EU MDR penalties and enforcement risk

Article 113 is the MDR penalty provision: Member States must lay down penalty rules for infringements of the MDR, take the measures needed to implement them, and make the penalties effective, proportionate, and dissuasive. That is why a useful penalty assessment should not invent an EU-wide maximum fine.

For a device-specific issue, the first evidence item is a national-law mapping: the Member State, competent authority, economic operator role, alleged MDR infringement, local penalty provision, and status of any authority contact. If the national law is not already grounded, leave the amount blank rather than guessing.

Penalty exposure normally follows a concrete MDR failure. The most enforcement-relevant records are the ones competent authorities can request or inspect: technical documentation, EU declaration of conformity, certificates, QMS procedures, risk management, clinical evaluation, PMS records, vigilance reports, field safety corrective actions, and cooperation evidence.

Manufacturers must keep technical documentation, the EU declaration of conformity, and relevant certificates available for competent authorities for at least 10 years after the last device covered by the declaration is placed on the market, or at least 15 years for implantable devices. A missing, incomplete, or incorrect response to an authority request can itself escalate risk because Article 10 allows authorities to restrict, withdraw, or recall a device until cooperation or complete and correct information is provided.

The MDR enforcement path depends on the risk and the type of non-compliance. Under Article 94, competent authorities evaluate devices suspected of presenting an unacceptable risk or otherwise failing MDR requirements. If Article 95 applies, authorities can require corrective action proportionate to the risk, including market restrictions, specific requirements, withdrawal, or recall.

Article 97 covers other non-compliance where the device does not present an unacceptable health or safety risk. The operator still must end the non-compliance within a defined and communicated period; if it does not, the Member State can restrict or prohibit availability, or ensure recall or withdrawal. Article 98 separately supports preventive health protection measures where a potential risk justifies prohibition, restriction, special requirements, withdrawal, or recall.

For devices requiring notified-body involvement, fines are not the only material consequence. Article 56 says certificates may be valid for a stated period not exceeding five years, but if the notified body finds MDR requirements are no longer met, it must, proportionately, suspend or withdraw the certificate or impose restrictions unless timely corrective action restores compliance.

Certificate evidence should identify the manufacturer, device or device group, risk classification, intended purpose where required, Basic UDI-DI where applicable, conformity assessment annex, tests and examinations, surveillance conditions, validity limits, and any supplement, restriction, suspension, reinstatement, withdrawal, refusal, or reissue history.

A defensible MDR penalties file should let counsel, regulatory, quality, and management reconstruct the enforcement exposure without relying on memory. It should show what MDR obligation was at issue, which Member State penalty rule was checked, which authority or notified body was involved, what the operator did, and whether the device risk was eliminated, mitigated, restricted, withdrawn, recalled, or otherwise closed.

For vigilance-linked matters, keep Article 87 serious-incident and field safety corrective action reports with the Article 89 investigation, risk assessment, field safety corrective action decision, authority communications, and field safety notice. For market-surveillance matters, keep the Article 93 inspection report, Article 94 evaluation basis, and any Article 95 to 98 measures or operator submissions.