Risk-Adaptive Surveillance: The Change That Will Determine How Often Notified Bodies Audit You, and What It Means for Manufacturers

End of the "five-year renewal" era?

Those who have undergone a certification process under the MDR are familiar with the rhythm: a certificate valid for five years, followed by a full recertification. The European Commission wants to fundamentally change this. A proposal for a revision of the MDR from December 2025 (COM(2025) 1023 final) indicates an intention to abolish the maximum validity of certificates and move from periodic renewals to periodic reviews whose intensity is derived from the risk level of the device and the manufacturer.

The idea looks good on paper, but it leaves a void: if there is no longer a fixed renewal cycle, how exactly is the intensity of surveillance determined? This is where a new document from Team-NB, the association of European Notified Bodies, comes in. The position paper adopted on June 30, 2026, proposes a concrete mechanism to fill this void: Risk-Adaptive Surveillance.

It is important to state this immediately and clearly: this is a proposal from the association of Notified Bodies, not legally binding text. It has not yet passed the Commission and Parliament. But precisely because it comes from the entities that will implement the mechanism in practice, it is very important to understand the direction. Those who build their quality system correctly now will find themselves on the right side of the equation.

The mechanism in brief: three levels of surveillance

The core of the proposal is a new section, Article 52c, which defines three levels of surveillance. The level you find yourself in determines the frequency and intensity of audits, unannounced audits, and technical documentation sampling.

  • Initial/Enhanced: Every manufacturer starts here, immediately after initial certification. Anyone with a "triggering event" in the last three years remains at or returns to this level.

  • Medium: No "triggering event" for three years.

  • Reduced: No "triggering event" for six years.

Note the asymmetry, and it is not accidental.

A reduction in the level of surveillance is gradual and slow: you cannot drop from the enhanced level before three years from initial certification, and each further reduction requires another period of quiet. Conversely, a return to a high level can be immediate as soon as a "triggering event" occurs.

In other words: trust is built slowly and broken quickly.

What constitutes a "triggering event"

This is perhaps the most important list for manufacturers, as it defines what will keep you in or return you to intensive surveillance. The document lists, among other things:

  • serious incidents with a confirmed causal link to the device, or FSCA.

  • Material or recurring non-conformities (NC) in the last two audits, including control of critical suppliers.

  • Failure to implement CAPA within the specified time, or inability to demonstrate the effectiveness of actions.

  • Documented deficiencies in the quality system indicating insufficient process control.

  • Negative vigilance and PMS data, including trend reports.

  • Delays or omissions in fulfilling reporting obligations: PSUR, PMS reports, trend reports.

  • Slow, partial, or weak responses to Notified Body requests, especially when accompanied by low-quality documentation and repeatedly causing clarification rounds.

  • Reliable third-party information: medical professionals, patients, authorities, and even whistleblowers.

The main point: these are not only "dramatic events" like a serious incident.

Even disorganized routine operations, a delayed PSUR, or a recurring NC on the same issue are included in the list.

Why this is dramatically important for small manufacturers and startups

Here's the main point. The change shifts the entire logic from "fixed renewal cycles" to "surveillance intensity based on compliance history."

This has three direct implications for your finances and schedule.

1. Intensive surveillance falls precisely during your most sensitive years. Every manufacturer starts at the enhanced level, and cannot drop from it before three years. This means that in the first years after certification, precisely when cash flow is tightest and every day of your team's work is valuable, you can expect the highest frequency of audits and sampling. This is not a bug, it is the legislator's intention: to invest intensive monitoring at the beginning to establish a risk assessment.

For example: A startup that received MDR certification for a Class IIb device in 2027 will not be able to expect a reduction in surveillance before 2030 at the earliest, and even then, only in the complete absence of triggering events. When planning the regulatory budget for the first three years, it is advisable to assume the maximum surveillance scenario, not the minimum.

2. A mature quality system translates directly into money. This is the positive news. The proposal explicitly states that the audit time itself can be shortened when there is maturity and proven effectiveness of the quality system, available and high-quality documentation, and a clean compliance history. Until now, investing in a quality system felt to many like a "cost of compliance." In the new model, it becomes an investment with a measurable return: fewer audit days, less sampling, less disruption to work.

For example: Two manufacturers in the same classification. The first arrives at the audit with corrective actions closed on time, an updated PSUR, and organized responses to every request. The second drags on with clarification rounds and delays in reporting. Within three years, the first will drop to the medium level and save audit days; the second will remain stuck at the enhanced level. Same product, completely different surveillance cost.

3. "Minor non-compliance" gets a big price tag. In the old model, a single non-conformity or a PSUR delayed by a few weeks would be handled and forgotten until the next renewal. In the new model, a single triggering event can freeze you at the enhanced level or return you to it immediately, with all the associated costs. Routine conduct, not just major events, determines the level of surveillance.

Additional changes to note

  • PSUR (Article 86): The proposal reorders the update frequency. Class III will remain annual. Class IIa and IIb will switch to biennial updates. Note that this is a relief for IIb (which was annual) but an aggravation for IIa (which was "as needed"). In addition, certificates issued with conditions will require annual PSUR regardless of classification.

  • Stricter WET definition (Article 2(72)): The definition of "well-established technology device" is tightened considerably, and explicitly excludes AI or machine learning-based software. Those who develop AI-based SaMD will not benefit from the simplifications intended for established technologies. This is a critical point for anyone operating in the medical AI field.

  • Unannounced audits (Annex IX, 3.4): Today the frequency is random, at least once every five years. In the TEAM-NB proposal, the frequency is derived from your risk level. For-cause audits remain always possible, at any level.

  • Equivalence (Annex XIV): A loophole in the regulatory requirements is closed. The device to which equivalence is claimed must not itself claim equivalence to another device and must be supported by its own clinical data. Anyone who built a clinical strategy on a chain of equivalence claims needs to re-examine it.

  • Technology in audits: There is an explicit push for the use of digital tools and remote audits where possible, with the aim of streamlining and improving accuracy.

What to do now

Even if this is just a proposal, the direction is clear enough to act.

So here are 3 practical recommendations:

  1. Treat the maturity of the quality system as a cost lever, not a burden. Available documentation, timely closed corrective actions, and organized responses to the Notified Body are precisely the parameters that will determine your surveillance level.

  2. Build tight reporting discipline around PSUR, PMS, and trend reports. Reporting delays are a triggering event in themselves, regardless of whether the product is safe.

  3. If you are in the field of AI-based SaMD, do not rely on WET simplification pathways. Plan your regulatory dossier assuming that the full level of evidence will be required.

Summary

Risk-Adaptive Surveillance will change the rules of the game: intensive surveillance at the beginning, and relief earned only through a clean compliance history over time. For small manufacturers and startups, the message is twofold. On the one hand, the first years will be more demanding. On the other hand, for the first time, there is a direct and measurable link between the quality of the quality system and the actual cost of surveillance. Those who treat quality as a strategy, not a checklist and a check-mark, will profit.

We will follow the progress of the proposal in the legislative process and provide updates.