EU MDR penalties and enforcement risk

Article 113 is the MDR penalty provision: Member States must lay down penalty rules for infringements of the MDR, take the measures needed to implement them, and make the penalties effective, proportionate, and dissuasive. That is why a useful penalty assessment should not invent an EU-wide maximum fine.

For a device-specific issue, begin with a national-law mapping: the Member State, competent authority, economic-operator role, alleged MDR infringement, local penalty provision, and status of any authority contact. Article 113 does not decide whether a particular case attracts an administrative fine, criminal sanction, or another measure. That answer depends on the applicable Member State law and the facts. If the national rule is not supported by a current cited source, leave the amount and sanction type blank.

Check the national rule in force on the date of the alleged infringement and identify the procedural source separately from the penalty amount. National law may distinguish administrative and criminal proceedings, responsible legal and natural persons, limitation periods, aggravating factors, cooperation credit, and appeal routes. The MDR's Article 113 formula does not resolve any of those country-specific questions.

Penalty exposure normally follows a concrete MDR failure. The most enforcement-relevant records are the ones competent authorities can request or inspect: technical documentation, EU declaration of conformity, certificates, QMS procedures, risk management, clinical evaluation, PMS records, vigilance reports, field safety corrective actions, and cooperation evidence.

Manufacturers must keep technical documentation, the EU declaration of conformity, and relevant certificates available for competent authorities for at least 10 years after the last device covered by the declaration is placed on the market, or at least 15 years for implantable devices. A missing, incomplete, or incorrect response to an authority request can itself escalate risk because Article 10 allows authorities to restrict, withdraw, or recall a device until cooperation or complete and correct information is provided.

The MDR enforcement path depends on the risk and the type of non-compliance. Under Article 94, competent authorities evaluate devices suspected of presenting an unacceptable risk or otherwise failing MDR requirements. If Article 95 applies, authorities can require corrective action proportionate to the risk, including market restrictions, specific requirements, withdrawal, or recall. A withdrawal addresses a device in the supply chain, while a recall seeks the return of a device already made available to the end user.

Article 97 covers other non-compliance where the device does not present an unacceptable health or safety risk. The operator still must end the non-compliance within a defined and communicated period; if it does not, the Member State can restrict or prohibit availability, or ensure recall or withdrawal. Article 98 separately supports preventive health protection measures where a potential risk justifies prohibition, restriction, special requirements, withdrawal, or recall.

For devices requiring notified-body involvement, fines are not the only material consequence. Article 56 says certificates may be valid for a stated period not exceeding five years. If the notified body finds that MDR requirements are no longer met, it must, with regard to proportionality, suspend or withdraw the certificate or impose restrictions unless the manufacturer implements appropriate corrective action within the notified body's deadline.

Certificate evidence should identify the manufacturer, device or device group, risk classification, intended purpose where required, Basic UDI-DI where applicable, conformity assessment annex, tests and examinations, surveillance conditions, validity limits, and any supplement, restriction, suspension, reinstatement, withdrawal, refusal, or reissue history.

An MDR penalties file should let counsel, regulatory, quality, and management reconstruct the exposure without relying on memory. It should show the MDR obligation at issue, each Member State penalty rule checked, the authority or notified body involved, what the operator did, and whether the device risk was eliminated, mitigated, restricted, withdrawn, recalled, or otherwise closed. Keep the legal assessment separate from the remediation log so that correcting the device issue is not mistaken for a decision that no penalty can follow.

For vigilance-linked matters, keep Article 87 serious-incident and field safety corrective action reports with the Article 89 investigation, risk assessment, field safety corrective action decision, authority communications, and field safety notice. For market-surveillance matters, keep the Article 93 inspection report, Article 94 evaluation basis, and any Article 95 to 98 measures or operator submissions.