Received a Notified Body Deficiency Letter for Your CER? Here’s What to Do Next

Introduction

A deficiency letter rarely feels like good news. But under Regulation (EU) 2017/745, questions on the Clinical Evaluation Report are close to routine — the CER is one of the most cited areas in Notified Body review of technical documentation. Your file is being read, not rejected.

What separates a smooth assessment from months of back-and-forth is rarely the severity of the finding. It’s the quality of the response. This post walks through how to read a CER deficiency, diagnose what’s behind it, and build a response package that closes the item the first time.

Why the CER Attracts So Many Findings

Article 61 requires clinical evaluation to be planned and continuous; Annex XIV Part A sets out what the plan and report must contain. The standard is sufficient clinical evidence — enough data to demonstrate conformity with the relevant GSPRs in Annex I for your device, in its specific intended purpose. “Sufficient” is where the disputes live. Reviewers assess against criteria drawn from MDCG 2020-13, and legacy MDD devices face the added expectations of MDCG 2020-6.

First, Classify What You’ve Received

Not every question carries the same weight and treating them identically wastes time.

Deficiency, non-conformity or request for clarification

A request for clarification usually means the evidence exists but the reviewer can’t follow it. A deficiency means something required is missing or inadequate. A non-conformity raised during a QMS audit is a different instrument with its own correction and corrective action requirements. Read the letter’s own definitions — terminology varies between Notified Bodies.

Major versus minor, and why the clock matters

Major findings typically block certificate issuance until resolved. Response windows are set by the individual Notified Body rather than by the Regulation itself, and they are often tight. Diarise the deadline on day one, and if the remediation genuinely requires new data, request an extension early rather than missing the date silently.

The Most Common CER Deficiencies Under EU MDR

1. Claims that outrun the evidence: The data supports a narrower population or indication than the IFU claims. The gap is usually between marketing language and what the evidence demonstrates, including claims implicit in the intended purpose.
2. Equivalence claims that don’t hold up: Annex XIV Part A(3) requires technical, biological and clinical characteristics to be sufficiently similar that there is no clinically significant difference in safety and performance. Comparison tables asserted without justification, or equivalence claimed without the Article 61(5) data access arrangements, are routinely rejected.
3. A literature search that can’t be reproduced: Missing databases, undefined search strings, no inclusion and exclusion criteria, or an unstated appraisal method. If the reviewer can’t repeat your search, they can’t verify your conclusion.
4. State of the art treated as background: State of the art is the benchmark your device is judged against, not scene-setting. Findings arise where it is absent, where it fails to define which safety and performance parameters evidence-based medicine expects to see measured, or where clinical risks are not defined against the current standard of care.
5. Traceability that breaks down: Benefit-risk conclusions that don’t link back to specific GSPRs or to hazards in the risk management file. The same weakness shows across documents: claims in the CER that never appear in the CEP, or residual risks handled in one file and ignored in the next.
6. A PMCF plan that doesn’t close the loop: The CER identifies residual uncertainties, and the plan fails to address them; MDCG 2020-7 shows what a defensible one looks like. The mirror image is just as common — post-market data collected but never fed back into the CER, despite the Article 61(11) duty to keep it current.

One trap sits alongside these: usability data. Human factors work under IEC 62366-1 is essential for GSPR 5, but it is not clinical data within the meaning of Annex XIV. Offering it in place of clinically relevant endpoints or leaving use-related risks untraced through the evaluation, attracts findings.

A Note on Article 61(10) Justifications

If you have argued that clinical data is not appropriate, expect a distinct line of questioning. Article 61(10) is unavailable for implantable and Class III devices, and the justification must rest on risk management output, the device-body interaction, intended clinical performance and your claims. Findings cluster predictably:

• Restating the Article’s wording without working through each criterion
• Invoking 61(10) because clinical data is scarce, absence of data is not the same as data being inappropriate
• Presenting clinical data that materially supports conformity, at which point 61(10) no longer applies
• Not showing how non-clinical testing supports conformity with GSPR 1 and 8
• No PMS plan or general PMCF activities, or specific PMCF proposed without a rationale

Article 61(10) is a positive argument that clinical data is the wrong tool for this device, not a fallback for when the data is less.

A Step-by-Step Response Process

Figure 1: Responding to a Notified Body CER deficiency letter under EU MDR.

Step 1 — Decode before you draft: Map each finding to the exact clause behind it — Article 61, an Annex XIV requirement, a GSPR, or an MDCG section. If you can’t identify the requirement, request a clarification call rather than guessing.

Step 2 — Root-cause each item: Is this a documentation gap, where the evidence exists but is poorly presented, or an evidence gap, where the data does not exist? The first is fixed by restructuring. Evidence gaps cannot be written around, and attempting it is the most common reason a finding is reissued.

Step 3 — For evidence gaps, choose deliberately: Either generate data through PMCF or a clinical investigation under Annex XV or narrow the intended purpose and IFU claims to what your evidence supports — often the faster route.

Step 4 — Build one controlled package: A response matrix addressing each finding individually, the revised CER with a clear revision history, and consistent updates to the IFU, risk file, PMS and PMCF documents.

Step 5 — Submit, then manage the cycle: Expect follow-ups. Keep one version-controlled thread so the reviewer can trace every change.

Mistakes That Turn One Finding into Three

• Rewriting sections without version control, so the reviewer can’t see what moved
• Answering with argument where the reviewer asked for evidence
• Leaving the IFU, risk file or PMCF plan inconsistent with the revised CER

Bring in outside input when a finding challenges your equivalence strategy, when remediation implies new clinical data, or when the same deficiency is reissued. A second reviewer who reads the file the way a Notified Body does is cheaper than another assessment round.

Need support responding to a CER deficiency letter? Celegence’s EU MDR experts can help assess findings, identify the most effective remediation path, and develop a comprehensive response strategy aligned with current regulatory expectations.