Software CE Marking for Medical Device Software
Software CE marking is required before medical device software can be sold in the EU. I3CGLOBAL helps software companies worldwide with qualification, Rule 11 classification, IEC 62304, technical documentation and Notified Body certification under EU MDR 2017/745.
What Is Software CE Marking?
Software CE marking is the process that allows medical device software to be placed on the EU market under EU MDR 2017/745. It is not a single submission. It brings together qualification, classification, the software lifecycle, risk management, cybersecurity, usability, clinical evaluation and post-market surveillance.
Most submissions run into trouble where these pieces connect, for example when risk management outputs do not link clearly to the clinical evidence. CE marking of software therefore needs one traceable technical file, not a set of separate documents.
Does Your Software Qualify as a Medical Device?
Qualification comes first, and it depends on your intended purpose. Software as a medical device (SaMD) performs a medical function on ordinary hardware, such as a phone, laptop or cloud platform. MDCG 2019-11 Rev.1, published in June 2025, is the main EU guidance.
- Clinical decision support that influences diagnosis or treatment
- AI diagnostic or imaging analysis software
- Patient monitoring and remote monitoring apps
- Digital therapeutics with a treatment purpose
- Software for prediction or prognosis of disease
- Electronic patient records that only replace paper files
- PACS used only to store and display images
- Scheduling, billing and workflow software
- Laboratory systems that only store and transport data
- General lifestyle and wellness apps
Software that analyses data from human specimens to inform a clinical decision usually falls under the IVDR rather than the MDR. See our guide to IVD software device CE certification.
Who Needs Medical Software CE Marking Support?
I3CGLOBAL supports software developers, startups, healthcare technology companies and device manufacturers across Europe, North America and Asia.
AI diagnostic software
Rule 11 classification, clinical evaluation, IEC 62304 and AI technical documentation.
Mobile medical apps
CE marking support for health apps, telemedicine platforms and patient monitoring apps.
Clinical decision support
Regulatory consulting for decision support software under EU MDR.
Radiology and imaging AI
Rule 11 classification, clinical evaluation, cybersecurity documentation, usability engineering and technical file preparation.
Cloud medical platforms
Cloud architecture documentation, post-market surveillance and ongoing MDR compliance.
Digital therapeutics
Strategy and CE marking support, from qualification through to Notified Body submission.
How Is Software Classified Under Rule 11?
Rule 11 in MDR Annex VIII applies to software. It looks at the decisions the software informs and the harm those decisions could cause. Prediction and prognosis are part of the medical purpose under the MDR, so many tools sit higher than manufacturers expect.
| Class | Typical Software Example | Notified Body? |
|---|---|---|
| Class I | Other software that is not caught by the higher parts of Rule 11. | Not normally |
| Class IIa | Software that informs diagnostic or therapeutic decisions, or monitors physiological processes. | Yes |
| Class IIb | Decisions that could cause serious deterioration or surgery, or monitoring of vital parameters where changes could cause immediate danger. | Yes |
| Class III | Decisions that could cause death or irreversible deterioration of health. | Yes |
Modular software needs a clear boundary. Under MDCG 2019-11 Rev.1, each module should have a documented intended purpose, and the links between modules should be documented too.
What Are the 9 Steps in the Software CE Marking Process?
This flow shows the typical path. Your class decides the conformity route in step 7.
- Qualify the softwareConfirm that it is a medical device under MDR Article 2(1).
- Classify itApply Rule 11 and record the rationale.
- Plan the projectAssess gaps and set the regulatory strategy and timeline.
- Build the quality systemImplement ISO 13485 and IEC 62304 processes.
- Prepare the technical fileFollow MDR Annexes II and III.
- Generate evidenceComplete risk, cybersecurity, usability and clinical work.
- Complete conformity assessmentSelf-declare Class I, or work with a Notified Body for higher classes.
- Declare and registerIssue the EU declaration of conformity, apply the CE mark and meet UDI and EUDAMED duties.
- Maintain complianceRun post-market surveillance, vigilance and change control.
What Technical Documentation Is Needed?
MDR Annexes II and III set out the file. Our medical software technical documentation guide covers it in detail. Reviewers commonly look for these elements in a software CE certification:
- Intended purpose, users, platform and software version
- Classification rationale under Rule 11
- General safety and performance requirements checklist
- Software requirements, architecture, verification and validation
- Traceability from requirements to risk controls and tests
- Risk management file under ISO 14971
- Cybersecurity and IT security evidence
- Usability engineering file
- Clinical evaluation plan and report
- Labelling, instructions for use and release notes
- Post-market surveillance plan, PMCF and PSUR, as applicable
How Does IEC 62304 Fit With Software CE Marking?
IEC 62304 is the main standard for the medical software lifecycle. It sets activities according to a safety class, which is separate from your MDR class. See our IEC 62304 consultants if you need support.
| Standard or Guidance | Topic |
|---|---|
| IEC 62304 | Medical device software lifecycle |
| ISO 14971 | Risk management |
| ISO 13485 | Quality management |
| IEC 62366-1 | Usability engineering |
| IEC 82304-1 | Health software product safety |
| IEC 81001-5-1 | Health software security activities in the lifecycle |
| MDCG 2019-11 Rev.1 | Qualification and classification of software |
| MDCG 2020-1 | Clinical evaluation of medical device software |
| MDCG 2019-16 Rev.1 | Cybersecurity for medical devices |
Check the current edition and harmonised status of each standard before you rely on it, as these lists change.
What Clinical Evidence Does Software Need?
Medical software needs a clinical evaluation, proportionate to its risk. MDCG 2020-1 describes three linked types of evidence:
Valid clinical association
The output of the software is linked to the targeted clinical condition.
Technical performance
The software reliably and accurately generates its intended output from the input data.
Clinical performance
The output gives clinically relevant results in the intended population and use.
For AI software, also consider dataset quality, bias, and whether test data reflect your intended users and patients. Our team prepares the clinical evaluation report as part of the technical documentation.
What About Cybersecurity and the EU AI Act?
MDR Annex I requires IT security and protection against unauthorised access. See our medical device cybersecurity consulting service for threat modelling and security documentation.
Medical device AI may also be subject to the EU AI Act, Regulation (EU) 2024/1689. Regulation (EU) 2026/1744 moved the date for high-risk requirements for AI medical devices from 2 August 2027 to 2 August 2028. Plan your MDR and AI Act work together.
Who Issues Software CE Certification?
For Class IIa and above, a Notified Body issues the certificate after assessing your quality system and technical documentation. The manufacturer then issues the declaration of conformity and affixes the CE mark. For Class I software, the manufacturer declares conformity without a Notified Body.
| Requirement | Class I | Class IIa and IIb | Class III |
|---|---|---|---|
| Quality system | Yes | Yes, audited | Yes, audited |
| Technical documentation | Yes | Yes, reviewed by sampling or as required | Yes, reviewed |
| Notified Body certificate | Not normally | Yes | Yes |
| Post-market report | PMS report | PSUR | PSUR |
Non-EU manufacturers also need an EU authorised representative. Legacy devices may have transition arrangements, so check their status and conditions early.
Can You Use the Same Evidence Worldwide?
CE marking is not a global approval, but well-structured evidence can often be reused. Many software companies plan for several markets from the start.
| Market | Main Route | What to Reuse |
|---|---|---|
| EU | CE marking under MDR or IVDR | Core technical file |
| USA | FDA pathway, such as SaMD 510(k) | Lifecycle, risk and cybersecurity evidence |
| UK | MHRA rules and registration | Much of the CE evidence, subject to current UK rules |
| Others | Local registration | Technical file, often with local additions |
Our SaMD guide explains the wider concept of software as a medical device.
Why Do Software Submissions Run Into Trouble?
- Intended purpose in marketing differs from the technical file
- Rule 11 class understated, with no strong rationale
- Risk outputs not linked to clinical evidence
- Missing traceability between requirements, risks and tests
- No clear module boundary for modular software
- Cybersecurity treated as an add-on
- Software changes released with no regulatory assessment
- Clinical evaluation based only on general literature
- No plan for post-market data after release
How Do Software Updates Affect CE Certification?
Software changes often, but CE certification covers a defined product. Each release should go through change control, so that you know whether it is a routine update or a change that needs review. Significant changes may need to be reported to your Notified Body before release.
| Change | Questions to Ask |
|---|---|
| Bug fix or security patch | Does it alter the intended function, performance or risk? |
| New algorithm or AI model | Does it change clinical performance or need new validation? |
| New platform or operating system | Do compatibility and security tests need repeating? |
| New claim or user group | Does it change the intended purpose or Rule 11 class? |
| New cloud provider or architecture | Does it alter security, availability or data integrity? |
Keep version records, release notes and the assessment for each change in your quality system. Planning these rules early makes frequent releases far easier to manage after CE marking of software is complete.
What Should You Prepare to Start Software CE Marking?
You do not need a finished file to begin. A short set of information lets a consultant assess your medical software CE marking route and give a realistic plan:
- A description of the software, its users and its intended purpose
- Screenshots, demo access or a product overview
- Any clinical claims made on your website or in sales material
- Target markets and your preferred launch date
- Current development process and any quality system in place
- Existing risk, testing, security or clinical documents
- Whether the software uses AI or machine learning
- Your company location, as non-EU manufacturers need an authorised representative
The earlier this work starts, the better. Classification and regulatory requirements can affect architecture, data collection and clinical evidence, and these are costly to change late in development. Timelines depend on your class, your documents and Notified Body capacity, so we set them once we have reviewed your software.
How Does I3CGLOBAL Help With Software CE Marking?
I3CGLOBAL is a global regulatory consulting company specialising in medical devices and IVDs. Understanding your route before development starts saves significant time and cost. We support you from classification to CE certificate:
Classification
MDR Rule 11 classification based on patient risk.
IEC 62304
Software lifecycle support for safety classes A, B and C.
QMS and specifications
Specifications, quality plans, version control procedures and SOPs.
Technical documentation
GSPR, design documents, labelling and instructions for use.
Risk analysis
ISO 14971 hazard identification, estimation and controls.
Clinical evaluation
Clinical evaluation report for your software.
Post-market surveillance
PMS plan, PSUR, vigilance reporting and PMCF guidance.
Notified Body support
Submission, query responses and support through to the certificate.
File maintenance
Secure, version-controlled file maintenance after certification.
See CE certification cost for pricing information. See our MDR case studies, which include a medical device software example.
Get Full Software CE Marking Details in 2 Minutes
Receive classification, IEC 62304 scope, Notified Body, timeline and cost information by email.
Start Your Software CE Certification
Work with our SaMD and software CE marking consultants on EU MDR compliance and certification. Get a free quote in 24 hours.
- Qualification and Rule 11 classification
- IEC 62304 and QMS implementation
- Technical file and clinical evaluation
- Notified Body support to certificate
Request your quote
Share your software details and target markets, and we will prepare a proposal.
Software CE Marking: Frequently Asked Questions
Does standalone medical software require CE marking?
Yes. Standalone software that meets the definition of a medical device under EU MDR 2017/745 or EU IVDR 2017/746 must carry a CE mark before it can be placed on the European market.
What is software CE marking?
Software CE marking is the conformity process that lets medical device software be sold in the EU. It covers qualification, classification, a quality system, technical documentation, clinical evidence and, for most classes, Notified Body assessment.
What is MDR Rule 11 for software?
Rule 11 in MDR Annex VIII classifies software by the information it provides, or what it monitors. Software used for diagnostic or therapeutic decisions is at least Class IIa, and can be Class IIb or III depending on the possible harm.
Do all medical apps need a Notified Body?
No. Class I software can be self-declared. Class IIa, IIb and III software needs a Notified Body. Many apps that inform clinical decisions fall into Class IIa or higher under Rule 11.
What is the classification of AI software under MDR?
AI software has no dedicated MDR classification rule, so it is classified under Rule 11 like other software. AI that informs clinical decisions often falls into a higher class, and the EU AI Act may add requirements.
What is the difference between MDR classes and IEC 62304 classes?
MDR classes I to III set the conformity assessment route. IEC 62304 classes A, B and C set the rigour of the software lifecycle, based on the harm that a software failure could contribute to.
Can mobile apps qualify as medical devices?
Yes. A mobile app qualifies as a medical device under EU MDR 2017/745 if its intended purpose involves diagnosing, monitoring, treating or informing clinical decisions, regardless of the platform.
Does I3CGLOBAL support IEC 62304?
Yes, we support IEC 62304 implementation.
How long does IEC 62304 implementation take?
The average timeline for proper implementation is 3 to 4 months, depending on the software and your existing processes.
How long does software CE marking take?
It depends on the software class, how complete your documents are and Notified Body capacity. We set a timeline after reviewing your software.
Does a software update need a new CE certificate?
Not always. Assess each release through change control. Significant changes may need to be reported to your Notified Body before release.
Does the EU AI Act replace the MDR for AI software?
No. AI medical devices must still meet the MDR, and the AI Act may add further requirements.
Do you provide clinical evaluation for software?
Yes. We provide Clinical Evaluation Report documentation services for medical software CE marking as part of the technical documentation.
Is software running on a medical device considered an accessory?
It may be, if it acts as an addition to a particular configuration, such as a web application for configuring a device. Firmware is not considered an accessory, and accessory software must be externally integrated with an independently functioning device.
Can a device and its software have different classes?
Yes. A Class III device can include software with simple functions that carries a lower IEC 62304 class, such as A or B, where this is justified. The MDR class and IEC 62304 class are assessed separately.
Does CE marking allow global sales of medical software?
No. CE marking covers the EU and countries that accept it. Other markets, such as the USA and UK, have their own rules, though much of your technical evidence can be reused.