Since 16 December 2025, regulatory managers have been answering the same question from their directors: do we still plan certificate renewals, PSUR cycles and PRRC arrangements the way the MDR requires today, or will Brussels change the rules first? The question usually comes with a headline claiming the MDR has already been “simplified”.
It has not. The MDR revision 2025 proposal, published by the European Commission as COM(2025) 1023, is a draft regulation. Until the European Parliament and the Council agree a text and it is published in the Official Journal, Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) apply exactly as they stand. This article explains what the proposal would change, where it stands in the legislative process, and how to plan without betting on the outcome.
What COM(2025) 1023 is, and what it is not
COM(2025) 1023 final is a Commission proposal for a regulation amending the MDR and the IVDR “as regards simplifying and reducing the burden” of the rules. It also proposes amendments to Regulation (EU) 2022/123 (the EMA’s expanded mandate) and Regulation (EU) 2024/1689 (the AI Act). It was adopted in Strasbourg on 16 December 2025 under procedure number 2025/0404(COD), with Article 114 and Article 168(4)(c) TFEU as its legal basis.
That makes it the start of the ordinary legislative procedure, not the end. In practice:
- Nothing in it applies today. Notified bodies, competent authorities and manufacturers remain bound by the current MDR and IVDR.
- Every provision can change. Parliament and the Council will each adopt a position and then negotiate a final text.
- Status on 10 November 2026: Parliament’s Legislative Observatory lists the file as “awaiting committee decision”, with the Committee on Public Health (SANT) responsible and an indicative plenary date of 14 December 2026. An indicative date is a forecast, not a commitment. Council working documents from June 2026 show Member States examining the text.
Certificates, audits and notified body procedures
The changes most discussed in boardrooms concern certification. Under Article 56(2) MDR today, a certificate is valid for the period it indicates, which “shall not exceed five years”, and is extended only after re-assessment. The proposal would:
- Remove the five-year maximum validity of certificates under Article 56 MDR and Article 51 IVDR, replacing routine recertification with periodic reviews proportionate to risk.
- Reduce surveillance audit frequency to every two years where the absence of safety issues justifies it, and make unannounced audits “for-cause”.
- Sample technical documentation for Class IIa and non-implantable Class IIb devices: according to Recital 30, assessment would only be needed for one representative device per category or generic device group.
- Create a legal basis for structured dialogue between notified bodies and manufacturers before and after submission, in Annex VII.
- Reduce notified body fees for micro and small manufacturers and for orphan devices, and empower the Commission to set the level and structure of fees (Article 50 MDR).
- Drop the separate notified body validation of the summary of safety and clinical performance (Recital 24).
PRRC, well-established technologies and classification
Article 15 MDR currently sets two qualification routes for the person responsible for regulatory compliance: a relevant degree plus one year of regulatory or QMS experience, or four years of such experience. The proposal would remove these detailed criteria in favour of “requisite expertise”. Micro and small enterprises would need a PRRC at their disposal, without today’s wording that the person be available “permanently and continuously”. Our guide to the PRRC under Article 15 covers what applies now.
Other structural changes:
- Well-established technologies would get a definition (new point 72 of Article 2 MDR), based on MDCG guidance, replacing the device lists in Articles 18(3), 52(4) and 61(6)(b).
- Annex VIII would be amended so that some devices fall into a lower class. The Commission names reusable surgical instruments, accessories for active implantable devices and certain software as examples. Until then, apply the current rules; see our MDR classification rules with worked examples.
- Class A sterile IVDs would no longer require notified body involvement under the IVDR.
Post-market surveillance, vigilance and cybersecurity in the MDR revision 2025 proposal
Today, Article 86(1) MDR requires a PSUR for Class IIb and III devices “at least annually”, and for Class IIa “when necessary and at least every two years”. The proposal would reduce update frequency according to risk class (Recital 41) and fold the notified body’s PSUR review into surveillance.
Article 87(3) MDR sets an outer limit of 15 days for reporting a serious incident. The proposal would allow 30 days, but only for serious incidents that do not involve a serious public health threat, death or a serious deterioration in health; those cases have their own, shorter limits in Article 87(4) and (5).
On cybersecurity, the proposal would add cybersecurity to the general safety and performance requirements in Annex I and introduce a new Article 87a MDR (Article 82a IVDR): actively exploited vulnerabilities and severe incidents would be shared with national CSIRTs and ENISA through EUDAMED.
Innovation, digital labelling and in-house devices
- Orphan and breakthrough devices: a new Article 52a MDR and Article 48a IVDR would let an expert panel designate such devices for priority conformity assessment and rolling review.
- Digital documents: the EU declaration of conformity could be digital, and some label information could be provided digitally, subject to future implementing rules.
- In-house devices (Article 5(5)): transfers between health institutions would be allowed where justified by patient safety or public health; under the IVDR, the condition that no equivalent device is on the market would be removed.
- AI Act: the MDR and IVDR would move from Section A to Section B of Annex I to Regulation (EU) 2024/1689, changing how AI Act obligations reach AI-enabled devices.
The Commission estimates the combined quantifiable savings at more than €3 billion per year (SWD(2025) 1050). That is the Commission’s estimate, not a measured outcome.
What the proposal does not change today
Three things stay fixed until a final text is published. The extended transition dates in Article 120 MDR, as amended by Regulation (EU) 2023/607, remain the law; see MDR transition deadlines under Regulation (EU) 2023/607. The four EUDAMED modules have been mandatory since 28 May 2026; see EUDAMED mandatory registration. And certificates still expire on the date printed on them.
Where this goes wrong
- Letting a certificate run down. Manufacturers who read “no more recertification” delay their renewal application. If the revision is not in force when the certificate expires, the device cannot be placed on the market on that certificate.
- Restructuring the PRRC early. Replacing a qualified PRRC with someone who meets only the proposed “requisite expertise” test leaves you nonconforming with Article 15 as it stands.
- Cutting the PSUR cycle. A Class IIb PSUR skipped in anticipation of a two-year cycle is a finding at the next surveillance audit.
- Reporting serious incidents on a 30-day clock. The 15-day limit in Article 87(3) applies until amended. Update procedures only when the law changes.
- Self-reclassifying. Downgrading a reusable surgical instrument or software because a proposal mentions it changes nothing in Annex VIII today and will be challenged by your notified body.
- Promising dates to investors. No adoption or application date is fixed. Board papers that state one create expectations nobody can meet.
- Ignoring the parts that add work. Cybersecurity reporting would be a new obligation. Technical files that treat cybersecurity lightly will need attention whichever text is adopted.
How to plan while the text is negotiated
Comply with the current MDR and IVDR. Keep a short watch list of the provisions that would affect your portfolio, such as certificate validity, PSUR class, classification of specific products and in-house use. Map which products each would touch, and revisit the list when Parliament votes, when the Council agrees its mandate, and when the final text is published. Changes to procedures should follow the published regulation, not the proposal.
Frequently asked questions
Is the MDR revision 2025 proposal already law?
No. COM(2025) 1023 is a Commission proposal published on 16 December 2025. It must be adopted by both the European Parliament and the Council under the ordinary legislative procedure and then published in the Official Journal before any of it applies. Until then, the MDR and IVDR apply as currently in force, including all certificate, PSUR and vigilance obligations.
When will the revised MDR and IVDR apply?
No date is fixed. As at 10 November 2026, Parliament’s committee had not yet voted, and the Council and Parliament still had to agree a final text. The proposal itself defers some provisions to later application dates after entry into force. Any date quoted before the regulation is published in the Official Journal is a forecast, not a deadline.
Will MDR certificates stop expiring?
Under the proposal, the five-year maximum validity in Article 56 MDR and Article 51 IVDR would be removed and replaced by periodic, risk-based reviews. That is not yet law. Today a certificate is valid for the period it states, up to five years, and must be renewed through re-assessment. Plan renewal applications on that basis.
Does the proposal change who can be my PRRC now?
No. Article 15 MDR and IVDR still require either a relevant degree plus one year of regulatory or quality management experience, or four years of such experience. Micro and small enterprises must have the PRRC permanently and continuously at their disposal. The proposal would relax these requirements, but only once adopted and applicable.
Should a manufacturer wait for the revision before starting CE marking?
Waiting is rarely sensible. The final text and its application dates are unknown, and conformity assessment under the current MDR or IVDR takes time. Building a compliant technical file now does not become wasted work: clinical evidence, risk management and post-market surveillance remain central whatever is adopted. Keep the revision on a watch list instead.
If you need a clear view of which proposed changes would affect your portfolio, and a compliance plan built on the rules that apply today, Medfins can help. We have supported 175+ regulatory projects covering 250+ products for 100+ clients. See our CE marking support under EU MDR and IVDR, or contact our regulatory team.
