The MDR does not operate in a vacuum. Behind the regulation sits an ecosystem of institutions, bodies, and authorities — each with a specific role, specific powers, and specific ways they interact with your startup. Understanding who these players are and what they do is not academic knowledge. It directly affects your timeline, your strategy, and your chances of certification.
Here is the complete map.
What Are the Main Institutional Players?
The MDR ecosystem has five primary layers:
- The European Commission — sets the regulatory framework, adopts implementing acts, manages EUDAMED
- The Medical Device Coordination Group (MDCG) — coordinates interpretation and guidance across member states
- National Competent Authorities — enforce the MDR in each member state, designate and oversee Notified Bodies
- Notified Bodies — conduct conformity assessments (audits and technical documentation reviews)
- Economic Operators — manufacturers, authorized representatives, importers, and distributors (this is you)
Each layer has defined powers and responsibilities under the MDR. Understanding the hierarchy helps you know who to engage with, when, and for what purpose.
What Does the European Commission Do?
The Commission is the legislative engine behind the MDR. Its ongoing role includes:
Adopting implementing and delegated acts. The MDR authorizes the Commission to adopt supplementary rules on specific topics — common specifications (Article 9), EUDAMED functionality, UDI system details, and more . These acts add detail to the regulation without requiring a full legislative process.
Managing EUDAMED. The European Database on Medical Devices is a Commission project. The Commission determines when EUDAMED is fully functional, which triggers certain MDR provisions that depend on EUDAMED availability.
Market surveillance coordination. The Commission coordinates market surveillance activities across member states and can initiate EU-wide actions when a device poses a serious cross-border risk.
Harmonized standards. The Commission requests European standardization organizations (CEN, CENELEC, ETSI) to develop harmonized standards and publishes the list of harmonized standards that provide a presumption of conformity with MDR requirements.
For startups, direct interaction with the Commission is rare. But Commission decisions — on common specifications, EUDAMED timelines, and harmonized standards — directly affect your compliance requirements. Monitor Commission publications on medical devices.
What Is the MDCG and Why Does It Matter?
The Medical Device Coordination Group is established under Article 103 of the MDR . It is composed of representatives from the competent authorities of all member states, chaired by a Commission representative.
The MDCG's primary role is to issue guidance documents. These are not legally binding — they are not law — but they are practically authoritative. Notified Bodies apply them. Competent authorities reference them. Auditors use them as benchmarks.
Key MDCG functions: - Providing advice on MDR implementation questions - Issuing guidance documents on classification, clinical evaluation, post-market surveillance, and other topics - Advising the Commission on common specifications and harmonized standards - Contributing to market surveillance coordination
For startups, MDCG guidance documents are essential reading. They translate the broad language of the MDR into specific, actionable expectations. When the MDR says "sufficient clinical evidence," the MDCG guidance explains what "sufficient" means in practice.
The full list of MDCG guidance documents is published on the European Commission's medical devices website .
What Are Competent Authorities?
Each EU member state designates one or more competent authorities responsible for implementing and enforcing the MDR in their territory. These authorities are established under Article 101 of the MDR .
Competent authority responsibilities include:
Market surveillance. Competent authorities monitor devices on their national market. They can conduct inspections, request documentation, and take enforcement actions including market restrictions, recalls, and fines.
Notified Body oversight. Competent authorities designate Notified Bodies (with Commission and MDCG involvement) and oversee their ongoing operations. They conduct assessments of Notified Body competence and can restrict or withdraw designation if standards are not met.
Vigilance. Competent authorities receive serious incident reports from manufacturers and can require corrective actions.
Borderline and classification decisions. When a product's classification or regulatory status is disputed, the competent authority in the relevant member state can make a determination.
Key competent authorities for the DACH market: - Austria: BASG (Bundesamt für Sicherheit im Gesundheitswesen) - Germany: BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte) for most devices; PEI (Paul-Ehrlich-Institut) for certain blood and tissue-related devices - Switzerland: Swissmedic (though Switzerland is not EU, it has mutual recognition arrangements)
For startups, your primary competent authority is the one in the member state where you are established. If you face a market surveillance action, it will typically come from the competent authority in the member state where the device is being sold.
What Are Notified Bodies?
Notified Bodies are the organizations that conduct conformity assessments — the audits and technical documentation reviews that result in your CE marking certificate. They are private organizations (often testing and certification companies) that have been designated by their national competent authority and approved by the Commission to perform conformity assessments under the MDR.
Under the MDR, Notified Body designation is governed by Articles 35–44 . The requirements are significantly stricter than under the MDD, which is one reason there are fewer MDR-designated Notified Bodies.
What Notified Bodies do for your startup: - QMS audit: Review and audit your quality management system (Stage 1 and Stage 2 audits) - Technical documentation assessment: Review your technical documentation for compliance with Annex II - Certificate issuance: Issue EU Technical Documentation Assessment Certificates and/or QMS Certificates - Surveillance: Conduct periodic surveillance audits and unannounced audits - Certificate renewal: Certificates are valid for a maximum of five years and must be renewed
We cover Notified Bodies in much greater depth in What Is a Notified Body and How Do They Audit Your Startup? and How to Choose the Right Notified Body for Your MedTech Startup in 2026.
What Are Expert Panels?
The MDR introduced expert panels (Article 106) — groups of clinical and technical experts who provide scientific opinions on specific device types, particularly Class III and Class IIb implantable devices. Notified Bodies must consult expert panels when assessing clinical evaluations for certain high-risk devices.
For startups building high-risk devices, the expert panel involvement adds time to the conformity assessment process but also provides an additional layer of scientific scrutiny that can improve the quality of clinical evaluations.
How Do These Players Interact?
The interaction flow for a typical startup looks like this:
- You (manufacturer) develop your device and prepare documentation
- You engage a Notified Body for conformity assessment
- The Notified Body audits your QMS and reviews your technical documentation
- For high-risk devices, the Notified Body consults expert panels
- The Notified Body issues certificates, reported to EUDAMED
- You apply the CE marking and place the device on the market
- Competent authorities conduct market surveillance
- You report serious incidents to the competent authority
- The Notified Body conducts periodic surveillance audits
- The MDCG and Commission issue guidance and implementing acts that affect all of the above
Understanding this flow helps you plan your regulatory timeline. The Notified Body engagement (steps 2–4) is typically the longest single phase and the one most affected by external factors (Notified Body capacity, expert panel availability).
The Practical Implications for Startups
Three things matter most:
1. Engage your Notified Body early. The backlog is real. Starting the engagement process months before you are ready for audit gives you the best chance of a reasonable timeline. See The Notified Body Bottleneck: Strategies for Startups Facing Long Wait Times.
2. Monitor MDCG guidance. New guidance documents can change expectations for your submission. If a new MDCG guidance on clinical evaluation comes out while you are preparing your clinical evaluation report, you need to address it.
3. Know your competent authority. If you have a borderline classification question, a vigilance question, or face a market surveillance action, your national competent authority is your primary point of contact.
The MDR ecosystem is complex, but it is logical. Each player has a defined role, and the interactions are predictable. Understanding the system helps you work with it rather than against it.
Next: What Is a Notified Body and How Do They Audit Your Startup?.