A pre-marketing compliance strategy sequences clinical data, technical documentation, QMS, and clinical evaluation work across the pre-launch timeline so that each piece of evidence lands before it becomes a bottleneck. Notified bodies scrutinise four things first: intended purpose, clinical evaluation, risk-benefit, and design verification. Everything else follows.

By Tibor Zechmeister and Felix Lenhard.

TL;DR

  • The MDR evidence portfolio is an interlocking system — clinical, technical, quality, and risk evidence all reference each other and cannot be built sequentially from scratch at the end.
  • Notified bodies review from the top down: intended purpose, then classification, then clinical evaluation, then GSPR conformity, then design verification, then manufacturing controls.
  • The single most common cause of timeline blowouts is starting the Clinical Evaluation Report (CER) six months before submission instead of 24 months before.
  • A lean pre-marketing strategy does not cut corners — it sequences work so evidence is generated once and reused everywhere.
  • Your QMS (per Article 10 and EN ISO 13485:2016+A11:2021) must be operational before the notified body shows up, because the QMS is the system that generates all other evidence.

Why this matters

Founders routinely underestimate how much of a CE marking is evidence and how little is product. By the time a notified body sees your technical file, 70% of the effort has already happened — in the form of test reports, clinical data, design records, risk analyses, and management reviews that reference each other in a traceable chain.

If you start building that evidence three months before submission, you will fail. Not because you lack effort, but because clinical evaluation takes a year, biocompatibility testing takes four months, a proper usability engineering file takes six, and the GSPR conformity matrix references all of them.

The startups that ship CE-marked devices in 18 months are not faster. They are better sequenced. They understood from month one that pre-marketing compliance is a portfolio problem, not a submission problem.

What MDR actually says

Four provisions frame the pre-marketing evidence landscape.

Article 10 (General obligations of manufacturers). Manufacturers must establish, document, implement, maintain, keep up to date, and continually improve a quality management system that ensures compliance with MDR in the most effective manner. Article 10(9) makes the QMS mandatory. In practice, this is met via EN ISO 13485:2016+A11:2021.

Article 61 (Clinical evaluation). Confirmation of conformity with the relevant general safety and performance requirements must be based on clinical data providing sufficient clinical evidence, including, where applicable, data from post-market surveillance. The clinical evaluation must be planned, conducted, documented, and updated throughout the life cycle. For implantable and Class III devices, the bar is higher — a clinical investigation is required unless specific conditions in Article 61(4)–(6) are met (see MDCG 2023-7 on clinical investigation exemptions).

Annex II (Technical Documentation). Defines the structure of the technical file: device description and specification, information supplied by the manufacturer, design and manufacturing information, general safety and performance requirements, benefit-risk analysis and risk management, product verification and validation (including clinical evaluation). Annex III adds the post-market surveillance technical documentation. These are not optional sections — each is a required dossier chapter.

Annex IX (Conformity assessment based on QMS and assessment of technical documentation). Defines what the notified body looks at for most Class IIa, IIb, and III devices: QMS audit plus technical documentation review. The notified body samples technical files for review; for Class IIb implantables and Class III, every file is reviewed. Understanding Annex IX is how you predict what the notified body will scrutinise.

A worked example

Consider a 15-person startup building a Class IIa connected insulin dosing decision-support app. They target CE marking in 24 months. Here is how a well-sequenced pre-marketing compliance strategy unfolds, and how a poorly sequenced one fails.

Poorly sequenced (the usual failure mode): Months 1–18 are spent on product development. The QMS is set up in month 15 when someone remembers it is needed. The Clinical Evaluation Plan is drafted in month 18. Literature searches start in month 19. The first draft CER lands in month 22. Biocompatibility — wait, the device has a wearable component — starts in month 20 and takes five months. Usability engineering file is retrofitted in month 21. The notified body application goes in at month 24 and the NB comes back four months later with 40 findings because the evidence does not cross-reference. Final certificate lands at month 38. Actual elapsed time from start: 38 months. Budget spent: roughly double.

Well sequenced:

  • Months 1–3: Intended purpose drafted as working hypothesis. Classification justified against Annex VIII Rule 11. Regulatory strategy document written. Risk management plan drafted per EN ISO 14971:2019+A11:2021.
  • Months 3–6: Lean QMS operationalised against EN ISO 13485:2016+A11:2021. Design and development procedures in place. Clinical Evaluation Plan drafted. First literature search run.
  • Months 6–12: Product development in structured design phases with traceable inputs, outputs, verifications, and validations. Risk analysis iterated against each design decision. State-of-the-art clinical review updated quarterly. Usability engineering file built alongside the UI.
  • Months 12–18: First complete CER draft. Clinical data gap analysis. Decision on clinical investigation or equivalence claim. Biocompatibility on the wearable started early so reports land by month 18. Software lifecycle documentation (EN 62304:2006+A1:2015) complete.
  • Months 18–22: Final verification and validation. GSPR conformity matrix referencing every relevant piece of evidence. PMS plan (Annex III) complete. Internal audit. Management review. Mock notified body audit.
  • Month 22: Notified body application submitted with a clean, cross-referenced dossier.
  • Month 24: Certificate issued.

The difference is not effort. It is order.

The Subtract to Ship playbook

Here is the sequencing playbook we use with startups preparing for CE marking.

Step 1: Freeze the four anchors in month one. Intended purpose (draft), classification (with justification), regulatory strategy (conformity route, notified body shortlist, timeline), and risk management framing. These are the anchors every later document hangs from. If you get them wrong, every downstream document is wrong. See when to start regulatory work on why month one is not too early.

Step 2: Operationalise a lean QMS before you start generating records. You need a functioning QMS in month three at the latest, because from month three onwards you are generating design records, risk records, and supplier records that the QMS must control. Retrofitting a QMS around 18 months of scattered engineering work is the single most expensive mistake in MedTech. Use the build-technical-documentation-from-day-one approach to fold documentation into engineering flow, not after it.

Step 3: Start the clinical evaluation file in month three, not month eighteen. The CER is not a write-up at the end. It is a living document built from a Clinical Evaluation Plan, iterated systematic literature reviews, ongoing state-of-the-art analysis, clinical data appraisal, and (usually) a clinical investigation or PMCF plan. A notified body can tell in the first 30 seconds whether your CER was built over 18 months or hastily in the last two. Our guide on clinical evidence strategy portfolio covers the portfolio logic in depth.

Step 4: Sequence long-lead items early. Biocompatibility testing (EN ISO 10993-1:2025) can take 4–9 months. Sterilisation validation is similar. EMC and electrical safety testing (EN 60601-1, EN 60601-1-2) often require multiple rounds. Clinical investigations can take 12 months from ethics approval to final report. Anything that takes more than 6 months to complete must start at least 6 months before the integration point where it is needed. Draw a dependency graph. The critical path is rarely product development — it is usually clinical or test-lab bottlenecks.

Step 5: Build the GSPR conformity matrix from month one. Annex I lists the general safety and performance requirements. The conformity matrix maps each GSPR to the standard(s) and the specific evidence that demonstrates conformity. Start it empty. Add a row every time you finish a test, a design verification, a risk control. By month 18, it should be 80% complete. By month 22, it is the spine of your technical file.

Step 6: Mock-audit yourself six months before the notified body. An internal notified body simulation — ideally led by someone who has sat on the other side of the table — surfaces the cross-reference failures, the missing records, and the traceability gaps while you still have time to fix them. See preparing for your first notified body audit.

Step 7: Hold the two-phase development line. Phase 1 is validation and lean evidence. Phase 2 is scale and full evidence. Do not blur the two. Founders who try to do "some of each, all the time" run out of money before either phase finishes.

Reality Check

  1. Can you name the top ten pieces of evidence your notified body will ask for first, in order?
  2. What is the current age of your Clinical Evaluation Plan — was it drafted in the first six months of the project or the last?
  3. Does your GSPR conformity matrix exist, and does each row reference specific evidence rather than a standard title?
  4. Is your QMS running on real records, or is it a set of procedures that nobody follows yet?
  5. What are your three longest-lead evidence items, and when do they start?
  6. If your notified body asked for the latest risk management report today, could you produce one dated within the last 90 days?
  7. Have you run an internal mock audit against Annex II and Annex III structure?
  8. Are clinical data, technical evidence, and QMS records cross-referenced — or do they live in separate silos that a notified body will have to stitch together?

Frequently Asked Questions

When should we start working on the CER? The Clinical Evaluation Plan should be drafted in months 3–6 of the project. The CER itself is a living document, updated with every new piece of clinical data and every quarterly state-of-the-art review. If you are drafting the CER in the final quarter before submission, you are already late.

Do we need full ISO 13485 certification before the notified body comes? For most conformity assessment routes under Annex IX, the notified body audits your QMS as part of the certification process, so a separate prior ISO 13485 certificate is not strictly required. But the QMS must be operational, documented, and generating real records well before the NB audit.

Can we run evidence generation in parallel with product development? Yes, and you must. Evidence that is generated after product development is almost always of poor quality and full of cross-reference gaps. Evidence should be generated by the same engineering work that builds the product.

What does a notified body look at first? Intended purpose, classification, clinical evaluation, benefit-risk analysis, and the GSPR conformity matrix. If those four things are clean and cross-referenced, the rest of the review goes much faster. If they are messy, the rest of the review becomes a forensic exercise.

How much does the pre-marketing evidence work cost? For a Class IIa software device, typically 300,000–800,000 EUR depending on clinical investigation needs. For Class IIb, 600,000–1,500,000 EUR. Clinical investigations and lab testing dominate the variable cost.

Is it too early to talk to a notified body? No. Early informal contact (while avoiding pre-contract commitments) helps you understand their expectations and availability. Notified body capacity remains a real bottleneck, and lead times for new clients can be 6–12 months.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Article 10, Article 61, Annex II, Annex III, Annex IX, Annex XIV.
  2. MDCG 2023-7 (December 2023) — Guidance on clinical investigation exemptions under Article 61(4)–(6).
  3. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems.
  4. EN ISO 14971:2019+A11:2021 — Medical devices — Application of risk management.