Is your product a medical device, and if so what class? Get that wrong and every downstream decision – QMS, evidence, market access, timeline, funding – is built on sand.
Two questions, in order. Is it a device at all? Then: what class? Founders routinely discover the answer late, after a QMS has been scoped or an investor has asked.
Turns on intended purpose as stated by the manufacturer – including in your marketing. Software that only stores, archives, communicates or searches data is generally not a device. Software intended to diagnose, monitor, predict or treat generally is.
Class I, IIa, IIb or III, by applying the classification rules. The class sets your conformity assessment route and whether an Approved or Notified Body has to be involved – which sets your cost and timeline.
UKCA for Great Britain, CE under EU MDR 2017/745 for the EU, with transitional recognition arrangements in Great Britain that have shifted repeatedly and remain under active consultation.
Rule 11 of Annex VIII to EU MDR 2017/745 is why so much clinical software sits above Class I – and why so many digital health companies need a Notified Body they had not budgeted for.
Software providing information used to take diagnostic or therapeutic decisions is generally Class IIa. It rises to IIb where those decisions could cause serious deterioration in health or require surgical intervention, and to Class III where death or irreversible deterioration could result.
Intended purpose is what the manufacturer says it is. A wellness app that starts describing itself as detecting a condition has changed its regulatory status through its own marketing copy, without a line of code changing. We review claims alongside the product.
AI-enabled devices are regulated as medical devices, with particular attention to the evidence base, performance across intended populations, change management for models that update, and human oversight. The MHRA publishes specific guidance on software and AI as a medical device.
We are a clinician-led regulatory consultancy. On medical devices, our value is upstream: the strategic and clinical judgement calls that determine everything downstream, and joining device regulation to the CQC and NHS obligations that usually sit alongside it.
A written, reasoned opinion on whether your product is a medical device and what class it falls into, with the rules applied explicitly rather than asserted. This is the document your investors, partners and Notified Body will ask for, and it is far cheaper to produce now than to reconstruct under diligence.
Where the honest answer is that you are borderline, we say so and set out what would move you either way – including changes to intended purpose and claims that keep you out of scope, where that is a legitimate option.
Most of our clients are not only device manufacturers. They also deliver regulated clinical care, which brings CQC registration, and they sell into the NHS, which brings DCB0129 clinical safety and DTAC. These regimes ask overlapping questions and are usually answered by separate consultancies producing contradictory documents.
We build one hazard analysis and one governance spine, then map it to each framework. This is the part of the work where clinician-led judgement matters most, and where we are strongest.
ISO 13485 quality management system build and ISO 14971 risk management file preparation, delivered with specialist partners where an engagement calls for deep device-specific expertise. We are straight with you about which parts we lead and which parts a device specialist leads – and we will tell you when you need a Notified Body conversation rather than more consultancy.
| Great Britain framework | Medical Devices Regulations 2002, as amended, enforced by the MHRA. Reform has been proceeding in stages, with post-market surveillance requirements strengthened ahead of wider future core regulations. |
|---|---|
| Northern Ireland | Follows EU rules under the Windsor Framework. |
| EU framework | EU MDR 2017/745, with conformity assessment by an EU Notified Body where the class requires it. |
| Conformity markings | UKCA for Great Britain; CE for the EU. Great Britain has recognised CE-marked devices under transitional arrangements, with longer-term recognition under MHRA consultation in 2026. |
| Risk classes | Class I, IIa, IIb and III, determined by applying the classification rules. Class I is often self-declared; IIa and above generally require third-party assessment. |
| Software classification | EU MDR Annex VIII Rule 11. Decision-support software is generally Class IIa, rising to IIb or III with the severity of the decision. |
| Core standards | ISO 13485 for the quality management system; ISO 14971 for risk management. Normally implemented together. |
| UK Responsible Person | Required where the manufacturer has no registered place of business in the UK. Carries defined regulatory obligations and should sit under a written agreement. |
| Adjacent obligations | NHS clinical safety standards DCB0129 and DCB0160, DTAC, and CQC registration where regulated clinical activity is also delivered. |
| Verify before relying | UK arrangements have changed repeatedly. Confirm the current position against MHRA guidance at the point of planning. |
It is if you intend it for a medical purpose – diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease. Software that only stores, archives, communicates or performs simple search on data generally is not.
The test rests on intended purpose as stated by the manufacturer, including marketing claims. That means how you describe your product publicly can itself change its regulatory status, which is a trap worth understanding before your website copy is written.
Great Britain is currently regulated under the Medical Devices Regulations 2002, as amended, enforced by the MHRA. Northern Ireland follows EU rules under the Windsor Framework.
The UK framework has been reformed in stages, with strengthened post-market surveillance requirements introduced ahead of wider future core regulations. Do not plan against the 2002 regulations alone – check the current MHRA position.
UKCA is the Great Britain conformity marking, assessed where required by a UK Approved Body. CE is the European marking, assessed by an EU Notified Body under EU MDR 2017/745.
Great Britain has continued to recognise CE-marked devices under transitional arrangements, and the MHRA consulted in 2026 on recognising CE-marked devices on a longer-term or indefinite basis. These arrangements have shifted repeatedly, so confirm your route against current MHRA guidance rather than against an article written a year ago.
Into risk classes – broadly Class I, IIa, IIb and III – by applying classification rules based on duration of contact, invasiveness, whether the device is active, and the seriousness of the decision it informs. The class determines your conformity assessment route and whether an Approved or Notified Body must be involved. Class I can often be self-declared; IIa and above generally require third-party assessment.
The classification rule for software, in Annex VIII to EU MDR 2017/745. Software providing information used to take diagnostic or therapeutic decisions is generally Class IIa; Class IIb where those decisions could cause serious deterioration in health or require surgical intervention; Class III where death or irreversible deterioration could result. Software intended to monitor physiological processes is Class IIa or higher depending on the parameter.
Rule 11 pulls a great deal of clinical software above Class I. It is the single most common reason a digital health company discovers it needs a Notified Body.
ISO 13485 is the quality management system standard for medical devices: design and development controls, document and record control, supplier management, production, complaint handling and corrective action. ISO 14971 is the risk management standard. They are distinct and normally implemented together – ISO 13485 is how you run, ISO 14971 is how you reason about harm.
Yes, if you have no registered place of business in the UK and want to place devices on the Great Britain market. The UK Responsible Person acts on your behalf and interacts with the MHRA, and carries defined regulatory obligations – so put it under a written agreement rather than treating it as an administrative formality.
Separate regimes that frequently apply to the same business. CQC registration governs the delivery of regulated activities in England; medical device regulation governs the product placed on the market. A digital health company that both supplies software and delivers clinical care through it can be subject to both, alongside DCB0129 and DCB0160.
Handled as one regulatory strategy rather than three, the documentation stops contradicting itself – which matters, because assessors on each side read the others' documents.
General information about UK and EU medical device regulation, not regulatory or legal advice on a specific product. UK arrangements in particular have changed repeatedly – confirm the current position with the MHRA or take advice on your own circumstances.
