Annex 7 – Requirements to be met by notified bodies

• the provision of adequate resources for conformity assessment activities;
• the development of procedures and policies for the operation of the notified body;
• the supervision of implementation of the procedures, policies and quality management systems of the notified body;
• the supervision of the notified body’s finances;
• the activities and decisions taken by the notified body, including contractual agreements;
• the delegation of authority to personnel and/or committees, where necessary, for the performance of defined activities;
• the interaction with the authority responsible for notified bodies and the obligations regarding communications with other competent authorities, the Commission and other notified bodies.

1. be the designer, manufacturer, supplier, installer, purchaser, owner or maintainer of devices which they assess, nor the authorised representative of any of those parties. Such restriction shall not preclude the purchase and use of assessed devices that are necessary for the operations of the notified body and the conduct of the conformity assessment, or the use of such devices for personal purposes;
2. be involved in the design, manufacture or construction, marketing, installation and use, or maintenance of the devices for which they are designated, nor represent the parties engaged in those activities;
3. engage in any activity that may conflict with their independence of judgement or integrity in relation to conformity assessment activities for which they are designated;
4. offer or provide any service which may jeopardise the confidence in their independence, impartiality or objectivity. In particular, they shall not offer or provide consultancy services to the manufacturer, its authorised representative, a supplier or a commercial competitor as regards the design, construction, marketing or maintenance of devices or processes under assessment, and
5. be linked to any organisation which itself provides consultancy services as referred to in point (d). Such restriction does not preclude general training activities that are not client specific and that relate to regulation of devices or to related standards.

The notified body shall have at its disposal the financial resources required to conduct its conformity assessment activities within its scope of designation and related business operations. It shall document and provide evidence of its financial capacity and its long-term economic viability, taking into account, where relevant, any specific circumstances during an initial start-up phase.

• management system structure and documentation, including policies and objectives for its activities;
• policies for assignment of activities and responsibilities to personnel;
• assessment and decision-making processes in accordance with the tasks, responsibilities and role of the notified body’s personnel and top-level management;
• the planning, conduct, evaluation and, if necessary, adaptation of its conformity assessment procedures;
• control of documents;
• control of records;
• management reviews;
• internal audits;
• corrective and preventive actions;
• complaints and appeals; and
• continuous training.

Where documents are used in various languages, the notified body shall ensure and control that they have the same content.

In particular, notified bodies shall have the necessary personnel and possess or have access to all equipment, facilities and competence needed to perform properly the technical, scientific and administrative tasks entailed in the conformity assessment activities in relation to which they have been designated.

Such requirement presupposes at all times and for each conformity assessment procedure and each type of devices in relation to which they have been designated, that the notified body has permanent availability of sufficient administrative, technical and scientific personnel who possess experience and knowledge relating to the relevant devices and the corresponding technologies. Such personnel shall be in sufficient numbers to ensure that the notified body in question can perform the conformity assessment tasks, including the assessment of the medical functionality, clinical evaluations and the performance and safety of devices, for which it has been designated, having regard to the requirements of this Regulation, in particular, those set out in Annex I.

A notified body’s cumulative competences shall be such as to enable it to assess the types of devices for which it is designated. The notified body shall have sufficient internal competence to critically evaluate assessments conducted by external expertise. Tasks which a notified body is precluded from subcontracting are set out in Section 4.1.

Personnel involved in the management of the operation of a notified body’s conformity assessment activities for devices shall have appropriate knowledge to set up and operate a system for the selection of assessment and verification staff, for verification of their competence, for authorisation and allocation of their tasks, for organisation of their initial and ongoing training and for the assignment of their duties and the monitoring of those staff, in order to ensure that personnel who carry out and perform assessment and verification operations are competent to fulfil the tasks required of them.

The notified body shall identify at least one individual within its top-level management as having overall responsibility for all conformity assessment activities in relation to devices.

Specific qualification criteria shall be defined at least for the assessment of:

• the pre-clinical evaluation,
• clinical evaluation,
• tissues and cells of human and animal origin,
• functional safety,
• software,
• packaging,
• devices that incorporate as an integral part a medicinal product,
• devices that are composed of substances or of combinations of substances that are absorbed by or locally dispersed in the human body and
• the different types of sterilisation processes.

• Union devices legislation and relevant guidance documents;
• the conformity assessment procedures provided for in this Regulation;
• a broad base of knowledge of device technologies and the design and manufacture of devices;
• the notified body’s quality management system, related procedures and the required qualification criteria;
• training relevant to personnel involved in conformity assessment activities in relation to devices;
• adequate experience in conformity assessments under this Regulation or previously applicable law within a notified body.

• identify when specialist input is required for the assessment of the clinical evaluation conducted by the manufacturer and identify appropriately qualified experts;
• appropriately train external clinical experts in the relevant requirements of this Regulation, CS, guidance and harmonised standards and ensure that the external clinical experts are fully aware of the context and implications of their assessment and the advice they provide;
• be able to review and scientifically challenge the clinical data contained within the clinical evaluation, and any associated clinical investigations, and appropriately guide external clinical experts in the assessment of the clinical evaluation presented by the manufacturer;
• be able to scientifically evaluate and, if necessary, challenge the clinical evaluation presented, and the results of the external clinical experts’ assessment of the manufacturer’s clinical evaluation;
• be able to ascertain the comparability and consistency of the assessments of clinical evaluations conducted by clinical experts;
• be able to make an assessment of the manufacturer’s clinical evaluation and a clinical judgement of the opinion provided by any external expert and make a recommendation to the notified body’s decision maker; and
• be able to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.

• successful completion of a university or a technical college degree or equivalent qualification in relevant studies, e.g. medicine, pharmacy, engineering or other relevant sciences;
• four years’ professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing or research, of which two years shall be in the design, manufacture, testing or use of the device or technology to be assessed or related to the scientific aspects to be assessed;
• knowledge of device legislation, including the general safety and performance requirements set out in Annex I;
• appropriate knowledge and experience of relevant harmonised standards, CS and guidance documents;
• appropriate knowledge and experience of risk management and related device standards and guidance documents;
• appropriate knowledge and experience of clinical evaluation;
• appropriate knowledge of the devices which they are assessing;
• appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those assessments;
• the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.

• successful completion of a university or a technical college degree or equivalent qualification in relevant studies, such as medicine, pharmacy, engineering or other relevant sciences;
• four years’ professional experience in the field of healthcare products or related activities, such as in manufacturing, auditing or research, of which two years shall be in the area of quality management;
• appropriate knowledge of devices legislation as well as related harmonised standards, CS and guidance documents;
• appropriate knowledge and experience of risk management and related device standards and guidance documents;
• appropriate knowledge of quality management systems and related standards and guidance documents;
• appropriate knowledge and experience of the conformity assessment procedures laid down in Annexes IX to XI, in particular of the aspects of those procedures for which they are responsible, and adequate authorisation for carrying out those audits;
• training in auditing techniques enabling them to challenge quality management systems;
• the ability to draw up records and reports demonstrating that the relevant conformity assessment activities have been appropriately carried out.

• devices legislation and relevant guidance documents;
• the device conformity assessments relevant to this Regulation;
• the types of qualifications, experience and expertise relevant to device conformity assessment;
• a broad base of knowledge of device technologies, including sufficient experience of conformity assessment of devices being reviewed for certification, the device industry and the design and manufacture of devices;
• the notified body’s quality management system, related procedures and the required qualifications for personnel involved;
• the ability to draw up records and reports demonstrating that the conformity assessment activities have been appropriately carried out.

• a matrix detailing the authorisations and responsibilities of the personnel in respect of conformity assessment activities; and
• records attesting to the required knowledge and experience for the conformity assessment activity for which they are authorised. The records shall contain a rationale for defining the scope of the responsibilities for each of the assessment personnel and records of the conformity assessment activities carried out by each of them.

The subcontracting of the auditing of quality management systems or of product related reviews as a whole shall not be permitted; nevertheless parts of those activities may be conducted by subcontractors and external auditors and experts working on behalf of the notified body. The notified body in question shall retain full responsibility for being able to produce appropriate evidence of the competence of subcontractors and experts to fulfil their specific tasks, for making a decision based on a subcontractor’s assessment and for the work conducted by subcontractors and experts on its behalf.

The following activities may not be subcontracted by notified bodies:

• review of the qualifications and monitoring of the performance of external experts;
• auditing and certification activities where the subcontracting in question is to auditing or certification organisations;
• allocation of work to external experts for specific conformity assessment activities; and
• final review and decision making functions.

• the subcontractor meets the relevant requirements of this Annex;
• subcontractors and external experts do not further subcontract work to organisations or personnel; and
• the natural or legal person that applied for conformity assessment has been informed of the requirements referred to in the first and second indent.

Any subcontracting or consultation of external personnel shall be properly documented, shall not involve any intermediaries and shall be subject to a written agreement covering, among other things, confidentiality and conflicts of interest. The notified body in question shall take full responsibility for the tasks performed by subcontractors.

• are aware of Union and national law in force on devices, relevant harmonised standards, CS, guidance documents and the results of the coordination activities referred to in Section 1.6; and
• take part in the internal exchange of experience and the continuous training and education programme referred to in Section 3.1.2.

The notified body shall have in place documented processes and sufficiently detailed procedures for the conduct of each conformity assessment activity for which it is designated, comprising the individual steps from pre-application activities up to decision making and surveillance and taking into account, when necessary, the respective specificities of the devices.

The requirements laid down in Sections 4.3, 4.4, 4.7 and 4.8 shall be fulfilled as part of the internal activities of notified bodies and shall not be subcontracted.

The notified body shall:

1. publish a publicly available description of the application procedure by which manufacturers can obtain certification from it. That description shall include which languages are acceptable for submission of documentation and for any related correspondence;
2. have documented procedures relating to, and documented details about, fees charged for specific conformity assessment activities and any other financial conditions relating to notified bodies’ assessment activities for devices;
3. have documented procedures in relation to advertising of their conformity assessment services. Those procedures shall ensure that advertising or promotional activities in no way imply or are capable of leading to an inference that their conformity assessment will offer manufacturers earlier market access or be quicker, easier or less stringent than that of other notified bodies;
4. have documented procedures requiring the review of pre-application information, including the preliminary verification that the product is covered by this Regulation and its classification, prior to issuing any quotation to the manufacturer relating to a specific conformity assessment; and
5. ensure that all contracts relating to the conformity assessment activities covered by this Regulation are concluded directly between the manufacturer and the notified body and not with any other organisation.

The notified body shall require a formal application signed by a manufacturer or an authorised representative containing all of the information and the manufacturer’s declarations required by the relevant conformity assessment as referred to in Annexes IX to XI.

The contract between a notified body and a manufacturer shall take the form of a written agreement signed by both parties. It shall be kept by the notified body. This contract shall have clear terms and conditions and contain obligations that enable the notified body to act as required under this Regulation, including an obligation on the manufacturer to inform the notified body of vigilance reports, the right of the notified body to suspend, restrict or withdraw certificates issued and the duty of the notified body to fulfil its information obligations.

The notified body shall have documented procedures to review applications, addressing:

1. the completeness of those applications with respect to the requirements of the relevant conformity assessment procedure, as referred to in the corresponding Annex, under which approval has been sought,
2. the verification of the qualification of products covered by those applications as devices and their respective classifications,
3. whether the conformity assessment procedures chosen by the applicant are applicable to the device in question under this Regulation,
4. the ability of the notified body to assess the application based on its designation, and
5. the availability of sufficient and appropriate resources.

The outcome of each review of an application shall be documented. Refusals or withdrawals of applications shall be notified to the electronic system referred to in Article 57 and shall be accessible to other notified bodies.

The notified body shall have documented procedures to ensure that all conformity assessment activities are conducted by appropriately authorised and qualified personnel who are sufficiently experienced in the evaluation of the devices, systems and processes and related documentation that are subject to conformity assessment.

For each application, the notified body shall determine the resources needed and identify one individual responsible for ensuring that the assessment of that application is conducted in accordance with the relevant procedures and for ensuring that the appropriate resources including personnel are utilised for each of the tasks of the assessment. The allocation of tasks required to be carried out as part of the conformity assessment and any changes subsequently made to this allocation shall be documented.

The notified body and its personnel shall carry out the conformity assessment activities with the highest degree of professional integrity and the requisite technical and scientific competence in the specific fields.

The notified body shall have expertise, facilities and documented procedures that are sufficient to effectively conduct the conformity assessment activities for which the notified body in question is designated, taking account of the relevant requirements set out in Annexes IX to XI, and in particular all of the following requirements:

• appropriately plan the conduct of each individual project,
• ensure that the composition of the assessment teams is such that there is sufficient experience in relation to the technology concerned, and that there is continuous objectivity and independence, and to provide for rotation of the members of the assessment team at appropriate intervals,
• specify the rationale for fixing time limits for completion of conformity assessment activities,
• assess the manufacturer’s technical documentation and the solutions adopted to meet the requirements laid down in Annex I,
• review the manufacturer’s procedures and documentation relating to the evaluation of pre-clinical aspects,
• review the manufacturer’s procedures and documentation relating to clinical evaluation,
• address the interface between the manufacturer’s risk management process and its appraisal and analysis of the pre-clinical and clinical evaluation and to evaluate their relevance for the demonstration of conformity with the relevant requirements in Annex I,
• carry out the specific procedures referred to in Sections 5.2 to 5.4 of Annex IX,
• in the case of class IIa or class IIb devices, assess the technical documentation of devices selected on a representative basis,
• plan and periodically carry out appropriate surveillance audits and assessments, carry out or request certain tests to verify the proper functioning of the quality management system and to perform unannounced on site audits,
• relating to the sampling of devices, verify that the manufactured device is in conformity with the technical documentation; such requirements shall define the relevant sampling criteria and testing procedure prior to sampling,
• evaluate and verify a manufacturer’s compliance with relevant Annexes.

The notified body shall, where relevant, take into consideration available CS, guidance and best practice documents and harmonised standards, even if the manufacturer does not claim to be in compliance.

1. As part of the assessment of the quality management system, a notified body shall prior to an audit and in accordance with its documented procedures:
2. assess the documentation submitted in accordance with the relevant conformity assessment Annex, and draw up an audit programme which clearly identifies the number and sequence of activities required to demonstrate complete coverage of a manufacturer’s quality management system and to determine whether it meets the requirements of this Regulation,
3. identify links between, and allocation of responsibilities among, the various manufacturing sites, and identify relevant suppliers and/or subcontractors of the manufacturer, and consider the need to specifically audit any of those suppliers or subcontractors or both,
4. clearly define, for each audit identified in the audit programme, the objectives, criteria and scope of the audit, and draw up an audit plan that adequately addresses and takes account of the specific requirements for the devices, technologies and processes involved,
5. draw up and keep up to date, for class IIa and class IIb devices, a sampling plan for the assessment of technical documentation as referred to in Annexes II and III covering the range of such devices covered by the manufacturer’s application. That plan shall ensure that all devices covered by the certificate are sampled over the period of validity of the certificate, and
6. select and assign appropriately qualified and authorised personnel for conducting the individual audits. The respective roles, responsibilities and authorities of the team members shall be clearly defined and documented.
7. Based on the audit programme it has drawn up, the notified body shall, in accordance with its documented procedures:
   • audit the manufacturer’s quality management system, in order to verify that the quality management system ensures that the devices covered conform to the relevant provisions of this Regulation which apply to devices at every stage, from design through final quality control to ongoing surveillance, and shall determine whether the requirements of this Regulation are met,
   • based on relevant technical documentation and in order to determine whether the manufacturer meets the requirements referred to in the relevant conformity assessment Annex, review and audit the manufacturer’s processes and subsystems, in particular for:
   • design and development,
   • production and process controls,
   • product documentation,
   • purchasing controls including verification of purchased devices,
   • corrective and preventive actions, including for post-market surveillance, and
   • PMCF, and review and audit requirements and provisions adopted by the manufacturer, including those in relation to fulfilling the general safety and performance requirements set out in Annex I.

   The documentation shall be sampled in such a manner as to reflect the risks associated with the intended use of the device, the complexity of the manufacturing technologies, the range and classes of devices produced and any available post-market surveillance information,

   • if not already covered by the audit programme, audit the control of processes on the premises of the manufacturer’s suppliers, when the conformity of finished devices is significantly influenced by the activity of suppliers and, in particular when the manufacturer cannot demonstrate sufficient control over its suppliers,
   • conduct assessments of the technical documentation based on its sampling plan and taking account of Sections 4.5.4. and 4.5.5. for pre-clinical and clinical evaluations, and
   • the notified body shall ensure that audit findings are appropriately and consistently classified in accordance with the requirements of this Regulation and with relevant standards, or with best practice documents developed or adopted by the MDCG.

Assessment of the technical documentation

For assessment of the technical documentation conducted in accordance with Chapter II of Annex IX, notified bodies shall have sufficient expertise, facilities and documented procedures for:

• the allocation of appropriately qualified and authorised personnel for the examination of individual aspects such as use of the device, biocompatibility, clinical evaluation, risk management, and sterilisation, and
• the assessment of conformity of the design with this Regulation, and for taking account of Sections 4.5.4. to 4.5.6. That assessment shall include examination of the implementation by manufacturers of incoming, in-process and final checks and the results thereof. If further tests or other evidence is required for the assessment of conformity with the requirements of this Regulation, the notified body in question shall carry out adequate physical or laboratory tests in relation to the device or request the manufacturer to carry out such tests.

Type-examinations

The notified body shall have documented procedures, sufficient expertise and facilities for the type-examination of devices in accordance with Annex X including the capacity to:

• examine and assess the technical documentation taking account of Sections 4.5.4. to 4.5.6., and verify that the type has been manufactured in conformity with that documentation;
• establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility;
• document its rationale for the selection of those parameters;
• carry out the appropriate examinations and tests in order to verify that the solutions adopted by the manufacturer meet the general safety and performance requirements set out in Annex I. Such examinations and tests shall include all tests necessary to verify that the manufacturer has in fact applied the relevant standards it has opted to use;
• agree with the applicant as to where the necessary tests will be performed if they are not to be carried out directly by the notified body; and
• assume full responsibility for test results. Test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.

Verification by examination and testing of every product

The notified body shall:

1. have documented procedures, sufficient expertise and facilities for the verification by examination and testing of every product in accordance with Part B of Annex XI;
2. establish a test plan identifying all relevant and critical parameters which need to be tested by the notified body or under its responsibility in order to:
   • verify, for class IIb devices, the conformity of the device with the type described in the EU type-examination certificate and with the requirements of this Regulation which apply to those devices,
   • confirm, for class IIa devices, the conformity with the technical documentation referred to in Annexes II and III and with the requirements of this Regulation which apply to those devices;
3. document its rationale for the selection of the parameters referred to in point (b);
4. have documented procedures to carry out the appropriate assessments and tests in order to verify the conformity of the device with the requirements of this Regulation by examining and testing every product as specified in Section 15 of Annex XI;
5. have documented procedures providing for the reaching of an agreement with the applicant concerning when and where necessary tests that are not to be carried out by the notified body itself are to be performed; and
6. assume full responsibility for test results in accordance with documented procedures; test reports submitted by the manufacturer shall only be taken into account if they have been issued by conformity assessment bodies which are competent and independent of the manufacturer.

The notified body shall have documented procedures in place for the review of the manufacturer’s procedures and documentation relating to the evaluation of pre-clinical aspects. The notified body shall examine, validate and verify that the manufacturer’s procedures and documentation adequately address:

1. the planning, conduct, assessment, reporting and, where appropriate, updating of the pre-clinical evaluation, in particular of
• the scientific pre-clinical literature search, and
• the pre-clinical testing, for example laboratory testing, simulated use testing, computer modelling, the use of animal models,
2. the nature and duration of body contact and the specific associated biological risks,
3. the interface with the risk management process, and
4. the appraisal and analysis of the available pre-clinical data and its relevance with regard to demonstrating conformity with the relevant requirements in Annex I.

The notified body’s assessment of pre-clinical evaluation procedures and documentation shall address the results of literature searches and all validation, verification and testing performed and conclusions drawn, and shall typically include considering the use of alternative materials and substances and take account of the packaging, stability, including shelf life, of the finished device. Where no new testing has been undertaken by a manufacturer or where there are deviations from procedures, the notified body in question shall critically examine the justification presented by the manufacturer.

The notified body shall have documented procedures in place relating to the assessment of a manufacturer’s procedures and documentation relating to clinical evaluation both for initial conformity assessment and on an ongoing basis. The notified body shall examine, validate and verify that manufacturers’ procedures and documentation adequately address:

• the planning, conduct, assessment, reporting and updating of the clinical evaluation as referred to in Annex XIV,
• post-market surveillance and PMCF,
• the interface with the risk management process,
• the appraisal and analysis of the available data and its relevance with regard to demonstrating conformity with the relevant requirements in Annex I, and
• the conclusions drawn with regard to the clinical evidence and drawing up of the clinical evaluation report.

These procedures referred to in the first paragraph shall take into consideration available CS, guidance and best practice documents.

The notified body’s assessment of clinical evaluations as referred to in Annex XIV shall cover:

• the intended use specified by the manufacturer and claims for the device defined by it,
• the planning of the clinical evaluation,
• the methodology for the literature search,
• relevant documentation from the literature search,
• the clinical investigation,
• validity of equivalence claimed in relation to other devices, the demonstration of equivalence, the suitability and conclusions data from equivalent and similar devices,
• post-market surveillance and PMCF,
• the clinical evaluation report, and
• justifications in relation to non-performance of clinical investigations or PMCF.

In relation to clinical data from clinical investigations included within the clinical evaluation, the notified body in question shall ensure that the conclusions drawn by the manufacturer are valid in the light of the approved clinical investigation plan.

The notified body shall ensure that the clinical evaluation adequately addresses the relevant safety and performance requirements provided for in Annex I, that it is appropriately aligned with the risk management requirements, that it is conducted in accordance with Annex XIV and that it is appropriately reflected in the information provided relating to the device.

The notified body shall have documented procedures, sufficient expertise and facilities for the procedures referred to in Sections 5 and 6 of Annex IX, Section 6 of Annex X and Section 16 of Annex XI, for which they are designated.

In the case of devices manufactured utilising tissues or cells of animal origin or their derivatives, such as from TSE susceptible species, as referred to in Regulation (EU) No 722/2012, the notified body shall have documented procedures in place that fulfil the requirements laid down in that Regulation, including for the preparation of a summary evaluation report for the relevant competent authority.

The notified body shall:

• ensure that all steps of the conformity assessment are documented so that the conclusions of the assessment are clear and demonstrate compliance with the requirements of this Regulation and can represent objective evidence of such compliance to persons that are not themselves involved in the assessment, for example personnel in designating authorities,
• ensure that records that are sufficient to provide a discernible audit trail are available for quality management system audits,
• clearly document the conclusions of its assessment of clinical evaluation in a clinical evaluation assessment report, and
• for each specific project, provide a detailed report which shall be based on a standard format containing a minimum set of elements determined by the MDCG.

The report of the notified body shall:

• clearly document the outcome of its assessment and draw clear conclusions from the verification of the manufacturer’s conformity with the requirements of this Regulation,
• make a recommendation for a final review and for a final decision to be taken by the notified body; this recommendation shall be signed off by the member of personnel responsible in the notified body, and
• be provided to the manufacturer in question.

The notified body shall prior to making a final decision:

• ensure that the personnel assigned for the final review and decision-making on specific projects are appropriately authorised and are different from the personnel who have conducted the assessments,
• verify that the report or reports and supporting documentation needed for decision making, including concerning resolution of non-conformities noted during assessment, are complete and sufficient with respect to the scope of the application, and
• verify whether there are any unresolved non-conformities preventing issuance of a certificate.

The notified body shall have documented procedures for decision-making including as regards the allocation of responsibilities for the issuance, suspension, restriction and withdrawal of certificates. Those procedures shall include the notification requirements laid down in Chapter V of this Regulation. The procedures shall allow the notified body in question to:

• decide, based on the assessment documentation and additional information available, whether the requirements of this Regulation are fulfilled,
• decide, based on the results of its assessment of the clinical evaluation and risk management, whether the post-market surveillance plan, including the PMCF plan, is adequate,
• decide on specific milestones for further review by the notified body of the up to date clinical evaluation,
• decide whether specific conditions or provisions need to be defined for the certification,
• decide, based on the novelty, risk classification, clinical evaluation and conclusions from the risk analysis of the device, on a period of certification not exceeding five years,
• clearly document decision making and approval steps including approval by signature of the members of personnel responsible,
• clearly document responsibilities and mechanisms for communication of decisions, in particular, where the final signatory of a certificate differs from the decision maker or decision makers or does not fulfil the requirements laid down in Section 3.2.7,
• issue a certificate or certificates in accordance with the minimum requirements laid down in Annex XII for a period of validity not exceeding five years and shall indicate whether there are specific conditions or limitations associated with the certification,
• issue a certificate or certificates for the applicant alone and shall not issue certificates covering multiple entities, and
• ensure that the manufacturer is notified of the outcome of the assessment and the resultant decision and that they are entered into the electronic system referred to in Article 57.

The notified body shall have documented procedures and contractual arrangements with manufacturers in place relating to the manufacturers’ information obligations and the assessment of changes to:

• the approved quality management system or systems or to the product-range covered,
• the approved design of a device,
• the intended use of or claims made for the device,
• the approved type of a device, and
• any substance incorporated in or utilised for the manufacturing of a device and being subject to the specific procedures in accordance with Section 4.5.6.

The procedures and contractual arrangements referred to in the first paragraph shall include measures for checking the significance of the changes referred to in the first paragraph.

In accordance with its documented procedures, the notified body in question shall:

• ensure that manufacturers submit for prior approval plans for changes as referred to in the first paragraph and relevant information relating to such changes,
• assess the changes proposed and verify whether, after these changes, the quality management system, or the design of a device or type of a device, still meets the requirements of this Regulation, and
• notify the manufacturer of its decision and provide a report or as applicable a supplementary report, which shall contain the justified conclusions of its assessment.

The notified body shall have documented procedures:

• defining how and when surveillance activities of manufacturers are to be conducted. Those procedures shall include arrangements for unannounced on-site audits of manufacturers and, where applicable, subcontractors and suppliers carrying out product tests and the monitoring of compliance with any conditions binding manufacturers and associated with certification decisions, such as updates to clinical data at defined intervals,
• for screening relevant sources of scientific and clinical data and post-market information relating to the scope of their designation. Such information shall be taken into account in the planning and conduct of surveillance activities, and
• to review vigilance data to which they have access under Article 92(2) in order to estimate its impact, if any, on the validity of existing certificates. The results of the evaluation and any decisions taken shall be thoroughly documented.

The notified body in question shall, upon receipt of information about vigilance cases from a manufacturer or competent authorities, decide which of the following options to apply:

• not to take action on the basis that the vigilance case is clearly not related to the certification granted,
• observe the manufacturer’s and competent authority’s activities and the results of the manufacturer’s investigation so as to determine whether the certification granted is at risk or whether adequate corrective action has been taken,
• perform extraordinary surveillance measures, such as document reviews, short-notice or unannounced audits and product testing, where it is likely that the certification granted is at risk,
• increase the frequency of surveillance audits,
• review specific products or processes on the occasion of the next audit of the manufacturer, or
• take any other relevant measure.

In relation to surveillance audits of manufacturers, the notified body shall have documented procedures to:

• conduct surveillance audits of the manufacturer on at least an annual basis which shall be planned and conducted in line with the relevant requirements in Section 4.5,
• ensure adequate assessment of the manufacturer’s documentation on, and application of the provisions on, vigilance, the post-market surveillance, and PMCF,
• sample and test devices and technical documentation, during audits, according to pre-defined sampling criteria and testing procedures to ensure that the manufacturer continuously applies the approved quality management system,
• ensure that the manufacturer complies with the documentation and information obligations laid down in the relevant Annexes and that its procedures take into account best practices in the implementation of quality management systems,
• ensure that the manufacturer does not use quality management system or device approvals in a misleading manner,
• gather sufficient information to determine if the quality management system continues to comply with the requirements of this Regulation,
• ask the manufacturer, if non-conformities are detected, for corrections, corrective actions and, where applicable, preventive actions, and
• where necessary, impose specific restrictions on the relevant certificate, or suspend or withdraw it.

The notified body shall, if listed as part of the conditions for certification:

• conduct an in-depth review of the clinical evaluation as most recently updated by the manufacturer based on the manufacturer’s post-market surveillance, on its PMCF and on clinical literature relevant to the condition being treated with the device or on clinical literature relevant to similar devices,
• clearly document the outcome of the in-depth review and address any specific concerns to the manufacturer or impose any specific conditions on it, and
• ensure that the clinical evaluation as most recently updated, is appropriately reflected in the instructions for use and, where applicable, the summary of safety and performance.

The notified body shall have documented procedures in place relating to the re-certification reviews and the renewal of certificates. Re-certification of approved quality management systems or EU technical documentation assessment certificates or EU type-examination certificates shall occur at least every five years.

The notified body shall have documented procedures relating to renewals of EU technical documentation assessment certificates and EU type-examination certificates and those procedures shall require the manufacturer in question to submit a summary of changes and scientific findings for the device, including:

1. all changes to the originally approved device, including changes not yet notified,
2. experience gained from post-market surveillance,
3. experience from risk management,
4. experience from updating the proof of compliance with the general safety and performance requirements set out in Annex I,
5. experience from reviews of the clinical evaluation, including the results of any clinical investigations and PMCF,
6. changes to the requirements, to components of the device or to the scientific or regulatory environment,
7. changes to applied or new harmonised standards, CS or equivalent documents, and
8. changes in medical, scientific and technical knowledge, such as:
   • new treatments,
   • changes in test methods,
   • new scientific findings on materials and components, including findings on their biocompatibility,
   • experience from studies on comparable devices,
   • data from registers and registries,
   • experience from clinical investigations with comparable devices.

The notified body shall have documented procedures to assess the information referred to in the second paragraph and shall pay particular attention to clinical data from post-market surveillance and PMCF activities undertaken since the previous certification or re-certification, including appropriate updates to manufacturers’ clinical evaluation reports.

For the decision on re-certification, the notified body in question shall use the same methods and principles as for the initial certification decision. If necessary, separate forms shall be established for re-certification taking into account the steps taken for certification such as application and application review.