Written and maintained by CASRAI Editorial Board
Last updated
EU MDR Rule 11—enacted in Annex VIII, Chapter III, Section 6.3 of Regulation (EU) 2017/745 on Medical Devices (read 2026-11-10 at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R0745)—is the dedicated risk-classification rule governing standalone Medical Device Software (MDSW) in the European Union. Introduced when the EU Medical Device Regulation replaced the legacy Medical Devices Directive (`93/42/EEC`, MDD) in May 2021, Rule 11 fundamentally restructured European digital health regulation by shifting almost all diagnostic, therapeutic, and clinical decision support software out of self-certified Class I into Notified-Body-audited Class IIa, Class IIb, or Class III. Software engineering and regulatory affairs teams pair Rule 11 with the European Commission’s interpretive standard MDCG 2019-11 and lifecycle software safety engineering standards such as IEC 62304 software safety classification.
How does EU MDR (Regulation 2017/745) Annex VIII Rule 11 classify Medical Device Software (MDSW) into Class I, IIa, IIb, and III?
Because standalone software counts as an “active device” under EU MDR Article 2(4) and Annex VIII Section 3.3 (Note: “Software, which drives a device or influences the use of a device, shall fall within the same class as the device. If the software is independent of any other device, it shall be classified in its own right”—a distinction detailed in SaMD vs. SiMD), independent Medical Device Software is classified under Rule 11. The statutory text of Annex VIII Rule 11 is divided into three structural paragraphs commonly referred to as Rule 11a (decisions for diagnosis or therapy), Rule 11b (monitoring of physiological processes), and the residual Class I provision:
- First Paragraph (“Rule 11a” — Software Providing Information Used to Take Decisions with Diagnosis or Therapeutic Purposes):
- Default Baseline (`Class IIa`): Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa, EXCEPT if such decisions have an impact that may cause:
- Irreversible Deterioration or Death (`Class III`): Death or an irreversible deterioration of a person’s state of health, in which case it is in Class III; or
- Serious Deterioration or Surgical Intervention (`Class IIb`): A serious deterioration of a person’s state of health or a surgical intervention, in which case it is in Class IIb.
- Second Paragraph (“Rule 11b” — Software Intended to Monitor Physiological Processes):
- Default Baseline (`Class IIa`): Software intended to monitor physiological processes is classified as Class IIa, EXCEPT if it is intended for:
- Vital Physiological Parameters with Immediate Danger (`Class IIb`): Monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as Class IIb.
- Third Paragraph (Residual Provision — `Class I`):
- All other Medical Device Software is classified as Class I.
Why did Rule 11 up-classify most diagnostic and therapeutic clinical decision support software from MDD Class I to MDR Class IIa or higher?
Under the legacy 1993 Medical Devices Directive (`93/42/EEC`, Annex IX Rule 12), standalone software that did not directly drive a hardware medical device or monitor vital physiological parameters in intensive care was treated as an “other active medical device” and defaulted to Class I (self-certified via manufacturer Declaration of Conformity without Notified Body review). As a result, thousands of clinical decision support (CDS) calculators, medical imaging viewing/triage tools, symptom checkers, and radiation treatment planning aids entered the European market as self-certified Class I devices.
EU MDR Rule 11 closed that gap through the wording of its opening clause: “Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as Class IIa…” Because virtually any software that qualifies as a medical device under EU MDR Article 2(1)—by having a medical purpose of diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease—does so by providing information used for diagnostic or therapeutic decisions (Rule 11a) or by monitoring physiological processes (Rule 11b), almost no clinical MDSW remains in Class I. Regulators and Notified Bodies refer to this as the “Rule 11 Class I dichotomy”: if software merely stores, archives, compresses, or searches data without interpreting it for clinical management, it does not qualify as a medical device at all (`MDCG 2019-11` Section 3); once it crosses the threshold into Medical Device Software by providing clinical decision information, Rule 11a immediately places it in at least Class IIa.
Only narrow, non-diagnostic/non-therapeutic medical software—such as a standalone fertility app that tracks basal body temperature solely to support natural conception without diagnosing infertility (`MDCG 2019-11` Annex III)—remains in MDR Class I.
How does Rule 11 interact with the IMDRF N12 risk matrix (MDCG 2019-11) and EU AI Act Article 6(1) High-Risk conformity assessments?
To prevent inconsistent interpretation of “serious deterioration” (`Class IIb`) versus “irreversible deterioration or death” (`Class III`) under Rule 11a, the Medical Device Coordination Group issued MDCG 2019-11 (read 2026-11-10 at https://health.ec.europa.eu/system/files/2020-09/mdcg_2019_11_guidance_qualification_classification_software_en_0.pdf), which directly adopts the International Medical Device Regulators Forum (IMDRF) Software as a Medical Device: Possible Framework for Risk Categorization (IMDRF/SaMD WG/N12FINAL:2014) 3×3 risk matrix:
| State of Healthcare Situation or Condition | Treat or Diagnose | Drive Clinical Management | Inform Clinical Management |
|---|---|---|---|
| Critical Situation or Condition (Immediate/timely action required to avoid death or irreversible morbidity) |
IMDRF IV -> EU MDR Class III (e.g., AI software diagnosing acute stroke LVO or malignant melanoma without human override) |
IMDRF III -> EU MDR Class IIb (e.g., ICU sepsis risk-triage score driving immediate escalation or closed-loop drug titration) |
IMDRF II -> EU MDR Class IIa (e.g., software aggregating clinical options for a critical condition where clinician independently verifies) |
| Serious Situation or Condition (Accurate diagnosis/treatment vital to avoid unnecessary surgical intervention or long-term disability) |
IMDRF III -> EU MDR Class IIb (e.g., oncology radiation therapy dose-planning software or fracture detection CADx) |
IMDRF II -> EU MDR Class IIa (e.g., chronic heart failure or diabetes therapy adjustment recommendation tool) |
IMDRF II -> EU MDR Class IIa (e.g., clinical decision support displaying guideline options for serious chronic disease) |
| Non-Serious Situation or Condition (Manageable conditions not leading to death or long-term irreversible disability) |
IMDRF II -> EU MDR Class IIa | IMDRF II -> EU MDR Class IIa | IMDRF I -> EU MDR Class IIa (Note: MDCG 2019-11 maps even IMDRF Category I decision-informing MDSW to MDR Class IIa under Rule 11a) |
Impact on Notified Body Conformity Assessment and the EU AI Act (`Regulation 2024/1689`)
Up-classification under Rule 11 triggers two cascading regulatory obligations for European digital health and clinical AI developers:
- Mandatory Notified Body Audit (`EU MDR Article 52`): Unlike Class I devices, Class IIa, IIb, and III Medical Device Software cannot be CE-marked by self-declaration. Manufacturers must implement a full Quality Management System (`ISO 13485` and an IEC 62304 checklist lifecycle), compile a Clinical Evaluation Report (`MDR Article 61` & `MDCG 2020-1`), and undergo conformity assessment by a designated Notified Body under Annex IX (QMS + technical documentation assessment of representative devices for Class IIa/IIb, or every device for Class III) or Annex X / XI.
- Automatic Qualification as a High-Risk AI System under EU AI Act Article 6(1): Under Article 6(1) and Annex I Section A (Point 11) of Regulation (EU) 2024/1689 (the EU Artificial Intelligence Act, read 2026-11-10 at
https://eur-lex.europa.eu/eli/reg/2024/1689/oj), any AI-enabled Medical Device Software that is required to undergo a third-party conformity assessment by a Notified Body under EU MDR—which, because of Rule 11, includes all Class IIa, Class IIb, and Class III AI medical devices—automatically qualifies as a High-Risk AI System. Consequently, Rule 11 directly determines whether a healthcare AI product must satisfy EU AI Act Chapter III High-Risk requirements (Articles 8–15: risk management, data governance, technical documentation, logging, human oversight, accuracy, robustness, and cybersecurity) during its integrated Notified Body conformity assessment.
Frequently Asked Questions
How does EU MDR (Regulation 2017/745) Annex VIII Rule 11 classify Medical Device Software (MDSW) into Class I, IIa, IIb, and III?
Under Rule 11a, software providing information used to take diagnostic or therapeutic decisions defaults to Class IIa, rising to Class IIb if decisions may cause serious health deterioration or surgical intervention, and Class III if they may cause death or irreversible health deterioration. Under Rule 11b, software monitoring physiological processes is Class IIa, rising to Class IIb when monitoring vital physiological parameters whose variations could create immediate patient danger. All other MDSW is Class I.
Why did Rule 11 up-classify most diagnostic and therapeutic clinical decision support software from MDD Class I to MDR Class IIa or higher?
Under the old MDD (`93/42/EEC`), standalone software defaulted to self-certified Class I. EU MDR Rule 11a changed the baseline so that any software providing information used for diagnostic or therapeutic decisions is at least Class IIa, moving virtually all clinical decision support, diagnostic imaging, and triage software under mandatory Notified Body oversight.
How does Rule 11 interact with the IMDRF N12 risk matrix (MDCG 2019-11) and EU AI Act Article 6(1) High-Risk conformity assessments?
MDCG 2019-11 maps the IMDRF N12 risk categories onto Rule 11: IMDRF Category IV maps to Class III, Category III maps to Class IIb, and Categories II and I (when informing clinical decisions) map to Class IIa. Because Class IIa, IIb, and III devices require Notified Body conformity assessment under MDR Article 52, any AI-based MDSW in Class IIa–III automatically becomes a High-Risk AI System under EU AI Act Article 6(1).
