EU MDR Transition Deadlines: What Regulation 2023/607 Really Requires Before 2027
When the European Commission extended the Medical Device Regulation (MDR) transition in 2023, many manufacturers treated it as a reprieve. It was actually a conditional bridge with fixed tollbooths. Regulation (EU) 2023/607 did not simply move the finish line; it attached conditions to the extension that had to be met by specific dates in 2024, and it left the core obligation untouched: every legacy device that a manufacturer wants to keep on the EU market must be certified under the MDR by the end of 2027 or 2028, depending on risk class.
As of late 2026, the first of those final deadlines is roughly fifteen months away. At the same time, a Commission proposal to simplify the MDR and IVDR is working its way through the legislative process, and EUDAMED has become mandatory for its first four modules. For regulatory affairs teams, that combination creates real risk of misplanning: assuming the proposal will rescue late projects, or assuming a legacy certificate is still valid when the conditions attached to it were never fully satisfied.
This article sets out what the extension actually requires, where manufacturers are most exposed, and a practical sequence for closing out the transition portfolio.
What Regulation (EU) 2023/607 Actually Changed
Regulation (EU) 2023/607 amended Article 120 of the MDR in three important ways.
1. It extended the validity of legacy certificates. Certificates issued under the Medical Devices Directive (MDD) or the Active Implantable Medical Devices Directive (AIMDD) that were still valid on 20 March 2023 (or that had expired after 26 May 2021 under specific conditions) were deemed valid until the new transition deadlines, provided the conditions below are met.
2. It set staggered, risk-based deadlines.
31 December 2027 for Class III devices and Class IIb implantable devices (except sutures, staples, dental fillings, braces, tooth crowns, screws, wedges, plates, wires, pins, clips and connectors, which fall into the later group).
31 December 2028 for other Class IIb devices, Class IIa devices, and Class I devices placed on the market in sterile condition or with a measuring function, as well as devices that were self-declared Class I under the MDD but require notified body involvement under the MDR (the "up-classified" group).
26 May 2026 for Class III custom-made implantable devices, which needed an MDR certificate by that date (or a lodged application and signed agreement by 26 May 2024 to benefit from the extension).
3. It removed the "sell-off" date. Devices already placed on the market under the directives no longer have a hard cut-off after which they must be withdrawn from the supply chain. Stock legitimately placed on the market can continue to be made available.
The Conditions That Most Teams Underestimate
The extension is not automatic. A legacy device only benefits if all of the following are true:
The device continues to comply with the MDD or AIMDD. Legacy status does not freeze compliance; the device must still meet the directive's essential requirements.
There are no significant changes in design or intended purpose. MDCG 2020-3 (Rev.1) remains the reference for what counts as "significant." A new indication, a new material in contact with the patient, a change in sterilization method, or a software change that alters the clinical function can all end legacy status for that device.
The device does not present an unacceptable risk to the health or safety of patients, users or other persons.
The manufacturer put in place an MDR-compliant quality management system in accordance with MDR Article 10(9) no later than 26 May 2024.
The manufacturer lodged a formal application with a notified body for MDR conformity assessment of the legacy device (or a substitute device) no later than 26 May 2024, and signed a written agreement with that notified body no later than 26 September 2024.
From 26 September 2024, the MDR notified body is responsible for appropriate surveillance of the legacy device, taking over from the directive notified body where they differ.
Two of these conditions deserve particular attention in 2026.
The "no significant change" trap
Legacy devices are still being manufactured, and manufacturing brings change: supplier substitutions, component obsolescence, cybersecurity patches, labeling updates. Each of these requires a documented assessment against MDCG 2020-3. The failure mode is not that teams skip the assessment; it is that they treat it as a formality, approving changes on the basis of "no impact on safety and performance" without mapping the change against the specific flowcharts in the guidance. When a notified body reviews those change records during surveillance, a poorly reasoned conclusion can call the device's legacy status into question retroactively.
Practical step: Maintain a single "legacy change register" per device that records each change, the MDCG 2020-3 chart applied, the conclusion, and whether the notified body was informed. Notified bodies increasingly ask to see exactly this.
The surveillance handover
Where the legacy certificate was issued by one notified body and the MDR application is with another, the MDR notified body took over "appropriate surveillance" from 26 September 2024. Many manufacturers still have unclear tripartite agreements, or no clear understanding of which body audits what. If your legacy and MDR notified bodies differ, confirm in writing which body holds surveillance responsibility, what the audit schedule is, and how vigilance and change notifications should be routed.
Where Portfolios Actually Stand
The extension succeeded in preventing a cliff-edge in 2024, but it did not remove the underlying capacity constraint: notified body review of MDR technical documentation remains slow, and first-round reviews commonly generate extensive nonconformity lists. The Commission's own notified body surveys have consistently shown a gap between the number of applications lodged and the number of certificates issued, and the queue is weighted toward the higher-risk devices that face the earlier December 2027 deadline.
That means a manufacturer whose Class III or implantable IIb application is still in first-round technical documentation review in late 2026 has limited room for a second or third round. Realistically, a device that has not cleared technical documentation review by mid-2027 is at risk of missing the deadline.
What the December 2025 Simplification Proposal Does (and Does Not) Do
On 16 December 2025, the Commission published a proposal to amend the MDR and IVDR (COM(2025) 1023). Among its headline changes:
Replacing the fixed five-year certificate renewal cycle with risk-based periodic reviews.
Adjusting PSUR frequency, with Class IIb and III updates after the first year and then every two years, and Class IIa updates only when necessary.
A formal legal basis for structured dialogue with notified bodies before and after submission.
Pre-agreed change control plans that distinguish changes requiring notification, approval, or neither.
Dedicated pathways for orphan and breakthrough devices, including priority conformity assessment.
Digital-by-default measures, including electronic submissions and expanded use of electronic instructions for use.
These are meaningful improvements, particularly for lifecycle management after certification. But the proposal is a proposal. It must pass through the European Parliament and the Council, and its final content may differ. Critically, it is not a substitute for meeting the December 2027 and December 2028 deadlines. Planning a transition portfolio on the assumption that the proposal will extend deadlines further is a regulatory risk, not a strategy. Treat any relief as upside.
EUDAMED Is Now Part of the Transition
Regulation (EU) 2024/1860 allowed EUDAMED modules to become mandatory individually once declared functional. Following the Commission notice published in November 2025, the first four modules (actor registration, UDI/device registration, notified bodies and certificates, and market surveillance) became mandatory from 28 May 2026.
For transition planning, this matters in three ways:
Devices certified under the MDR must now be registered in EUDAMED on the applicable timelines, including Basic UDI-DI and UDI-DI data.
Legacy devices also have registration obligations under the transitional provisions of Regulation 2024/1860, with specified grace periods for devices already on the market.
Certificate data entered by notified bodies becomes visible, which means gaps between what a manufacturer says it holds and what EUDAMED shows will be noticed by distributors, hospital procurement teams and competent authorities.
If your UDI data is still maintained in spreadsheets across regions, reconciling it with EUDAMED should be treated as a transition workstream, not an IT side project.
A Practical Close-Out Sequence for 2026–2028
For teams managing a mixed portfolio of legacy and MDR devices, the following sequence has proven effective.
Step 1: Build a single portfolio truth table
For every device family, record: current certificate (directive or MDR), certificate number and notified body, risk class under the MDR, applicable deadline (26 May 2026, 31 December 2027, or 31 December 2028), date the formal application was lodged, date the written agreement was signed, current review stage, open nonconformities, and EUDAMED registration status. This table should be owned by regulatory affairs and reviewed monthly at management review.
Step 2: Confirm eligibility evidence
For each legacy device relying on the extension, assemble a short eligibility file: the QMS evidence as of 26 May 2024, the application acknowledgment, the signed agreement, the notified body's confirmation letter (many notified bodies issue these to support market access), and the legacy change register. Distributors and tender authorities frequently request confirmation letters, and having them ready avoids sales disruption.
Step 3: Rationalize the portfolio honestly
Not every legacy device will justify MDR certification. Low-volume variants, devices with weak clinical data, or products with an equivalent device that will be certified are candidates for discontinuation. Make those decisions early and communicate them to customers with realistic timelines. A late withdrawal is more damaging to customer relationships than a planned one.
Step 4: Front-load clinical evidence
The most common source of prolonged notified body review is the clinical evaluation. Common deficiencies include equivalence claims that do not meet MDR Article 61 and MDCG 2020-5 requirements, state-of-the-art sections that are generic rather than device-specific, and post-market clinical follow-up (PMCF) plans that do not address the residual uncertainties identified in the clinical evaluation report. Resolve these before submission, not in response to a deficiency letter.
Step 5: Plan for review rounds
Assume at least two rounds of technical documentation questions for Class III and implantable devices. Work backward from the deadline: if a round takes two to four months including your response, a Class III device whose documentation was submitted in late 2026 has limited slack. Negotiate review slots early and keep responses complete; partial answers usually generate a further round.
Step 6: Align post-market surveillance now
MDR post-market surveillance obligations, including PSURs for Class IIa and above and the post-market surveillance plan required by Annex III, apply to legacy devices as well. Notified bodies conducting surveillance will look for them. Ensure that vigilance, trend reporting and PSUR processes cover the full portfolio, not only MDR-certified devices.
Working Effectively with Your Notified Body
Notified body capacity has grown since 2021, but the relationship still determines how fast a file moves. Several habits consistently shorten review timelines.
Submit complete files, not placeholders. Incomplete sections do not reserve a place in the queue; they generate deficiency letters and restart clocks. If a biocompatibility report or usability summary is not final, delay the submission of that device rather than submitting a partial file.
Use a navigable structure. Organize technical documentation strictly according to MDR Annex II and Annex III headings, with a cross-reference table mapping each General Safety and Performance Requirement (GSPR) in Annex I to the evidence that addresses it. Reviewers who can find evidence quickly raise fewer questions.
Answer the question that was asked. Deficiency responses should restate each question, give a direct answer, and point to the exact revised page or section. Long narrative responses that re-argue the whole file tend to trigger follow-up rounds.
Track reviewer themes across devices. Notified bodies often raise the same deficiency across a product family. Maintain a lessons-learned log and fix recurring issues across all pending files before the reviewer finds them again.
Agree on timelines explicitly. Ask for estimated review windows at each stage and record them in the portfolio truth table. When a date slips, escalate early through your account manager rather than waiting for the deadline to approach.
Don't Forget the Supply Chain
MDR obligations extend beyond the manufacturer. Importers (Article 13) and distributors (Article 14) must verify that devices carry the CE mark, have a declaration of conformity, are properly labeled, and, where applicable, have been assigned a UDI. During the transition, these operators often ask for proof that a legacy device is still lawfully on the market.
Prepare a standard "legacy status" package for commercial partners that includes the notified body confirmation letter, a statement of the applicable transition deadline, and a contact point for questions. Also review your authorized representative agreement (Article 11) if you are a non-EU manufacturer: the authorized representative shares liability for defective devices under the MDR and will expect visibility into your transition status.
Finally, confirm that your Person Responsible for Regulatory Compliance (PRRC) under Article 15 has documented oversight of the transition, including release of devices, vigilance reporting and the conformity of technical documentation. Notified bodies frequently interview the PRRC during audits, and a PRRC unfamiliar with the transition status of the portfolio is a finding waiting to happen.
Common Questions from RA Teams
Can we still make changes to a legacy device?
Yes, provided they are not significant changes under MDCG 2020-3. Non-significant changes must still be assessed, documented and, where the certificate conditions require it, notified to the notified body.
What happens if we miss the deadline?
The legacy certificate stops providing a legal basis for placing the device on the market after the applicable date. Devices already placed on the market before that date can continue to be made available (because the sell-off date was removed), but no new units can be placed on the market until an MDR certificate is issued.
Does the extension apply to IVDs?
No. IVDs follow the IVDR transitional provisions, which were separately amended by Regulation (EU) 2024/1860 and have their own class-based deadlines.
Should we wait for the simplification proposal before finalizing documentation?
No. The current MDR requirements apply until any amendment is adopted and applies. Documentation built to today's requirements will remain compliant; documentation delayed in hopes of relief may not be reviewed in time.
The Bottom Line
The MDR extension bought time, but it also created an assumption that more time would follow. For regulatory affairs professionals, the job in the next fifteen months is to replace that assumption with evidence: evidence that each legacy device still qualifies, evidence that the application is progressing, and evidence that the portfolio decisions have been made deliberately. Teams that maintain a live portfolio truth table and treat the 2027 and 2028 dates as fixed will be positioned to benefit from any future simplification rather than depending on it.
Sources
Regulation (EU) 2023/607 amending Regulations (EU) 2017/745 and (EU) 2017/746 as regards transitional provisions (EUR-Lex)
European Commission, Proposal COM(2025) 1023 final, 16 December 2025: health.ec.europa.eu
European Commission, "The EUDAMED four first modules will be mandatory to use as from 28 May 2026": health.ec.europa.eu
MDCG 2020-3 Rev.1, Guidance on significant changes regarding the transitional provision under Article 120 of the MDR
MDCG 2020-5, Clinical evaluation – equivalence
TGA, EU MDR transition extension: tga.gov.au
Comments