Notified Body Designation & Audits

A notified body is a private conformity assessment organization that a national authority has formally designated, under the EU Medical Devices Regulation (MDR, Regulation (EU) 2017/745) or In Vitro Diagnostic Regulation (IVDR, Regulation (EU) 2017/746), to certify that a manufacturer’s quality management system and technical documentation meet the regulation’s requirements before the device can carry a CE mark. For most Class IIa and higher devices under MDR, and most Class B, C and D devices under IVDR, a notified body relationship is not optional — it is the gate between a finished technical file and a legally marketable product. This guide covers how notified bodies themselves come to hold that authority, what their published scope actually commits them to, the practical sequence of getting certified once you’ve picked one, and why notified body capacity — not your own paperwork — is usually the longest item on the critical path.

How a notified body gets designated in the first place

A notified body isn’t self-appointed. Under MDR/IVDR, an organization that wants to act as a notified body applies to the national authority responsible for notified bodies in the EU Member State where it is established. That national authority assesses the applicant against the detailed competence, independence, impartiality, resourcing and confidentiality criteria set out in the regulations, then convenes a joint assessment together with experts appointed by the European Commission and, where relevant, other Member States. The joint assessment includes document review and on-site evaluation of the applicant’s personnel qualifications, internal procedures and technical capability for the specific device categories it wants to cover.

The outcome is a joint assessment report, on which the Medical Device Coordination Group (MDCG) is consulted before the designating Member State issues (or refuses) the designation. A successful designation is notified to the Commission and other Member States and published in NANDO (New Approach Notified and Designated Organisations), the Commission’s public database of designated conformity assessment bodies. Designation is not indefinite or unconditional: notified bodies are subject to ongoing monitoring and periodic reassessment by their designating authority, and a designation can be suspended, restricted or withdrawn if the notified body no longer meets the criteria it was assessed against.

This matters practically because it explains why the pool of MDR/IVDR notified bodies is much smaller than the pool that operated under the earlier Medical Devices Directive (MDD) and IVD Directive (IVDD): the assessment bar under the regulations is substantially higher, and re-designation under the new framework has been a slow, resource-intensive process for both applicants and the national authorities running the assessments.

What a notified body’s “scope” actually means

A notified body’s designation is never a blanket “certified to work on all medical devices” grant. Each designation specifies the device categories, technologies and, for some codes, the specific conformity assessment procedures the notified body is authorized to assess — this is what people mean when they refer to a notified body’s scope. NANDO publishes each notified body’s scope codes alongside its designation. Before you sign anything, confirm your device actually falls inside the notified body’s published scope; a notified body cannot certify a device category it hasn’t been designated for, no matter how strong its general reputation is. This check costs a few minutes and prevents discovering, months into an application, that you engaged the wrong body for your device’s technology or risk class.

Scope also isn’t static. Notified bodies periodically apply to extend their designation into new device categories, which means the notified body that couldn’t handle your device type two years ago may be able to now — and conversely, a notified body’s scope can be restricted following a reassessment. Re-check NANDO at the point you’re actually selecting a body, not from memory of an older list.

Choosing a notified body

Once you’ve narrowed the field to notified bodies whose published scope genuinely covers your device, the remaining differentiators are largely practical rather than regulatory:

Current capacity and realistic queue length — ask directly for an estimated timeline from application to contract signature, and from contract to first audit; treat any answer measured in weeks with skepticism given the industry-wide bottleneck described below.
Relevant device-type experience — a notified body that already reviews technical documentation for your device’s specific technology area will generally move faster and ask more targeted questions than one working in unfamiliar territory, even within the same scope code.
Existing relationship — if you already hold certificates with a notified body for other products, extending that relationship to a new device is usually faster than starting cold with a new body, because the audit team already understands your quality management system.
Language and site logistics — on-site audits (including the unannounced ones described below) happen at your manufacturing and design-control locations, so a notified body with auditors who can work efficiently at your actual sites, in a shared working language, removes friction from every audit cycle to follow.

Multiple manufacturers now apply to more than one notified body in parallel purely to hedge against the capacity constraint — a costly but increasingly common response to how unpredictable a single body’s queue can be.

The application and quality-system audit sequence

Once you’ve selected a notified body and it has confirmed your device falls inside its scope, the path to a CE certificate under MDR Annex IX (or the equivalent IVDR annex) generally runs through these stages:

Application and contract. You submit an application identifying the device(s), intended purpose, classification, and manufacturing sites. The notified body reviews this against its scope and capacity before agreeing to take on the work and signing a contract.
Quality management system audit — Stage 1 (documentation review). The notified body reviews your quality management system documentation (typically built to ISO 13485) for completeness and readiness before committing auditor time to an on-site visit. See CASRAI’s ISO 13485 certification guide for how this stage is generally structured.
Quality management system audit — Stage 2 (on-site). Auditors visit your facility to verify the QMS is actually implemented as documented — design controls, production and process controls, CAPA, and the other clauses of ISO 13485 and, for US-market devices, 21 CFR Part 820.
Technical documentation assessment. The notified body reviews your technical file against the applicable General Safety and Performance Requirements. Depth varies by risk class: higher-class devices get full technical documentation review, while some lower-risk categories are reviewed on a representative sampling basis.
Certificate issuance. Once nonconformities from the audits and documentation review are closed, the notified body issues the QMS and/or product certificate(s) that support your CE mark.
Ongoing surveillance. Certification isn’t a one-time event. Notified bodies conduct periodic surveillance audits through the certificate’s life, reviewing your continued QMS compliance, changes to the device or process, and post-market data.

Unannounced audits

Notified body oversight under MDR/IVDR isn’t limited to audits you schedule and prepare for. Regulators require notified bodies to build unannounced, on-site audits into their audit programs for certificate holders — not only as a response to a specific complaint, but as a standing feature of ongoing surveillance. The wider certification-body audit framework that underpins this (ISO/IEC 17021-1 and the device-sector guidance in IAF MD 9) sets out the kinds of triggers that make a short-notice or unannounced visit more likely: a new manufacturing site or relocated production; a new or changed process, including a changed sterilization method; an extension of certified scope to a materially different device category; changes to who holds release authority within your quality system; or post-market surveillance and vigilance signals suggesting a possible QMS deficiency. Industry guidance treats at least one unannounced visit within each certification cycle as the baseline expectation, with additional visits layered on top whenever one of those risk signals appears — confirm the specific cadence your notified body applies with the body itself, since this is exactly the kind of detail a certifying body will confirm in writing as part of your contract.

Practically, this means your facility, your CAPA records, and your production floor need to be genuinely audit-ready year-round, not brought into shape ahead of a scheduled visit. A notified body showing up with a few days’ notice (or none) is treated as a normal part of holding a certificate, not an adversarial event.

The capacity constraint that drives timelines

The single biggest practical variable in this whole process is notified body capacity, not your own preparation. Notified body capacity for IVDR in particular has been a persistent, industry-wide bottleneck since 2022: the original IVDR transition period set out in the regulation turned out to be too short relative to how much notified body capacity actually existed, which is a large part of why the EU extended the transitional deadlines by device class through Regulation (EU) 2022/112 (Class D to 26 May 2025, Class C to 26 May 2026, Class B and sterile Class A to 26 May 2027, conditional on the device already being legally on the market under the prior directive and unchanged in design or intended purpose). MDR has faced a comparable, if less acute, version of the same constraint.

The underlying cause is structural: the smaller, more selectively designated pool of notified bodies described earlier in this guide has to absorb both a much larger regulatory workload per device (more extensive technical documentation review, more frequent surveillance, mandatory unannounced audits) and, for years at a time, a backlog of manufacturers transitioning legacy Directive-era certificates onto the new regulations at once. For many manufacturers, securing and working through a notified body relationship is now the longest single item on the path to market — longer than the underlying engineering, clinical evidence generation, or technical documentation work itself.

What this means for planning: treat notified body engagement as an early, parallel-track activity, not something you start once your technical file is finished. Confirm scope and get a realistic capacity estimate before you commit development resources to a specific submission date, and build buffer into any public or contractual timeline that depends on a certificate being issued by a particular quarter.

Frequently asked questions

What is a notified body under MDR/IVDR?

A notified body is a conformity assessment organization formally designated by an EU Member State’s national authority to assess whether a manufacturer’s quality management system and technical documentation meet MDR or IVDR requirements, as a precondition for CE marking most device classes above the lowest-risk tier.

How do I check whether a notified body can actually certify my device?

Check the notified body’s published scope codes in NANDO, the European Commission’s public database of designated conformity assessment bodies, before engaging with them — a notified body cannot legally certify a device category outside its designated scope, regardless of general reputation or experience with adjacent technologies.

Are notified body audits always scheduled in advance?

No. In addition to the routine, scheduled QMS surveillance audits, notified bodies are required to build unannounced, short-notice audits into their oversight of certificate holders, with likelihood increasing around events like new manufacturing sites, changed processes, or post-market safety signals.

Why do notified body timelines take so long right now?

The MDR/IVDR designation bar is significantly higher than under the earlier Directives, which produced a smaller pool of notified bodies. That smaller pool has had to absorb a heavier per-device regulatory workload plus, for several years, a backlog of manufacturers transitioning legacy certificates — a capacity constraint that has been documented industry-wide since 2022 and is a large part of why the EU extended IVDR’s transitional deadlines.

Can I work with more than one notified body at once?

Yes, and a growing number of manufacturers do exactly that — applying to more than one notified body in parallel specifically to hedge against an individual body’s queue length, given how unpredictable capacity has become across the designated pool.

Notified Body Designation and Audits Under MDR/IVDR

Ask about Notified Body Designation and Audits Under MDR/IVDR