To write an SSCP for a Class III or implantable device, build a document that mirrors MDR Article 32 section by section, sources every claim from the technical documentation and Clinical Evaluation Report (CER), and carries two parallel tracks: one written for healthcare professionals and one written for patients as a lay summary. The notified body validates both before Eudamed publication.

By Tibor Zechmeister and Felix Lenhard. Last updated 2026-04-10.

TL;DR

  • MDR Article 32 requires a Summary of Safety and Clinical Performance (SSCP) for every implantable and Class III device, except custom-made and investigational devices.
  • The SSCP is not marketing copy. It is a formal regulatory deliverable validated by the notified body and published in Eudamed.
  • Article 32(2) sets nine mandatory content elements, from device identification to residual risks to the clinical evaluation summary.
  • The patient section must be written at a reading level a layperson can understand — MDCG 2019-9 Rev.1 gives concrete drafting rules for the lay summary.
  • Evidence traces from the CER and Annex II technical documentation into the SSCP. Nothing in the SSCP should be a new claim the file cannot support.

Why this matters for your startup

The first time a founder sees the SSCP requirement, they often confuse it with the Instructions for Use, the CER, or a marketing brochure. It is none of those. The SSCP is a separate public document that lives on Eudamed and becomes the single most-read artefact about your device — by regulators, by hospital procurement, by patient advocacy groups, and by competitors.

For a Class III or implantable device, the SSCP is also one of the few regulatory outputs that patients themselves will actually open and read. That changes the drafting discipline. Every sentence is on public record. Every claim will be held against the CER and the technical documentation. Every simplification in the lay summary will be scrutinised by the notified body for whether it distorts the truth.

If you are still mapping where the SSCP sits in the regulation, start with our sister post on the SSCP and MDR Article 32. This post assumes you know what the SSCP is and focuses on how to actually write one.

What MDR Article 32 says

Article 32(1) is explicit about scope: "For implantable devices and for class III devices, other than custom-made or investigational devices, the manufacturer shall draw up a summary of safety and clinical performance." (Regulation (EU) 2017/745, Article 32, paragraph 1.)

Article 32(2) then lists the mandatory content. The SSCP must include at least:

  • device identification details, including name, UDI-DI, and the manufacturer's SRN;
  • the intended purpose, indications, contraindications, and target populations;
  • a description of the device, including reference to previous generation(s) or variants if applicable;
  • possible diagnostic or therapeutic alternatives;
  • a reference to any harmonised standards and common specifications applied;
  • the summary of clinical evaluation referred to in Annex XIV, and relevant information on post-market clinical follow-up (PMCF);
  • the suggested profile and training for users;
  • information on residual risks and any undesirable effects, warnings, and precautions.

(Regulation (EU) 2017/745, Article 32, paragraph 2, points (a)–(h).)

Article 32(3) requires the SSCP to be "written in a way that is clear to the intended user and, if relevant, to the patient." Article 32(4) places validation in the hands of the notified body during conformity assessment: the NB validates the SSCP and uploads it to Eudamed. The language obligations follow the language rules for the Member States where the device is made available.

The single authoritative drafting guide is MDCG 2019-9 Rev.1, "Summary of safety and clinical performance — A guide for manufacturers and notified bodies." It operationalises Article 32 into a concrete template, readability targets, and NB validation checkpoints.

Section-by-section: the SSCP template walkthrough

MDCG 2019-9 Rev.1 splits the SSCP into two parts: a professional section aimed at healthcare providers and, where the device is intended to be used by or on patients, a patient-facing lay summary. Both parts share the same underlying evidence but are drafted independently for their audience.

Part A — Information for healthcare professionals. This is the clinical and technical substance of the SSCP. Every section maps directly to an Article 32(2) requirement and to specific sections of the Annex II technical documentation.

  1. Device identification and general information. Device trade name, Basic UDI-DI, UDI-DI of the specific device(s) covered, manufacturer name and SRN, notified body number, and the MDR risk class with classification rule. Sourced from Annex II Section 1.
  2. Intended purpose, indications, contraindications, and target populations. Sourced from Annex II Section 1.1 and the IFU. Wording must be identical in meaning to the IFU — the SSCP is not the place to expand the intended purpose.
  3. Device description. Generation history, design features, materials, principles of operation. Cross-references to Annex II Section 1.2.
  4. Risks, warnings, and undesirable side effects. Directly sourced from the risk management file under EN ISO 14971:2019+A11:2021 and from the IFU. Residual risks must match exactly what the risk management file concludes.
  5. Summary of clinical evaluation and PMCF. The core of the SSCP. Sourced from the CER (Annex XIV Part A) and the PMCF plan and report (Annex XIV Part B). Presents the pivotal clinical data, the acceptable benefit-risk conclusion, and the PMCF follow-up strategy.
  6. Possible diagnostic or therapeutic alternatives. A fair presentation, not a competitive pitch. This section is a frequent NB flag when manufacturers editorialise.
  7. Suggested profile and training for users. Required qualifications and any mandated training. Consistent with the IFU and with any training materials distributed with the device.
  8. Reference to harmonised standards and common specifications applied. Full citation with edition and amendment.
  9. Revision history. Every SSCP update is logged with date and change description.

Part B — Information for patients. Only present where the device is intended to be used by or on patients. This is the lay summary. Same underlying facts, radically different drafting discipline.

Lay versus professional language: the drafting split

The professional section is written in clinical English at the level a hospital-based specialist would expect. Technical terms are used without translation. Effect sizes are reported with confidence intervals. Risks are quantified.

The patient section is written so that someone with no medical background can understand it. MDCG 2019-9 Rev.1 points to plain-language writing principles consistent with EU health literacy guidance: short sentences, active voice, familiar vocabulary, explanations of every unavoidable technical term, and avoidance of statistics presented only as relative risk.

Three drafting rules that notified bodies check specifically:

  • No promotional language. "Revolutionary," "breakthrough," "superior," "best-in-class" — all flagged on first pass. The SSCP is a regulatory summary, not marketing.
  • No new claims. Every statement in the lay summary must be traceable to the professional section, and from there to the CER and technical documentation. If a claim is not in the CER, it cannot be in the SSCP.
  • Balanced benefit-risk framing. Patients must be able to read the benefits and the residual risks in the same document with comparable prominence. Burying risks in the last paragraph fails validation.

Sourcing evidence from the CER and Annex II

The SSCP is an output document. It does not generate new evidence. If the authoring team is tempted to draft an SSCP claim that is not already supported in the Clinical Evaluation Report or in the Annex II technical documentation, that is a signal to fix the CER or the tech file — not to paper over the gap in the SSCP.

A reliable working method:

  1. Start with the finalised CER (or near-final draft if the CER is still in review). Extract the clinical conclusion paragraph, the pivotal data summary, and the PMCF strategy.
  2. Pull the intended purpose and indications verbatim from the IFU.
  3. Pull residual risks from the risk management report under EN ISO 14971:2019+A11:2021.
  4. Pull device description and generation history from Annex II Section 1.
  5. Draft the professional section (Part A) using only that sourced material. Every paragraph carries an internal reference to its source document and section number.
  6. Draft the lay section (Part B) as a faithful translation of Part A into plain language. Re-read against the professional section to check nothing was added, dropped, or distorted.

This approach is what our post on the Clinical Evaluation Report under MDR calls the "upstream discipline": the SSCP is only as good as the CER it summarises.

A worked Class III example: an implantable neurostimulator

Consider a startup bringing a Class III active implantable neurostimulator to market. The device is implanted by a neurosurgeon and used long-term by the patient for chronic pain management. Both parts of the SSCP are required.

Professional section (excerpted structure):

  • Device identification: trade name, Basic UDI-DI, manufacturer SRN, NB number, Class III (Rule 8, active implantable).
  • Intended purpose: pain management via spinal cord stimulation for adult patients with chronic intractable pain of specified aetiologies, in line with the IFU.
  • Summary of clinical evaluation: reports the pivotal randomised controlled trial results — pain reduction on a validated scale, responder rate at 12 months, adverse events, device-related serious adverse events, dropout rate. Cites the CER. Describes the PMCF plan: a multi-centre registry with annual follow-up for five years post-implant.
  • Residual risks: infection at the implant site, lead migration, loss of stimulation effect, battery depletion requiring reoperation, MRI restrictions. Each risk matches the risk management file.
  • Standards applied: full citations including the current edition of EN ISO 14971 and any relevant active implantable electrical safety standards referenced in the technical documentation.

Patient section (excerpted):

"This device is a small electrical stimulator implanted under the skin, connected to thin wires placed near your spinal cord. It sends gentle pulses that can reduce the feeling of chronic pain that has not responded to other treatments. It is for adults whose pain has a specific cause that your doctor will explain to you.

In the clinical study, [X] out of every 100 patients reported meaningful pain reduction twelve months after implantation. The most common problems were infection at the site of the implant, the thin wires moving out of place, and the battery needing to be replaced by another operation several years later. Some scans, such as certain MRI scans, may not be possible after implantation. Your doctor will explain all of these before you decide."

Every number in the lay section traces back to a number in the professional section. Every risk named in the lay section is named in the professional section. No new claim appears.

The drafting and review playbook

A lean way to ship an SSCP without ballooning the process:

  1. Assign a single author. One person drafts both sections to keep the voice and evidence consistent. Co-authoring Part A and Part B separately almost always creates drift.
  2. Draft against a source-reference matrix. Every paragraph carries a footnote to its source (CER section, Annex II section, risk management report line item). This matrix is shared with the notified body at validation — it shortens the review cycle significantly.
  3. Run an internal lay-summary readability check. Ask someone with no MedTech background to read Part B cold and paraphrase it back. If they cannot, rewrite.
  4. Submit to the notified body with the CER. The NB validates the SSCP as part of conformity assessment. Submitting the SSCP without the CER in final form is a common cause of round-tripping.
  5. Lock the SSCP with a revision history block. Every future change is dated and described. MDCG 2025-10 PMS guidance reinforces that the SSCP is a living document — updated whenever PMCF, PSUR, or vigilance data changes the benefit-risk conclusion in a way a reader would care about.

Reality Check — Where do you stand?

  1. Can you point to the exact section of your CER that every clinical claim in your SSCP draft comes from?
  2. Does the patient section of your SSCP contain any claim, number, or benefit that is not also present in the professional section?
  3. Has a non-medical reader read your lay summary and paraphrased it back to you accurately?
  4. Is every residual risk in your SSCP mirrored line-for-line in your risk management report under EN ISO 14971?
  5. Does your revision history plan describe when you will update the SSCP based on PMCF and PSUR cycles?
  6. Have you checked the language requirements for every Member State where the device will be made available, and planned the translations accordingly?
  7. Have you agreed the SSCP validation checklist with your notified body ahead of submission, or are you assuming their criteria?

If you answered "no" or "not sure" to two or more, your SSCP is not ready for notified body validation.

Frequently Asked Questions

Which devices need an SSCP under MDR? MDR Article 32(1) requires an SSCP for every implantable device and every Class III device, except custom-made and investigational devices. All other device classes do not have an SSCP obligation, though nothing prevents a manufacturer from producing one voluntarily.

Does the SSCP replace the Clinical Evaluation Report? No. The SSCP summarises the CER for public audiences. The CER itself remains the underlying evidence document in the Annex II technical documentation and is not published. The SSCP cannot contain claims the CER does not support.

Is the patient lay summary always required? The lay summary is required when the device is intended to be used by or on patients, which covers essentially all implantables and most Class III devices. MDCG 2019-9 Rev.1 gives the drafting rules. A device used only by clinical staff on inanimate samples would not trigger the patient section.

Who validates the SSCP and publishes it? The notified body validates the SSCP during conformity assessment under Article 32(4), then uploads the validated version to Eudamed. The manufacturer is responsible for keeping the SSCP current and for providing updated versions whenever the benefit-risk profile changes materially.

How often does an SSCP need to be updated? At minimum whenever the PMCF report, PSUR, or vigilance data leads to a change in the benefit-risk conclusion or in the residual risks that a healthcare professional or patient would want to know about. Many manufacturers align SSCP updates with the annual PSUR cycle for implantable and Class III devices.

Can the SSCP be written in English only? No. The language requirements follow the Member State rules for the countries where the device is made available. English may serve as the drafting language, but translations into the relevant official languages are part of the SSCP obligation.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Article 32 and Annex XIV. https://eur-lex.europa.eu/eli/reg/2017/745/oj
  2. MDCG 2019-9 Rev.1, Summary of safety and clinical performance — A guide for manufacturers and notified bodies, March 2022.
  3. MDCG 2025-10, Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025.
  4. EN ISO 14971:2019 + A11:2021, Medical devices — Application of risk management to medical devices.
  5. Commission Implementing Regulation (EU) 2021/2078 on Eudamed, 26 November 2021.

This post is part of the Post-Market Surveillance and Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. For startup-specific regulatory support on drafting your SSCP, Zechmeister Strategic Solutions has validated SSCPs on both sides of the notified body table.