MiBB Regulatory

EU MDR template kits and specialist support for software & AI medical devices

SaMD templates written from the Notified Body side of the table.

Six years reviewing MDR software submissions showed me where technical files fail. The SaMD Classification Kit and the SaMD Technical Documentation Kit are built around those findings, with reviewer notes in every template. When a team needs a specialist on their device, I also work with them directly.

  • 6+ years reviewing MDR submissions at TÜV SÜD & DNV
  • Qualified PRRC under MDR Article 15
  • 100% focus on SaMD, AI/ML, and software-enabled devices

Guidance templates. No guarantee of certification.

Need a specialist on your device? See specialist support or email mikkel@mibb-regulatory.eu.

Mikkel Bruus-Borggaard, founder of MiBB Regulatory
Mikkel Bruus-Borggaard · EU MDR specialist for software & AI · former Notified Body assessor

6+years

Notified Body assessor

TÜV SÜD Denmark MHS & DNV

2NBs

Reviewed from inside

Know what auditors look for

7MDR codes

Active qualification scope

SaMD & software systems

16templates

Classification to technical file

Plus specialist support by email

Who the kits are for

Built for teams who do the regulatory work themselves.

If several of these sound familiar, the kits are a good starting point.

  • You are building SaMD, AI/ML-enabled or software-heavy medical devices for the EU market.

  • You need a Rule 11 classification rationale you can defend.

  • You want a technical documentation structure built around what assessors actually check.

  • You have the team to do the work and want a proven starting point instead of a blank page.

  • Stuck on a boundary case or a Notified Body question? Specialist support is there for that, or email me and I’ll tell you whether I can help.

Quick check

Is your product regulated under EU MDR?

Answer a few questions for indicative qualification and classification guidance — aligned with MDCG 2019-11 and related guidance.

Document this properly. Turn the result into a written qualification memo and Rule 11 rationale.

SaMD Classification Kit →

Template kits

From classification to technical file.

Start with a defensible classification, then build the software documentation set the Notified Body expects. Word and Excel templates, delivered by email.

SaMD Classification Kit

€99excl. VAT

Launch price · 4 templates

Qualification memo, Rule 11 rationale, intended purpose statement and classification decision checklist.

SaMD Technical Documentation Kit

€549excl. VAT

Launch price · 12 templates

IEC 62304 plans, SOUP/SBOM register, risk, usability, cybersecurity, GSPR checklist, and V&V.

Bundle: both kits

€569excl. VAT

Launch price · 16 templates

All 16 templates: the SaMD Classification Kit plus the SaMD Technical Documentation Kit.

Businesses only · prices excl. VAT · guidance templates, no guarantee of certification.

How the kits are made: I use AI tools to help draft and structure the templates, then review, correct and finalise every document myself, drawing on six years as a Notified Body assessor. AI speeds up the writing; the regulatory judgement is mine. How the kits are made

Need more than templates? I also take on a limited number of SaMD and AI projects: targeted reviews, Notified Body responses and classification strategy. See specialist support or email mikkel@mibb-regulatory.eu.

Process

Where the kits fit

  1. Define → SaMD Classification Kit

    Qualification · Intended purpose · Rule 11 rationale

  2. Build → SaMD Technical Documentation Kit

    IEC 62304 · Risk & usability · Cybersecurity · GSPR · V&V

Documentation lifecycle

EU MDR Documentation Process Map

A structured overview of the documentation lifecycle for software medical devices (SaMD) under EU MDR — from design inputs through post-market surveillance, QMS certification, and the parallel cybersecurity risk management track.

1

Design inputs

  • Intended use & classification

    Rule 11 analysis, device scope

  • Applicable standards list

    IEC 62304, ISO 14971, 62366

  • System requirements

    Clinical, user & stakeholder needs

  • Design & development plan

    Milestones and review gates

  • Risk management plan

    ISO 14971, hazards and harms

  • Usability engineering plan

    IEC 62366, use specification

  • Clinical evaluation plan

    CEP, clinical strategy

2

Design outputs & V&V

  • Device description

    BoM, drawings, labelling

  • Software lifecycle docs

    IEC 62304, SDS, unit tests

  • Design FMEA

    Risk control verification

  • Verification plans & records

    Multi-level V&V protocols

  • Validation plan & report

    Clinical environment testing

  • Summative evaluation

    Use scenarios, hazard analysis

  • GSPR checklist

    Annex I, applied standards

3

Post-market

  • PMS plan

    Post-market surveillance

  • PMCF plan

    Post-market clinical follow-up

  • Clinical evaluation report

    CER, literature review

  • Plan and report

    PMS report / PSUR

  • Periodic safety update

    PMCF report

  • Follow-up results

4

QMS & NB review

  • QMS development

    ISO 13485, procedures, SOPs

  • NB stage 1 desk review

    Technical file completeness

  • NB stage 2 onsite audit

    QMS process audit

  • NB Q&A / negotiation

    Deficiency responses

  • ISO 13485 certificate

    QMS certification issued

  • CE mark certificate

    Market release authorised

  • STED

    Summary technical documentation

  • PRRC oversight

    Article 15, ongoing compliance

Cybersecurity track

Runs in parallel across all phases

  1. Intended use & assets

    Threats and vulnerabilities

  2. Cybersecurity risk analysis

    Threat/vulnerability estimation

  3. Risk control measures

    Implementation and verification

  4. Cybersecurity RM report

    Residual risk evaluation

  5. Post-production monitoring

    Vulnerability disclosure, patches

Cybersecurity risk feeds into ISO 14971 safety risk management — adverse impacts must be evaluated jointly.

Specialist support

When your device needs a specialist, not just a template.

The kits cover the groundwork. Some questions need someone who has sat on the Notified Body side of the table. Alongside the kits, I take on a limited number of SaMD and AI projects, so each one gets my full attention.

Who it’s for

  • Classification questions. You are not sure whether your software qualifies as a medical device, which Rule 11 class applies, or your device sits on a boundary.

  • Notified Body questions or deficiency lists. You have received questions or a deficiency list and need answers that actually close them.

  • Technical documentation gaps. Your technical file has gaps against MDR Annex II, IEC 62304, ISO 14971 or IEC 62366-1.

  • AI/ML-specific MDR questions. Your device uses AI or machine learning, and you need to know what MDR expects and how the AI Act will apply on top.

  • Cybersecurity. Your software is connected and you need to meet MDR cybersecurity expectations and IEC 81001-5-1.

How I can help

Targeted reviews

A focused review of your classification rationale, software documentation, risk file or GSPR checklist, read the way an assessor reads it, with written findings.

Notified Body responses

Help answering Notified Body questions and deficiency lists: what is really being asked, and which evidence closes the point.

Classification & regulatory strategy

Qualification, Rule 11 classification and the route to CE marking for SaMD and AI devices, including how the AI Act fits alongside MDR.

PRRC-level advice

Advice from a qualified PRRC under MDR Article 15 on compliance questions across the software lifecycle, from release to post-market.

Every engagement has defined outputs, not open-ended consulting hours. Scope, timeline and deliverables are agreed in writing before work starts, and the work runs by email.

Tell me about your device. Send a short description of what it does, its intended purpose, your current stage and what you need help with. I’ll reply in writing and tell you honestly whether I’m the right fit.

Email only: mikkel@mibb-regulatory.eu. Specialist support is provided under a separate written agreement. No one can guarantee certification, and I don’t either.

Expertise

Credentials that matter to Notified Bodies — and to your team.

Six years on the assessor side of the table, backed by engineering and clinical experience. Based in Copenhagen, serving SaMD and AI device teams across Denmark, the Nordics, and the wider EU.

Assessor's perspective

Six years reviewing submissions at two Notified Bodies. I know which gaps stall assessments and which documentation patterns pass.

Engineering fluency

M.Sc. in biomedical engineering with hands-on firmware and DSP experience at GN Otometrics, GN ReSound, and B&O Medicom. I read your architecture diagrams.

Clinical grounding

Four years as a clinical engineer at Rigshospitalet — intraoperative monitoring during spinal surgery and hospital system rollouts. Real clinical risk context.

Background

  1. 2026 —

    Founder

    MiBB Regulatory

  2. 2022 — 2026

    Certified Technical Assessor

    TÜV SÜD Denmark MHS

  3. 2019 — 2022

    Certified Technical Assessor

    DNV Business Assurance

  4. 2015 — 2019

    Clinical Engineer

    Rigshospitalet

  5. 2013 — 2015

    Firmware Engineer

    GN Otometrics

  6. 2010 — 2013

    DSP / OS Engineer

    GN ReSound

  7. 2007 — 2010

    Software Engineer

    Bang & Olufsen Medicom

About

A specialist in EU MDR for software and AI.

I founded MiBB Regulatory in Copenhagen after six years as a Notified Body assessor, and before that worked as a firmware, DSP and clinical engineer. I focus entirely on SaMD, AI/ML and software-enabled devices, and I work in two ways: template kits that teams can use themselves, and specialist support for a limited number of teams who need direct help with classification, Notified Body questions, technical documentation, AI/ML or cybersecurity. See specialist support or email me.

Assessor-built

Every template opens with “What the Notified Body will challenge here”.

Specialist support

Direct help for selected SaMD and AI teams, from a qualified PRRC and former assessor.

Kept current

Free v1.x updates for 12 months, each with a changelog.

FAQ

Common questions about the kits, EU MDR and SaMD.

Straight answers to what manufacturers ask most — from classification through Notified Body submission.

How do I know if my software is a medical device under EU MDR?

EU MDR applies when software is intended for a medical purpose — defined by your intended purpose in labelling, instructions for use, and promotional material. General-purpose tools are out of scope; software that processes patient-specific data to support clinical decisions usually is. The first step is a written qualification and classification rationale before any technical documentation work begins.

Read our Rule 11 analysis →

What is MDR Rule 11 and how does it affect SaMD classification?

Rule 11 of MDR Annex VIII classifies software that provides information used for diagnostic or therapeutic decisions. Most SaMD falls into Class IIa or higher depending on the severity of the clinical decision and the population affected. Rule 11 is not a bright-line test — classification depends on intended purpose, clinical context, and how directly the output drives decisions. AI-enabled software that generates patient-specific outputs is almost always in scope.

Read our Rule 11 analysis →

Do I need a Person Responsible for Regulatory Compliance (PRRC)?

Under MDR Article 15, manufacturers must have a PRRC with the required qualifications and professional experience. Micro and small enterprises are not required to employ the PRRC; they may have the PRRC permanently and continuously at their disposal rather than employed (Article 15(2)).

Read our PRRC guide →

What does the EU AI Act mean for AI-enabled medical devices?

Most AI-enabled medical devices that need a Notified Body are high-risk AI systems under Article 6(1) and Annex I of the AI Act. After the Digital Omnibus on AI (Regulation (EU) 2026/1744), those obligations apply from 2 August 2028. If your device is MDR-regulated and uses AI, you will face dual compliance under both frameworks. The good news: mature MDR documentation covers much of the foundation — but data governance, human oversight, and transparency requirements need explicit attention.

Read about the AI Act deadline →

How long does Notified Body submission typically take for SaMD?

Timelines vary by device class, NB workload, and documentation quality. Class IIa SaMD commonly takes 12–18 months from submission to certificate, but poor preparation — especially weak classification rationale, incomplete IEC 62304 evidence, or gaps in clinical evaluation — adds months of query cycles. A thorough self-check before you file, e.g. with the free Top 25 SaMD Findings checklist, is the highest-leverage step.

Which kit should I start with?

Start with the SaMD Classification Kit if your class isn’t settled. Your technical documentation depends on it. If you already have a defensible class, go straight to the SaMD Technical Documentation Kit, or get the bundle.

Will the templates get me certified?

No template can guarantee certification. The kits are guidance written from an assessor’s perspective. You stay responsible for your documentation.

Did you use AI to make these templates?

Yes. I use AI tools to help draft and structure the templates. Every document is then reviewed, corrected and finalised by me, drawing on my background in medical device software engineering and six years as a Notified Body assessor. AI does not make classification or conformity decisions, and every template must be adapted to your own device.

Do you sell outside Denmark?

Yes, to businesses across the EU and beyond. EU businesses with a valid VAT number are reverse-charged.

Can you help us directly?

Yes, for a limited number of projects. I offer specialist support on classification, Notified Body questions and deficiency lists, technical documentation reviews, AI/ML-specific MDR questions and cybersecurity. Email mikkel@mibb-regulatory.eu with your device and stage, and I’ll reply in writing about whether I can help.

Insights

Regulatory thinking for SaMD and AI teams.

Practical analysis with linked sources — plus weekly updates from EU regulators.

Regulatory updates

Filtered from EU health and EMA feeds. Refreshed weekly.

Last updated 13 Jul 2026

EU Medical Devices29 Jun 2026 · European Commission — Medical Devices

Medical Devices: Delegated acts on well-established technologies published

Medical Devices: Delegated acts on well-established technologies published

Read source ↗

EU Medical Devices18 Jun 2026 · European Commission — Medical Devices

New MDCG Position Paper: Management of SS(C)P in EUDAMED after mandatory use

New MDCG Position Paper: Management of SS(C)P in EUDAMED after mandatory use

Read source ↗

EU Medical Devices17 Jun 2026 · European Commission — Medical Devices

New guidance document on the “EU REP” symbol for authorised representatives

New guidance document on the “EU REP” symbol for authorised representatives

Read source ↗

EU Medical Devices17 Jun 2026 · European Commission — Medical Devices

New harmonised standards for the Regulations on medical devices

New harmonised standards for the Regulations on medical devices

Read source ↗

EU Medical Devices11 Jun 2026 · European Commission — Medical Devices

Update MIR 7.3.1. form – Updated XSD-XSL files for field 4.3.3.d. and Changelog file (SB 11252)

Update MIR 7.3.1. form – Updated XSD-XSL files for field 4.3.3.d. and Changelog file (SB 11252)

Read source ↗

EU Medical Devices18 May 2026 · European Commission — Medical Devices

New Implementing Regulation sets out uniform requirements for conformity assessment and notified bodies

New Implementing Regulation sets out uniform requirements for conformity assessment and notified bodies

Read source ↗

EU Medical Devices5 May 2026 · European Commission — Medical Devices

Implementing Regulation (EU) 2026/977 – uniform requirements for conformity assessment and notified bodies (Annex VII)

Implementing Regulation (EU) 2026/977 – uniform requirements for conformity assessment and notified bodies (Annex VII)

Read source ↗

EU Medical Devices22 Apr 2026 · European Commission — Medical Devices

Update – Documents on European Medical Device Nomenclature (EMDN)

Update – Documents on European Medical Device Nomenclature (EMDN)

Read source ↗

Contact

Questions about the kits or your device?

Questions about the kits, a purchase, or which kit fits your device? Email me and I’ll reply in writing. Need specialist support on your device? Say so in your email.

  • Written reply by email — no calls to schedule
  • No sales pitch — straight technical answers
  • A clear pointer to the right kit, or to specialist support