“CE is not a burden, it is the map of how innovation reaches the market.” – Paulina Jonasson, CEO and regulatory director, Medtech Maze.
CE marking is something all medtech companies must comply with. It is the basis for selling a product to healthcare, and ultimately a guarantee that patients can trust that the technology they encounter is safe to use.
Because from a patient perspective, it's obvious: if you yourself are going to be diagnosed or treated using new technology, you want to know that it is well thought out, evaluated and does not risk making you more sick than healthy.
Despite this, there is a common misconception that CE marking is a cumbersome and bureaucratic process that slows down innovation and slows down the company. It is easy to think that regulation is about documentation “at the end”, rather than as an integral part of development.
But in practice, it's the opposite. When startups understand the logic behind CE marking, they avoid expensive rework, build faster, and can focus their creativity in the right places. The CE process forces clarity, which is exactly what makes innovation more accurate.
The more people on the team who have a regulatory mindset, the stronger both the development work and the business strategy will be. When the entire team thinks in terms of purpose, risks, traceability and correct communication, the risk of misunderstandings and missteps is reduced. Product validation is faster, documentation becomes an asset rather than a burden and the company builds the predictability that investors and regions demand. In other words: CE marking is both a patient safety requirement and a business framework.
Here is an introduction to what CE marking is, why it exists and how it actually works.
What is CE marking and what does it mean in practice?
The CE marking is a legal requirement for all medical devices to be sold in the EU and shows that the product:
- Is safe for the user
- Based on clinical evidence
- Is manufactured under controlled processes
- Is traceable and documented
- Monitored even after launch
So it's not just a symbol. It's the whole frame which determines whether a product is allowed to reach the patient.
Three reasons why the CE marking exists
1. Protect patients: CE comes from the need to reduce risks, errors and unclear products. Every technical detail and every clinical task must be explainable.
2. Create quality and traceability: CE allows you to follow how the product was designed, tested, manufactured and updated.
3. Making Europe a single market: When a product is CE marked, it can be sold in all EU countries without more local approvals. That's why CE is like a "passport" for medtech.
MDR and IVDR – the two regulatory frameworks behind CE
In medical technology, there are two central EU regulations that form the basis for CE marking:
MDR – Medical Device Regulation, which includes medical devices such as instruments, software (SaMD), hardware and combination products.
IVDR – In Vitro Diagnostic Regulation, which regulates diagnostic tests and laboratory products, such as blood and urine samples, biomarkers and laboratory instruments.
The MDR came into force in 2021 and replaced the previous MDD system. The regulations are significantly more comprehensive and place higher demands on clinical evidence, traceability, post-market follow-up and quality systems. This is one of the main reasons why CE marking today is often perceived as more demanding than before.
Regulatory framework in change
The EU medical device regulatory framework is in an ongoing phase of maturation. Following the introduction of the MDR and IVDR, the focus has been on strengthening patient safety, traceability and quality, while the application is gradually adjusted in line with practical experience.
Several factors contribute to the perception of the regulatory framework as changeable:
- Harmonization between member states is still ongoing, which means that interpretations and application may differ
- The capacity of Notified Bodies is strained, which affects lead times and priorities
- New technologies, especially in software and AI, are developing rapidly, which requires continuous updating of guidance and practices
- National practices and expectations may differ, especially around data protection, ethics and documentation level. For many Swedish companies, the interface between MDR/IVDR and, for example, GDPR becomes practically important early on.
The EU is continuously working to clarify, adjust and improve the application of the regulatory framework to reduce bottlenecks and increase predictability, not least for small and medium-sized companies. This means that the MDR and IVDR should not be seen as static regulatory frameworks, but as systems that evolve over time. For medtech companies, it is therefore crucial to work in a structured way, follow changes and build flexibility into both the regulatory strategy and business model.
Risk class levels within CE marking
Risk classes within CE marking exist to adapt the rules to the extent of clinical harm a product can cause. Safety is higher where needed and the burden is lower where the risk is minimal. The risk class is therefore not about how “dangerous” the technology is, but about what harm a faulty function could cause the patient. The MDR uses four risk class levels:
Class I (lowest risk): simple aids, non-sterile products without a measuring function, non-invasive products such as simple applicators, certain training aids, certain basic apps that do not provide medical recommendations.
Class IIa: The most common class for modern medtech, especially for software such as medical technology. For example, clinical apps that support decision-making, some monitoring systems, simpler diagnostic algorithms, sensors with medical purposes.
Class IIb: The product impacts the diagnosis/treatment of serious conditions. For example, AI that suggests diagnosis, monitoring systems that guide medical intervention, software that drives decision support with high clinical impact, infusion techniques, respiratory systems.
Class III (highest risk): For example, implants, pacemakers, advanced life support systems, software that controls life-critical functions.
For IVD products, A–D apply.
How the CE process works – step by step
Step 1. Define what the product actually does One of the most difficult, but most important, parts of the CE process is determining the product's intended purpose, i.e. what the product is intended to do, for whom and in what clinical context.
Here you set the framework for the entire deal: area of use, patient group, environment and function. An unclear or too broad purpose often leads to a higher risk class, more clinical requirements and unnecessarily complex development later on.
Step 2. Risk classify the product The product is risk classified according to the MDR (class I, IIa, IIb or III). The risk class determines:
- How extensive the CE process will be
- What amount of clinical evidence is required?
- Whether and how a Notified Body should review the documentation
Risk class is not about how advanced the technology is, but about what consequences an error could have for the patient.
Step 3. Create technical documentation The technical documentation is not a binder of documents, but a comprehensive and traceable description of how the product is designed, developed, tested and controlled.
It contains, among other things:
- Product design and architecture
- Verification and validation
- Clinical evaluation
- Risk management
- Cybersecurity and data protection
- Post-market follow-up plan
Well-structured documentation makes the CE process faster, cheaper and more predictable, and is also a strong support in dialogues with investors and partners.
Step 4. Secure clinical evidence This step is about demonstrating that the product works as intended and is safe to use in a real clinical environment.
The requirements for clinical evidence depend on the product's risk class, maturity level and how innovative it is. It may include:
- Scientific literature
- Comparison with existing products
- User tests or pilot studies
- Clinical studies in healthcare settings
Clinical evidence does not always have to involve large and expensive studies, but it must be relevant, documented and linked to the product's intended purpose. Early clinical thinking also makes it easier to demonstrate value to healthcare providers, regions and future customers.
Step 5. Implement a QMS (quality management system for higher classes) For products in higher risk classes than Class I, a quality system according to ISO 13485 is required.
QMS ensures that the company works in a structured and controlled manner over time, from development and changes to incident management and follow-up. A lightweight but correct QMS early on saves both time and costs later.
Step 6. Notified Body review (for higher classes) For products above Class I, an independent body, a Notified Body, reviews the technical documentation, QMS and clinical evidence.
The review is not an “exam”, but a structured dialogue where the company demonstrates that it has control over its product, its processes and its risks. The better prepared the documentation is, the faster and smoother the process will be.
Step 7. Declare conformity + affix the CE mark When all requirements are met, the company draws up a Declaration of Conformity, certifying that the product complies with applicable regulations.
The product can then be CE marked and sold within the EU, and the company enters the next phase: follow-up, improvement and scaling.
How long does CE marking take and how much does it cost?
Class I is faster, while IIa and IIb often require more clinical evidence and a clear documentation process. If the structure is put in place late, there is often rework, which prolongs the process.
For startups, costs vary greatly depending on risk class, evidence needs, and how early the structure is in place. What often drives cost is not “CE per se,” but late iterations: reclassification, redesign, additional verification, and retroactive documentation.
The point is not that CE is expensive. The point is that late structure is expensive. When regulatory planning is done in parallel with development, the process becomes both faster and more capital efficient.
Where can a company turn for help with CE marking?
Notified Bodies (NB) – The formal approval and quality review
- Reviews technical documentation and QMS
- Determines whether the product can be CE marked (for class IIa–III)
Exempel: BSI, TÜV SÜD, TÜV Rheinland, Intertek Semko
Medical Products Agency (Sweden) – Support in boundary demarcation and overall practice in Sweden
- National supervisory authority
- Preliminary guidelines
- Classification assistance in borderline cases
- Responsibility for certain national interpretations
Standardization bodies (ISO/IEC, CEN, SIS) – The map for how to build a secure product
- Develops the harmonized standards on which CE is based
- Helps you demonstrate how you meet MDR
Examples ISO 13485, ISO 14971, IEC 62304, IEC 82304-1
Industry organizations – Interpret what the rules mean in everyday life
- Practical interpretations
- Workshops, guides, feedback
- Clarifications of how MDR is used in reality
For example: MedTech Europe, Swedish Medtech
Consultants and Regulatory Affairs (RA) Partners – Getting the Job Done
- Risk classification, strategy, documentation
- QMS, clinical plans, risk management
- NB preparations, implementation support
For example: QARA Consulting AB, MedQtech, Key2Compliance
Venture studios and company builders – when regulation needs to sit together with team, capital and go-to-market
Some companies choose to work with an operational investor/venture studio early on to connect the regulatory path, clinical plan, capital plan and commercial strategy. This may be relevant when the company is past the research phase but does not yet have the structure required for the CE process and B2B sales.
For example: Medtech Maze
Summary
CE marking is a complex but necessary framework to ensure patient safety, quality and access to the European market. For companies that work in a structured way from the start, the process becomes both more predictable and more business efficient. That is why CE should not be seen as an obstacle, but as an integral part of building sustainable medical device innovation.
This article is part of a series where we delve deeper into how regulation interacts with business strategy, investments, teams, internationalization, branding and innovation. Read more about that in our next article. “Regulation as a strategy – not as a brake.”.