Device Risk Classification — Why It Determines Everything Else

Medical device risk classification does for materiovigilance exactly what seriousness classification does for conventional drug case processing in Module 6: it’s not a passive description, it’s the input that determines what regulatory obligations actually apply from that point forward. Under the EU Medical Device Regulation (Regulation (EU) 2017/745), devices are sorted into four risk tiers — Class I (low risk), Class IIa (low-to-medium risk), Class IIb (medium-to-high risk), and Class III (high risk) — with FDA’s parallel Class I/II/III system covering broadly similar ground under different specific criteria.

The classification itself isn’t simply "how bad would it be if this failed" — it’s based on a defined set of factors including how long the device is in contact with the body, how invasive it is, and whether it’s an active device that uses an energy source (electrical, mechanical) to function, among other criteria. A non-sterile examination glove or a pair of reading glasses sits at Class I — minimal invasiveness, no active energy source, brief or no meaningful body contact. A hearing aid or non-invasive diagnostic ultrasound device sits at Class IIa. An infusion pump or ventilator, actively delivering something into the body with real potential for serious harm if it malfunctions, sits at Class IIb. And a cardiac pacemaker or an implantable neurostimulator — long-term, invasive, active, life-critical — sits at Class III, the highest tier.

That classification cascades directly into two distinct sets of obligations, mirroring the risk-proportionate logic this course has built repeatedly since Module 9’s risk minimisation content. Pre-market, higher-class devices require substantively more rigorous conformity assessment — Class I devices can typically be self-certified by the manufacturer, while Class IIa, IIb, and III devices require increasing levels of independent Notified Body review of technical documentation and clinical evidence, with Class III requiring the most extensive review of all. Post-market, that same risk gradient determines the intensity of ongoing vigilance obligations — how much surveillance data has to be actively collected, how quickly incidents have to be reported, and how detailed the post-market surveillance plan has to be.

Understanding this classification precisely matters for the same reason understanding seriousness classification precisely mattered in Module 6: a PV professional who treats "it’s a medical device" as one undifferentiated category will misjudge both the regulatory stakes and the appropriate response to an incident. A Class I device incident and a Class III device incident aren’t just different in severity — they sit inside genuinely different regulatory obligation structures, which is exactly what Lesson 14.9’s reporting-pathway content builds on directly.