Disclaimer: This is my personal, subjective opinion based on my consulting experience since 2020 (5 years and counting!).
On paper, all Notified Bodies are the same: They all audit you based on the same standards (supposedly), their audits are all equally qualified (at least on paper), and their prices are transparent (kind of). As you might have noticed based on the words in brackets, not all Notified Bodies are created equal, to say the least.
Here’s a summary of my experiences I’ve made over the years. Again, these are all highly subjective. If you’re working at a Notified Body and think I’ve misrepresented your company here, post a comment below and I’m happy to append your statement.
TLDR: Choose DQS Or BerlinCert
DQS and BerlinCert are the two Notified Bodies where a reasonable amount of startups (~50%?) come away and say their experience “wasn’t catastrophically bad”. So those would be my first choice. Their auditors seem to have a reasonable level of software expertise (i.e. they might have looked at some code within the last 10 years), their pricing isn’t insane, and they are responsive enough to not give you the impression that they ran away with your money. Yeah.. the bar is not super high right now.
So it’s not like they are really great all the time. Internally, they’ll forward you to one of their auditors which might be working freelance, and you have no control over who that might be. Those auditors vary in their subjective interpretations of the standards, and also in their understanding of fast-moving software startups.
Generally speaking, the costs we’ve heard of for a MDR class IIa QMS and Techdoc audit are in the range of 30-50k€, but then again, prices may vary for you.
Maybe Look At Eastern Europe
One thing which I’ve been suggesting to consulting customers in the past 5 years has been to look at some of the lesser-known Notified Bodies in Eastern Europe. No, not because of random shady reasons (I don’t think you can bribe Notified Bodies – your thoughts, not mine!), but because I simply haven’t heard of any company working with them yet, and it might be interesting to see whether they are pragmatic and understand software startups well.
Given that Eastern Europe has quite a few software startups, I would have the reasonable hope that their Notified Bodies might be similarly qualified and pragmatic. But, again, I have no data points.
If you’ve worked with one of them, let me know in the comments below!
Don’t Choose These
BSI
BSI is funny. Every time a potential customer contacts us and they describe some sort of crazy auditor questions which are completely decoupled from reality, I ask them “is it BSI?”, and so far, I’ve been right 100% of the time. There’s some bias here because, for some reason, many companies choose BSI (???). But the point still stands that BSI has the weirdest interpretation of regulations in our experience.
If you’re a company which gets a lot of satisfaction out of arguing with auditors while running out of money, BSI might be a good choice. In all other cases, especially if you’re a company which wants to bring a medical device to market, don’t choose BSI.
Tüv Süd
Tüv Süd is an interesting one. They seem reasonably well-organized and they are said to have the most competent auditors and technical staff. Some of them even understand software pretty well (gasp). Those are the positive aspects.
The negative aspects, however, are that they are one of the most expensive Notified Bodies, and they tend to be one of the strictest Notified Bodies around when it comes to interpreting regulations. Note that this is different from BSI: Tüv Süd is strict, but in a mostly-rational way. BSI is often simply irrational.
Some companies now say “hey cool, let’s go for Tüv Süd because they’re super strict and our future customers will appreciate that we’ve got approval from Tüv Süd!”. The problem with this thinking, however, is that your customers don’t care about Tüv Süd, nor about any other Notified Body. They care about whether your damn product is available, how well it works, and how much it costs. So don’t choose Tüv Süd.
Tüv Süd Denmark
Tüv Süd Denmark is also an interesting one. They’re essentially Tüv Süd, but focused on software and much faster (supposedly). It comes at a cost though: They are much more expensive.
I don’t really see a good reason to choose them. You get the drawbacks of Tüv Süd (strict, high cost) and maybe faster speed. But that ‘s not guaranteed: Fast response times end up being useless if a Notified Body comes up with many rounds of questions, which still results in a long time to market.
It’s too early to tell though.
Tüv Rheinland
Not many data points on Tüv Rheinland, but the few ones which we have point towards them not being organized very well. Again, not many data points unfortunately.
So those are the Notified Bodies we don’t recommend. Finally, let’s look at Scarlet which is an interesting case.
Scarlet: Maybe, Not Sure, Probably Not
So what a about Scarlet, a Notified Body “startup”? Their promise is to make the whole process of auditing medical devices more digital and efficient. Will they deliver on this? It’s too early to tell.
What we know for sure is that they’re certainly much more expensive. It’s up to your whether you want to choose an experimental startup for a core aspect of your company (certification) – the perceived benefit should be worth the risks. One risk of Scarlet is that they’re currently not profitable and relying on investor funds to finance their day-to-day operations. So if they don’t become profitable at some stage, they’ll go bankrupt.
The initial feedback we’ve heard from startups seems to be a mixed bag – neither overwhelmingly positive nor negative.
Notified Body Reviews
If you’d like to make an informed decision yourself, we’ve built a database of anonymous Notified Body Reviews in which lots of companies have rated their experience with their notified body, so take a look at those 🙂
