Binding assessment timelines

After years of manufacturer surveys, transition extensions, and sector calls for predictability, the European Union has done something sharper than guidance: it has made certain Notified Body timelines legally binding. Commission Implementing Regulation (EU) 2026/977, adopted on 4 May 2026, lays down uniform quality-management and procedural requirements for conformity-assessment activities under the MDR and IVDR, including maximum durations for each major stage of initial certification, planned-change assessment, and re-certification.

The regulation arrives in a system already under load (series A). What changes now is not the abstract wish for faster reviews. It is the operating environment: institutions must complete defined phases within ceilings, monitor performance, and publish data, while still making defensible decisions under Annex VII.

The “90-day rule” is real, but it names product verification of technical documentation, not the entire path from application to certificate.

Implementing law, not MDCG comfort reading

Sector papers have long urged alignment on timelines and submission quality. Implementing Regulation 2026/977 is different in kind: directly applicable Union law that notified bodies must implement in documented procedures. Its recitals justify uniform requirements for predictability, timely completion and fair treatment of manufacturers, especially SMEs. Do not confuse it with Regulation (EU) 2024/1860, which addressed transitional deadlines and EUDAMED phasing, not stage clocks for ongoing conformity assessment.

What Article 2 actually caps

Article 2(2) caps four initial-certification stages at 30, 120, 90 and 20 days; the often-quoted 90 days is point (c) product verification under Annex VII 4.5.3, not the end-to-end path (Commission Implementing Regulation (EU) 2026/977, Art. 2(2)). Each clock starts when that activity begins, not when the manufacturer first considers CE marking.

The figure everyone quotes, 90 days, belongs to point (c): product verification in accordance with Section 4.5.3 of Annex VII. The clock starts on the day the Notified Body initiates assessment of the technical documentation of each device or each representative device, and ends when the Annex VII final review for that verification path is completed. That is the substantive technical-documentation assessment phase, not application triage, not on-site QMS auditing, not certificate typing and Eudamed entry.

Point (b) allows up to 120 days for quality-management-system auditing. Point (a) allows 30 days from receipt of a complete application to contract signature. Point (d) allows 20 days from the day after the last relevant final review to issuance and Eudamed entry. Under Annex IX procedures, QMS auditing and product verification may run in parallel when the audit programme accounts for required input from technical-documentation assessment, so the practical calendar is not a naive sum of 30 + 120 + 90 + 20.

Do not misread the old averages

Manufacturer-reported averages for technical-documentation assessment have sat far above any 90-day ceiling, on the order of many months in recent surveys (MedTech Europe 2024). Team-NB data likewise show long bands for new certificates overall (Team-NB Survey 2025). Those figures describe a world before these maxima bite for new agreements, and they often blend phases that Article 2 now separates. The honest comparison is not “21.8 months versus 90 days” as if one replaced the other overnight. It is: once product verification starts, the regulated assessment of technical documentation must fit inside a bounded window, subject to agreed shorter timelines and controlled interruptions, while institutions still owe the same substantive duties under the MDR and IVDR.

Interruptions and what expiry does not mean

Interruptions are capped per phase and require written agreement on duration; expiry of a maximum timeline is explicitly not grounds for a Notified Body to refuse a certificate or a change (Commission Implementing Regulation (EU) 2026/977, Art. 2(4) and Art. 3). Article 3 permits interruptions only for capped counts (e.g., four for product verification), with additional pauses when EMA, competent authorities, expert panels or EU reference laboratories must contribute.

The regulation thus stops open-ended drift without creating a new automatic refusal ground - the obligation to decide remains.

When it applies

Articles 1-3 apply to conformity assessment procedures for which the Notified Body and manufacturer signed a written agreement on or after 25 February 2027. Article 4’s monitoring and annual reporting provisions phase in on later dates. Institutions have a planning horizon, but not unlimited time to treat product verification as an unbounded queue.

Why infrastructure is now a compliance surface

A 90-day product-verification ceiling does not tell reviewers what conclusion to reach. It changes the cost of everything that is not judgment: hunting evidence, reconstructing context after revisions, improvising review structure, and coordinating findings that are not tied to sources. Under load, those wastes were already capacity problems. Under law, they become risks to stage performance, monitoring metrics, and public reporting.

• Quotations must now include estimated timelines (Article 1(3)(c)), manufacturers will compare what was promised with what monitoring reports show.
• Monitoring requires notified bodies to track the percentage of activities completed within maximum timelines and median duration from application to certification (Article 4), published annually on their websites.
• Re-certification is scoped to avoid repeating full initial product verification by default (Articles 5-7), another signal that the system wants targeted assessment, not endless re-reading of unchanged files.

The wrong response is to rush conclusions to beat a clock. The right response is to remove avoidable friction from the environment in which judgment happens: shared structure, source-linked records, traceable assistance, and institutional control over every disposition.

Bottom line

If someone says the EU now requires notified bodies to “finish reviews in 90 days,” that is only partially correct. The precise statement is that Implementing Regulation 2026/977 imposes binding maximum timelines on conformity-assessment stages, including 90 days for product verification of technical documentation, alongside other limits for application review, QMS auditing, and certification decision-making, with defined interruptions and parallel paths where Annex IX allows them. The product-verification phase now has a legal finish line once assessment begins. Infrastructure that helps expert teams spend that window on evidence and accountable conclusions is not a shortcut around the MDR. It is how a trustworthy system keeps pace without pretending that searching a PDF folder is the same thing as professional scrutiny.