What does an MDR audit check?

MDR Annex IX · Article 44–53 (NCA market surveillance) · Article 93–95

NB audit types

• Initial certification audit: Full QMS audit + technical documentation assessment for one or more representative devices; results in issuance (or denial) of EU certificate
• Surveillance audits: Annual QMS audits to confirm ongoing compliance; may include spot checks on technical documentation
• Unannounced audits: MDR Annex IX requires NBs to conduct unannounced factory inspections; manufacturers must cooperate
• Follow-up audits: After significant changes (design change, new product, serious incident) or to close out findings from a prior audit

Most common MDR audit findings

• Incomplete GSPR checklist: Requirements listed but not linked to specific evidence documents; "N/A" stated without justification
• CER not current: Clinical Evaluation Report not updated per required cycle; literature search cutoff more than 12 months old for Class IIb/III
• PMS plan exists but no evidence of data analysis: Plan documents the process but the actual analysis records (trending, PSUR data) are absent
• SOUP register missing or incomplete: For software devices — no record of third-party libraries, or no anomaly evaluation
• Software classification not documented: Rule 11 applied informally; no written classification rationale with Annex VIII rule reference
• Labelling non-compliant: Missing MDR-mandated symbols, missing UDI on label, IFU not updated
• Design changes not assessed for significance: Software updates made without an MDCG 2020-3 significance assessment

How to prepare — readiness checklist

• GSPR checklist maps each requirement to a specific evidence document or test report
• CER is current (literature search within required cycle for device class)
• PMS Report or PSUR generated for current period, with evidence of data analysis
• Risk management file complete and linked to clinical evaluation conclusions
• Software classification documented with Annex VIII Rule 11 rationale (if applicable)
• IEC 62304 software lifecycle records available (if software device)
• Labelling reviewed against MDR Annex I Chapter III requirements
• EUDAMED registration complete (actor, device, UDI)
• PRRC designated and qualifications documented

NCA market surveillance — how it differs from NB audits

National Competent Authorities (e.g. BfArM in Germany, ANSM in France, MHRA in UK) conduct market surveillance independently of Notified Bodies. NCAs can:

• Request access to full technical documentation without notice
• Conduct inspections at manufacturer premises
• Order recalls, withdrawals, or market restrictions if a device is found non-conforming or presents a safety risk
• Impose financial penalties for regulatory non-compliance

NCAs also investigate serious incident reports and coordinate across EU member states through EUDAMED and the MDCG (Medical Device Coordination Group) network.

Frequently asked questions

What should I expect during an unannounced audit?

An unannounced audit (Annex IX Section 3.4) means the NB arrives at your manufacturing or office site without prior notice, during normal business hours. They will review manufacturing records, QMS procedures in practice, and may request production of recent batch records or complaint files. You must cooperate. Refusing access is a serious non-conformity.

What is the difference between a critical finding and a minor finding?

A critical (major) finding indicates a systemic failure or direct patient safety risk — it typically triggers suspension of certification or certificate withdrawal if not resolved within the required timeframe. A minor finding is a gap that does not immediately threaten safety but requires correction within the agreed schedule. Multiple minors in the same area may be upgraded to a major.

How do I respond to an NB audit report with findings?

The NB audit report will specify the finding classification, the evidence cited, and the required corrective action timeframe. You must provide a root cause analysis (not just the correction), a corrective action plan, and evidence of implementation. Superficial responses without root cause analysis are typically not accepted.