What does an MDR audit check?

Regulation (EU) 2017/745 · Article 52 · Annex VII · Annex IX · Article 93 — what the Regulation itself requires of an assessment

What the Regulation requires of the notified body — and therefore of you (Annex IX route)

Annex VII sets out what a notified body has to do; Annex IX sets out how the assessment of your quality management system runs. Both are requirements on the notified body — which is exactly why they are the only reliable statement of what will be looked at.

• The application has to contain, among other things, your QMS documentation, the documentation of your post-market surveillance system and the clinical evaluation plan — Section 2.1 of Annex IX
• Your QMS documentation has to describe, among other things, risk management as set out in Section 3 of Chapter I of Annex I, clinical evaluation under Article 61 and Annex XIV, and change management — Section 2.2 of Annex IX
• The audit is carried out against that documentation; where you apply a harmonised QMS standard, the notified body assesses conformity with that standard; for class IIa and IIb devices the technical documentation is sampled — Section 2.3 of Annex IX
• Planned substantial changes to the QMS or the device range have to be notified to the notified body, which assesses them and may audit — Section 2.4 of Annex IX
• Surveillance: you have to allow all necessary audits including on-site audits (Section 3.2); surveillance audits at least once every twelve months, including on-site audits (Section 3.3); unannounced audits at least once every five years, with samples of manufactured devices, on a plan that is not disclosed to you (Section 3.4); technical documentation sampled again during surveillance (Section 3.5) — all Annex IX
• During surveillance the notified body examines, among other things, your QMS documentation, findings from post-market surveillance and post-market clinical follow-up, and design data including the risk management solutions under Section 4 of Chapter I of Annex I — Section 3.1 of Annex IX
• Consequences of non-conformity: the certificate can be suspended, withdrawn or restricted — Section 3.7 of Annex IX; Section 4.10 of Annex VII
• The technical documentation assessment covers, among other things, the benefit-risk determination, risk management, the instructions for use, training, the post-market surveillance plan and the post-market clinical follow-up plan — Sections 4.4 to 4.7 of Annex IX
• The notified body's own duties include examining the interface between your risk management process and your assessment of the pre-clinical and clinical evaluation (Section 4.5.1 of Annex VII); auditing design and development, manufacturing controls, product documentation, purchasing, corrective and preventive action for post-market surveillance and post-market clinical follow-up (Section 4.5.2 (b) of Annex VII); surveillance audits at least annually, and short-notice or unannounced audits where vigilance information puts the certificate in question (Section 4.10 of Annex VII)
• Certificates run for at most five years; re-certification at least every five years — Sections 4.8 and 4.11 of Annex VII

What the Regulation requires you to keep in place — check your own file point by point

Each point names where the requirement is written, so you can read it instead of taking our word for it.

• A quality management system — established, documented, implemented and maintained; Article 10(9) lists what it has to cover, among it the identification of the applicable general safety and performance requirements (b), risk management (e), clinical evaluation (f), post-market surveillance (i), vigilance procedures (k) and corrective and preventive action (l)
• A risk management system as described in Section 3 of Chapter I of Annex I — Article 10(2)
• Technical documentation with the content of Annex II — the results of risk management and the benefit-risk analysis (Section 5) and the clinical evaluation report (Section 6.1 (c)) among it; the post-market surveillance part with the content of Annex III, including a plan with suitable indicators and threshold values for the continuous reassessment of the benefit-risk analysis (Section 1 (b))
• The technical documentation kept available for the competent authorities for at least ten years after the last device has been placed on the market, fifteen for implantable devices, and provided in full or as a summary on request — Article 10(8); after an Annex IX procedure, the same periods under Section 7 of Annex IX
• One benefit-risk determination — the one in your clinical evaluation and the one in your risk management file are the same — Sections 1 and 8 of Chapter I of Annex I, Article 61(1)
• Risk acceptability and risk control measures argued against the generally acknowledged state of the art — Sections 1 and 4 of Chapter I of Annex I
• Post-market surveillance findings evaluated against hazards, risks and the benefit-risk determination, and the technical documentation updated — Section 3 of Chapter I of Annex I, Article 83(3)
• The safety report for your class for the current period — the periodic safety update report for class IIa, IIb and III (Article 86), the post-market surveillance report for class I (Article 85)
• Every serious incident reported, and its investigation including a risk assessment — Article 87(1), Article 89(1)
• Software developed according to the state of the art, taking into account life cycle, risk management including information security, verification and validation — Section 17.2 of Chapter II of Annex I; classified against the rule that applies, for software Rule 11 in Section 6.3 of Chapter III of Annex VIII — the risk class and the justification for the classification rule(s) applied are part of the technical documentation (point (f) of Section 1.1 of Annex II)
• Evidence for each general safety and performance requirement — the technical documentation has to contain the information for the demonstration of conformity with the requirements of Annex I that apply to the device, with a justification, validation and verification of the solutions adopted: which requirements apply and why others do not (a), the method or methods used for each applicable requirement (b), the harmonised standards, CS or other solutions applied (c), and the precise identity of the controlled documents offering the evidence, with a cross-reference to where they sit in the full technical documentation (d) — Section 4 of Annex II
• Labelling and instructions for use in accordance with Chapter III of Annex I — Article 10(11)
• Registration, twice — of you as an economic operator: before placing a device on the market, and where a notified body is involved before applying to it, the information in Section 1 of Part A of Annex VI submitted to the electronic system (Article 31(1)); the competent authority issues a single registration number, which you use towards the notified body and in Eudamed (Article 31(2) and (3)); changes within one week (Article 31(4)); the data confirmed after one year and every second year thereafter (Article 31(5)) — and of the device: a Basic UDI-DI assigned and provided to the UDI database with the core data elements of Part B of Annex VI before placing on the market (Article 29(1)); the information in Section 2 of Part A of Annex VI entered or verified in Eudamed and thereafter kept updated (Article 29(4))
• A person responsible for regulatory compliance — at least one, within your organisation, with the expertise Article 15(1) requires; micro and small enterprises need not have that person within the organisation but must have such a person permanently and continuously at their disposal (Article 15(2)); that person is responsible at least for ensuring that the conformity of the devices is checked in accordance with the quality management system before a device is released, that the technical documentation and the EU declaration of conformity are drawn up and kept up to date, and that the post-market surveillance obligations and the reporting obligations under Articles 87 to 91 are complied with (Article 15(3))
• The clinical evaluation kept up to date — planned, conducted and documented in accordance with Article 61 and Part A of Annex XIV (Article 61(1)), with a clinical evaluation plan that is established and updated (Section 1 (a) of Part A of Annex XIV) and a systematic scientific literature review to identify the available clinical data and any gaps in clinical evidence (Section 1 (b)); the clinical evaluation and its documentation updated throughout the life cycle of the device with clinical data from the PMCF plan and the post-market surveillance plan (Article 61(11)); for class III and implantable devices, the PMCF evaluation report and, if indicated, the summary of safety and clinical performance updated at least annually (Article 61(11)); the clinical evaluation report part of the technical documentation (Article 61(12); Section 4 of Part A of Annex XIV)

Market surveillance is the authorities' job — post-market surveillance is yours

The Regulation keeps the two apart by definition: post-market surveillance (Article 2(60)) is what you, the manufacturer, do; market surveillance (Article 2(61)) is what the competent authorities of the Member States do. Article 93 sets out what that involves:

• Checks on the conformity of devices, including sampling, review of documentation and physical or laboratory checks — Article 93(1) and (3)
• Announced and, where necessary, unannounced inspections of the premises of economic operators — Article 93(3)
• Where a device presents an unacceptable risk, the authorities may take measures including seizure or destruction — Article 93(5) and (6); Article 94 governs the evaluation of such devices
• Your technical documentation, in full or as a summary, on request — Article 10(8)

Frequently asked questions

Does the Regulation provide for unannounced audits?

Yes, twice over. Under the Annex IX route the notified body has to carry out unannounced audits at least once every five years, taking samples of manufactured devices, on a plan it does not disclose to you (Section 3.4 of Annex IX) — and you have to allow all necessary audits including on-site audits (Section 3.2). Independently of that schedule, Annex VII requires the notified body to carry out short-notice or unannounced audits where vigilance information puts the certificate in question (Section 4.10 of Annex VII). The Commission may lay down a minimum frequency by implementing act (Article 52(14)(b)).

What happens if the notified body finds non-conformities?

The Regulation names the consequences, not the categories: a certificate can be suspended, withdrawn or restricted (Section 3.7 of Annex IX; Section 4.10 of Annex VII). It does not define "major" or "minor" findings — those labels come from audit practice, and we do not tell you how any one notified body applies them.

Where do I find what a notified body will focus on?

In Annexes VII and IX — that is the only source we cite. What any one notified body will focus on beyond what the Regulation requires of it is not something we will tell you; we do not know it.