The conformity assessment procedure for a Class IIb device under Regulation (EU) 2017/745 follows the same seven-step spine as Class IIa on the Annex IX route — Notified Body selection, contract and scope, application package, QMS audit, technical documentation assessment, certificate issuance, annual surveillance — but every step carries more weight. The defining difference is that the technical documentation is assessed per device rather than sampled across a generic device group. Article 52 is the legal basis, Annex IX is the dominant route, and Annex X combined with Annex XI is the alternative for manufacturers whose operations fit a type-examination-plus-verification model. EN ISO 13485:2016+A11:2021 is the harmonised standard that provides presumption of conformity with the Article 10(9) QMS obligations audited under Annex IX Section 2.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Article 52 of Regulation (EU) 2017/745 sets out the conformity assessment procedures available for Class IIb. The primary route is Annex IX. The alternative is the combination of Annex X (type examination) and Annex XI (production conformity verification).
  • The Annex IX procedure for Class IIb uses the same seven ordered steps as Class IIa, but the technical documentation assessment is per device, not sampled across a generic device group.
  • The QMS audit under Annex IX Section 2 is full-scope at both Class IIa and Class IIb, but the depth of reviewer attention on design control, risk management, clinical evaluation, and post-market surveillance rises at Class IIb.
  • EN ISO 13485:2016+A11:2021 is the harmonised standard that provides presumption of conformity with the Article 10(9) QMS obligations the Notified Body audits under Annex IX Section 2.
  • Class IIb certificates are valid for up to five years, with annual surveillance audits and the possibility of unannounced visits throughout the certificate cycle.
  • The two founder mistakes that sink Class IIb projects are underestimating the per-device review effort and underestimating the clinical evidence bar.

Why Class IIb deserves its own walkthrough

Class IIa and Class IIb look similar on paper — both need a Notified Body, both use Annex IX by default, both end with a CE-marked product and an annual surveillance cycle. The shape of the procedure is the same. The weight inside the shape is not. At Class IIa, the Notified Body samples the technical documentation across a generic device group. At Class IIb, the Notified Body assesses the technical documentation for every device in scope. That single structural change reshapes every later step: the application package is bigger, the review rounds are more, the clinical evidence bar is higher, and the surveillance cycle re-samples more surface area each year.

This post walks through what to expect at each step of the Class IIb Annex IX procedure, with emphasis on the places where Class IIb differs from Class IIa. The step numbering matches the Class IIa walkthrough in The Conformity Assessment Procedure for Class IIa Devices: Step-by-Step, so the two posts can be read side by side. The conceptual overview of what Class IIb means is in Class IIb Medical Devices Under MDR: The Regulatory Burden Explained. For the upstream route decision across Annex IX, Annex X, and Annex XI, see Choosing the Right Conformity Assessment Route for Your Startup's Device Class.

Step 1 — Notified Body selection

Notified Body selection is the single highest-leverage decision in a Class IIb project, and the leverage is larger than at Class IIa. The reason is capacity. Notified Bodies designated for Class IIb scopes are fewer than those designated for Class IIa alone, the queues are longer, and the per-project time demand from the reviewer side is larger. A Notified Body that can take a Class IIa project on a nine-month runway may take eighteen months for a Class IIb project with the same team.

Three criteria apply, the same as at Class IIa, but the weighting shifts. Scope match comes first — the Notified Body must be designated by the Commission for the specific device codes and horizontal technologies that apply to your Class IIb device. A body designated for your codes in theory but without recent Class IIb experience in your technology family will cost you the entire round game in translation time. Capacity comes second — the question is not whether they can take you, it is when they can start and when they can finish, and Class IIb queues are longer than Class IIa queues at almost every Notified Body in the market. Communication speed comes third — the per-device review at Class IIb multiplies the number of written rounds, and reviewer response latency compounds across every file.

Output of Step 1: a Notified Body selected with a documented rationale covering scope match for your Class IIb device codes, designated technical experience in your technology family, capacity availability for your target start date, and references or evidence of their communication cadence on similar Class IIb projects. For the detailed selection methodology, see How to Choose the Right Notified Body.

Step 2 — Contract and scope definition, with Class IIb documentation depth

The contract and scope step carries more weight at Class IIb than at Class IIa because the scope definition directly determines how much per-device review work the Notified Body will perform. The contract names the conformity assessment procedure (Annex IX, or Annex X + Annex XI), the scope of the QMS to be audited, the specific devices that will be covered by the certificate, the language of the assessment, the fee structure, the planned audit dates, and the surveillance cadence for the five-year certificate cycle.

The Class IIb wrinkle is that, under Annex IX, the technical documentation is assessed per device rather than across a generic device group. The concept of the generic device group still exists in the contract — it governs how related devices are organised — but the review effort scales with the number of devices, not with the number of groups. Founders who plan a Class IIb certificate intended to cover multiple devices in the same pipeline should budget review time and fees per device, then confirm this with the Notified Body before signing.

The documentation depth expected at Class IIb is higher than at Class IIa across every section of the technical file. The GSPR conformity matrix against Annex I must be more tightly argued. The risk management file must show a closer coupling to the clinical evaluation and to the post-market surveillance plan. The clinical evaluation report itself must address the Class IIb evidence bar explicitly — literature-based evaluation is still possible in many cases, but the reviewer will test the methodology harder. Section 2 of the Annex IX procedure still governs the QMS audit, but the reviewer at Class IIb is looking for design control, risk management, and PMS processes that can carry the weight of the higher-risk product.

Output of Step 2: a signed contract with the Notified Body, a written scope statement listing the devices the certificate will cover, the audit calendar for the first certificate cycle, and a clear statement of which annex (IX, or X + XI) and which chapters within that annex will govern the procedure.

Step 3 — Application package submission

The application package at Class IIb is a heavier version of the Class IIa package, and the heaviness is in depth rather than volume. A 400-page Class IIb technical file that is well-structured beats a 1,500-page Class IIb technical file that buries the evidence in noise. The reviewer's time is finite; the quality of their questions is determined by how easy the file is to read, and at Class IIb the cost of a difficult file multiplies with every device in scope.

The Class IIb application package typically includes the QMS manual, the core QMS procedures (document control, design and development, purchasing, production and service, CAPA, internal audit, management review), the device description and intended purpose for each device the certificate will cover, the classification rationale citing the specific Annex VIII rule and any Rule 8 escalations considered, the GSPR conformity matrix for every device, the technical documentation per Annex II including the risk management file, the clinical evaluation report per Article 61 and Annex XIV at Class IIb depth, the post-market surveillance plan per Annex III, the post-market clinical follow-up plan where applicable, the labelling and instructions for use per Annex I Chapter III, and — for implantable Class IIb devices — the implant card and patient information required under Article 18.

The package has to be complete for every device, not for a representative device. This is the structural change from Class IIa that determines the whole shape of the project. Teams that build one strong technical file and then try to stretch it across three devices will fail the completeness check before the on-site audit is even scheduled.

Output of Step 3: the complete application package submitted to the Notified Body, acknowledged as received and complete for every device in scope, with any initial completeness-check queries resolved before the on-site audit is scheduled.

Step 4 — QMS audit and surveillance scrutiny

The fourth step is the Quality Management System audit. Annex IX Section 2 of Regulation (EU) 2017/745 sets out the requirements for the QMS assessment under the Annex IX procedure. The statutory QMS obligation the audit maps to is Article 10(9), and the harmonised standard that provides presumption of conformity with the MDR QMS requirements is EN ISO 13485:2016+A11:2021.

At Class IIb, the QMS audit is still on-site and full-scope, but reviewer attention concentrates on the processes that carry the higher-risk product. Design and development receives more scrutiny — the reviewer wants to see design inputs traced to risk controls, design outputs traced to verification and validation, and design changes traced to re-evaluation of risk and clinical evidence. Risk management is examined in more depth, including how the risk management file couples to the clinical evaluation and to the post-market surveillance plan. Post-market surveillance and vigilance processes are examined more closely because the feedback loops matter more for Class IIb devices.

The test the auditor applies is the same as at Class IIa: whether the documented QMS is the QMS that actually runs. The difference is that the auditor is more experienced with Class IIb products, the audit day budget is larger, and the tolerance for a template QMS that does not match real operations is lower. Non-conformities are normal at Class IIb and should be planned for — more than at Class IIa, not fewer — because the surface area under review is larger.

Surveillance scrutiny at Class IIb is heavier than at Class IIa. The Notified Body conducts annual surveillance audits throughout the five-year certificate cycle, and each surveillance re-samples both QMS processes and technical documentation. Unannounced audits under Annex IX can and do happen at Class IIb manufacturers and at their critical suppliers, and the test at an unannounced audit is whether the documented QMS matches the QMS running on the day of the visit.

Output of Step 4: a QMS audit report from the Notified Body listing any non-conformities, the manufacturer's corrective action responses, and, once the non-conformities are closed, confirmation that the QMS meets the requirements of Annex IX Section 2.

Step 5 — Technical documentation review per device

The fifth step runs in parallel with or immediately after the QMS audit. This is the step where Class IIb differs most from Class IIa. Under Annex IX for Class IIb, the Notified Body assesses the technical documentation for every device in the scope of the certificate. There is no sampling across a generic device group. Every device goes through the same review structure.

The review is typically off-site, conducted by a qualified reviewer at the Notified Body for each device. The reviewer goes through the device description, the GSPR conformity matrix against Annex I, the design and manufacturing information, the risk management file, the verification and validation evidence, the clinical evaluation report under Article 61 and Annex XIV, the labelling and the IFU, and the post-market surveillance plan under Article 83. Questions are issued in writing per device, answers are returned in writing per device, and the review proceeds in rounds until each device file is acceptable.

The round game at Class IIb is where documentation quality earns or loses the project. A well-structured file attracts precise, answerable questions. A weak file attracts broad, exploratory questions that multiply the rounds and inflate the bill — and at Class IIb, every round is multiplied by the number of devices under review. Teams that save at Step 3 by submitting weak files pay at Step 5 in reviewer hours and calendar months.

For implantable Class IIb devices, the clinical evaluation consultation procedure may apply for specific categories of devices. The rules are set out in the Regulation and must be checked against the current consolidated text for the specific device category at hand. The consultation procedure adds an external clinical expert review layer to the technical documentation assessment and extends the timeline accordingly.

Output of Step 5: a technical documentation assessment report from the Notified Body confirming that each device in scope meets the requirements of Annex I and the other applicable provisions, with any non-conformities closed through written rounds of questions and responses.

Step 6 — Certificate issuance

Once the QMS audit and the per-device technical documentation assessment both pass, the Notified Body issues the certificates. The outcome of a successful Annex IX procedure for Class IIb is an EU quality management system certificate and EU technical documentation assessment certificates covering the devices in scope. The certificates name the manufacturer, the Notified Body, the devices covered, the applicable annex and chapters, and the validity period. Certificates are valid for up to five years, subject to the surveillance audits scheduled in the contract at Step 2.

From the date of certificate issuance, the manufacturer can affix the CE marking with the Notified Body's four-digit identification number and place each covered device on the market in the European Union. The declaration of conformity under Article 19, drawn up in the format of Annex IV, is the manufacturer's own legal instrument referencing the Notified Body certificates. For implantable Class IIb devices, the implant card requirements under Article 18 apply from the moment the device reaches the patient.

Output of Step 6: the EU QMS certificate and the EU technical documentation assessment certificates issued by the Notified Body, the EU declaration of conformity drawn up by the manufacturer referencing those certificates, and the CE marking affixed in accordance with the Regulation.

Common mistakes at Class IIb

The recurring failure modes on Class IIb projects have a specific shape. Budgeting as if it were Class IIa — expecting a Class IIa-sized Notified Body invoice and a Class IIa-sized timeline, then running out of runway when the per-device review multiplies the effort. Submitting one strong technical file and stretching it across multiple devices — the Notified Body will reject the completeness check before the on-site audit. Under-scoping the clinical evaluation — a literature-based evaluation that would have survived at Class IIa will often fail at Class IIb, and fixing it mid-project is much more expensive than building it properly up-front. Treating the risk management file as a standalone deliverable rather than coupling it tightly to the clinical evaluation and the post-market surveillance plan — reviewers at Class IIb read these together and will find the gaps. Picking a Notified Body on fee alone without checking capacity and scope fit — a cheaper body with a twelve-month queue costs the runway that a more expensive body with a shorter queue would have saved.

None of these mistakes are mysterious. They are all predictable, and they all get fixed by running the Classification Pass and the Operations Pass properly before Step 1 of the procedure begins.

The Subtract to Ship angle

At Class IIb, Subtract to Ship stops being a productivity framework and starts being a survival framework. The per-device review at Step 5 multiplies every inefficiency in the technical file by the number of devices in scope. A fifty-page section that could have been thirty pages costs the startup the same twenty pages of reviewer time for every device — and Class IIb reviewer time is billable by the hour.

The subtraction discipline at Class IIb is specific. Cut every document that does not trace to a specific GSPR, an Annex IX requirement, a harmonised standard clause, or a clinical evaluation obligation under Article 61 and Annex XIV. Cut every speculative risk analysis of hazards that cannot occur on the device as designed. Cut every redundant verification chain that duplicates another chain already in the file. Cut every project management artifact that exists to make the project look organised rather than to make the device safe. What remains is the real Class IIb technical file — shorter than what most consultants will recommend, more defensible than what most templates produce, and cheap enough to ship. For the full methodology, see The Subtract to Ship Framework for MDR Compliance.

Reality Check — Where do you stand on the Class IIb procedure?

  1. Have you selected a Notified Body whose designated scope covers your Class IIb device codes, whose capacity matches your timeline, and whose recent experience in your technology family you have verified?
  2. Does your contract scope statement list every device the certificate will cover, with the per-device review effort budgeted in fees and calendar time?
  3. Is every device in scope supported by its own complete technical documentation package at Class IIb depth, not a single file stretched across multiple devices?
  4. Does your QMS actually match the processes your company runs, so that the Annex IX Section 2 audit will confirm a real system rather than expose a template?
  5. Is your clinical evaluation under Article 61 and Annex XIV built to the Class IIb bar, with literature, equivalence, or investigation pathways chosen deliberately rather than inherited from a Class IIa plan?
  6. Is your risk management file coupled tightly to the clinical evaluation and to the post-market surveillance plan, so that reviewers reading the three together see a coherent story?
  7. Have you budgeted time and money for more non-conformity rounds than you would at Class IIa, rather than assuming a clean first pass?
  8. Is your surveillance plan for the five-year certificate cycle documented, with ownership assigned and unannounced-audit readiness treated as an operational requirement rather than a paperwork exercise?
  9. Can you defend every page in your application package by tracing it to a specific MDR article, annex, GSPR, or harmonised standard clause — for every device in scope?

Frequently Asked Questions

What is the legal basis for Class IIb conformity assessment? Article 52 of Regulation (EU) 2017/745 is the legal basis. For Class IIb, Article 52 allows conformity assessment under Annex IX (quality management system plus technical documentation assessment) or under a combination of Annex X (type examination) and Annex XI (production conformity verification). Annex IX is the most common route for Class IIb startups because it consolidates the QMS audit and the technical documentation review into a single integrated procedure with one Notified Body contract.

How is technical documentation assessed at Class IIb? Under Annex IX for Class IIb, the Notified Body assesses the technical documentation for every device in the scope of the certificate. There is no sampling across a generic device group. The QMS is audited in full, and each device file is reviewed in full through written rounds of questions and answers until the reviewer is satisfied that the device meets the requirements of Annex I and the other applicable provisions.

How long does a Class IIb Annex IX procedure take? The honest order of magnitude is twelve to twenty-four months from a QMS-ready state to certificate issuance, driven by Notified Body capacity, scope match, the quality of the clinical evidence, and the depth of the technical documentation. Exceptional projects move faster when the Notified Body fit and documentation quality are both strong. Projects with weak clinical evidence, poor Notified Body fit, or documentation that has to be rebuilt mid-project can stretch beyond two years.

What QMS standard is audited under Annex IX Section 2 for Class IIb? The harmonised standard that provides presumption of conformity with the Article 10(9) QMS obligations is EN ISO 13485:2016+A11:2021. The Notified Body audits the manufacturer's QMS against the MDR requirements using EN ISO 13485:2016+A11:2021 as the reference standard. Compliance with the standard, where it applies, gives presumption of conformity with the matching MDR QMS provisions that Annex IX Section 2 audits.

What happens at surveillance for Class IIb? The Notified Body conducts annual surveillance audits throughout the five-year certificate cycle. Each surveillance re-samples parts of the QMS and re-samples the technical documentation for the devices covered by the certificate. Unannounced audits under Annex IX can occur at any point during the certificate cycle, at the manufacturer or at critical suppliers. Non-conformities at surveillance have to be closed, and significant changes to devices covered by the certificate can trigger additional review.

Can a Class IIb manufacturer use Annex X combined with Annex XI instead of Annex IX? Yes. Article 52 allows a Class IIb manufacturer to combine Annex X type examination with Annex XI production conformity verification as an alternative to the Annex IX route. For most Class IIb startups with one or two products and in-house production, Annex IX is the better fit because it consolidates the QMS audit and the technical documentation review into a single contract. The Annex X + Annex XI combination is more common for manufacturers with stable designs and established production lines where a type-examination-plus-verification structure fits the operational model better than a full QMS-plus-technical-documentation integrated assessment.

Does the Class IIb certificate cover future products automatically? No. Each device covered by a Class IIb certificate is assessed individually under Annex IX, and a new product added to the pipeline after the certificate is issued requires either an extension of the certificate scope — with the corresponding per-device technical documentation assessment — or a new application. This is a structural difference from Class IIa, where the generic device group sampling logic can cover related products under the existing certificate in some cases.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 52 (conformity assessment procedures), Annex IX (conformity assessment based on a quality management system and on assessment of technical documentation), Annex X (conformity assessment based on type examination), Annex XI (conformity assessment based on product conformity verification). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.

This post is part of the Device Classification & Conformity Assessment series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The Class IIb Annex IX procedure follows the same seven-step spine as Class IIa, but every step carries more weight — and the per-device technical documentation review at Step 5 is the structural change that decides whether a resource-constrained startup reaches the certificate on runway or stalls on the second round of reviewer questions.