1. Existing law keeps manufacture and use inside one legal person

Article 5(5) is an exemption with a retained safety core, not a regulatory absence. Under the MDR, a device manufactured and used within a Union health institution is treated as having been put into service. Most requirements of the Regulation then fall away only if the applicable Annex I requirements and every condition in Article 5(5) are satisfied. The IVDR follows the same structure, with additional provisions concerning medical-laboratory competence and the documentation of class D devices.Footnote ⁷ The present point (a) is categorical: the device may not be transferred to another legal entity. Point (b) places manufacture and use under appropriate quality-management systems. Public identification, authority access, technical documentation, manufacture in accordance with that documentation, review of clinical experience and necessary corrective action complete the parts relevant here.Footnote ⁸

That arrangement matters for a reason easily missed when Article 5(5) is read as a checklist. The rule does not have to design a message path between independent institutions because its boundary condition prevents that separation. A hospital may divide technical, clinical and governance work among departments, sites and laboratories, yet the legal person remains able to prescribe internal authority and escalation through one institutional system. Whether a particular network is one legal person is a factual and national-law question; a shared brand, common procurement system or regional label does not answer it. MDCG 2023-1 therefore treats manufacture and use within the same health institution as a condition of the current exemption and advises institutions to examine the legal-entity boundary.Footnote ⁹

Within that single-person arrangement, the binding safety logic is continuous rather than episodic. Annex I describes risk management as an iterative process throughout the device lifecycle, with systematic updating. Software must be developed and manufactured with attention to its development lifecycle, risk management, information security, verification and validation. IVD performance remains tied to intended purpose, and devices used with other products must retain safe compatibility and interoperability.Footnote ¹⁰ Article 5(5)’s direction to review experience and take necessary corrective action sits within that retained Annex I setting. MDCG 2023-1 reads device identification as capable of forming part of a tracking system for affected products and patients; it also places lifecycle risk management, monitoring and corrective action within an appropriate in-house QMS. Kahles and colleagues describe one pathology service’s implementation of device-specific IVDR Annex I requirements. Straathof and colleagues report an MDR Article 5(5) development case in which applicable Annex I requirements were checked through risk analysis and verification of a patient-tailored brachytherapy applicator and associated software. In an EFLM joint opinion, Vanstapel and colleagues argue that ISO 15189 can be a sufficient instrument for compliant in-house manufacture; MDCG 2023-1 cautions that ISO 15189 alone does not establish an appropriate QMS covering all manufacturing and relevant Annex I requirements.Footnote ¹¹ These accounts do not yet allocate safety tasks across two legal persons.

Below the Union text, national implementation shows how much operational content may exist. Portugal, for example, requires a notified in-house MDR device to sit within a QMS covering design, manufacture, control, release, internal distribution, use and traceability, and requires a system for recording and analysing clinical-use experience.Footnote ¹² Release and internal distribution can thus be stated expressly, but no Union-wide recipient duty follows from one national rule.

2. The proposed text opens the boundary but stops at information exchange

COM (2025) 1023 would replace the present prohibition with a qualified permission. A device could be transferred to another health institution where the move is duly justified by public health, patient safety or patient health, or where it prepares for or responds to a public-health emergency. In both regimes, transferor and recipient would have to maintain device traceability, and the recipient would report any incident related to the device back to the transferor.Footnote ¹³ All of this remains proposed text. Procedure 2025/0404(COD) remains ongoing; a Council progress report dated 5 June 2026 records continuing article-by-article examination and the need for further work on several parts of the package.Footnote ¹⁴

Two textual changes sharpen the enquiry. For the MDR, the Commission proposes a new documentation formulation and deletion of point (g), which obliges the institution to ensure manufacture according to the point (f) documentation; for the IVDR it narrows the documentation arrangement and deletes the counterpart point (h). Remaining Annex I, QMS and corrective-action duties should prevent an exaggerated reading of these deletions. Even so, the express sentence tying the manufactured instance to its documentary baseline would disappear just as the law begins to tolerate movement to a separate user institution. Traceability is added, but its unit is left unstated: family, design revision, software build, reagent lot and individual printed article can each be “the device,” and only some levels let a later safety instruction reach the affected object.

Alongside those textual changes, the surrounding eligibility conditions would also shift asymmetrically. The MDR would retain point (c), coupled with a maximum ten-year continuation after a market device can meet the target group’s needs; the IVDR would delete its present equivalent-device condition in point (d). The IVDR proposal would also extend Article 5(5) to specified clinical-research laboratories.Footnote ¹⁵ Those broader changes are not evaluated here; the analysis assumes that a particular transfer satisfies every threshold condition in the final regime.

Presenting the reform as simplification, the Commission’s evaluation does not specify a recipient-side use-stop procedure for an Article 5(5) transfer. In the related debate, Cobbaert and colleagues, writing for the EFLM, favour more flexible in-house IVD arrangements while retaining essential safety and performance safeguards.Footnote ¹⁶ The proposal states a justified transfer, traceability at both institutions and an incident message back, but not the intervening control states or the closing event.

A defined-term question nevertheless remains. “Incident” in Article 2 is framed by reference to a device made available on the market. Some qualifying transfers may themselves satisfy “making available,” which extends to supply in the course of a commercial activity whether for payment or free; others may not.Footnote ¹⁷ The proposal does not specify whether its Article 5(5) duty uses incident only within that Article 2 scope or as a route-specific trigger. The central conclusion does not depend on the answer: even a valid backward incident report is not a forward instruction, local execution duty or closure record.

3. Recall is the comparator, not the governing classification

Ordinary recall law provides a demanding comparison. The MDR defines recall as a measure aimed at obtaining the return of a device already made available to an end user; the IVDR uses the same structure. A field safety corrective action is action by a manufacturer, for technical or medical reasons, to prevent or reduce serious-incident risk associated with a device made available on the market.Footnote ¹⁸ Chapter VII then connects manufacturer investigation, competent-authority assessment, a field safety notice, correct device identification and instructions to users. MDR Article 89(8) and IVDR Article 84(8) require the notice to identify the device, explain the risk and state the user action.Footnote ¹⁹

None of this may simply be declared applicable to the exempt route. Article 5(5) disapplies the Regulation apart from the relevant Annex I requirements once its conditions are met. The defined market event, the economic-operator structure and the manufacturer-centred vigilance procedure therefore cannot be imported wholesale merely because a hospital needs to retrieve or correct a device. MDCG 2023-3 Rev.2 illustrates why the comparison remains valuable: its non-exhaustive FSCA examples include return, exchange, modification, destruction, changed maintenance or calibration advice, training, software update or rollback, patient or sample retesting and review of earlier results.Footnote ²⁰ These examples demonstrate that a safety correction is not synonymous with physical return. They remain market-route guidance.

That negative boundary finds confirmation in the Commission’s 2025 post-market-surveillance guidance. MDCG 2025-10 expressly excludes the Article 5(5) health-institution requirements from its scope, although it recalls that institutions are expected to review in-house use experience and take necessary corrective action.Footnote ²¹ A transferred in-house device therefore needs a functional counterpart to recall: one able to stop use and account for the affected object without converting the transfer into an ordinary placing-on-the-market event by analogy.

Read in context, the new incident sentence does more than exchange data: its express cross-reference to point (h) or (i) supports an inference that the transfer side must use the report in experience review and corrective action. That is the strongest textual answer to this article, and it remains incomplete. Point (h) or (i) names “the health institution”; traceability does not say which institution decides, which must implement, or what follows from silence. A QMS or transfer agreement can implement those duties but cannot settle the statutory trigger, competent-authority allocation or an unrecorded downstream recipient’s obligations. Table 1 separates the stated elements from the unresolved execution points.

Table 1.

Textual basis and unresolved execution point.

Table 1. Long description

A table with three columns and eight rows. The columns are labeled ‘Element’, ‘Legal basis’, ‘What the text establishes’, and ‘What the text does not establish’. Row 1: Annex I safety baseline, Current MDR and IVDR Art. 5(5), Applicable general safety and performance requirements remain binding for a qualifying in-house device, No named cross-entity command and acknowledgment route. Row 2: Appropriate quality management, Current Art. 5(5)(b), Manufacture and use occur under appropriate quality-management systems, No stated interface between the systems of two legal entities. Row 3: Experience review and corrective action, MDR Art. 5(5)(h); IVDR Art. 5(5)(i), The health institution reviews clinical-use experience and takes necessary corrective action, No actor allocation after transfer, response deadline or closure condition. Row 4: Limited transfer ground, Proposed replacement of point (a), A transfer to another health institution may preserve the exemption where the stated ground is met, No present transfer entitlement, general authorisation procedure or onward-transfer rule. Row 5: Bilateral traceability, Proposed new sentence in Art. 5(5), Transferor and recipient maintain traceability of the device, No prescribed grain for family, release, lot, instance, endpoint or deployment. Row 6: Incident information, Proposed new sentence in Art. 5(5), The recipient reports a device-related incident to the transferor, No timing, required content, confirmation, forward safety instruction, non-response rule or completed-action evidence. Row 7: Production-documentation link, Current MDR Art. 5(5)(g) and IVDR Art. 5(5)(h); proposed deletion, Present law expressly links manufacture with the relevant documentation, The proposal does not state how release drift is controlled after the sentence is removed. Row 8: Public device identity, Current Art. 5(5) declaration duties and national practice, A public administrative object may be named or described, Public identity does not by itself identify the transferred release, local deployment or post-action state.

This article assumes that both entities meet the applicable health-institution definition, manufacture remains non-industrial and every amended Article 5(5) threshold is satisfied. A non-qualifying supply may instead engage the ordinary market regime; its classification under Article 2 is outside the enquiry. Legislative developments are stated as at 26 July 2026; online sources were otherwise last accessed on 14 July 2026. The file remains open in the ordinary legislative procedure.

1. The object must be fixed at release

Traceability answers a question only after its object has been selected. A record stating that “the assay” travelled from institution A to institution B supports administrative history while remaining useless for a correction affecting reagent lot R17 on instrument configuration C3; the same defect appears where “the software” covers three builds, one locally patched instance and a remote model whose parameters changed without a new interface version. A closed-loop chain therefore begins with a controlled release identity: the smallest stable description that lets both institutions decide whether a later safety instruction concerns the deployed object.

This term is an analytical proposal, not vocabulary found in Article 5(5). Its legal support is indirect. It rests instead on what several provisions presuppose. Annex I requires lifecycle risk management and safe performance, which cannot operate on an object the institution is unable to delimit; the public declaration must carry the details needed to identify the device; present Article 5(5) ties manufacture to technical documentation; and MDCG 2023-1 associates identification with tracking affected products and patients.Footnote ²² None of those sources expressly prescribes a release hash, lot hierarchy or recipient deployment key. The inference is functional: corrective action cannot be directed at an affected instance if the institutions cannot distinguish it from unaffected instances.

Commercial UDI materials supply a useful design analogy, not a hidden duty for exempt devices. The MDR and IVDR establish UDI systems for devices within their ordinary structures; Commission Implementing Decision 2019/939 designates issuing entities. MDCG materials distinguish the Basic UDI-DI from the device-specific UDI-DI, discuss changes that trigger a new identifier and place UDI governance inside the organisation’s QMS.Footnote ²³ The point is not that an in-house transfer must carry a UDI. Rather, the established system shows why family identity and production identity perform different work.

For the same reason, release identity must remain modality-sensitive. A physical instrument may require model, design revision, serial or batch, component state and manufacture date. For software, product name alone is rarely enough; version, build, validated configuration, dependencies and an immutable digest where technically suitable can matter. MDCG 2018-5 recognises that software identification turns on version changes, while the current software-qualification guidance separates medical-device software from software performing only storage, communication or simple search.Footnote ²⁴ An assay may need method revision, reagent and calibrator lots, instrument settings and analytical acceptance limits. A patient-matched printed article may require the design revision, patient-input link, printer, material lot, build parameters and post-processing state. IMDRF’s production-verification document for personalised medical devices provides a non-Union technical comparator for that last problem.Footnote ²⁵

2. Acceptance is a recorded state, not a delivery receipt

Once the object is fixed, the recipient must decide whether that release can be used in its own environment. This proposed acceptance stage is narrower than a conformity assessment and wider than proof of delivery: the record covers the received release, local infrastructure, interfaces, storage and handling, authorised use, user competence, validation result and any restrictions. A refusal or conditional acceptance is legally intelligible; silent installation is not a useful control state.

That distinction matters most for software and IVDs. MDCG 2023-4, addressing medical-device software used with hardware, calls for verification and validation of compatibility and interoperability across intended configurations and for communication mechanisms concerning changes and incidents.Footnote ²⁶ MDCG 2020-1 likewise treats valid clinical association, technical performance and clinical performance as distinct parts of software evaluation.Footnote ²⁷ Those documents concern ordinary regulatory settings and do not create a transfer-acceptance duty. They do, however, refute the idea that safe use follows from file identity alone.

At this stage, the private record must also make the release addressable. Addressability means that a safety instruction can reach every authorised deployment and that each deployment can return an execution status. Recipient legal identity is only the beginning. Beneath it lie the levels at which an instruction actually lands: site and department, then the instrument or software endpoint, then the stock location, and, where proportionate, the affected patient, specimen or result. Personal data should be stored only where needed and on a lawful basis; Article 5(1)(c) GDPR requires data minimisation, while health data receive the protection of Article 9.Footnote ²⁸ The recommendation is therefore a linkable custody record, not an indiscriminate central patient list.

3. Change control preserves the meaning of traceability

A release identity becomes false if either institution changes the object while leaving the identifier untouched. Change control is thus no ornamental QMS entry; it preserves the proposition that the traced item remains the item assessed. The chain should distinguish an administrative correction, a technical change within the same release, a new release requiring acceptance, a safety correction requiring temporary cessation, and a recipient alteration amounting to modification or local manufacture. The converse rule matters equally. A change of supplier reference, internal document number or local label alone creates no new controlled release, and no institution may discharge an outstanding instruction by renaming what it holds.

Software makes the problem visible. A dependency patch may leave the intended purpose untouched but alter cybersecurity exposure. A model update may change output behaviour without changing the user interface. A receiver-side configuration script can make the deployed system differ from the transferor’s validated build. MDCG and IMDRF materials treat security as lifecycle work, including communication, security-issue management and updates. Landman and colleagues documented a browser update that disrupted the link from an emergency-department tracking board to the radiology image viewer. Jabin’s case report describes a patient-monitoring patching tool that signalled completion although about half the centres or clients patched the previous day still required a restart the next morning. Neither account concerns an Article 5(5) transfer or establishes patient injury; both show why the deployed clinical state must be checked after an update.Footnote ²⁹ A software bill of materials can identify affected dependencies; it does not allocate legal responsibility.

Change control also determines whether the original transfer remains the right legal description. MDCG 2023-1 treats manufacture broadly enough to include production from raw materials or components and combinations that create a new device; it separately states that a shared written protocol is not a device.Footnote ³⁰ If the recipient substitutes a reagent, changes a design file or rebuilds software, the legal result depends on what changed, the intended purpose and the resulting product. No universal answer follows; the classification depends on what was transferred and on the conditions the receiving institution can meet. The record must instead expose the change so that the classification can be made on the facts.

4. An incident report is a trigger, not a completed response

Read at its exact level, the proposed recipient-to-transferor report moves information from the institution observing use to the institution associated with transfer, and no further. The sentence states no reporting period, required content, receipt confirmation, risk-classification method, authority route or fallback where the transferor is silent. Nor does it say that the recipient must wait before protecting its patients. These are omissions from the proposed interface, not proof that no other legal or professional duty applies. Those duties run within each institution rather than between them, and none of them generates a release-specific instruction that the other institution must acknowledge.

A workable trigger should carry the time, affected release, observed failure or result, immediate clinical consequence, evidence preserved and local interim measure. On receipt, the transferor needs to identify the controlled baseline and assess whether the signal concerns one deployment, every copy of a release, a component used across releases, or a recipient-side change. The ordinary vigilance framework offers a disciplined comparison, because it sequences what the proposal leaves unordered. Manufacturer awareness starts the reporting period. Investigation follows, competent authorities may intervene in it, and evidence in the device or batch must not be altered in a way that frustrates it.Footnote ³¹ Those provisions are not treated here as directly applicable to an exempt transfer. Their value lies in revealing the procedural questions left unanswered when the proposal says only that an incident is reported to the transferor.

Urgency changes sequence, not the need for control. Where continued use may expose patients to serious harm, the recipient must be able to suspend local use before the transferor completes root-cause analysis. Conversely, a technically informed transferor may detect a cross-recipient defect before any recipient reports an incident, yet the proposal contains no express forward safety-notice duty. An interface built only around backward incident information is reactive by design. The retained lifecycle duty gives an interpretive reason to communicate a discovered risk, but the obliged sender and the recipient’s response should be stated rather than assumed.

5. Use stops only when receipt becomes execution

A use-stop instruction should contain at least six elements: the affected release identity; the hazard and degree of urgency; the action to stop or restrict use; the evidence or item to preserve; any patient, specimen or result review; and the conditions, if known, for return to use. This is a recommendation. It draws by analogy from the content logic of MDR Article 89(8), IVDR Article 84(8) and the action range collected in MDCG 2023-3 Rev.2.Footnote ³² Electronic instructions can support rapid distribution, but availability is not reception. Even the ordinary electronic-instructions regime retains rules about access, version history and provision of paper information in specified circumstances.Footnote ³³

Acknowledgement closes that evidential gap. The recipient records when the instruction arrived, when access or use was blocked, which locations and instances were checked, what remained unresolved, and whether another institution had received the device. A response of “received” is inadequate if it does not state execution; equally, a transferor’s outgoing email log cannot establish that a diagnostic workflow ended or a remote instance was disabled. The proposed chain therefore separates instruction, receipt and execution as different states.

Beyond execution, remediation is modality-specific. Physical stock may be quarantined, returned or destroyed; software disabled, updated or rolled back; an assay suspended and earlier results reviewed. For an implanted or patient-matched article, removal may be clinically worse than surveillance. Ordinary FSCA examples and IMDRF legacy-device guidance recognise that range.Footnote ³⁴

In the proposed lifecycle, custody closure requires an auditable account of every affected instance, including any open exception. That account should record whether access is blocked, corrected or expressly released; whether downstream recipients have responded; whether necessary patient or result action is recorded; and whether return, destruction or replacement is documented. Closure should allow stated exceptions: a device retained for investigation, an unreachable endpoint or a patient for whom removal is contraindicated remains an open item rather than disappearing into a completed-case label. Controlled resumption needs a new or confirmed release identity and a recipient acceptance decision, without which a temporary stop can decay into undocumented reuse. Figure 2 assembles these states into a release-to-closure lifecycle.

Figure 2.

Author-proposed safety-handover lifecycle. Five gates test whether release, receipt, deployment, affected scope and execution can be resolved, matched, addressed, acted on and reconciled. The phases and gates are analytical recommendations, not conditions stated in COM (2025) 1023.

Alt text: Six phases run from release to closure. Five gates test the connecting record, while three lines require continuity of identity, authority and evidence.

1. Technical knowledge and clinical control are divided

After transfer, neither institution alone necessarily controls the whole event. The manufacturing institution holds the design history, production record and comparative signals across releases; a transferor that is not itself the manufacturer may instead hold the custody record and recipient contact while lacking full technical authority. The receiving institution controls local access, clinical workflow, users, specimens, result communication and immediate patient protection. A rule assigning the whole response to one side will often assign part of it to the actor least able to perform it.

Current Article 5(5) can refer simply to “the health institution” because point (a) prevents the legally relevant split. The proposal introduces “transferring” and “receiving” institutions only for traceability and incident reporting. It does not say whether the manufacturer and transferor must be identical, who owns the risk decision, or who tells the recipient to resume. Region Skåne’s official consultation response identifies responsibility allocation and post-market requirements as matters needing clarification, with software and shared medical infrastructure as concrete boundary problems.Footnote ³⁵ That response is not law. It confirms, however, that the ambiguity is perceived by a health-system operator rather than manufactured solely by doctrinal abstraction.

Allocated soundly, the response is concurrent and sequenced. On the transfer side, the institution controlling the manufacturing baseline assesses technical scope, links signals across recipients, issues a release-specific instruction and maintains the master correction record. Locally, the receiver triages the event, acts immediately where delay would expose patients, identifies deployments and affected clinical outputs, preserves evidence, executes the instruction and returns status. Neither role excludes competent-authority action under retained powers. The recommendation attaches a local control duty to the institution that actually permits use; it does not make the recipient a commercial manufacturer.

This minimum public-law allocation does not determine civil liability, professional discipline, contractual indemnities or data-controller status.

2. Silence, disagreement and non-response need a rule

The simple case is cooperative: the recipient reports a signal, the transfer side evaluates it, both agree on suspension, and every affected instance is located. A legal interface should be drafted for the harder cases. The transferor may regard the event as local misuse while the recipient suspects a release defect; the recipient may continue use because no substitute exists; contact details may be obsolete; a weekend emergency may arise before either governance committee can meet.

For immediate local risk, the recipient should have authority to suspend or restrict use without prior permission. That recommendation follows from control over the clinical setting and the retained Annex I baseline; it is not an express sentence in the proposal. The transfer side should then be informed and given the evidence needed for a wider assessment. Where the transferor issues a safety instruction, the receiver should either execute it or document a reasoned clinical exception with compensating measures and competent-authority escalation; an unreasoned refusal would break the chain.

Non-response should produce timed escalation rather than repeated informal messages. The final act could require current emergency contacts and acknowledgment within a risk-based period, leaving exact periods to subordinate material. Where acknowledgment does not arrive, the transferor should notify the relevant competent authority or authorities and the recipient’s designated governance contact.

A cross-border transfer sharpens the same defect. Two national competent authorities may each hold inspection and restriction powers, yet the proposal assigns the exempt route no coordinating function. Ordinary vigilance law constructs that coordination expressly, obliging authorities to coordinate their assessments where a serious incident or a proposed field safety corrective action touches more than one Member State, under a coordinating authority anchored by default to the manufacturer’s registered seat. That anchor does not translate. Two health institutions in different Member States have no manufacturer’s seat to locate, and a bare traceability sentence supplies no substitute.Footnote ³⁶

1. Software: correction without physical return

Institution A transfers build 4.2 of an in-house decision-support application to institutions B, C and D. The release passed local acceptance at all three. B later changed a configurable threshold; C installed build 4.2 on two virtual machines but retained build 4.1 for a specialist workflow; D allowed authenticated remote use by a separate legal entity. A then finds that build 4.2 can suppress a warning when a particular data field is null.

A family name cannot determine the affected population. Version alone may also fail because local configuration and dependencies can alter performance. Medical-software traceability literature accordingly treats version, machine and operating environment as separate identifiers, while Prictor’s work on clinical decision support distinguishes the availability of a correction from its implementation by the user.Footnote ³⁷ The release key in this example would have to resolve build 4.2 and any configuration relevant to the defect. The deployment record would identify each endpoint and the legal entity controlling it.

Return is the wrong physical model. Depending on risk and technical feasibility, local execution may mean disabling access, restoring a validated earlier build, applying a corrected build, changing a configuration, or restricting the intended use while a correction is assessed. Work on software-related device recalls shows why software faults may demand action even where no tangible product is collected.Footnote ³⁸ Closure would require a response for every affected endpoint, including the remote deployment at D’s downstream institution. A statement that three recipients received an email proves neither that four relevant deployments were found nor that each changed state.

AI-enabled devices need a further boundary. The proposal would move the Regulations from Section A to Section B of AI Act Annex I, limiting that Act through its Article 2(2). That move has not been made: the Digital Omnibus on AI, adopted in July 2026, effected the same transfer for machinery alone and left the medical-device entries in Section A. Device law and the AI Act therefore remain parallel regimes, subject to the AI Act’s phased application: the high-risk requirements in Chapter III, Sections 1–3, for systems within Article 6(1) and Annex I apply from 2 August 2028. Even so, in-house software will not always be AI, meet Article 6(1)’s condition or fall within Annex III, and case-specific AI duties supply no general bilateral use-stop and acknowledgement route.Footnote ³⁹

2. Other modalities: assay, printed object and onward transfer

What holds for software holds, in different material, for the remaining transferable forms. Take an in-house IVD moved as a validated assay configuration, its handover record naming a method revision, instrument model, analytical software and specified reagents. During a shortage the receiving laboratory substitutes a reagent lot and recalibrates; results later disclose a bias confined to the combination of that substituted lot, one calibrator lot and one instrument software version. The affected object is a configuration rather than a name, and an instruction addressed to the assay alone would be at once too broad and dangerously narrow.

Additive manufacture divides the object again, and along a different seam. A hospital may send a finished printed device, disclose a design protocol, or provide a file from which the recipient manufactures its own object. These are not interchangeable events. MDCG 2023-1 distinguishes a written protocol from a product that meets the device definition; a transfer analysis must first identify what crossed the boundary.Footnote ⁴⁰ Hospital-makerspace research likewise reports both distribution of printed copies and disclosure of design files, illustrating the factual alternatives without deciding their legal classification.Footnote ⁴¹

Onward movement, finally, removes the addressee altogether. Institution A transfers a device to B; B later passes a physical unit, assay access or software credentials to C, a legal entity with which A has never dealt. An incident at B prompts A to instruct B to stop use. C receives nothing because it is absent from A’s record. Bilateral traceability between A and B is accurate yet incomplete for the affected population.

3. Emergency transfer: less time, not less identity

COM (2025) 1023 includes preparation for or response to a public-health emergency among the proposed grounds for a qualifying transfer.Footnote ⁴² Assume that a regional outbreak creates an immediate need for an in-house assay. The receiving institution cannot finish every local verification step before first use without defeating the clinical purpose.

Time pressure of that kind is the strongest objection to a detailed handover record, though not to the minimum chain, since urgency raises rather than lowers the cost of ambiguity. A staged acceptance can identify the provisional release, restricted intended use, authorised site, named contacts, unresolved local conditions, expiry or review time, and an immediate route to suspend use. Later steps may complete verification and reconcile instances created during the provisional period. The design does not treat emergency care as ordinary administration; it preserves the few facts without which a later correction cannot be directed.

1. The binding act should carry the operative core

The final amending Regulation should state the duties that determine whether a safety instruction crosses the institutional boundary: release-level identification; reciprocal communication of a safety signal, correction or restriction; recipient action with execution acknowledgment and any justified exception; and retention of transfer, action and closure records for competent-authority access.

Traceability alone, on the other hand, cannot supply these duties. Union product law separates identification, safety communication and user action: MDR Article 89(8) and IVDR Article 84(8) require the notice to identify the device, explain the risk and state what users must do. Article 5(5) needs a shorter chain across institutions, but the missing links are the same.

What follows is offered as a drafting core for discussion, not as finished legislative text. It is set out in the form the act itself would take, recital before enacting terms, so that each rule can be argued with:

Read against Table 1, each paragraph closes one of the gaps recorded there: paragraph 1 names the institution that must issue a release-specific instruction, paragraph 2 resolves the case in which manufacture and transfer are separated, paragraphs 3 and 4 place immediate protection and execution with the institution that controls use, paragraph 5 gives silence a consequence, and paragraph 6 makes closure visible to supervision.

The drafting is the author’s, and two points are left deliberately open. “Transferred release” needs a formulation broad enough for software builds, IVD configurations and patient-matched articles; “resumption of use” cannot authorise a transferor to override national clinical law. Legislative counsel would integrate both with the final structure of the Regulations.

Within that structure, the final act should distinguish transfer eligibility from continuing duties. A late acknowledgment or incomplete closure record should not leave the exemption’s retrospective status unclear. Supervision, remediation and any penalty should be proportionate while preserving urgent authority powers.

Likewise, the term “incident” requires repair. A short provision could state that, for Article 5(5), incident carries the Article 2 content whether or not the transferred device was made available on the market. An alternative is a route-specific term such as “safety event,” followed by criteria. Either is preferable to relying on an unexplained use of a market-linked definition, and any change must be made in binding text because it defines the trigger for a legal duty.

2. Delegated powers and common specifications are not a certain substitute

COM (2025) 1023 would confer power on the Commission to amend Annex I by delegated act in response to scientific or technical progress, international developments, emerging risks or technologies. Wider common-specification powers appear elsewhere in the instrument.Footnote ⁴³ As drafted, the new Article 5 power speaks to the general safety and performance requirements in Annex I. By its terms, the provision does not authorise the Commission to create a bilateral recipient acknowledgement duty, decide onward-transfer legality or reallocate Article 5(5) responsibility between institutions. The Council progress report records that several proposed delegations remain under legal scrutiny.Footnote ⁴⁴

Article 290(1) TFEU supplies the sharper reason. The Court treats as essential those elements whose adoption requires political choices balancing divergent interests. Recipient execution, clinical exception, escalation and non-response allocate safety responsibility between independent institutions and should be enacted by the legislature. Technical fields and formats may follow later.Footnote ⁴⁵

The operative core should therefore be enacted in Article 5(5). Common specifications may later detail Annex I within a valid legal basis, but cannot supply the missing addressee and consequence.

By contrast with the technical detail, that distinction is one of competence. Articles 114 and 168(4)(c) TFEU support a common product-safety interface, while Article 168(7) preserves Member-State responsibility for the organisation and delivery of care.Footnote ⁴⁶ The Union rule should identify the transferred release, safety message, acknowledgment and authority-accessible record. It should not determine the recipient’s clinical treatment decision, patient-management choice or internal allocation of staff and resources, which remain governed by applicable national law.

3. Guidance should specify the record, not invent the duty

Once the duties exist, conversely, MDCG guidance may supply the modality-specific handover, use-stop and closure forms. Examples may translate the common states into software builds and endpoints, assay configurations and testing windows, patient-matched production records or physical stock. The minimum fields are those of Figure 3; no modality-specific field should become universal where it has no technical meaning.

Figure 3.

Author-proposed minimum handover record and two-key use-stop rule. Closure requires the transferor’s affected-scope key to match the receiver’s execution key, with inventory and exceptions reconciled. The displayed fields are modality-sensitive recommendations, not wording stated in the Commission proposal.

Alt text: Three panels list minimum record fields, match transferor scope to receiver execution, and distinguish software, assay, printed-device and emergency identifiers. Closure requires matching keys and reconciled exceptions.

Response periods should be risk-based. Guidance may propose default windows and escalation templates, subject to national authority powers. Patient- or specimen-linked records must comply with GDPR purpose limitation, data minimisation, security and the rules for health data. A locally resolvable link may suffice; pseudonymisation remains processing and does not displace Articles 6 and 9, controller allocation or professional secrecy.Footnote ⁴⁷

4. A legal test for implementation

Judged properly, the proposed route is not tested by whether two institutions can produce a transfer document after the event. Its practical test is prospective and state-based: each stage must disclose whether it is complete, conditional or open. Can the transferor identify the exact release, has the recipient accepted it for a stated environment, and can every deployment be addressed? Does a material change produce a new status, can either side trigger an urgent stop, and does the recipient return execution evidence? Are unresolved instances visible, and is resumption or final disposal recorded?

Failure at one state should keep the chain open. A traceability record without a release key cannot support scoped correction; a notice without acknowledgment proves dispatch only; an acknowledgment without deployment reconciliation leaves unknown instances; destruction at B does not close custody if C received an onward copy. Figure 3 reduces the record to the two keys that must match, the transfer side’s affected scope and the receiver’s execution evidence, a test deliberately narrower than a QMS audit, asking only whether the legal bridge introduced by transfer can carry a safety decision to completion.

Adoption of that minimum would not turn health institutions into ordinary economic operators or impose the entire vigilance chapter on the exempt route. It would do something more exact: connect the retained Article 5(5) duties to the institutional separation created by the new exception. Transfer may then remain exceptional, purpose-limited and supervised, while the law acquires a route by which use can actually be stopped.