Meeting UK medical device regulation requirements can be difficult for companies launching their devices in the UK market. Issues such as classification, conformity assessment, technical documentation, registration, and post-marketing aspects need to be dealt with first.
Regulatory changes are also taking place. According to the MHRA 2026 report, about 90% of medical devices in Great Britain have been CE marked. This highlights the importance of understanding how UK and CE routes interact during the transition. The MHRA is also progressing reforms to strengthen medical device oversight and post-market surveillance.
In this blog, we will discuss key UK MDR 2002 requirements for manufacturers placing devices on the Great Britain market. This blog also covers classification, conformity assessment, registration, post-market surveillance, software, cybersecurity, and other essential compliance considerations.
Key Takeaways
- UK MDR 2002 applies to medical devices placed on the Great Britain market.
- They are categorized as Class I, IIa, IIb, and III depending on their risk level.
- Certain criteria relating to safety, performance, risk management, clinical, and documentation must be satisfied.
- The right conformity assessment procedure has to be carried out prior to market release.
- All applicable devices should be registered with MHRA before their supply in Great Britain.
- A UK Responsible Person (UKRP) is required for overseas manufacturers.
Understanding UK Medical Devices Regulations (UK MDR 2002)
The UK Medical Devices Regulations 2002 (UK MDR 2002) is the major regulation for medical devices in Great Britain. These regulations lay down the requirements that must be fulfilled by manufacturers to launch their devices lawfully in the UK. Areas covered under these regulations include safety, performance, risk management, conformity assessment, technical documentation, and post-market surveillance.
They are currently regulated through the Medicines and Medical Devices Act 2021 and have been revised in light of the present regulatory system in the UK. The post-market surveillance rules became mandatory as well on 16 June 2025.
Manufacturers must meet UK medical device regulations before and after placing a medical device on the Great Britain market. This includes:
- Meet safety and performance requirements: Devices must be safe, perform as intended, and have appropriate risk controls. Manufacturers must also maintain supporting technical documentation.
- Complete conformity assessment: You should follow the correct conformity assessment route based on the device. Higher-risk devices generally require assessment by a UK Approved Body.
- Register devices with the MHRA: You have to register the devices with the MHRA before placing them on the Great Britain market. The requirements apply across different device classes and include IVDs and custom-made devices.
- Maintain post-market surveillance: You should monitor to ensure the safety and performance of the devices even after their placement on the market.
- Maintain compliance: Respond to new safety information, regulatory changes, and issues identified through post-market monitoring.
Which Medical Devices Fall Under UK MDR 2002?
UK MDR 2002 is related to medical devices that have uses such as diagnosis, prevention, monitoring, treatment, or the alleviation of diseases. The classification of a particular device is based on its function, and it depends on whether it is invasive, has a long-term use period, and whether it is active or implantable.
For general medical devices, there are four classes of risk classification, which include:
- Class I: This class includes lower-risk medical devices that include simple surgical instruments, spectacle frames, and non-invasive devices. Some Class I medical devices are capable of being self-certified, so long as they lack the features that would need third-party assessment.
- Class IIa: This category includes higher-risk devices, including standard hearing aids and some active therapeutic or diagnostic devices. This requires conformity assessment with the involvement of a UK Approved Body.
- Class IIb: This includes higher-risk devices such as ventilators, monitoring, and therapeutic devices. There is increased scrutiny of the manufacturer’s technical documents and risk controls.
- Class III: This includes the highest-risk medical devices such as pacemakers, breast implants, and implantable devices. This class requires the highest level of conformity assessment.
AIMDs and IVDs have different requirements for classification under UK MDR 2002. Software is also classified according to its medical purpose, implying that medical software alone could be classified even without hardware.
Getting the classification right matters because it determines the conformity assessment route, the level of regulatory scrutiny, the device security requirements, and the evidence needed for market access.
What Essential Requirements Manufacturers Must Meet Under UK MDR 2002?
Under the UK MDR 2002, you have to prove that your device is safe, works as expected, and meets all the essential requirements. Some of the requirements are about safety, design, manufacturing, labelling, risk management, and clinical data. These requirements form the basis for regulating medical devices in the UK, covering safety, design, manufacturing, and risk management.
1. Safety and Performance Requirements
Manufacturers must show that a device achieves its intended purpose without creating unacceptable risks for patients or users. The safety and performance should be evaluated during the life cycle of the device.
Key considerations include:
- Intended Performance: The device should work the way the manufacturer described.
- Risk reduction: Risks should be identified and controlled in the design phase.
- Patient safety: Materials, construction, and operation must not create unacceptable risks.
- Balance of benefits and risks: Expected clinical benefits should be greater than the risk that is present.
2. Design and Manufacturing Controls
Compliance should be taken into account not only before product approval, but during development. Manufacturers are advised to keep controls that show the design, testing, validation, manufacturing, and changes to the device.
This includes:
- Design verification and validation
- Controlled manufacturing processes
- Testing under expected conditions of use
- Documented design and production changes
- Appropriate quality management processes
Appropriate designated standards may also be applied to meet applicable essential requirements.
3. Information, Labelling and Instructions for Use
Information should be clearly provided so that the user can identify and operate the device safely. The information should be appropriate for the device and contain warnings and limitations as applicable.
Depending on the device, this can include:
- The name of the manufacturer or identification of the device
- Batch, lot, or serial information
- Operating instructions
- Warnings and precautions
- The storage and handling requirements are as specified.
- Any relevant restrictions or cautions
If these devices are supplied in Great Britain, they must be accompanied by labelling and instructions in English.
4. Risk Management and Clinical Evidence
You have to identify potential hazards and evaluate the risks and to put in place appropriate controls. You also require proper clinical evidence to back the safety and performance of the device.
In the 2026 guidance, the MHRA specifies that manufacturers who need to conduct a clinical investigation should inform the MHRA at least 60 days before they begin the clinical investigation.
You need to keep records of:
- Identified risks and implemented controls
- Verification and validation results
- Clinical evidence supporting device claims
- Remaining risks and their acceptability
- Updates to the risk assessment when new evidence emerges
How Can Medical Devices Meet UK MDR 2002 Compliance Requirements?
There are a number of steps required before and after placing a device on the Great Britain market to meet UK MDR 2002 requirements. The exact process depends on the classification and characteristics of the device.
- Identify the device classification: Identify the applicable class and whether the device is sterile, has a measuring function, is implantable, or qualifies as software.
- Prepare Technical documentation: Gather evidence to prove compliance, which may consist of design documentation, testing, risk assessment, labelling, and clinical evidence.
- Compile the technical documentation: Bring together the evidence needed to demonstrate compliance, including design information, testing, risk assessment, labelling, and clinical evidence where applicable.
- Fill in the UK Declaration of Conformity: Once the applicable requirements are met, the manufacturer must formally declare conformity before applying the UKCA marking where required.
- Register with the MHRA: Manufacturers are required to register themselves and their devices with the MHRA before they can be made available on the Great Britain market.
- Maintain compliance: Continue to monitor the device in post-market surveillance, vigilance, and update technical documentation as needed.
Manufacturers must register themselves and their devices with the MHRA UK medical devices system before they can be made available on the Great Britain market.
What Are the Registration Requirements for Medical Devices in the UK?
Medical device registration is one of the important stages before placing a medical device on the Great Britain market. You are required to register with the MHRA and submit details of the organisation and device. The requirements vary according to your location (UK or overseas). UK medical device registration is an important stage before placing a medical device on the Great Britain market.
I. MHRA Registration Requirements
Manufacturers must register applicable medical devices with the MHRA before placing them on the Great Britain market. The registration process links the device to the responsible manufacturer and supports regulatory oversight.
Manufacturers should:
- Provide the required manufacturer and device details.
- Identify the device type and relevant classification.
- Provide applicable device identifiers and GMDN information.
- Keep registration details accurate and update them when information changes.
Registration does not replace conformity assessment. Manufacturers must complete the applicable conformity assessment process before registration and market placement.
II. UK Responsible Person Requirements (UKRP)
Manufacturers based outside the UK must appoint a UK Responsible Person before placing devices on the Great Britain market. The UKRP acts as the manufacturer’s regulatory contact in the UK.
The UKRP is responsible for:
- Registering the manufacturer’s devices with the MHRA.
- Keeping required copies of technical documentation and declarations.
- Supporting MHRA requests for information and documentation.
- Cooperating with safety actions, investigations, recalls, and corrective measures.
The manufacturer remains responsible for meeting the applicable UK MDR 2002 requirements.
III. Importers and Distributors
Importers and distributors have separate responsibilities within the Great Britain supply chain. Their duties focus mainly on checking devices, maintaining traceability, and supporting corrective actions.
Importers and distributors should:
- Check that required conformity markings and documentation are present.
- Verify that labelling and instructions meet applicable requirements.
- Maintain records that support device traceability.
- Report or escalate complaints and non-conforming devices.
- Cooperate with manufacturers during recalls and corrective actions.
GB-based importers must provide their details to the manufacturer or UKRP. The manufacturer or UKRP then submits the required importer information to the MHRA.
How Can You Prepare for UK MDR 2002 Compliance?
Preparing for UK MDR 2002 compliance requires coordination between regulatory, quality, engineering, and clinical teams. Start by reviewing current practices against the applicable requirements and identifying any compliance gaps.
- Review Technical Documentation: Check design files, manufacturing records, specifications, and other documents for completeness, consistency, and traceability.
- Update Risk Management: Maintain risk assessments throughout the device lifecycle and address physical, clinical, and software-related risks. ISO 14971 can support this process.
- Maintain a Quality Management System: Ensure quality processes support controlled design, manufacturing, testing, and verification. ISO 13485 provides a recognised framework for medical device quality management.
- Appoint a UK Responsible Person: Manufacturers based outside the UK must appoint a UKRP for devices placed on the Great Britain market. Select the UKRP early to support MHRA registration and regulatory communication.
- Strengthen Post-Market Surveillance: Monitor device performance after market placement, record complaints and incidents, analyse emerging risks, and take corrective action when required.
How Does VAPT Support UK MDR 2002 Compliance?
Vulnerability Assessment and Penetration Testing (VAPT) can support the security aspects of medical device compliance. It helps manufacturers identify, validate, and address vulnerabilities across software, connected devices, and supporting infrastructure. VAPT does not replace UK MDR 2002 conformity assessment, but it can provide useful security evidence for risk management and technical documentation.
1. Identifying Security Vulnerabilities in Medical Devices
Medical devices can include software, web interfaces, APIs, mobile applications, and cloud-connected systems. Each component can introduce security risks that may affect device safety, data confidentiality, or system integrity.
VAPT helps identify weaknesses such as:
- Insecure authentication and access controls
- Vulnerable APIs and web interfaces
- Insecure data transmission or storage
- Weak device-to-cloud communication
2. Penetration Testing for Medical Device Security
Penetration testing goes beyond identifying potential vulnerabilities by attempting to exploit them safely. Depending on the device architecture, testing can cover:
- Network and application security
- Web and mobile applications
- APIs and cloud infrastructure
- Connected devices and communication protocols
- Device interfaces and embedded components, where appropriate
This approach helps determine whether identified weaknesses can be practically exploited.
3. Vulnerability Assessment and Risk Prioritization
VAPT combines automated scanning with manual testing to identify and validate vulnerabilities. Security teams can then assess each finding based on exploitability, potential impact, and its relevance to device safety and patient data.
This helps manufacturers prioritise remediation based on actual risk rather than vulnerability severity alone.
4. Security Testing Evidence for Regulatory Compliance
Testing results can support your risk management and technical documentation. Maintaining clear test methods, findings, evidence, remediation records, and retesting results creates traceable security evidence for compliance activities and future assessments.
How Can Qualysec Help with UK MDR 2002 Compliance?
Qualysec is a specialized penetration testing company that helps organizations achieve compliance easily. We assist medtech professionals in discovering any vulnerabilities in connected devices, applications, APIs, and their infrastructure. Our testing includes both manual security testing and guidance on remediation for issues before they have any impact on device security or compliance.
- Medical Device & IoT Penetration Testing: Testing of the connections between the device, its firmware, and channels of communication with the cloud.
- Web and Mobile Applications Testing: We check SaMD products, patient mobile applications, web portals for clinicians, and APIs for issues related to inadequate authorization or insecure data processing.
- Cloud and API Security Testing: Security testing of cloud platforms and medical APIs with respect to misconfigurations, authorization weaknesses, and data exposures.
- Remediation Recommendations: Risk context and recommendations for fixing issues, allowing development teams to mitigate the risks of vulnerabilities.
- Compliance-Risk Technical Documentation: We prepare vulnerability reports and validation materials that may be used for documentation and further risk assessments.
- CREST-Certified Security Assessments: Following standard practices for ethical hacking, we perform security assessments of medical technologies.
Conclusion
UK medical device regulation sets the standards that manufacturers have to comply with for placing medical devices on the Great Britain market. These requirements include classification of devices, conformity assessment, technical documentation, MHRA registration, risk management, and post-market surveillance. Compliance with all of these requirements demands proper evidence of compliance during the lifecycle of the medical device.
Medical devices are becoming increasingly connected and software-oriented. Cybersecurity is one of the aspects of medical device safety that manufacturers have to consider. Considering all the requirements in advance, maintaining appropriate documentation, and addressing post-market risks will assist manufacturers in staying in compliance.
FAQS
1. What are the FDA and MHRA?
The FDA regulates medical devices and other healthcare products in the United States. The MHRA regulates medical devices and medicines in the UK, including their market access and safety.
2. What is the difference between EU MDR and UK MDR?
EU MDR applies to medical devices placed on the European Union market. UK MDR 2002 governs medical devices placed on the Great Britain market, with separate arrangements applying to Northern Ireland.
3. What is the difference between ISO 13485 and MDR?
ISO 13485 is a quality management standard for medical device organisations. MDR is a regulatory framework that sets legal requirements for placing medical devices on the relevant market.
4. What is the difference between MHRA and HPRA?
MHRA is the UK regulator responsible for medical devices and medicines. HPRA is Ireland’s national regulator for health products, including medical devices, medicines, and certain other healthcare products.
5. What are the 4 classes of medical devices?
The four main classes under UK MDR 2002 are Class I, Class IIa, Class IIb, and Class III. Classification reflects device risk and determines the applicable conformity assessment requirements.
6. Which is newer, MDD or MDR?
The Medical Devices Regulation (MDR) is newer than the Medical Devices Directive (MDD). EU MDR 2017/745 replaced the MDD framework and introduced broader requirements for medical device regulation.
