The EU’s MDR explained for aesthetic device manufacturers

The beauty and aesthetic device market is worth billions globally, with Mordor Intelligence putting medical aesthetic devices at $17.10 billion in 2025 and forecasting $30.49 billion by 2031 — with energy-based platforms like lasers, radiofrequency and light-based systems accounting for just over half of that revenue.

But devices used in surgical and non-surgical cosmetic procedures are getting a regulatory revamp in the EU. Under Annex XVI of the EU’s enhanced Medical Device Regulation (MDR), lasers, IPL equipment, liposuction devices and brain stimulation tools are now treated as medical devices — and the timeline for compliance is becoming a more pressing challenge for anyone who wants to keep selling in the EU.

The requirements that apply to them are set out in the Common Specifications, published as Commission Implementing Regulation (EU) 2022/2346, which has applied since 22 June 2023.

What is an Annex XVI device?

An Annex XVI device is a product for which the manufacturer claims only an aesthetic or other non-medical purpose, but which the EU has brought under the MDR because its functionality and risk profile are comparable to a medical device. Because these products have no medical purpose, they are not required to demonstrate a clinical benefit — but they must still demonstrate safety and performance.

Aesthetic devices affected by MDR

In this article, we’re not going through all the devices and treatments affected by this change. Still, as a software company, we’d like to highlight below the following devices as they often use software:

• Liposuction, lipoplasty devices.
• Light-emitting equipment, like lasers or intense pulse light (IPL) devices used in hair removal.
• Light-emitting equipment like lasers or IPL used in tattoo removal, skin resurfacing or other skin treatments.
• Brain stimulation devices.

This means that manufacturers of aesthetic devices like lasers, IPLs, and brain stimulation tools must now familiarise themselves with these requirements and ensure full compliance.

Why the extra scrutiny now?

For medical devices, the MDR’s central test is that a device’s clinical benefits outweigh its risks. But because Annex XVI products have no claimed clinical benefit to weigh, the test works slightly differently. Under Article 61(9) of the MDR, the requirement to demonstrate clinical benefit becomes a requirement to demonstrate the device’s performance.

When MDR was initially drafted, devices like these were not under consideration. However, due to new available scientific evidence about the risks and side effects made possible by aesthetic treatments, and at the request of several member states, the regulation was changed.

Now, even if a beauty device wasn’t initially conceptualised for clinical uses, the EU Commission has asked that specific aesthetic devices follow development and risk management processes, have proper labelling criteria, and proactively monitor the safety of these devices.

How are these devices now classified?

Classification for the active devices in Annex XVI is set by Commission Implementing Regulation (EU) 2022/2347. Every device type listed below falls into Class IIa or above.

Hair removal comes with a specific distinction that can catch people out. Class IIa applies only where hair removal is the device’s sole intended purpose. A multi-indication platform that offers hair removal alongside skin rejuvenation or pigmentation treatment is Class IIb, and the European Commission’s guidance in MDCG 2023-5 gives exactly that example. If your platform has more than one indication, check it against that guidance before assuming the lower class.

What do these classifications mean?

The classifications impact routes to gaining a CE mark and how much work is involved in meeting compliance.

Class I is for the lowest risk for devices under MDR. Having a notified body involved in making a declaration of conformity is only needed in limited circumstances. But as we can see in the table above, none of the devices being discussed here are in the lowest risk class.

Class IIa are medium-risk devices. Here, you need to get a declaration of conformity from a notified body following a conformity assessment.

Class IIb are medium to high-risk devices. The conformity assessment for these devices requires more clinical and safety related documentation to be provided to the notified body.

Class III are the highest-risk devices. These have the strictest requirements and will need a clinical investigation and other technical documentation included in the conformity assessment.

Does the MDR reach my device’s software specifically?

Yes. The Common Specifications in Commission Implementing Regulation (EU) 2022/2346 set device-level safety requirements — things like alarms, interlocks and emission limits — that land squarely on your software, not just the hardware. The specifics vary by product group, so it’s worth checking the annex for yours rather than treating it as documentation to sort out later.

What changes for manufacturers?

Aside from needing to act like medical device manufacturers, several changes must be noted:

1. Comprehensive compliance: The MDR introduces a range of requirements. This includes the establishment of quality systems, collection of clinical data, creation of technical files, and initiation of post-market surveillance.
2. Time is of the essence: Compliance deadlines depend on whether your device needs a clinical investigation. If it doesn’t, you need a signed agreement with a notified body by 1 January 2027 — and with notified body reviews commonly running well over a year, immediate preparations are needed. (We’ve got more on those deadlines further down in this article.)
3. Clinical investigations are the default: Under Article 61(9), clinical investigations must be performed for Annex XVI products unless you can duly justify relying on existing clinical data from an analogous medical device. Because equivalence between a medical device and a non-medical-purpose product usually can’t be shown, that justification can be hard to make.
4. A Person Responsible for Regulatory Compliance: Under Article 15 of the MDR, you must have a designated Person Responsible for Regulatory Compliance (PRRC) with the relevant expertise. Micro and small enterprises don’t need this person in-house, but must have permanent, continuous access to one.
5. Potential challenges: It’s essential to be aware of potential obstacles to compliance. These might include securing prompt clinical investigation approvals, collaborating with notified bodies, standardising documentation processes, minimising design modifications, and understanding and integrating new responsibilities as a manufacturer.
6. First steps for compliance: Before diving into the regulatory process, it’s recommended you conduct a thorough gap analysis, review your current product portfolios, then draft a well-researched action plan, and consider any necessary adjustments to business models. Here, forward planning and readying for strategic investment are critical.
7. Software standards and IEC 62304: Given the reclassification of specific beauty devices as medical devices, compliance with IEC 62304 becomes crucial. This standard pertains to the safe design and maintenance of medical device software. In our experience, adhering to it is best practice—and the most likely route to gaining approval for the software used in your device.

Consequences and benefits of compliance

Non-compliance carries substantial risks. These include potential patient harm, failed regulatory audits, the need for product rework, the discovery of undetected product flaws, and even the potential removal of products from the EU market.

However, compliance isn’t solely about navigating risks. It’s also about harnessing opportunities. By aligning with IEC 62304, manufacturers can enhance software practices, improve product quality, elevate safety standards, and enrich overall device usability.

An overview of IEC 62304

IEC 62304 serves as a foundational standard for medical device software, and the current edition is IEC 62304:2006+AMD1:2015. It offers guidance and regulations on:

• Lifecycle processes: It gives a detailed structure for tasks throughout the software lifecycle, encompassing development, maintenance, risk management, and problem resolution.
• Risk management: Central to the standard is the identification, classification, and management of risks, categorising software based on potential harm.
• Emphasis on quality: Quality assurance processes, including verification, validation testing, defect tracking, and other related practices, are detailed to ensure software reliability.
• Documentation: A clear mandate exists for comprehensive documentation across various phases, from plans and design outlines to test cases and change logs.
• Regulatory significance: Beyond the scope of the EU MDR, the principles of IEC 62304 are recognised in many jurisdictions, making it a crucial standard if you’re also selling in countries like the US.
• Adaptability: While detailed, IEC 62304 is also designed to offer adaptability, allowing it to be tailored to various software development models, including Agile.

Like MDR, IEC 62304 has its own classes. How you follow it depends on the software’s potential for harm, and this will affect what class the software gains versus the overall class of the device. For IEC 62304, Class A is the lowest class and goes up to Class C (software that could cause death or severe injury).

In essence, IEC 62304 equips manufacturers with a comprehensive framework that emphasises risk management and quality, ensuring medical device software is safe and reliable. It offers a means of meeting the requirements set by the MDR when it comes to device software.

Timelines for approval

The transitional provisions for Annex XVI products were extended by Commission Implementing Regulation (EU) 2023/1194, which amended the original Common Specifications to align them with the wider MDR transition. There are two routes, and which applies depends on whether your device needs a clinical investigation.

Both routes carry the same conditions. The product must have been lawfully marketed in the EU before 22 June 2023, must continue to comply with the Union and national law that applied to it before that date, and must have had no significant changes to its design or intended purpose. A significant change ends your eligibility, so any planned redesign needs assessing against that test before you commit to it.

If your device was not on the EU market before 22 June 2023, neither route applies. New products need to meet the MDR and the Common Specifications in full from the outset, with a notified body involved from the start.

Considering how busy notified bodies covering the region are, capacity remains the practical constraint either way. In its Medical Device Survey 2025, Team-NB — the European association of notified bodies — found that 48% of new MDR certificates took 13 to 18 months to issue, and a further 22% took longer still.

If you’re relying on the no-clinical-investigation route, 1 January 2027 is the date to work back from. You need a signed agreement with a notified body in place by then to keep your product on the market, and on those review times the assessment behind it will occupy most of the period remaining before the 31 December 2028 cut-off. If you haven’t yet approached a notified body, that’s the immediate priority.

These provisions carry further conditions and cross-references — including separate arrangements for dual-purpose products that held a certificate under the old Medical Device Directive for their medical use — so it’s worth reading Article 2 of Regulation (EU) 2022/2346 alongside its amendment for your specific situation.

Don’t forget EUDAMED

Alongside the conformity assessment routes above, you have registration obligations under EUDAMED — the European Database on Medical Devices. Four of its modules became mandatory on 28 May 2026, covering actor registration, UDI and device registration, notified bodies and certificates, and market surveillance.

Registering as an actor and obtaining a Single Registration Number is the starting point. For devices already on the EU market before that date, registration must be completed by 28 November 2026 — twelve months from the Commission’s notice of 27 November 2025. We have covered what EUDAMED requires, and how to get your device data ready for submission, in a separate article: EUDAMED goes mandatory: what medical device teams need to know.

Don’t let your software get in the way of MDR approval

While the road to compliance might seem challenging, with the proper understanding and proactive measures, you can not only comply but also improve the quality and safety of your products, ensuring continued success in the market.

Do you need assurances on your device software and whether it can meet what’s needed for approval? Bluefruit Software has been providing embedded software development and testing services for more than 20 years, working to IEC 62304 on medical device and SaMD projects for both CE and FDA approval. Contact Bluefruit Software today, and we can help you by performing a detailed IEC 62304 gap analysis and set you on the path to compliance.

Alternatively, you can look at our IEC 62304 checklist to gain quick insights into whether your software hits the mark.