Notified body selection and timeline planning for SaMD founders

Any device above Class I needs conformity assessment involving a notified body — an organisation designated by an EU member state to assess whether a manufacturer’s technical documentation and quality system meet MDR’s requirements. Since Rule 11 moved most standalone clinical software from the old directive’s Class I into MDR’s Class IIa, demand for that review capacity has outpaced supply for years, and the queue itself — not the complexity of any individual submission — is what most first-time manufacturers actually wait on. A well-run engineering programme cannot compress a review queue by working harder; the only lever available is starting the relationship earlier.

Not every notified body is designated for every device type, and designation scope is the first, hardest filter: confirm a candidate is actually designated for the relevant product code and, ideally, has a demonstrated track record with standalone software specifically, not only hardware devices with an incidental software component. Track record matters because reviewers who understand SaMD-specific evidence — IEC 62304 documentation, cybersecurity per IEC 81001-5-1, usability evidence under IEC 62366-1 — ask sharper, faster questions than reviewers encountering it for the first time on your file.

Beyond designation and experience, practical factors matter more than founders expect: working language, whether the body has capacity for a manufacturer of your size and stage rather than prioritising larger established clients, and — bluntly — whether they will take an introductory call before you have a completed technical file. A body willing to have that conversation early is telling you something about their current capacity that their published information will not.

Plan in quarters, not weeks, and build the plan backward from notified body availability rather than forward from your engineering roadmap. The realistic sequence runs: an initial engagement to confirm scope and designation fit, a period where your QMS has to be operating — not just documented — long enough to generate at least one internal audit and management review cycle, submission of technical documentation, the formal review itself (which routinely includes rounds of clarification questions), and only then certificate issuance. Each stage has its own calendar time that cannot be substituted with more engineering hours.

The single highest-leverage action available to an early founder is contracting notified body capacity earlier than feels natural — often before the technical documentation is complete — because the queue position you secure is frequently worth more than additional polish on a submission that then waits months to be read.

A notified body is assessing evidence that a system has operated, not a plan for one to operate eventually. That means a QMS compliant with ISO 13485 that has actually been running — with real records, not a template populated the week before — technical documentation structured per MDR Annexes II and III, a risk management file maintained under ISO 14971 across the product’s development rather than assembled retrospectively, and a clinical evaluation appropriate to the claims being made. Arriving without these in a genuinely operated state is the most common reason an engagement stalls rather than progresses.

Notified body strategy is not a task to hand to whoever is available closest to submission — it is a sequencing decision that belongs in the same conversation as classification and QMS design, which is the substance of our SaMD regulatory strategy advisory. Getting the order right, and the relationship started early, is usually worth more than any amount of last-mile documentation polish.