What a Notified Body Does in CE-Marking a Medical Device

What is a notified body?

A notified body is an independent organization that the European Union authorizes to check whether a higher-risk medical device meets the law before it can carry a CE mark and be sold. It is not a government agency, and it is not the company that made the device. It sits between the two, paid by the manufacturer but accountable to the authorities that designate it, and its job is to examine the evidence a manufacturer assembles and decide whether the claim holds up. When the device qualifies, the body issues a certificate, and only then can the maker affix the CE mark. This article is general education, not medical or legal advice.

I learned to read this system through a Medical Device Regulations training from KTH Royal Institute of Technology. The idea that stayed with me is plain. For the devices that can hurt people most, the maker is not the only judge of its own work.

Where the notified body fits under EU MDR

EU MDR is the European Medical Device Regulation (Regulation 2017/745), and it sorts every device into a risk class. The lowest class can often reach market on the manufacturer's own declaration, with no outside review. As the risk rises, the law requires an independent check, and that check is the notified body's role.

The mechanism that triggers it is conformity assessment, the formal process of showing that a device meets the regulation's safety and performance requirements. For higher-risk products the manufacturer cannot self-certify. A notified body examines the technical documentation, audits the quality system that produces the device, and confirms both before a certificate is granted.

This matters most for software and diagnostics, which climb the risk ladder quickly. Under MDR, software that informs a diagnosis or a treatment decision rarely lands in the lowest class, so a notified body usually reviews it. The same logic runs through IVDR, the In Vitro Diagnostic Regulation (2017/746), where many tests that once reached market on a self-declaration now require third-party assessment.

What the assessment actually involves

A notified body does two distinct kinds of work. One is product review: reading the technical documentation and judging whether the evidence supports the intended purpose. The other is system review: auditing the quality management system that designs, builds, and monitors the device.

The product review is where the claim meets scrutiny. Assessors read the intended purpose, the clinical evidence, the risk-management file, and the labeling, then ask whether each part reaches the claim being made. A device meant to detect a condition has to show evidence in the people who have it, gathered where the tool will be used. If the evidence falls short, the body can ask for more, narrow what the device may say, or decline to certify.

The system audit is less visible but matters just as much. A device is made continuously, through processes that drift, suppliers that change, and updates that alter behavior. The notified body checks that the quality system can keep producing the device that was assessed, and it returns for periodic audits rather than signing off once.

Why third-party review is the point, not the obstacle

An outside reviewer exists because self-judgment has a known weakness. A team that has spent years building a device is poorly placed to see its blind spots, not from carelessness but from closeness.

Consider the failure modes an honest internal team can still miss. A model trained mostly on one population can underperform quietly on another. An impressive number on a tidy test set can sag in a messy clinic. A fresh set of eyes, with no stake in the launch date, is likelier to name these problems early.

A meta-analysis I co-authored in Diabetes Care on ethnic differences in insulin sensitivity and response carried a durable lesson: an effect measured in one group may not transfer cleanly to another (doi 10.2337/dc12-1235). That is the kind of gap a developer can talk past and an independent assessor is positioned to catch. Third-party review is not a vote of no confidence. It recognizes that the people who build a device and the people who trust their lives to it are not the same.

What the CE mark does and does not promise

When the assessment succeeds, the manufacturer may affix the CE mark, often shown with the notified body's identification number for higher-risk devices. The mark signals that the device has been through the conformity-assessment route its risk class demands.

That signal means something specific, and it is easy to over-read. The CE mark says a device met the regulation's requirements for its intended purpose, judged against the evidence available at the time. It does not say the device is the best option, that it suits every patient, or that it will never need correction. Devices stay under post-market surveillance because some problems only surface once a product meets the full variety of real patients.

The mark also rests on the integrity of the body behind it, which is why notified bodies are themselves designated, monitored, and reassessed by national authorities. The arrangement is a chain of accountability. Authorities watch the bodies, the bodies watch the manufacturers, and manufacturers keep the device safe after launch.

How this shapes the way good teams build

Once you understand the notified body's role, it changes how you design from the first sprint rather than how you scramble at the end. The questions an assessor will ask are the ones a serious team should ask itself early: what are we claiming, what evidence reaches that claim, how could this fail in a real clinic, and how will we know if it stops working. I have looked at this from the development side as well as the regulatory one, through global drug development and as a co-developer of a diabetes decision-support tool evaluated in a registered randomized controlled trial (NCT03258268).

So when a higher-risk device reaches a clinic carrying a CE mark and a notified body's number, that mark is not a sticker. It is the visible end of a process in which someone with no stake in the launch examined the evidence and agreed it held. Whether a specific device is right for you is still a question for a clinician who knows your history.