MDR Article 120: which legacy certificates are still valid, and until when?

A legacy device can stay on the EU market until 31 December 2027 or 31 December 2028, depending on its class — but only if five conditions were already met, and two of those conditions had deadlines in 2024 that have long since passed. The extension is not a grace period you can still opt into; it is a status your device either has or does not have. Here is how to tell which.

What a "legacy device" is

A legacy device is one lawfully placed on the EU market under the old directives — the Medical Device Directive (MDD, 93/42/EEC) or the Active Implantable Medical Devices Directive (AIMDD, 90/385/EEC) — and not yet certified under the MDR (Regulation (EU) 2017/745). Article 120 is the MDR's transitional provision governing how long those devices may continue on the market.

The version of Article 120 that matters today is the one amended by Regulation (EU) 2023/607, which replaced the original hard cut-off with a longer, conditional extension.

The two end dates

Devices	Extension runs to
Class III, and implantable class IIb	31 December 2027
Other class IIb, class IIa, and class I devices that are measuring, sterile or reusable surgical	31 December 2028

Note what the second row actually covers: class I is in scope only for the measuring, sterile and reusable surgical subsets — the ones that needed a notified body under the old directives. A plain class I device never had a notified-body certificate to extend.

The five conditions — all of them

This is the part most summaries flatten, and flattening it is how teams end up believing they have until 2028 when they do not. Article 120(3c) sets five conditions, and they are cumulative:

1. The device continues to comply with the AIMDD or MDD.
2. There is no significant change in design or intended purpose.
3. The device presents no unacceptable risk to health or safety.
4. By 26 May 2024, the manufacturer had a quality management system meeting MDR Article 10(9) in place.
5. By 26 May 2024, a formal application for MDR conformity assessment had been lodged, and by 26 September 2024 a written agreement had been signed with an MDR-designated notified body.

Conditions 4 and 5 are the ones with teeth, because their deadlines are in the past. If a manufacturer did not lodge and sign by those dates, the extension never applied to that device — the original certificate expiry stands, whatever the 2027/2028 dates say. There is no retroactive entry.

The Commission's guidance on the transitional provisions (MDCG 2022-18) and its Article 120 flowchart walk the decision tree case by case; if a device sits near an edge, work the flowchart rather than a summary like this one.

Who watches the device now

One consequence that surprises people: when a manufacturer signed that written agreement, the MDR-designated notified body named in it became responsible for appropriate surveillance of the legacy device — even though the device is still certified under the old directive. So a legacy device in the extension is not unsupervised, and it is not supervised by whoever issued the original certificate if that body is no longer designated.

This is why "our old certificate is still valid" is an incomplete answer. Valid under which route, watched by whom, and until which of the two dates?

How to check where a device stands

You cannot read Article 120 compliance off a public database — the conditions are about the manufacturer's own filings and QMS, which are not published. What the public record does give you is the surrounding evidence:

• The certificates. Look at the indexed certificate records and check what is recorded against the manufacturer: an MDR certificate alongside a legacy portfolio tells you the transition is under way; nothing recorded tells you less than you would like, because notified bodies have until 27 May 2027 to upload pre-existing certificates.
• The device records. A legacy device in EUDAMED is identifiable: it carries a system-assigned EUDAMED DI (prefix B-) instead of a Basic UDI-DI, because legacy devices have no UDI. Scan the device corpus and that prefix is the tell.
• The notified body. Check the body named in the written agreement is still designated — a lapsed designation is a live problem for surveillance, and designations are concentrated in a handful of bodies (see which notified bodies issue the most MDR certificates). The manufacturer's registered actor record and the notified bodies behind its certificates are the two ends of that thread.

Remember throughout that MD Atlas indexes a subset of EUDAMED, not the complete database, so absence of a record is not evidence of absence of a certificate — particularly during the upload window now running.

What to do if you are on the wrong side of it

If conditions 4 or 5 were missed, the honest position is that the device's legacy certificate expired on its own terms and the device should not be on the market under the extension. The route back is a normal MDR conformity assessment, not an appeal to Article 120. Establish that status deliberately, in writing, before a competent authority establishes it for you — and treat the two remaining calendar dates as what they are: the end of a runway that a lot of portfolios are still on.