If you want to bring software as a medical device to the market under the MDR, it’s likely that it’s class IIa. And if it’s class IIa, you to get audited first, and that’s done by a Notified Body. A Notified Body is a company which audits your company and its product, and you pay them for this service. If you think that sounds weird, I agree, but let’s talk about something else today: The curious emergence of “premium” Notified Bodies - yes, the phrase is new, I’m coining it here and now, OpenRegulatory is making history again!

Let’s backtrack for a moment. Did you know that many Notified Bodies already offered some sort of “fast track” service in the past? No, neither did I. Here’s how it works: If you pay them more, they’ll respond to you faster, e.g. with feedback to the documents you handed in. If you, again, think this sounds weird, I agree with you again, but let’s move on once more!

What’s new now however is that we’re seeing new Notified Bodies appearing which offer only fast track, premium pricing. The proposition, in simplified terms, is this: If you’re willing to pay 100k€ - 150k€ for your certification, they’ll guarantee you some sort of fast service and your overall experience is supposedly going to be better.

To put this into perspective: I recently talked to a startup which got their MDR QMS + Techdoc certification done for less than 25k€. So.. wait what, we’re looking at a price increase of a factor of 4-5x.

Crazy!

To be fair - nowadays, prices for a MDR QMS + Techdoc certification might be more towards 50k€, but that’s still a 2-3x price increase. Wow.

This is not speculation - this is already happening. Let’s look at two examples.

Premium Notified Bodies: Tüv Süd Denmark and Scarlet

Example #1: Tüv Süd is building up its subsidiary in Denmark and they recently got appointed as an MDR Notified Body. They only audit a limited set of product types (software included) and offer audit results in a fixed period of time. This all comes at a much higher cost though: The initial fee, just to get started with them, is 10k€ (yes, seriously) as mentioned on their pricing page. In addition to that, there’s an annual maintenance fee of 10k€, which already moves the sum close to the total price the aforementioned startup paid (25k€). But we they haven’t even audited you yet! For audits, the hourly rate is either 650€ / hr or 1.100€ / hr.

Quick comparison: BerlinCert charges 2k€ per day for audits (250€ / hr at 8 hrs) and 250€ or 300€ / hr for additional audit work. So the hypothesis of price increase of a factor of 2-5x is supported by this data, too.

This lines up with what I’ve heard from startups: Informal quotes for QMS + Techdoc audits seem to be around 100-150k€.

Example #2: Scarlet is a new Notified Body “startup”. They only audit software (for now), are backed by Venture Capital investors and, according to their website, “charges a flat monthly fee which can range from €9,000 to €25,000”. Yes, that’s a monthly fee, irrespective of audits. So, at minimum, you’re looking at 9k€ / month, which equals 108k€ per year.

This might turn out to be even more expensive than Tüv Süd Denmark, because, in theory, 100-150k€ for your initial audit (Tüv Süd Denmark) don’t translate to 100k€ / year, because subsequent audits might be cheaper, and you’re only paying per audit.

Wow.

So, where does this leave us? Is this good? Bad? Will Notified Bodies get rich and auditors fly around in private jets?

(Speaking about private jets, BerlinCert notes in its pricing sheet that they fly business class to non-EU countries. To be fair, that might be reasonable. Imagine the pain of having to audit someone (already very painful) after being crammed in an economy class seat for 12 hours (also painful).)

Now, where were we. Where does this leave us? And are Notified Bodies rich, evil, or a combination thereof?

Three Predictions For The Notified Body Landscape

I think none of the above. No one is going to get particularly rich (well, maybe besides consultants like us), and it’s neither good nor bad.

Here’s what we can learn, and here’s also what I predict:

1. Existing Notified Bodies are becoming increasingly dysfunctional, and audit result wait times will remaing long. This is not necessarily because they’re incompetent, but rather due to (hugely) increasing requirements which they have to now fulfil under the MDR. Additionally, they have to hire many more specialists for product audits, and those people are hard to find, so they’ll be lacking people. All the while more customers are knocking at their door because more products and companies need certificates under the MDR. All of this will lead to long wait times and sometimes “dropping the ball” entirely - I’ve recently heard of a company which didn’t hear back for one year after their QMS audit, and in the meantime, that first audit “expired” and they now need another audit, so the first audit was for nothing. That’s crazy!

2. Notified Bodies now compete for talent in a talent pool which is extremely limited. Imagine you’re an AI startup in Germany, building a competitor to ChatGPT, looking for smart, young AI engineers. The market for this sort of talent is very competitive, because it’s considered the next big thing. Still, you might be able to hire some smart people if you’re in Berlin (fun city), offer big salaries (you’re competing with Google) and a cool team (smart, young people love being among other smart, young people).

Now imagine you’re a Notified Body and are attempting to hire smart, young AI engineers for your product specialist auditor team. You’re not in a fun city, you offer average salaries, and your team is full of old auditors. None of this is bad (I appreciate old people), but I’m just saying that this is not a competitive proposition if you’re in the market for smart, young AI engineers.

Still, you might find a few, maybe because they’re idealistically motivated to work in regulation (like we are!) - but, in all likelyhood, your biggest leverage is simply paying higher salaries. So your costs go up. And now imagine that you are competing with the other 20+ Notified Bodies for such talent, because one person can only work for one Notified Body. Wow. Good luck.

(Side note: This would be a big argument for a central authority like EMA to do this stuff instead, because there’d be less competition for people)

All of this leads to..

3. Premium Notified Bodies are emerging. This is a logical consequence of the prior points: The inherent complexity is higher, more people have to be hired and those people are (much) more expensive.

Comparing this to plane tickets (taking another cue from the price sheet), this is quite similar to business class vs. economy class: A business class seat takes up much more space than an economy class seat, and space is the limiting factor in an airplane. Likewise, with increasing complexity under the MDR and more product auditors required, the “space” taken up by each audit within a Notified Bodies is equally higher.

When flying business, the customer however gets more perks which seem fancy but don’t impact the bottom line of the airline very much: More drinks, fancy food, and a friendly steward or stewardess who asks you if you’d like more drinks or more fancy food. Likewise, we might observe these perks with premium Notified Bodies, too: Better customer service, faster turnaround times and better software tooling (Scarlet comes to mind).

So this is great for companies with a lot of money. But what does this mean for all other companies, founded by mere mortals with limited budgets?

Are Premium Notified Bodies Improving Things For Everyone?

The hallmark of progress in human civilizations is when things get both better and cheaper. If you buy a laptop nowadays, that laptop is easily 10x better than a laptop 10 years ago, but it’s not 10x more expensive. In terms of “computing power per money”, things have gotten much cheaper, and amazingly so.

The problem with premium Notified Bodies, however, is that you’re purchasing something which is 2-5x more expensive, and the service you get is most definitely not 2-5x better than what it used to be 10 years ago. On the contrary, you’re probably getting the same services like 10 years ago, because 10 years ago, under the MDD, Notified Bodies already were rather responsive and audits got done pretty fast.

Another problem with business class is that you transport much less people. And this is what I expect of premium Notified Bodies, too: The experience for existing customers might be great, but purchasing these sort of expensive services might simply not be in reach for many other medical device manufacturers.

So yes, premium Notified Bodies are solving a problem (the current Notified Body experience sucks), but they are not solving the right problem (bringing safe medical devices to patients in an affordable way).

But I don’t think it’s their fault. I think they’re an emergent phenomenon triggered by the essential complexity of the MDR, and that’s the root cause.

Do I dislike them? My honest answer is that I don’t have a final opinion on this - yet. But what I do know is that I don’t like it when things become so much more expensive, as I’m a startup founder (and software engineer) at heart.

Regardless of whether I like it or now, my prediction is that this won’t change the current doomsday scenario of many medical devices disappearing from the market. I hope I’m wrong. In the meantime, if you have tons of money, consider a premium Notified Body.