Medical Device Assessment - March 2026

As it is the end of March 2026, your Medical Device assessment is likely falling under two specific legislative pillars: the Post-Market Surveillance (PMS) requirements (active since June 2025) and the newly arriving Pre-Market regulations.

Here is a suggested plan to see what you need to do to comply with the current framework. Feel free to comment:

1. Immediate Priority: Post-Market Surveillance (PMS)

The most critical change currently in force is Part 4A of the UK Medical Devices Regulations 2002. If your device is already on the Great Britain market, you must have updated your PMS system.

• Reporting Timelines: You must now report serious incidents within 15 days (down from 30).
• Documentation: You are required to maintain a formal PMS Plan and a PMS Report (PMSR) or Periodic Safety Update Report (PSUR) depending on your device class.
• Digital Reporting: All incidents must be reported via the MORE portal. If you haven't updated your account roles by March 30, 2026, your account may be closed.

2. The 2026 Pre-Market Assessment

The MHRA is currently implementing a "Pre-Market" Statutory Instrument. This introduces several new "hard" requirements for your assessment:

• Classification Review: Several device types (especially software and certain implants) have been reclassified. You must check if your device has moved to a higher risk class (e.g., from Class I to IIa).
• Technical Documentation: Requirements have been strengthened to align more closely with EU MDR. You’ll need to ensure your "Essential Requirements" (ERs) match the new "General Safety and Performance Requirements" (GSPRs).
• Unique Device Identification (UDI): You must now incorporate UDIs for better traceability throughout the supply chain.
• Implant Cards: If you manufacture implantable devices, you are now legally required to provide patient-specific implant cards.

3. Choose Your "Route to Market"

Because we are in a transition period, you have a choice in how you demonstrate conformity:

Your Checklist for Action:

1. Gap Analysis: Compare your current technical file against the UK MDR 2002 (as amended). Focus on the new PMS and UDI requirements.
2. Appoint a UKRP: If you are based outside the UK, you must have a UK Responsible Person (UKRP) to handle your registration.
3. Register on the MHRA Portal: All devices must be registered before being placed on the market, regardless of whether they have a CE or UKCA mark.
4. Consultation Watch: The consultation on "Indefinite Recognition of CE marks" closes on April 10, 2026. Keep an eye on the outcome, as it may mean you don't need a separate UKCA mark if you already hold an EU MDR certificate.

Note: These rules apply to Great Britain (England, Scotland, Wales). If you are placing devices in Northern Ireland, you must continue to follow EU MDR/IVDR rules due to the Windsor Framework.

To review your existing medical devices, you need to access the Device Online Registration System (DORS).

Since we are currently in the final week of the "Data Clean-Up" phase (ending March 30, 2026), the portal layout has been updated to help manufacturers prepare for the new annual fee structure starting April 1.

1. Accessing your Registered Devices

Log in to your DORS account. Once inside, you can navigate your portfolio using these tabs:

• "Applications" Tab: This shows all historical and pending submissions. You can check the status of recent updates here.
• "Manage Registered Devices": This is your primary workspace for the current audit.
• Search & Filter: You can now filter your list by Brand/Trade Name (a feature added in February 2026) or by GMDN code.
• Export to Excel: There is an "Export" button on the device management page. I highly recommend downloading the full list to perform an offline "gap analysis" against the new legislation.

2. The "March 30th Clean-Up" Checklist

The MHRA has signalled a "hard stop" on March 30, 2026, at 5:00 PM. Before then, you should review each entry for the following:

3. Key Deadlines & Technical Transitions

• System Downtime: DORS will be offline for essential updates from 5:00 PM on March 30 until April 1. You will not be able to make changes during this window.
• Annual Invoicing: On April 1, 2026, the MHRA will automatically generate your first annual invoice based on whatever is left in your account. You will find this in a new "Finance" or "Invoices" section of the portal.
• Northern Ireland (EUDAMED): Note that if you have devices registered for the NI market, a major shift occurs on May 28, 2026, where most non-custom devices must be moved to the EU's EUDAMED database instead of DORS.

Pro-Tip for Visual Thinkers

If your portfolio is complex, use the Excel Export to create a "pivot table" of your GMDN Level 2 categories. Since the MHRA is expected to charge roughly £300 per category, this will give you an immediate visual map of your upcoming regulatory budget.

In the medical device world, GMDN (Global Medical Device Nomenclature) codes are usually very specific (e.g., "manual toothbrush"). Level 2 is the broader "family" or category that code belongs to (e.g., "Dental equipment").

Starting April 1, 2026, the MHRA is changing how they charge you. Instead of a one-off fee per application, you will pay an annual "maintenance" fee of £300 per GMDN Level 2 category.

Why "Verifying" Matters Right Now

If you have 50 different products registered, but they all fall under one Level 2 category, you only pay £300 total per year. However, if your data is messy and those same 50 products are scattered across three different Level 2 categories due to old or "pseudo" codes, your bill triples to £900.

Verifying Level 2 means ensuring your devices are grouped as efficiently as possible before the snapshot on March 30.

How to Verify Your Categories

Since the DORS portal doesn't always show the "Level 2" name directly in the main list, you have to look it up:

1. Export your Data: Download your device list from the DORS portal.
2. Identify the GMDN Terms: Look at the "GMDN Term" or 5-digit code assigned to each device.
3. Check the Hierarchy: * If you have a GMDN Agency membership, log in and go to "My Terms." Click "Details" on a code, and look at the bottom for the "Device Function" header. This will show the Level 1 and Level 2 categories.
• If you don't have a membership, the MHRA portal has a "search" function within the registration update section. When you select or update a GMDN term, the system should now display which fee-bearing category it falls into.
4. Look for "Pseudo-Codes": If any of your devices are still using "Legacy" or "Pseudo" GMDN terms (common in older registrations), these must be updated to official terms by March 30. If you don't, the account may be suspended.

The "Cost-Saving" Audit

To minimize your bill before April 1, check for these three things:

• Duplicates: Do you have the same device registered twice under slightly different codes? Consolidate them.
• Obsolete Devices: If you aren't selling a product anymore, delete it from the portal now. If it's there on April 1, you're paying for it.
• Active vs. Non-Active: Products with similar purposes but different "active" statuses (e.g., a manual scalpel vs. a laser scalpel) will almost always be in different Level 2 categories.

Critical Deadline

The "Snapshot" Date: The MHRA will calculate your invoice based on your account status at 5:00 PM on March 30, 2026.

If you miss this window, the DORS system goes offline until April 1, and your invoice will be generated based on whatever data was there—mistakes and all.

If GMDN Level 2 was about grouping your devices for billing, checking your UDI-DI is about identifying each specific version of your device for safety and tracking.

Under the new 2026 legislation, the MHRA is making the Unique Device Identifier (UDI) a "hard" requirement. Think of it as a digital DNA strand for your product.

1. Breaking down the "UDI-DI"

A full UDI consists of two parts, but for the MHRA Portal (DORS), the DI is the one you need to verify:

• UDI-DI (Device Identifier): This is the static part. it identifies the specific model, version, or "catalogue number" of your device. It never changes as long as the design stays the same. (In the GS1 system, this is usually your GTIN).
• UDI-PI (Production Identifier): This is the dynamic part (Batch number, Serial number, Expiry date). You do not upload this to the portal, as it changes with every box you make.

2. What "Checking" your UDI-DI data actually involves

When you log into the DORS portal to review your registered devices, you need to ensure the UDI-DI field is populated and accurate for every "active" device.

Check for these three specific things:

1. Presence: Many older registrations (pre-2024) left the UDI-DI field blank or marked it as "N/A." Under the new rules, almost all devices (except custom-made ones) must have a valid UDI-DI from an issuing agency (like GS1, HIBCC, or ICCBBA).
2. Packaging Levels: If you sell a device individually AND in a box of 10, those are two different "trade items." Check that you have the correct UDI-DI for the level of packaging you have registered.
3. Basic UDI-DI vs. UDI-DI: * Basic UDI-DI: This is a "family" code (used mainly for EU MDR compliance). It connects several similar UDI-DIs together.
• UDI-DI: This is the specific product code.
• The MHRA portal now allows (and in some routes, requires) both. Make sure you haven't accidentally swapped them.

3. Why this is urgent for the March 30th Deadline

If you are transitioning a CE-marked device to a UKCA mark, or if you are using the new "International Reliance" route (FDA/TGA recognition), the MHRA system uses the UDI-DI as the primary key to pull data from other global databases.

• If the UDI-DI is wrong: The system won't be able to "see" your clinical data or safety certificates from other regulators.
• If it's missing: Your registration may be flagged as "Non-Compliant" during the April 1st transition, which could block you from generating a Certificate of Free Sale (CFS) if you export your products.

Summary Checklist:

• [ ] Open your DORS export.
• [ ] Look for any rows where the UDI-DI column is empty.
• [ ] For each empty row, find the barcode (GTIN) on your physical product packaging.
• [ ] Update the portal with that number before March 30, 5:00 PM.

To confirm your UK Responsible Person (UKRP) details, you need to verify both the data in the portal and the legal documentation supporting it.

Because we are approaching the March 30, 2026 "Clean-Up" deadline, the MHRA is being much stricter about this. If your UKRP role isn't explicitly confirmed and updated by 5:00 PM on March 30, the MHRA has stated they will close the account, requiring you to start the entire registration process from scratch.

1. Verify the "Letter of Designation"

The most important step is ensuring you have a valid Letter of Designation (LoD) uploaded. This is the legal contract between the manufacturer and the UKRP.

• What to check: The LoD must be a formal document on the manufacturer's letterhead, signed by both parties.
• The "Exclusivity" Clause: The new legislation requires the LoD to state that the UKRP is the exclusive representative for the manufacturer's devices in Great Britain.
• Mandatory Tasks: It must explicitly list the UKRP’s duties (e.g., registering devices, keeping technical files available, and liaising with the MHRA on safety issues).
• How to check in DORS: Go to the "Your Organisation" section. Look for the uploaded documents area. If the letter is more than two years old or doesn't mention the current 2026 regulations, you should upload a fresh version.

Good news: Starting April 1, 2026, the MHRA is removing the fee for uploading a new Letter of Designation. However, if you need to update it to meet the March 30th deadline, you should do it now to avoid account closure.

2. Check Account Status & Contacts

In the DORS portal, navigate to the "Organisation Details" page. You need to confirm:

• Account Status: It must say "Registered." If it says "Suspended" or "Pending Update," your devices are not legally on the market.
• Primary Contact: Ensure the "Administrative Contact" is still with the company. If the person who set up the account has left, you must add a new administrator immediately. You can have up to 15 people with access to the account.
• Address Accuracy: The address for the UKRP in the portal must exactly match the address on your product labelling and the Letter of Designation. Even a small discrepancy can cause a "Request for Further Information" (RFI) from the MHRA.

3. The UKRP "Substantive Partner" Test

The MHRA has moved away from "letterbox" UKRPs (those who just provide an address). To confirm your UKRP is compliant for 2026, ask them:

1. Do they have your Technical Files? A UKRP is legally required to have a copy (or immediate access) to your full technical documentation.
2. Are they registered for MORE? They must have access to the MORE portal to assist with incident reporting.
3. Are they monitoring the CE Consultation? The MHRA is currently consulting on "Indefinite Recognition" of CE marks (closing April 10, 2026). Your UKRP should be advising you on how this affects your specific portfolio.

Final "Deadline" Check