EU Medical Device Compliance in Q4 2026: Class C IVDR Deadline Missed, Cyber Reporting Live & the Proposed MDR Overhaul

If you supply or procure single-use medical consumables for the EU market, Q4 2026 is not a quiet quarter. Three deadlines that have been looming for years are now landing simultaneously: the IVDR Class C transition window closed on 26 September 2026, the EU Cyber Resilience Act (CRA) reporting obligations became binding on 11 September 2026, and the European Commission's proposed MDR/IVDR revision — published in December 2025 — is working its way through the legislative pipeline with direct implications for single-use devices. This article unpacks what each milestone means for manufacturers, authorised representatives and procurement teams, and what to do before year-end.

1. IVDR Class C: the written-agreement deadline has passed — what now?

Under Regulation (EU) 2017/746, legacy IVD devices could continue placing on the EU market during a transition period, provided they met certain conditions. For Class C devices, the transition required a two-step proof of intent: a formal application lodged with a Notified Body by 26 May 2026, followed by a signed written agreement by 26 September 2026. That second gate has now closed.

According to regulatory consulting firms, the consequence for Class C devices that missed the 26 September agreement deadline is loss of the transitional provision. Without a valid written agreement, the device can no longer rely on the legacy IVDD certificate pathway and must either have a full IVDR certificate or be withdrawn from the market. In practice, Notified Body capacity constraints mean that many manufacturers who filed on time still face multi-month waits for the agreement to be signed, and those who filed late or with incomplete dossiers are now in a high-risk position.

For procurement teams sourcing IVD consumables, the immediate action is to ask every supplier: Is your Class C IVD product covered by a signed Notified Body agreement dated before 26 September 2026? If the answer is no or uncertain, the risk of market withdrawal — with no replacement supply for 12–18 months — is real. Class B and sterile Class A devices have until 26 May 2027 for the formal application and 26 September 2027 for the written agreement, but the same capacity constraints apply, and the Notified Body queue is not getting shorter.

2. EU Cyber Resilience Act: 24-hour reporting is now live

While IVDR dominates compliance conversations for device manufacturers, the EU Cyber Resilience Act (CRA) — Regulation (EU) 2024/2847 — introduced obligations that started applying on 11 September 2026, and they are separate from MDR/IVDR compliance. Under Article 14, manufacturers of products with digital elements placed on the EU market must report to ENISA (the EU Agency for Cybersecurity) within:

• 24 hours of becoming aware of an actively exploited vulnerability;
• 72 hours of becoming aware of a severe incident; and
• 14 days of a final report with a detailed assessment.

For medical device manufacturers, this intersects with MDR/IVDR cybersecurity requirements under MDCG guidance. A device that is compliant from a clinical-safety perspective may still trigger CRA reporting obligations if its software component has a vulnerability that is actively exploited. The reporting entity is the manufacturer placing the product on the EU market, not the importer or distributor — which means that non-EU manufacturers must have a clear incident-response chain that can activate within hours, not days.

Full CRA obligations — including the essential cybersecurity requirements of Annex I — apply from 11 December 2027, but the reporting clock is already running. Every exporter with software-enabled or connected medical devices should establish an ENISA-reporting procedure now, designate a responsible person, and test the chain with a tabletop exercise before the next security incident.

3. EUDAMED: four modules mandatory since May 2026

While the IVDR and CRA deadlines grab headlines, the practical burden of EUDAMED registration continues to grow. Under Regulation (EU) 2024/1860, the first four EUDAMED modules — Actor registration, UDI and device registration, Certificate and Notified Body information, and Vigilance and post-market surveillance — became mandatory on 28 May 2026.

This means that any device placed on the EU market after that date must be registered in EUDAMED by the economic operator placing it on the market. For manufacturers outside the EU, the registration is typically performed by the EU Authorised Representative acting on the manufacturer's behalf, but the data — UDI-DI, manufacturer details, device category, and certificate information — must originate from the manufacturer and be kept current.

The practical impact: procurement teams should verify that every SKU in a supplier's portfolio has a valid EUDAMED registration entry, and that the UDI-DI on the registration matches the UDI on the device labelling. Mismatches are a common finding in EU market surveillance checks and can trigger detention at customs or recall requests.

4. Proposed MDR/IVDR revision: single-use devices in scope

In December 2025, the European Commission published its proposal to revise the MDR (2017/745) and IVDR (2017/746), with stated goals of simplifying administrative burden, improving notified body capacity, and clarifying the rules for single-use medical devices. The feedback period ran from January to March 2026, and as of November 2026 the proposal is undergoing co-legislative review by the European Parliament and Council.

The most directly relevant element for single-use medical consumables exporters is the proposed Article 17 amendment, which would introduce a streamlined conformity assessment pathway for certain single-use devices that meet predefined criteria — potentially reducing the documentation burden for products with established safety profiles. The proposal also addresses the notified body capacity bottleneck by mandating increased resources and clearer prioritisation rules for Class III and implantable devices.

While the revision is not yet law, the direction of travel is clear: the Commission recognises that the current MDR/IVDR framework is creating access-to-market delays that are counterproductive for patient care. Exporters should monitor the legislative process and begin aligning their technical documentation with the proposed streamlined requirements, so that when the revised regulation enters into force, the transition is a formality rather than a scramble.

A Q4 2026 action checklist

• IVDR Class C: Confirm signed Notified Body agreements for all Class C IVD SKUs. For any that missed the 26 September 2026 deadline, assess alternative compliance pathways immediately.
• CRA reporting: Establish a 24-hour incident-response chain with ENISA as the reporting endpoint. Designate a responsible person and document the procedure before an incident occurs.
• EUDAMED: Verify UDI-DI consistency between device labelling and EUDAMED registration entries. Ensure the EU Authorised Representative has current data for all SKUs.
• MDR revision: Track the co-legislative process. Begin aligning technical documentation with the proposed streamlined requirements for single-use devices.
• Quality system: The FDA QMSR (in force since 2 February 2026) incorporates ISO 13485:2016 by reference into 21 CFR Part 820. Ensure your quality system documentation reflects this integration — QMSR audits are already underway.

Related Links — Authoritative Sources

• EUR-Lex — Regulation (EU) 2017/746 (IVDR)
• Specculo — IVDR Class C Written Agreement Deadline Has Passed (Sep 29, 2026)
• MDXCRO — MDR & IVDR Transitional Provisions: Current Deadlines
• European Commission — Cyber Resilience Act
• Crowell & Moring — EU CRA Reporting Deadline Alert
• European Commission — Have Your Say: MDR/IVDR Revision

Related Reading

• The 2026 Regulatory Horizon: EU AI Act Deferral, US EtO Rollback and the Packaging Rules Exporters Must Plan Around
• FDA QMSR and EU EUDAMED Are Now in Force: 2026 Regulatory Milestones

Wehere Medical operates an ISO 13485:2016-certified quality management system across three own factories and a network of more than 45 audited partner factories, covering 2,500+ products shipped to 50+ countries. Our regulatory team documents sterilisation modality by reference, MDR conformity and EUDAMED registration data — with 24-hour response on active compliance inquiries.