwork step people sometimes assume it is. It is the step that determines the timeline, the cost, the technical dialogue quality, and the surveillance relationship for the next five years of the certificate cycle. Picking the wrong Notified Body can cost a startup a year of runway. Picking the right one can save one. Three criteria matter most at this step. Scope match. The Notified Body must be designated by the Commission for the specific device codes and horizontal technologies your device falls under. A body that is technically designated but has no practical experience with your device type is almost as bad as one that is not designated at all. Capacity. The question is not whether they can take you, it is when they can start and when they can finish. Bodies with twelve-month queues will give your project a twelve-month delay that no amount of good documentation can recover. Communication speed. The round game of Class IIa technical documentation review happens in writing, and the response latency on the Notified Body side is the biggest factor in how long the review takes. **Output of Step 1:** a Notified Body selected with a documented rationale covering scope match, designated device codes, capacity availability for your target start date, and references or evidence of their communication cadence on similar projects. For the detailed selection methodology, see [How to Choose the Right Notified Body](/blog/choose-right-notified-body). ## Step 2. Contract and scope definition Once the Notified Body is selected, the second step is the contract and scope definition. The contract names the conformity assessment procedure (Annex IX or Annex XI), the scope of the QMS to be audited, the generic device groups that the certificate will cover, the language of the assessment, the fee structure, the planned audit dates, and the surveillance cadence for the certificate cycle. This is the document that defines what the Notified Body will and will not do for the next five years. The scope statement deserves particular care. Under Annex IX for Class IIa, the technical documentation is assessed on a representative basis across each generic device group. How you define the generic device groups in the scope affects how future products are handled during the certificate period. Whether a new product is "inside the group" and covered by the existing sampling, or "outside the group" and requires its own assessment. Defining the groups too narrowly means every new product is a fresh assessment. Defining them too broadly means the Notified Body may insist on deeper per-device sampling to compensate. The right definition is specific to your pipeline and deserves a conversation with the Notified Body before the contract is signed. **Output of Step 2:** a signed contract with the Notified Body, a written scope statement listing the generic device groups, the audit calendar for the first certificate cycle, and a clear statement of which annex (IX or XI) and which chapters within that annex will govern the procedure. ## Step 3. Application package submission The third step is the submission of the application package. This is the stack of documents the Notified Body reviews before they set foot on site for the QMS audit. A strong application package saves the entire rest of the project. A weak one guarantees that the first round of findings will be a repeat of problems that could have been caught on paper. The application package for a Class IIa Annex IX procedure typically includes the QMS manual, the core QMS procedures (document control, design and development, purchasing, production and service, CAPA, internal audit, management review), the device description and intended purpose for each device the certificate will cover, the classification rationale citing the specific Annex VIII rule, the GSPR conformity matrix for the representative device the Notified Body will sample, the technical documentation per Annex II including the risk management file per EN ISO 14971:2019+A11:2021, the clinical evaluation report per Article 61 and Annex XIV, the post-market surveillance plan per Annex III, and the labelling and instructions for use per Annex I Chapter III. The package has to be complete. "Complete" here does not mean "voluminous." It means every section a reviewer is going to look for is present, addressed at Class IIa depth, and cross-referenced coherently. A 300-page technical file that is well-structured beats a 1,200-page technical file that buries the evidence in noise. The reviewer's time is finite; the quality of their questions is determined by how easy the file is to read. **Output of Step 3:** the complete application package submitted to the Notified Body, acknowledged as received and complete, with any initial completeness-check queries resolved before the on-site audit is scheduled. ## Step 4. QMS audit under Annex IX Section 2 The fourth step is the Quality Management System audit. Annex IX Section 2 of Regulation (EU) 2017/745 sets out the requirements for the quality management system assessment that the Notified Body conducts under the Annex IX procedure. The statutory QMS obligation the audit maps to is Article 10(9), and the harmonised standard that provides presumption of conformity with the MDR QMS requirements is EN ISO 13485:2016+A11:2021. The audit is on-site at the manufacturer's facilities. For a Class IIa startup, the audit is typically focused rather than sprawling. A small number of auditor days, a tightly scoped set of processes, and a heavy emphasis on whether the documented procedures are the procedures the company actually runs. The auditor checks management responsibility, resource management, product realisation, measurement and analysis, and improvement. Records are sampled. Procedures are walked. Interviews are held with the people who run the processes, not just the people who wrote them. The test the auditor applies is whether the QMS is real. Whether it would survive if the consultant who set it up disappeared tomorrow. Non-conformities at this step are normal, and the well-run project plans for them. Major non-conformities trigger a corrective action plan and a follow-up. Minor non-conformities are resolved in writing. A Class IIa project that expects zero non-conformities is either overconfident or over-documented to the point of waste. A project that plans for one round of majors and two rounds of minors lands on a realistic timeline. **Output of Step 4:** a QMS audit report from the Notified Body listing any non-conformities, the manufacturer's corrective action responses, and, once the non-conformities are closed, confirmation that the QMS meets the requirements of Annex IX Section 2. ## Step 5. Technical documentation assessment on a representative sample The fifth step runs in parallel with or immediately after the QMS audit. Under Annex IX for Class IIa, the technical documentation is assessed on a representative basis. At least one representative device per generic device group defined in the scope at Step 2. The Notified Body does not review every single technical file individually at Class IIa, but the sample it does review is examined in depth. The review is typically off-site, conducted by a qualified reviewer at the Notified Body. The reviewer goes through the device description, the GSPR conformity matrix against Annex I, the design and manufacturing information, the risk management file, the verification and validation evidence, the clinical evaluation report under Article 61 and Annex XIV, the labelling and the IFU, and the post-market surveillance plan under Article 83. Questions are issued in writing. The manufacturer answers in writing. The review proceeds in rounds until the documentation is acceptable or the route is suspended pending major rework. The round game is where documentation quality earns its cost savings. A well-structured file attracts precise, answerable questions. A weak file attracts broad, exploratory questions that multiply the rounds and inflate the bill. Every additional round is auditor time, and auditor time is billable. The startups that finish Class IIa on runway are the ones whose first-round file was good enough to make the reviewer's questions narrow from the start. **Output of Step 5:** a technical documentation assessment report from the Notified Body confirming that the representative device meets the requirements of Annex I and the other applicable provisions, with any non-conformities closed through written rounds of questions and responses. ## Step 6. Certificate issuance Once the QMS audit and the technical documentation assessment both pass, the Notified Body issues the certificates. The outcome of a successful Annex IX procedure for Class IIa is an EU quality management system certificate and an EU technical documentation assessment certificate. The certificates name the manufacturer, the Notified Body, the generic device groups covered, the applicable annex and chapters, and the validity period. The certificate is valid for up to five years, subject to the surveillance audits scheduled in the contract at Step 2. From the date of certificate issuance, the manufacturer can affix the CE marking with the Notified Body's four-digit identification number and place the device on the market in the European Union. The declaration of conformity under Article 19, drawn up in the format of Annex IV, is the manufacturer's own legal instrument referencing the Notified Body certificates. The certificates do not replace the declaration, they enable it. **Output of Step 6:** the EU QMS certificate and the EU technical documentation assessment certificate issued by the Notified Body, the EU declaration of conformity drawn up by the manufacturer referencing those certificates, and the CE marking affixed in accordance with the Regulation. ## Step 7. Annual surveillance The seventh step is the ongoing one. The Annex IX certificate is valid for up to five years, and the Notified Body conducts annual surveillance audits throughout that period. Each surveillance audit re-samples parts of the QMS and re-samples the technical documentation for the devices covered by the certificate. New products added to the scope during the certificate period may trigger additional technical documentation assessment, depending on whether the new product is inside the existing generic device group or outside it. Significant changes to existing products can also trigger a re-assessment. Surveillance is where the cost of a well-run Class IIa project compounds into savings. A QMS that was built to match real operations survives surveillance audits without needing to be rebuilt each cycle. A QMS that was bought as a template and never reconciled with real operations produces new non-conformities every surveillance. The Operations Pass of the Subtract to Ship framework is designed exactly for this. Build the QMS once, accurately, and let it run with minimal maintenance overhead. Unannounced audits are a separate obligation under Annex IX. The Notified Body can and does conduct unannounced visits to the manufacturer, or to critical suppliers, during the certificate cycle. The test is the same as for the initial audit: whether the documented QMS matches the QMS that is actually running on the day of the visit. **Output of Step 7:** annual surveillance audit reports, any non-conformities closed, and the certificate maintained in force until the end of the five-year cycle, at which point recertification begins. ## The Annex XI alternative Article 52 allows a Class IIa manufacturer to use the combination involving Annex XI (production quality assurance) instead of the full Annex IX route in specific scenarios. Annex XI covers a production-phase quality management system focused on production and final inspection, narrower in scope than the full Annex IX QMS audit. For a Class IIa startup with one product and in-house production, Annex XI rarely offers an advantage over Annex IX because the consolidated single-contract structure of Annex IX is cheaper and faster. For manufacturers with established production lines or contract manufacturing arrangements, Annex XI can fit better. The seven-step spine above still applies in structure. Notified Body selection, contract, application, audit, review, certificate, surveillance. But the audit focus and the technical documentation interaction differ from Annex IX. The route decision itself is covered in [Choosing the Right Conformity Assessment Route for Your Startup's Device Class](/blog/choosing-conformity-assessment-route-startup). ## The Subtract to Ship angle The Subtract to Ship methodology treats the Class IIa seven-step procedure as the full execution of the Classification Pass and the Operations Pass together. Every step traces to a specific article or annex. Nothing in the seven steps is optional. Nothing in the seven steps is ceremonial. The subtraction is not in the steps themselves. It is in what each step is filled with. Step 3 is where the subtraction earns the most. Founders under pressure default to volume: more procedures, more templates, more appendices, more pages. More documentation is not more quality. A Class IIa application package that is half the volume and twice the coherence of the industry default moves through Steps 4 and 5 faster, attracts narrower questions, and produces fewer billable rounds. The test is the same one the framework asks everywhere: does this page trace to a specific MDR obligation, a specific GSPR, or a specific Annex IX requirement? If yes, keep it. If no, cut it. The Notified Body is not paid to read decoration. For the full methodology, see [The Subtract to Ship Framework for MDR Compliance](/blog/subtract-to-ship-framework-mdr). ## Reality Check. Where do you stand on the Class IIa procedure? 1. Have you selected a Notified Body whose designated scope covers your device codes, whose capacity matches your timeline, and whose communication speed you have verified with references? 2. Is your contract scope statement written with a deliberate definition of the generic device groups that matches your product pipeline for the next five years? 3. Is your application package complete against every section of Annex II and Annex III, at a depth that matches Class IIa risk rather than Class III? 4. Does your QMS actually match the processes your company runs, so that the Annex IX Section 2 audit will confirm a real system rather than expose a template? 5. Can the representative device for each generic device group carry the weight of the technical documentation assessment on its own? 6. Have you budgeted time and money for at least one round of major non-conformities and two rounds of minor ones, rather than assuming a clean first pass? 7. Is your surveillance plan for the five-year certificate cycle documented, with ownership assigned and calendar commitments made? 8. Can you defend every page in your application package by tracing it to a specific MDR article, annex, GSPR, or harmonised standard clause? ## Frequently Asked Questions **What is the legal basis for Class IIa conformity assessment?** Article 52 of Regulation (EU) 2017/745 is the legal basis. For Class IIa, Article 52 allows conformity assessment under Annex IX (quality management system plus technical documentation assessment) or, in specific scenarios, under Annex XI (production quality assurance). Annex IX is the most common route for Class IIa startups because it consolidates the QMS audit and technical documentation review into a single integrated procedure with one Notified Body contract. **How is technical documentation sampled at Class IIa?** Under Annex IX for Class IIa, the Notified Body assesses the technical documentation for at least one representative device per generic device group defined in the certificate scope. The QMS is audited in full, but the technical files are sampled. How the generic device groups are defined in the contract at the start of the procedure affects how future products are handled during the five-year certificate period, which is why the scope statement deserves careful attention before signing. **How long does a Class IIa Annex IX procedure take?** The honest order of magnitude is nine to eighteen months from a QMS-ready starting state to certificate issuance, driven primarily by Notified Body capacity, scope match, and the quality of the application package. Exceptional projects can move faster when the Notified Body fit and documentation quality are both strong. Slower projects can stretch to two years or more when the Notified Body selection is wrong or the documentation needs multiple rebuild rounds. **What QMS standard is audited under Annex IX Section 2 for Class IIa?** The harmonised standard that provides presumption of conformity with the Article 10(9) QMS obligations is EN ISO 13485:2016+A11:2021. The Notified Body audits the manufacturer's QMS against the MDR requirements using EN ISO 13485:2016+A11:2021 as the reference standard. Compliance with the standard, where it applies, gives presumption of conformity with the matching MDR QMS provisions that Annex IX Section 2 audits. **What happens at annual surveillance?** The Notified Body conducts a surveillance audit every year during the certificate cycle. Each surveillance re-samples parts of the QMS and re-samples the technical documentation for the devices covered by the certificate. Non-conformities found at surveillance have to be closed. New products added to the scope during the period may trigger additional technical documentation assessment. Unannounced audits may also occur at any point during the certificate cycle. **Does the certificate cover future products automatically?** Only within the boundaries of the generic device groups defined in the certificate scope. A new product that falls inside an existing group may be covered by the existing sampling logic and may not require a fresh full assessment. Though the Notified Body may still sample it. A new product that falls outside the existing groups requires either an extension of the certificate scope or a new application. This is why the scope definition at Step 2 has long-term consequences. **Can a Class IIa manufacturer use Annex XI instead of Annex IX?** Yes, in specific scenarios. Article 52 allows Class IIa conformity assessment under the production quality assurance route based on Annex XI. For most Class IIa startups with one product and in-house production, Annex IX is the better fit because it consolidates the QMS audit and technical documentation review into a single contract. Annex XI is more common for manufacturers with established production lines or contract manufacturing arrangements where a narrower production-phase QMS audit fits the operational model. ## Related reading - [Class IIa Medical Devices Under MDR: Requirements and Conformity Routes](/blog/class-iia-medical-devices-under-mdr) – the conceptual overview of what Class IIa means and which rule families produce it. - [Choosing the Right Conformity Assessment Route for Your Startup's Device Class](/blog/choosing-conformity-assessment-route-startup) – the upstream route decision across Annex IX, Annex X, and Annex XI. - [The Conformity Assessment Procedure for Class I Devices: A Startup Checklist](/blog/conformity-assessment-class-i-checklist) – the self-declaration counterpart to this procedure. - [MDR Conformity Assessment Routes Explained](/blog/mdr-conformity-assessment-routes) – the introductory overview of the routes under Article 52. - [MDR Article 52: Choosing a Conformity Assessment Procedure](/blog/mdr-article-52-conformity-assessment-procedure) – the article-level deep dive into the legal basis. - [Annex IX: Full QMS Plus Technical Documentation Assessment](/blog/mdr-annex-ix-qms-technical-documentation-assessment) – the deep dive on Annex IX structure and audit cadence. - [The Conformity Assessment Procedure for Class IIb Devices: Step-by-Step](/blog/conformity-assessment-class-iib-step-by-step) – the next step up the class ladder. - [The Conformity Assessment Procedure for Class III Devices: Step-by-Step](/blog/conformity-assessment-class-iii-step-by-step) – the deepest version of the Annex IX procedure. - [How to Choose the Right Notified Body](/blog/choose-right-notified-body) – the Step 1 decision that moves the Class IIa timeline more than any other. - [Person Responsible for Regulatory Compliance Under MDR Article 15](/blog/prrc-mdr-article-15) – the PRRC requirement that sits alongside the Class IIa QMS. - [The Subtract to Ship Framework for MDR Compliance](/blog/subtract-to-ship-framework-mdr) – the methodology that determines what actually needs to be in the Class IIa application package. ## Sources 1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 52 (conformity assessment procedures), Annex IX (conformity assessment based on a quality management system and on assessment of technical documentation), Annex XI (conformity assessment based on product conformity verification). Official Journal L 117, 5.5.2017. 2. EN ISO 13485:2016+A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes. --- *This post is part of the Device Classification & Conformity Assessment series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The Class IIa Annex IX procedure is the point where Notified Body involvement, QMS certification, and technical documentation assessment all begin at the same time for most startups, and the order in which the seven steps are executed decides whether the project finishes on runway or stalls on the second audit round.* --- *This post is part of the [Device Classification & Conformity](https://zechmeister-solutions.com/en/blog/category/classification) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*