What EU 2026/977 Changes for Notified Body Quality Management

Overview

On 4 May 2026 the Commission adopted Implementing Regulation (EU) 2026/977, published in the Official Journal the following day. Its full title is precise about its scope: it lays down certain uniform quality management and procedural requirements for the conformity assessment activities carried out by a notified body designated under Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). It is adopted under MDR Article 36(3) and IVDR Article 32(3).

The Regulation entered into force on the twentieth day after publication, but applies from 25 February 2027, with one exception: Article 4(4), the annual reporting obligation, applies from 1 January 2028.

For Notified Bodies this is not a designation-criteria change. Annex VII of both Regulations still governs what a Notified Body must be. What 2026/977 does is convert a set of previously discretionary process behaviours — how long a review may take, how often you may stop the clock, what you must tell a manufacturer about cost — into documented-procedure obligations enforceable through your quality management system.

Below is what changes operationally, article by article, and where the pressure lands on review workflows.

Article 1: Quotations become a gated process

Article 1 attaches to Section 4.2, point (d) of Annex VII in both Regulations. It requires documented procedures ensuring the Notified Body only issues a quotation once it has received a defined information set from the manufacturer, including:

• manufacturer identification, and the data needed to determine micro/small/medium enterprise status as defined in Commission Recommendation 2003/361/EC (employee numbers and annual turnover);
• addresses, employee numbers, number of work shifts and activity descriptions for each site covered by the manufacturer's QMS;
• suppliers and subcontractors performing design and manufacture activities relevant to the conformity assessment, with a description of what each performs;
• device description, intended purpose, specific characteristics, technologies or processes used, and risk classification;
• the conformity assessment procedure(s) applied for.

For changes under Section 4.9 of Annex VII, or for re-certification, the Notified Body must refrain from re-requesting points (b) to (g) where the manufacturer confirms nothing has changed. That is an explicit anti-redundancy instruction, and it has a workflow consequence: your intake process needs to distinguish new applications from change and re-certification submissions and suppress the standard questionnaire accordingly.

The quotation itself must state estimated overall costs — broken out for QMS assessment and technical documentation assessment — including typical costs for surveillance activities and unannounced audits, an estimate of potential extra costs, and estimated timelines. Hourly-rate quoting is permitted only where the duration of the specific activity cannot be predetermined.

Article 1(4) adds a live obligation: the Notified Body must inform the manufacturer in advance of any increase above 10% of estimated costs, with reasons.

Article 2: Four binding maximum timelines

Article 2(2) is the provision most reviewers will feel. It sets maximum timelines for conformity assessment activities:

Two structural points matter more than the numbers.

First, the QMS audit and product verification phases must be conducted in parallel where the assessment is carried out under Annex IX of either Regulation, provided the required input from the technical documentation assessment feeds the audit programme. Sequential scheduling of those two phases is no longer a valid default under Annex IX routes.

Second, the 20-day decision phase does not end when the certification decision is made. It ends when the certificate is entered in Eudamed. Database entry is inside the regulated clock, not an administrative afterthought.

Article 2(3) applies a parallel set of limits to changes: 30 days to review a planned substantial change and notify the manufacturer whether additional activities are needed; 90 days for those additional conformity assessment activities; 20 days to issue a certificate supplement. Where a new conformity assessment procedure is necessary, the Article 2(2) timelines apply instead.

Article 2(4) is the provision to read twice

The notified body shall continue the conformity assessment activities until a decision on issuing or refusing a certificate is made.

Expiry of a maximum timeline, or exhaustion of the permitted interruptions under Article 3, is explicitly not a sufficient reason to refuse a certificate or refuse to approve a change. The timelines are performance obligations on the Notified Body. They are not a procedural device for closing out difficult files.

Article 3: Clock-stops are now counted

Where a manufacturer must address non-compliances, or answer duly justified questions necessary for the assessment, the Notified Body may interrupt the timeline — but a capped number of times:

Three qualifications:

• Additional sites. Two additional interruptions are available for each additional site under the manufacturer's QMS requiring an on-site audit.
• Rolling review. Where the Notified Body and manufacturer agree a rolling review of the technical documentation, they must also agree a submission plan and may agree additional interruptions beyond the QMS and product verification caps.
• External opinions do not count. Under Article 3(3), where an opinion of the EMA, a regulatory authority, an expert panel or an EU reference laboratory is required, the Notified Body shall interrupt the timeline, and that interruption is neither counted nor cumulated against the Article 3(1) caps. It must be notified to the manufacturer in writing with the reason and expected duration.

Mechanically, an interruption starts the day the Notified Body informs the manufacturer of its requests, and resumes the day after the requested information is received unless otherwise agreed. Duration must be agreed with the manufacturer and confirmed in writing; extensions require justification and written agreement.

This is the operational heart of the Regulation. A capped, individually-justified, in-writing, agreed-duration clock-stop is a different object from an informal "waiting on the manufacturer" status. It has to be raised deliberately, evidenced, and counted against a budget that cannot be silently exceeded.

Article 4: Duration and cost monitoring inside the QMS

Article 4(1) requires the Notified Body to establish, document and implement a monitoring system as part of its quality management system under Section 2.1 of Annex VII. This is what makes 2026/977 a quality management regulation rather than a scheduling one.

The system must produce:

• the percentage of conformity assessment activities completed within the Article 2 maximum timelines;
• the median duration from application to certification, in days;
• the median total cost of completed activities, in euro — the sum of all fees applied to the manufacturer during the timeline, including administrative charges.

These must be reported for activities under Chapters I and II of Annex IX, Annex X, and Parts A or B of Annex XI (MDR) or Annex XI (IVDR), and separately for the change assessments under Article 2(3).

Article 4(4): by 30 April each year, the Notified Body draws up an annual report on timelines and costs covering the previous calendar year, publishes it on its website, and informs both its designating authority and the Commission. This applies from 1 January 2028.

Articles 5–7: Re-certification is bounded and scope-limited

Articles 5 and 6 set a 90-day maximum for assessing re-certification documentation for product certificates and QMS certificates respectively, running from receipt of the application.

Article 7(1) is the constraint that changes review practice: for the re-certification decision under Section 4.11, fourth paragraph of Annex VII, the Notified Body must limit re-certification activities to assessing the documentation specified in Article 5(1)–(2) or Article 6(1). Re-certification is not an opportunity to reopen the original assessment.

Both articles also constrain information requests: additional requests must be limited to the specific information necessary to complete the assessment. Broad supplementary document demands are no longer defensible.

Article 7(2) sets 20 days for the decision and re-issuance, ending on Eudamed entry. Article 7(3) handles early decisions: where the renewal decision is made more than three months before expiry, the 20-day period starts three months before the expiry date.

Article 8: The transitional provisions matter for planning

• Articles 1, 2 and 3 do not apply to conformity assessment procedures where the written agreement with the manufacturer was signed before 25 February 2027.
• Article 4(1), (2) and (3) apply to procedures where the agreement was signed after 25 May 2027.
• Articles 5, 6 and 7 do not apply to re-certification reviews of certificates expiring before 25 November 2027.

The practical read: contracts signed from 25 February 2027 onward carry the full timeline and interruption regime. Because a typical MDR file signed in early 2027 will still be in assessment well into 2028, the first published annual reports in April 2028 will describe a mixed population of legacy and regulated files. Notified Bodies that cannot segment their data by contract signature date will struggle to report meaningfully.

What this means for review workflows

Four capabilities move from "good practice" to "evidence you will be asked to produce."

1. Phase-accurate time accounting. The Regulation measures four distinct phases with different start and end triggers — receipt of complete application, first audit programme activity, start of technical documentation assessment, day after final review. A workflow that records only "opened" and "closed" cannot compute Article 4(2) metrics. Phase transitions need to be first-class, timestamped events.

2. Clock-stops as governed objects. Each interruption needs a justification, a written notification, an agreed duration, a resumption trigger, and a counter tied to its phase. A Notified Body with four permitted interruptions on a product verification file needs to know it has used three before a reviewer raises a fourth question set. That is a live budget, and it should be visible in the reviewer's interface, not reconstructed at audit.

3. Consolidated, non-duplicative information requests. With interruptions capped, the cost of a poorly-scoped question rises sharply. The incentive shifts decisively toward gathering all deficiencies across a technical documentation review into a single consolidated request rather than issuing them serially as reviewers encounter them. This is a review-sequencing problem before it is a software problem — but it is one where systematic gap detection across a full file, before the first question is issued, has obvious leverage.

4. Defensible cost attribution. Article 4(2)(b) requires median total cost including administrative charges, and Article 1(4) requires advance notice of any 10% overrun. Both require fees to be attributable to specific assessment activities on specific files.

Where we stand

We built Conformo on the premise that the reviewer's judgement is the product, and that software's job is to protect the time in which that judgement is exercised. 2026/977 is a useful stress test of that premise, because it regulates the clock without weakening the standard. Article 2(4) is unambiguous that a Notified Body may not resolve time pressure by refusing certificates, and nothing in the Regulation reduces the depth of assessment required under Annex VII.

The only remaining lever is the proportion of review time spent on activities that do not require regulatory expertise: locating the section of a technical file that responds to a given requirement, checking whether a referenced standard is current, confirming that a claim in the clinical evaluation is supported elsewhere in the file, assembling a deficiency list into a single coherent request. That is where assessment capacity is recovered — not by shortening the reviewer's analysis, but by ensuring it starts from a complete and organised picture of the file.

For the underlying process this Regulation constrains, see the technical documentation assessment process. For the specific gaps that most often trigger the interruptions Article 3 now caps, see common MDR documentation gaps and how to reduce technical assessment turnaround time.

Conformo builds AI-assisted review infrastructure for Notified Bodies, Certification Bodies and TIC organisations. Every finding is traceable to its source in the technical file, and every conformity decision remains with a qualified reviewer.

Sources and further reading

• Implementing Regulation (EU) 2026/977 — eur-lex.europa.eu