MDR 2.0, IVDR 2.0: What the Commission is planning

On December 16, 2025, the European Commission published its proposal for revising the MDR and IVDR , already titled MDR 2.0 and IVDR 2.0 respectively. But will manufacturers really benefit from it? This article provides the answers.

1. Why the EU wants to change something

The EU acknowledges that there are problems with the previous versions of the MDR and IVDR :

• “Certain requirements, particularly regarding conformity assessment procedures, are excessively complex, costly, lengthy and expensive;
• The application of legal requirements by national authorities and notified bodies is not sufficiently coordinated;
• The current coordination mechanisms are not efficient and effective enough;
• Sufficient technical and regulatory advisory services are not available at EU level;
• There are no adaptive pathways for groundbreaking innovations and rare or “niche products”;
• The regulations have unintended negative effects on innovation, competitiveness, and patient care.
• There is a need for better coherence with other EU legislation, such as the Clinical Trials Regulation.”

The EU writes that the evaluation of the regulations, which was itself required by the MDR and IVDR, showed that there was potential for simplification and reduction of the regulatory burden.

There is no comprehensive study that meets scientific standards and substantiates these claims. However, many shortcomings were obvious nonetheless.

Ultimately, the political pressure, including from manufacturers’ associations, was too great not to react.

2. What the EU wants to change with MDR 2.0 / IVDR 2.0

With MDR 2.0 and IVDR 2.0, the EU has adopted a whole package, which it divides into eight “topics”:

1. Simplification and proportionality
2. Reduction of administrative costs
3. Innovation and availability of products for specific patient groups or situations
4. Predictability and cost-effectiveness of certification
5. Coordination within the decentralized system
6. Further digitization
7. International cooperation
8. Interaction with other Union legislation

This list shows that the EU does not clearly distinguish between objectives (points 1 to 4) and measures (points 5 to 8).

The following table presents key requirements of MDR 2.0 and IVDR 2.0.

Change in MDR 2.0 / IVDR 2.0	Evaluation
Low PRRC requirements	This will be particularly helpful for small businesses. However, it will weaken the PRRC’s position as a highly competent quality assurance body.
Extended validity of the certificates	Risk-based reviews by the Notified Body (NB) are certainly helpful, provided the NB truly adopts a risk-based approach. This presupposes that the NB is aware of the risks and identifies them systematically.  Whether less oversight is the right approach is debatable. There was general agreement that the problem lies less in regulation than in oversight. This oversight deficit also stems from inadequately equipped and insufficiently competent authorities.  A look at the rest of the world shows that the EU is following the example of other countries in this regard. Conversely, in some countries, registration periods are linked to the validity of the certificate. This can be seen as an advantage.
Lower requirements for clinical evidence	The claim that the Commission allows a wider range of data with “in silico” data is incorrect. This was already clear from Annex VII, Section 4.3.4.  It will be helpful for companies that neither full access to the technical documentation of the equivalent product nor complete clinical equivalence is required . Instead of “same,” “same or similar” is now permitted.
Lower classification of software	An effort was made to align with the IMDRF classification. Unfortunately, the implementation was only moderately successful. The rules do not cover all cases, and some of the wording is ambiguous.  We will submit a further assessment later.
Lower classification of accessories	Rule 8, paragraph 6, has repeatedly led to considerable debate in the past, as this sub-rule automatically assigned accessories for active implantable medical devices to Class III. This particularly affected “simple” accessories for pacemakers, such as torque wrenches or magnets, which were thus equated with the pacemaker itself and consequently required a Special Security Prescription (SSCP) . With the amended Rule 8, these accessories have been removed from this paragraph. This is a significant relief for manufacturers of such accessories.
Changes regarding the obligation to publish the SSCP (or SSP for IVD) in EUDAMED (Article 57)	On the one hand, point i) of Article 57, which specifies the information to be managed by EUDAMED, is to be deleted ( “the summary of safety and clinical performance referred to in Article 32.” ).  On the other hand, MDR 2.0 requires in Article 32 for Class IIb implants and Class III products that “The manufacturer shall ensure that the summary of safety and clinical performance is available in Eudamed […]. ” The amendment in Article 29 of IVDR 2.0 demonstrates this in the same way.
Lower frequency at PSUR	This should mean some relief for manufacturers:  – Class IIa: instead of every two years, only if necessary  – Class IIb: instead of annually, initially annually, then every two years  – Class III: instead of annually, initially annually, then every two years  . The changes apply analogously to IVDs.  With this simplification, the EU is backtracking on its approach of increasing post-market requirements.
The IVDR also permits in-house production if an equivalent CE-marked product is available on the market.	This makes it easier for laboratories. There is also an “official legalization” that laboratories offering testing services within the framework of clinical trials (according to CTR) (e.g., CROs) fall under the exemption provision of Article 5(5) for health establishments.
Notifications based on Article 10a are now made via EUDAMED.	Whether this is a relief is debatable, especially since it is unclear when this functionality will be available.
There are now separate conformity assessment procedures for orphan and breakthrough devices.	This is generally welcome. Since the expert panels play an important role, it is crucial how quickly they are installed and respond, as there are no deadlines.
Grandfathering for orphan devices	This is long overdue, even though the damage caused by the lack of this exception has already occurred.
Regulatory sandboxes are being introduced.	This is generally welcome. However, the scope is so narrowly defined that the sandboxes are unsuitable for testing new evaluation pathways for novel technologies that do not address an unmet medical need. Therefore, they are only of limited use for regulatory science.
The “single use” of medical devices now requires justification. Corresponding reprocessing requirements have been removed.	The purpose is not entirely clear. Is this an aspect of sustainability? Why are “reprocessing requirements” no longer necessary?
Some obligations for TD reviews by notified bodies during (surveillance) audits have been removed.	The effect is unclear: On the one hand, notified bodies can still review the technical documentation (TD) “for cause.” On the other hand, auditing a quality management system without consulting the TD is difficult, as it contains the evidence for compliance with many quality management processes.  When auditing quality management processes, auditors are always permitted to consult the TD if the required results are found there. However, the formal TD review (often lasting two days) could be eliminated.  Regardless, if laws are only created or amended when someone complains loudly, all of this will be abolished again in the next breast implant scandal. This also applies to the following point.
The frequency of surveillance audits can be reduced to 24 months.	It is unclear how this aligns with audit practices according to ISO 13485 and MDSAP , and what the justifications are that permit or even require such a reduction. See the comments on monitoring above.
Prices for national regulatory authorities (NBs) should also be viewable or linked via the EU website and should also be reduced for small businesses.	Demanding a 50% discount is a significant intervention in the market. This could have the opposite effect, causing BS (Business Services) to stop accepting micro-enterprises.
Manufacturers are allowed to submit machine-readable data, at least if it can be made readable.	This is very welcome and will (hopefully) increase digitalization and thus automation, and consequently efficiency and effectiveness.
There may be other IT systems besides EUDAMED.	The purpose of this regulation is not entirely clear. Additional systems, especially national ones, increase complexity and thus the workload for manufacturers. The requirement for interoperability is usually not fully met and does not resolve this problem.
The demands on cybersecurity are increasing.	The new Article 87a introduces further reporting obligations. This does not make things easier for manufacturers. It is also unclear why this link to other regulations is necessary. The benefit of adding “cybersecurity” to “IT security measures” in Annex I is not apparent.

Furthermore, it is striking that the Commission is granting itself, the MDCG , and the expert panels even more rights. No counterweight to this concentration of power is apparent. Obligations such as response times and transparency requirements would be desirable in many areas.

In some cases, it is unclear whether an obligation or a right is to be removed, e.g.:

• Article 10 no longer contains the requirements for
  • a clinical evaluation
  • according to UDI ,
  • after PMS ,
  • after vigilance and a
  • “damage compensation”.
• Article 37 no longer permits BS to work with subcontractors.

This could be misunderstood.

3. What changes are there to the AI ​​Act?

The EU is also planning a change to the AI ​​Act : Medical devices will be moved from Section A to Section B of Annex I. This has led some manufacturers to prematurely assume that the AIA (Automated Information Exchange of Information) will no longer apply.

However, the aim is not to reduce the requirements, but rather to avoid overlaps and simplify the legal framework.

Furthermore, Article 5 states in the new section (7)

(7) The Commission is empowered to adopt delegated acts in accordance with Article 108, to amend the general safety and performance requirements set out in Annex I in order to adapt them to scientific or technical progress or to international developments, or to add requirements in relation to emerging risks or technologies.

This means that the EU explicitly reserves the right to adapt the GSPRs .

Furthermore, she writes in section (8):

When adopting implementing acts pursuant to paragraph 6 of this Article, delegated acts pursuant to paragraph 7 of this Article or Common Specifications pursuant to Article 9 of this Regulation concerning devices that are high-risk AI systems as referred to in Article 6(1) of Regulation (EU) 2024/1689 of the European Parliament and of the Council**, or that use high-risk AI systems as safety components, the Commission shall take into account the requirements set out in Chapter III, Section 2, of that Regulation .

This means that, in the end, the requirements beyond the state of the art and the countless standards are explicitly addressed via the supplementary GSPR in Annex I.

4. Conclusion and Summary

The changes to the MDR, IVDR and the AI ​​Act are welcome, as they demonstrate a willingness to limit undue burdens on manufacturers and thus on healthcare.

Just as the MDR and IVDR were written without a discernible and published “scientific foundation,” there is no evidence that the planned changes will achieve their intended goals, especially since the Commission has not formulated any measurable targets it intends to achieve. There is also no assessment of negative consequences.

Some manufacturers are already commenting on the draft in such a way that those who complied with the MDR or IVDR in time are the fools, thus incurring high costs and will benefit little from the MDR 2.0 or IVDR 2.0 in the future.