Norway consults on implementing EU notified body rules
The Norwegian Medical Products Agency (DMP) opened a consultation on 13 October 2026 on incorporating Commission Implementing Regulation (EU) 2026/977 into Norwegian law. Comments are due by 9 December 2026. The proposal would add Section 1j to Norway’s 2021 medical device regulations; its commencement date would be determined by the ministry and has not yet been specified.
The European Commission adopted the implementing regulation on 4 May 2026. It supplements requirements for notified bodies designated under the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR), both of which are already implemented in Norway. The October announcement concerns Norwegian implementation of that existing EU measure.
The regulation standardises notified body procedures for quotations, assessment timelines, interruptions, cost and duration monitoring, and re-certification. DMP identifies differences in notified body practice as a source of uncertainty for manufacturers. The measure does not change the substantive requirements for device safety, performance or continued conformity.
Manufacturers arranging notified body certification, changes or renewals are directly affected. The assessment timelines cannot simply be applied to devices for which the manufacturer may lawfully declare conformity without notified body involvement. Norway’s consultation focuses on the implementation method, administrative and economic effects, and any Norwegian circumstances relevant to incorporation into the European Economic Area framework.
More specific quotations and public performance data
Article 1 requires quotations to be based on information about the manufacturer, its size, manufacturing sites, relevant suppliers and subcontractors, the device’s intended purpose and risk class, and the requested conformity assessment procedure. Agreement on that scope is essential to making cost estimates comparable.
The quotation must include estimated overall costs, detailing quality management system and technical documentation assessment costs where applicable and including typical surveillance and unannounced audit costs. It must also identify estimated potential extra costs and timelines. Comparing headline prices alone may therefore overlook costs arising later in the certification cycle.
A cost increase exceeding 10% of the estimate requires advance notice to the manufacturer and an explanation. This is a notification threshold, not a 10% ceiling on increases. As a practical preparation step, manufacturers can retain the original assessment scope, estimate and subsequent change explanations to compare additional charges with the work involved.
DMP also clarifies that micro, small or medium-sized enterprise status does not create an automatic entitlement to reduced fees or priority treatment. Company-size information informs the quotation process without lowering the conformity assessment requirements.
Under Article 4, notified bodies must monitor assessment duration and costs and publish an annual report by 30 April covering activities completed in the preceding year. Measures include the proportion completed within maximum timelines, median duration from application to certification, and median total costs. Such data can inform comparisons, but device risk, technological complexity, site numbers and documentation quality still affect the results.
Assessment deadlines depend on defined starting points
Article 2 sets four maximum timelines for initial assessment activities:
- Application review and contract: 30 days, from receipt of a complete application to signature of the manufacturer’s contract.
- Quality management system auditing: 120 days, from the first activity in the audit programme to completion of the final review.
- Product verification: 90 days for each device or representative device, from the start of its technical documentation assessment to completion of the final review.
- Decision and certification: 20 days, starting the day after the last relevant final review is completed and ending when certificates are issued and entered in Eudamed.
These periods do not add up to a guaranteed 260-day route from application to certification. For procedures under Annex IX of the MDR or IVDR, quality management system auditing and product verification must run in parallel, provided the audit programme takes account of the required input from the relevant technical documentation assessment. Unless the parties agree otherwise, both activities start the day after contract signature. Interruptions also affect elapsed time.
Planned changes have separate timelines. The initial review runs for up to 30 days from receipt of complete change documentation to notification of approval or of the need for further assessment. Additional assessment has a 90-day limit, starting with the earlier of the first necessary audit activity or technical documentation assessment and ending with notification of approval. Where a certificate supplement is needed, the 20-day issuance and Eudamed-entry period starts the day after approval is notified. If a new conformity assessment procedure is required, the initial-assessment timelines apply instead.
Article 3 permits interruptions when manufacturers need to address non-compliances or duly justified questions and requests necessary for the assessment. The ordinary limits for the four initial-assessment phases are one, four, four and one interruption respectively. The first two change-assessment phases share a five-interruption limit, with one for issuing a certificate supplement. Each additional quality management system site requiring an on-site audit permits two further interruptions in the system-audit phase. Agreed rolling reviews require a plan for submitting documentation in parts and any additional interruptions. The certification-stage interruption concerns verification of certificate information and, where necessary, entry of relevant device information in Eudamed.
The parties must agree the duration of an ordinary interruption, with written notification to the manufacturer. The clock stops on the day a request is made and, unless otherwise agreed, resumes the day after the requested information is received. Extensions require justification and written agreement.
A separate interruption is required when an opinion from the European Medicines Agency, a regulatory authority, an expert panel or an EU reference laboratory is needed. It does not count towards the ordinary interruption limits. The notified body must give the manufacturer written reasons and an expected duration.
Exhausting a maximum timeline or interruption allowance is not, by itself, sufficient grounds to refuse a certificate or approval of a change. Assessment must continue to a substantive decision. Conversely, expiry of a deadline does not confer automatic approval: certification still depends on the conformity assessment outcome.
Re-certification evidence and transitional dates
Re-certification focuses on relevant evidence accumulated during the certification cycle. Article 5 requires a product renewal application to address changes since initial certification or the last renewal. Core information includes:
- Changes to the approved device, whether previously notified or not, including changes made to reflect the state of the art.
- The latest periodic safety update report and a summary of field safety corrective actions.
- A summary of changes to the risk evaluation that altered the device’s benefit-risk ratio, including relevant field safety corrective actions.
- The latest clinical evaluation report or performance evaluation report.
A separate list must identify changes not yet notified that are necessary to comply with new regulatory requirements or common specifications, or to take account of new scientific findings and standards. Where new scientific findings drive a change, the manufacturer must identify the basis, such as new medical or technical knowledge, testing methods, materials findings, or evidence from equivalent devices and publicly available registers or registries.
The notified body checks whether device changes are consistent with post-market surveillance, the state of the art and updated risk analysis. It also reviews non-compliances and the certificate’s conditions and scope. Additional technical documentation requests must be limited to the specific information necessary to complete the assessment. The product renewal assessment has a maximum 90-day period starting on receipt of the relevant documentation.
Quality management system renewal also has a 90-day period, but it starts on receipt of the renewal application. Checks include whether relevant audit requirements have been fully assessed at least once in the certification cycle, whether surveillance results remain compliant, whether audit and sampling plans need updating, and whether non-compliances have been resolved or addressed through an adequate, accepted corrective and preventive action plan. Certificate conditions, limitations and scope must also be reviewed. Product and system renewal reviews and verifications share an ordinary allowance of three interruptions, so the 90-day periods are not unconditional calendar-time guarantees.
Normally, the renewal decision, reissue and Eudamed entry must be completed within 20 days starting the day after the final review. If the renewal decision is made more than three months before the old certificate expires, that 20-day period instead starts three months before expiry. This changes the timing rule; it does not automatically extend the old certificate.
The EU regulation generally applies from 25 February 2027, while commencement of Norway’s proposed amendment remains to be determined. Its transitional provisions distinguish between agreement dates and certificate expiry dates:
- Articles 1–3 do not apply to conformity assessment procedures covered by a written agreement signed before 25 February 2027.
- Article 4(1)–(3) applies only to procedures covered by written agreements signed after 25 May 2027. The annual reporting provision in Article 4(4) applies from 1 January 2028.
- Articles 5–7 do not apply to renewal reviews of certificates expiring before 25 November 2027.
For existing projects, a useful preparation step is to check the signed agreement date, certificate expiry date and current assessment phase before discussing revised arrangements with the notified body. This is a practical inference from the transition provisions, rather than a new statutory manufacturer checklist. With Norwegian consultation responses due on 9 December 2026, those distinctions are also relevant to feedback on implementation and its practical effects.
Sources
- Primary official sourceHøring om endringer i forskrift for medisinsk utstyr – kvalitetsstyring og samsvarsvurdering (opens in a new tab)Norwegian Medical Products Agency
- Supporting sourceHøringsnotat: Forslag til endring av forskrift 9. mai 2021 nr. 1476 om medisinsk utstyr (opens in a new tab)Norwegian Medical Products Agency
- Supporting sourceCommission Implementing Regulation (EU) 2026/977 of 4 May 2026 laying down certain uniform requirements for quality management and procedures for conformity assessment activities carried out by a notified body designated under Regulations (EU) 2017/745 and (EU) 2017/746 of the European Parliament and of the Council (opens in a new tab)European Commission