SaMD Classification Kit
€99excl. VAT
Launch price · 4 templates
Qualification memo, Rule 11 rationale, intended purpose statement and classification decision checklist.
EU MDR template kits and specialist support for software & AI medical devices
Six years reviewing MDR software submissions showed me where technical files fail. The SaMD Classification Kit and the SaMD Technical Documentation Kit are built around those findings, with reviewer notes in every template. When a team needs a specialist on their device, I also work with them directly.
Guidance templates. No guarantee of certification.
Need a specialist on your device? See specialist support or email mikkel@mibb-regulatory.eu.

6+years
Notified Body assessor
TÜV SÜD Denmark MHS & DNV
2NBs
Reviewed from inside
Know what auditors look for
7MDR codes
Active qualification scope
SaMD & software systems
16templates
Classification to technical file
Plus specialist support by email
Who the kits are for
If several of these sound familiar, the kits are a good starting point.
You are building SaMD, AI/ML-enabled or software-heavy medical devices for the EU market.
You need a Rule 11 classification rationale you can defend.
You want a technical documentation structure built around what assessors actually check.
You have the team to do the work and want a proven starting point instead of a blank page.
Stuck on a boundary case or a Notified Body question? Specialist support is there for that, or email me and I’ll tell you whether I can help.
Quick check
Answer a few questions for indicative qualification and classification guidance — aligned with MDCG 2019-11 and related guidance.
Document this properly. Turn the result into a written qualification memo and Rule 11 rationale.
SaMD Classification Kit →Template kits
Start with a defensible classification, then build the software documentation set the Notified Body expects. Word and Excel templates, delivered by email.
€99excl. VAT
Launch price · 4 templates
Qualification memo, Rule 11 rationale, intended purpose statement and classification decision checklist.
€549excl. VAT
Launch price · 12 templates
IEC 62304 plans, SOUP/SBOM register, risk, usability, cybersecurity, GSPR checklist, and V&V.
€569excl. VAT
Launch price · 16 templates
All 16 templates: the SaMD Classification Kit plus the SaMD Technical Documentation Kit.
Businesses only · prices excl. VAT · guidance templates, no guarantee of certification.
How the kits are made: I use AI tools to help draft and structure the templates, then review, correct and finalise every document myself, drawing on six years as a Notified Body assessor. AI speeds up the writing; the regulatory judgement is mine. How the kits are made
Need more than templates? I also take on a limited number of SaMD and AI projects: targeted reviews, Notified Body responses and classification strategy. See specialist support or email mikkel@mibb-regulatory.eu.
Process
Qualification · Intended purpose · Rule 11 rationale
IEC 62304 · Risk & usability · Cybersecurity · GSPR · V&V
Documentation lifecycle
A structured overview of the documentation lifecycle for software medical devices (SaMD) under EU MDR — from design inputs through post-market surveillance, QMS certification, and the parallel cybersecurity risk management track.
Intended use & classification
Rule 11 analysis, device scope
Applicable standards list
IEC 62304, ISO 14971, 62366
System requirements
Clinical, user & stakeholder needs
Design & development plan
Milestones and review gates
Risk management plan
ISO 14971, hazards and harms
Usability engineering plan
IEC 62366, use specification
Clinical evaluation plan
CEP, clinical strategy
Device description
BoM, drawings, labelling
Software lifecycle docs
IEC 62304, SDS, unit tests
Design FMEA
Risk control verification
Verification plans & records
Multi-level V&V protocols
Validation plan & report
Clinical environment testing
Summative evaluation
Use scenarios, hazard analysis
GSPR checklist
Annex I, applied standards
PMS plan
Post-market surveillance
PMCF plan
Post-market clinical follow-up
Clinical evaluation report
CER, literature review
Plan and report
PMS report / PSUR
Periodic safety update
PMCF report
Follow-up results
QMS development
ISO 13485, procedures, SOPs
NB stage 1 desk review
Technical file completeness
NB stage 2 onsite audit
QMS process audit
NB Q&A / negotiation
Deficiency responses
ISO 13485 certificate
QMS certification issued
CE mark certificate
Market release authorised
STED
Summary technical documentation
PRRC oversight
Article 15, ongoing compliance
Cybersecurity track
Runs in parallel across all phases
Intended use & assets
Threats and vulnerabilities
Cybersecurity risk analysis
Threat/vulnerability estimation
Risk control measures
Implementation and verification
Cybersecurity RM report
Residual risk evaluation
Post-production monitoring
Vulnerability disclosure, patches
Cybersecurity risk feeds into ISO 14971 safety risk management — adverse impacts must be evaluated jointly.
Specialist support
The kits cover the groundwork. Some questions need someone who has sat on the Notified Body side of the table. Alongside the kits, I take on a limited number of SaMD and AI projects, so each one gets my full attention.
Who it’s for
Classification questions. You are not sure whether your software qualifies as a medical device, which Rule 11 class applies, or your device sits on a boundary.
Notified Body questions or deficiency lists. You have received questions or a deficiency list and need answers that actually close them.
Technical documentation gaps. Your technical file has gaps against MDR Annex II, IEC 62304, ISO 14971 or IEC 62366-1.
AI/ML-specific MDR questions. Your device uses AI or machine learning, and you need to know what MDR expects and how the AI Act will apply on top.
Cybersecurity. Your software is connected and you need to meet MDR cybersecurity expectations and IEC 81001-5-1.
How I can help
A focused review of your classification rationale, software documentation, risk file or GSPR checklist, read the way an assessor reads it, with written findings.
Help answering Notified Body questions and deficiency lists: what is really being asked, and which evidence closes the point.
Qualification, Rule 11 classification and the route to CE marking for SaMD and AI devices, including how the AI Act fits alongside MDR.
Advice from a qualified PRRC under MDR Article 15 on compliance questions across the software lifecycle, from release to post-market.
Every engagement has defined outputs, not open-ended consulting hours. Scope, timeline and deliverables are agreed in writing before work starts, and the work runs by email.
Tell me about your device. Send a short description of what it does, its intended purpose, your current stage and what you need help with. I’ll reply in writing and tell you honestly whether I’m the right fit.
Email only: mikkel@mibb-regulatory.eu. Specialist support is provided under a separate written agreement. No one can guarantee certification, and I don’t either.
Expertise
Six years on the assessor side of the table, backed by engineering and clinical experience. Based in Copenhagen, serving SaMD and AI device teams across Denmark, the Nordics, and the wider EU.
Six years reviewing submissions at two Notified Bodies. I know which gaps stall assessments and which documentation patterns pass.
M.Sc. in biomedical engineering with hands-on firmware and DSP experience at GN Otometrics, GN ReSound, and B&O Medicom. I read your architecture diagrams.
Four years as a clinical engineer at Rigshospitalet — intraoperative monitoring during spinal surgery and hospital system rollouts. Real clinical risk context.
Background
Founder
MiBB Regulatory
Certified Technical Assessor
TÜV SÜD Denmark MHS
Certified Technical Assessor
DNV Business Assurance
Clinical Engineer
Rigshospitalet
Firmware Engineer
GN Otometrics
DSP / OS Engineer
GN ReSound
Software Engineer
Bang & Olufsen Medicom
About
I founded MiBB Regulatory in Copenhagen after six years as a Notified Body assessor, and before that worked as a firmware, DSP and clinical engineer. I focus entirely on SaMD, AI/ML and software-enabled devices, and I work in two ways: template kits that teams can use themselves, and specialist support for a limited number of teams who need direct help with classification, Notified Body questions, technical documentation, AI/ML or cybersecurity. See specialist support or email me.
Every template opens with “What the Notified Body will challenge here”.
Direct help for selected SaMD and AI teams, from a qualified PRRC and former assessor.
Free v1.x updates for 12 months, each with a changelog.
FAQ
Straight answers to what manufacturers ask most — from classification through Notified Body submission.
EU MDR applies when software is intended for a medical purpose — defined by your intended purpose in labelling, instructions for use, and promotional material. General-purpose tools are out of scope; software that processes patient-specific data to support clinical decisions usually is. The first step is a written qualification and classification rationale before any technical documentation work begins.
Read our Rule 11 analysis →Rule 11 of MDR Annex VIII classifies software that provides information used for diagnostic or therapeutic decisions. Most SaMD falls into Class IIa or higher depending on the severity of the clinical decision and the population affected. Rule 11 is not a bright-line test — classification depends on intended purpose, clinical context, and how directly the output drives decisions. AI-enabled software that generates patient-specific outputs is almost always in scope.
Read our Rule 11 analysis →Under MDR Article 15, manufacturers must have a PRRC with the required qualifications and professional experience. Micro and small enterprises are not required to employ the PRRC; they may have the PRRC permanently and continuously at their disposal rather than employed (Article 15(2)).
Read our PRRC guide →Most AI-enabled medical devices that need a Notified Body are high-risk AI systems under Article 6(1) and Annex I of the AI Act. After the Digital Omnibus on AI (Regulation (EU) 2026/1744), those obligations apply from 2 August 2028. If your device is MDR-regulated and uses AI, you will face dual compliance under both frameworks. The good news: mature MDR documentation covers much of the foundation — but data governance, human oversight, and transparency requirements need explicit attention.
Read about the AI Act deadline →Timelines vary by device class, NB workload, and documentation quality. Class IIa SaMD commonly takes 12–18 months from submission to certificate, but poor preparation — especially weak classification rationale, incomplete IEC 62304 evidence, or gaps in clinical evaluation — adds months of query cycles. A thorough self-check before you file, e.g. with the free Top 25 SaMD Findings checklist, is the highest-leverage step.
Start with the SaMD Classification Kit if your class isn’t settled. Your technical documentation depends on it. If you already have a defensible class, go straight to the SaMD Technical Documentation Kit, or get the bundle.
No template can guarantee certification. The kits are guidance written from an assessor’s perspective. You stay responsible for your documentation.
Yes. I use AI tools to help draft and structure the templates. Every document is then reviewed, corrected and finalised by me, drawing on my background in medical device software engineering and six years as a Notified Body assessor. AI does not make classification or conformity decisions, and every template must be adapted to your own device.
Yes, to businesses across the EU and beyond. EU businesses with a valid VAT number are reverse-charged.
Yes, for a limited number of projects. I offer specialist support on classification, Notified Body questions and deficiency lists, technical documentation reviews, AI/ML-specific MDR questions and cybersecurity. Email mikkel@mibb-regulatory.eu with your device and stage, and I’ll reply in writing about whether I can help.
Insights
Practical analysis with linked sources — plus weekly updates from EU regulators.
Before you write a single line of regulatory documentation, you need to answer one foundational question: does EU MDR apply to your software at all? Getting this wrong — in either direction — is costly.
Read article →
For AI-enabled medical devices under Annex I, the EU AI Act's high-risk obligations now apply from 2 August 2028, following the Digital Omnibus on AI. For manufacturers of AI-enabled medical devices already navigating MDR, this creates a dual compliance challenge.
Read article →
Every EU manufacturer needs a Person Responsible for Regulatory Compliance — but what that means in practice, when you need one, and whether fractional coverage is legitimate are questions I hear constantly from SaMD start-ups.
Read article →
Filtered from EU health and EMA feeds. Refreshed weekly.
Last updated 13 Jul 2026
Medical Devices: Delegated acts on well-established technologies published
Read source ↗
New MDCG Position Paper: Management of SS(C)P in EUDAMED after mandatory use
Read source ↗
New guidance document on the “EU REP” symbol for authorised representatives
Read source ↗
New harmonised standards for the Regulations on medical devices
Read source ↗
Update MIR 7.3.1. form – Updated XSD-XSL files for field 4.3.3.d. and Changelog file (SB 11252)
Read source ↗
New Implementing Regulation sets out uniform requirements for conformity assessment and notified bodies
Read source ↗
Implementing Regulation (EU) 2026/977 – uniform requirements for conformity assessment and notified bodies (Annex VII)
Read source ↗
Update – Documents on European Medical Device Nomenclature (EMDN)
Read source ↗
Contact
Questions about the kits, a purchase, or which kit fits your device? Email me and I’ll reply in writing. Need specialist support on your device? Say so in your email.