CE Marking for Digital Health Under EU MDR

Navigating CE Marking for Digital Health Technologies Under EU MDR 2017/745

A comprehensive regulatory pathway for software as a medical device (SaMD), AI diagnostics, and mobile health apps in the European Union.

CE Marking of Digital Health Technologies: EU MDR Compliance Guide

Digital health technologies are transforming modern healthcare delivery. From mobile health applications and cloud-based AI diagnostic tools to wearable sensors that continuously track chronic conditions like diabetes or arrhythmia, software has become central to clinical decision-making.

However, rapid innovation brings heightened regulatory scrutiny. In the European Union (EU), manufacturers and software developers must comply with the EU Medical Devices Regulation (EU MDR 2017/745). Replacing the legacy Medical Device Directive (MDD), the EU MDR imposes stricter classification rules, expanded technical documentation, and rigorous post-market oversight—particularly for digital health software and independent applications.

Connect with our regulatory experts today

Understanding Medical Software Under EU MDR

Before introducing any digital health product to the European market, manufacturers must evaluate whether their software qualifies as Medical Device Software (MDSW) or Software as a Medical Device (SaMD).

According to Article 2(1) of EU MDR 2017/745, a product is regulated as a medical device if its intended purpose includes:

Diagnosis, prevention, monitoring, prediction, prognosis, treatment, or alleviation of disease.

Diagnosis, monitoring, treatment, or alleviation of an injury or disability.

Investigation, replacement, or modification of an anatomical or physiological process.

Providing information derived from in vitro examination of human specimens.

The inclusion of prediction and prognosis under EU MDR significantly widens the regulatory envelope. Algorithms that analyze patient risk trends or forecast disease onset are now treated as active medical devices.

EU MDR Rule 11: Software Classification Breakdown

The most significant regulatory hurdle for digital health software stems from Annex VIII, Rule 11 of the EU MDR. Under the old MDD framework, most standalone software fell into Class I (self-certification). Under Rule 11, the vast majority of medical software is up-classified to Class IIa, Class IIb, or Class III, requiring mandatory audit by a Notified Body.

MDR Rule 11 CategorySoftware Purpose / FunctionResulting MDR ClassDiagnostic & Therapeutic DecisionsSoftware providing information used to take diagnostic or treatment decisions.Class IIa (default)High-Risk Clinical ImpactIf decisions could cause serious health deterioration or surgical intervention.Class IIbCritical Clinical ImpactIf decisions could lead to death or irreversible health damage.Class IIIPhysiological MonitoringSoftware intended to monitor physiological parameters.Class IIa (default)Vital Parameter MonitoringMonitoring vital parameters where variation poses immediate danger.Class IIbAll Other SoftwareGeneral software with indirect medical utility non-critical to health.Class I

Medical Software as an Active Device & Lifecycle Standards

Under Article 2(4), standalone software is legally defined as an active medical device. Compliance for CE marking of digital health technologies requires building technical documentation in parallel across international standards:

IEC 62304 (Software Lifecycle Processes): Requires establishing software safety classes (Class A, B, or C) to validate architectural design, unit testing, release management, and bug tracking.

ISO 14971 (Risk Management): Demands systematic evaluation of software hazards, including algorithmic failures, display errors, and cybersecurity breaches.

ISO 13485 (Quality Management System): Mandatory quality framework covering design controls, software configuration management, and corrective actions (CAPA).

Annex II & III Technical Documentation: Includes verification, clinical evaluation reports (CER under MDCG 2020-1), and post-market clinical follow-up (PMCF) plans.

Predictive AI, Cloud Platforms, and Modular Software

Modern health apps operate on smartphones, tablets, and cloud environments. Per MDCG 2019-11 revision guidelines, manufacturers can utilize a modular architecture strategy.

If your app contains non-medical lifestyle features alongside clinical diagnostic algorithms, you can isolate and CE-mark only the medical modules under EU MDR. This approach limits the regulatory burden while ensuring robust cybersecurity, data integrity, and interoperability across cloud environments.

Unsure of your software’s risk class under EU MDR Rule 11?

Get a personalized classification consultation with NKB Regovanta today!

Medical Device Software vs. Wellness & Fitness Apps

Not all digital health applications require a CE mark under EU MDR. The distinguishing factor is the manufacturer’s intended medical purpose.

Feature / CriteriaMedical Device Software (MDSW)Wellness & Fitness AppsIntended PurposeDiagnostic, monitoring, or therapeutic decision-making.Fitness tracking, exercise logs, lifestyle advice.EU MDR ScopeRegulated under Article 2(1) & Rule 11.Exempt (Article 1, Paragraph 19).Notified Body NeedMandatory for Class IIa, IIb, and III.None required.ExampleApp analyzing ECG data for atrial fibrillation.Pedometer app counting daily steps.

GDPR Compliance and Data Protection in Digital Health

In addition to EU MDR conformity, manufacturers must maintain full compliance with the General Data Protection Regulation (GDPR).

Digital health solutions handle sensitive patient data (protected health information). Compliance requires Privacy by Design, user consent management, end-to-end data encryption, and explicit protocol definitions for cloud data storage and continuous software updates.

Navigating Digital Health CE Marking with NKB Regovanta

At NKB Regovanta, we provide end-to-end regulatory consulting services to assist medical software developers, health tech startups, and global device manufacturers in securing EU MDR approval efficiently:

MDR Rule 11 Qualification & Classification: Precise evaluation of your software's intended purpose to establish correct risk classification and avoid costly up-classification delays.

Quality Management Systems (ISO 13485 & IEC 62304): Implementation of compliant software development lifecycle processes, configuration controls, and CAPA systems tailored for digital health.

Technical Documentation & CER Preparation: Comprehensive compilation of Annex II/III technical files, software validation protocols, risk management files (ISO 14971), and Clinical Evaluation Reports.

Cybersecurity & GDPR Data Controls: Integration of robust data protection controls, secure network architecture, and privacy compliance into your technical file.

Notified Body Coordination & EUDAMED Submission: Seamless coordination with accredited European Notified Bodies, EU Authorized Representative (EC REP) representation, and full EUDAMED database registration.

streamline your CE marking journey and secure EU market access

Get Expert Consultation to achieve CE compliance

FAQ's

Does all health software require a CE mark under EU MDR?

No. Only software with an intended medical purpose—such as diagnosis, monitoring, prevention, or treatment—requires CE marking under EU MDR.

What is EU MDR Annex VIII Rule 11?

Rule 11 is the software-specific classification rule under EU MDR that assigns software into Class I, IIa, IIb, or III based on patient risk and clinical impact.

Do mobile health apps need Notified Body approval?

Yes, if the mHealth app supports clinical decisions or monitors vital parameters, it typically falls under Class IIa or higher, requiring Notified Body certification.

Which software lifecycle standard is required for CE marking?

Manufacturers must follow IEC 62304, which defines software development, maintenance, risk management, and lifecycle requirements.

Can general wellness apps be upgraded to medical devices later?

Yes, expanding software claims to include diagnostic or disease-monitoring features reclassifies the application as a medical device requiring EU MDR CE marking.