MDR Article 120: The Four Conditions — Not the Date

Regulation (EU) 2023/607 is remembered as the regulation that pushed the MDR legacy-device deadline out to 2027 and 2028. That is accurate, and it is also the least useful thing to know about it. The extension it granted was never unconditional. Article 120(3c) sets four conditions a legacy device must keep meeting, continuously, for as long as the manufacturer relies on the extended date — and a device can lose its eligibility years before the calendar date arrives, without anyone filing a single form to make it happen.

What Regulation 2023/607 actually extended

Before the 2023 amendment, MDR Article 120 gave legacy MDD and AIMDD certificates a transitional window that, for most device classes, ran out in May 2024. Regulation (EU) 2023/607 replaced that single cliff with class-dependent dates and removed the "sell-off" provision that had separately limited how long already-manufactured stock could remain on shelves. The result is not a blanket amnesty. It is a narrower, conditional bridge that keeps a legacy certificate valid past its original expiry only while the device and the manufacturer's quality system continue to satisfy specific, checkable conditions — the same conditions a manufacturer would eventually have to demonstrate anyway to move onto a full MDR certificate.

The four conditions in Article 120(3c)

All four have to hold, together, for a given device, for the extension to apply to it. None of them is a one-time filing that, once made, is settled for good.

1. Continued compliance with the legacy directive. The device still complies with the MDD or AIMDD, and its certificate of conformity has not been withdrawn by the issuing notified body.
2. No significant change to design or intended purpose. The device the manufacturer is placing on the market today has to be, in substance, the device the legacy certificate was issued for.
3. No unacceptable risk. The device must not present an unacceptable risk to the health or safety of patients, users, or other persons, or to other aspects of public health protection — a live, ongoing standard, not a point-in-time finding from the original certification.
4. An Article 10(9) quality management system, in place by May 26, 2024. Post-market surveillance, vigilance, and economic-operator and device registration obligations under the full MDR already applied from May 26, 2021; the QMS condition layered a further, MDR-compliant quality system requirement on top, with its own deadline.

Manufacturers make the first call on whether a change is significant. The notified body makes the call that actually counts — and it can make it after the fact. Why the self-assessment is not the end of the analysis

Where the extension lapses without anyone noticing

MDCG 2020-3 Rev.1 sets out how to assess whether a change to a legacy device is significant, and the notified body's role is to verify that assessment — during routine surveillance, in response to a manufacturer's own submission, or when something else draws its attention to the device. A manufacturer that treats a labeling update, a supplier substitution, or a software patch as obviously minor, without documenting the rationale against MDCG 2020-3, is making a determination that nobody has actually confirmed. If the notified body later disagrees, the position does not fail going forward only — it calls into question whether the condition was ever met, which puts the certificate's validity, and every device placed on the market under it since, in question. The EUDAMED registration data a manufacturer files for these same legacy devices only compounds the exposure: it creates a dated, searchable record of exactly what was on the market and when, for anyone checking the position later.

This matters beyond the manufacturer holding the certificate. In an M&A due-diligence review, a target's legacy MDD or AIMDD portfolio is frequently treated as a solved problem because the certificates show a 2027 or 2028 date. That date tells an acquirer nothing about whether the four conditions still hold today, whether design changes since certification were ever assessed against MDCG 2020-3, or whether the Article 10(9) QMS was genuinely operating by May 2024 rather than assembled retroactively for the file. Building this into a broader EU MDR & IVDR compliance review, on either side of a transaction, is what turns an assumed extension into a confirmed one.