How to register a medical device with the MHRA: a step by step guide
From classification to UKCA marking and MHRA registration, what UK manufacturers and overseas suppliers need to do, including software and AI.
Before a medical device can be placed on the Great Britain market it must meet the UK Medical Devices Regulations 2002 and be registered with the Medicines and Healthcare products Regulatory Agency (MHRA). This applies to physical devices and to software, including AI, that meets the definition of a medical device.
Rules and transition dates change, so always check the current MHRA guidance. The steps below are the route most manufacturers follow.
Step 1: Confirm it is a medical device
Start with intended purpose. Software that diagnoses, monitors, predicts, prevents or supports treatment of a condition is often a medical device. Software that only handles administration, booking or general wellbeing usually is not. The wording of your intended purpose decides this, so write it carefully.
Step 2: Classify the device
- Class I: lowest risk, the manufacturer self declares conformity
- Class IIa and IIb: medium to higher risk, an Approved Body must assess you
- Class III: highest risk, the most detailed assessment and clinical evidence
Step 3: Build your quality system and technical file
- A quality management system, usually aligned to ISO 13485
- Risk management to ISO 14971
- Software lifecycle and usability evidence, for example IEC 62304 and IEC 62366
- Clinical evaluation proportionate to the risk
- Labelling, instructions for use and a post market surveillance plan
Step 4: Conformity assessment and UKCA marking
Class I manufacturers complete a declaration of conformity themselves. Higher classes need an Approved Body to assess the quality system and technical documentation before UKCA marking. Check current MHRA guidance on whether CE marking is still accepted in Great Britain for your device.
Step 5: Register with the MHRA
Devices are registered through the MHRA's online registration system. Manufacturers based outside the UK must appoint a UK Responsible Person to register on their behalf. Registration must be in place before the device is placed on the market.
Step 6: After registration
- Post market surveillance and vigilance reporting
- Change control so updates do not change the class without review
- For the NHS, DCB0129 and DTAC evidence alongside your registration
How DigiSafe helps
We confirm whether your product is a device, classify it, build the technical file and ISO 13485 quality system, prepare the Class I declaration or support your Approved Body route, and align it all with DCB0129 and DTAC. Tell us what you need or book a free 20 minute call with an expert.
Want this applied to your product?
We turn standards like this into evidence packs, safety cases and embedded CSO support, so you can focus on building.
Keep reading
- Standards
DCB0129: Clinical Risk Management for Health IT Manufacturers, explained
What DCB0129 actually requires, why NHS buyers ask for it, and how to build a Safety Case that holds up to scrutiny.
- Standards
DCB0160: Clinical Risk Management for NHS Deployers, explained
DCB0160 is the deployer's responsibility, and it doesn't disappear just because your supplier has DCB0129. Here's what NHS organisations actually need to do.
- Frameworks
DTAC v2: what changed, what NHS buyers look for, and how to prepare
The Digital Technology Assessment Criteria moved to v2 with sharper expectations on clinical safety, AI, accessibility and interoperability. Here's the plain-English version.