This collection examines medical device and diagnostic regulation in Switzerland and the EU. Articles cover authorized representatives, market access, registration and transition arrangements, alongside software classification, clinical evidence, post-market surveillance and cybersecurity.
These articles provide general information and are not legal advice.
Since 2021, Switzerland and the EU have treated each other as third countries for medical devices, so a manufacturer selling in both runs two compliance systems. It needs a representative in the other market; legacy certificates face 2027 and 2028 deadlines.
Since mutual recognition with the EU lapsed for devices, a Swiss manufacturer needs an EU authorized representative. If the manufacturer breaches its MDR or IVDR obligations, the representative is liable alongside it, so the mandate also allocates liability.
Since the Swiss-EU mutual recognition agreement lapsed for medical devices in May 2021, Swiss makers need an EU authorized representative and EU makers a Swiss one, with registration in both device databases from mid-2026. Restoration under the Bilaterale III treaties may not come before 2028.
Switzerland has been a third country for medical devices since May 2021, and the Swiss-EU Bilaterals III protocols signed in March 2026 leave the devices chapter of the mutual recognition agreement to an undated Committee decision, so dual authorized representation persists.
Mandatory use of the first four modules of EUDAMED, the EU medical device database, began on 28 May 2026, putting actor registration upstream of conformity assessment for US device and IVD makers and setting backfill deadlines for devices already on the EU market.
Regulation (EU) 2024/1860 extends legacy IVD deadlines to 2027, 2028 and 2029, but only for unchanged devices that meet qualifying steps falling due from 2025 to 2027. The Swiss in vitro diagnostics ordinance (IvDV) mirrors those dates but requires its own Swiss representative and registration.
The Commission's December 2025 proposal would end MDR and IVDR certificate expiry, reclassify clinical software and loosen the evidence rules, but it is not law: the 2027 and 2028 transition deadlines and the EU medical device database EUDAMED still run on the unamended text.
The classification of software as a medical device under EU MDR creates regulatory exposure developers discover post-launch. Marketing claims often inadvertently determine regulatory status.
Under the EU MDR, clinical evidence for software as a medical device rests on valid clinical association, analytical and clinical validation, a burden many software makers underestimate.
Software as a medical device (SaMD) can lose accuracy on a new scanner or patient group, or change with an update, without any visible injury. Post-market surveillance under the MDR and the Swiss medical devices ordinance (MepV) must detect that, and the AI Act adds monitoring for high-risk AI devices.
The MDR requires security to be built into software as a medical device (SaMD) and maintained for its life, and notified bodies treat the international standard IEC 81001-5-1 as the state of the art. A security patch can itself need notified-body review, and one incident can start five reporting clocks.
AI-enabled medical software that needs a notified body under the MDR is high-risk through the product route in Annex I AI Act rather than Annex III AI Act, so its obligations attach in 2027 and are assessed within MDR conformity assessment.
An AI-enabled device sold from Switzerland into the EU answers to two cybersecurity regimes that measure different things: the MDR secures the device in its IT environment, the AI Act the model against manipulation. Switzerland adds a 24-hour reporting clock.
For in-scope medical-device units placed in the EU after 12 September 2026, the Data Act adds access-by-design duties. MDR change control and separate GDPR requirements can constrain how a manufacturer provides that access.
For advice on a particular matter, please get in touch.
Make an enquiry