EU MDR QMS

For devices other than investigational devices, Article 10(9) requires the manufacturer to run a documented QMS that covers the parts of the organisation dealing with quality of processes, procedures, and devices. The system must be proportionate to the risk class and type of device, so a low-risk Class I device and a high-risk implantable device should not have identical review depth, evidence gates, or management escalation.

The Article 10 list is the minimum map for the QMS. It includes regulatory compliance strategy, conformity-assessment and change-management procedures, general safety and performance requirements, management responsibility, resources, supplier and subcontractor controls, risk management, clinical evaluation and PMCF, product realisation, UDI verification and registration consistency, PMS, stakeholder communication, vigilance reporting, CAPA effectiveness, output monitoring, data analysis, and product improvement.

The MDR duty and a standards-based certification are related but different. Article 10(9) creates the manufacturer's legal QMS duty. Under Article 8, voluntary use of a harmonised standard whose reference is published in the Official Journal can create a presumption of conformity for the requirements the standard covers. A certificate to a quality standard does not by itself prove compliance with every MDR duty, device, or current technical-documentation record.

The QMS should make design and manufacture traceable from intended purpose through requirements, hazards, risk controls, verification, validation, labelling, release, and service provision. Article 10 requires devices to be designed and manufactured in accordance with MDR requirements, while Annex I treats risk management as a continuous lifecycle process.

Clinical evaluation cannot sit outside the quality system. Article 10 points to Article 61 and Annex XIV, which require a documented clinical evaluation and PMCF. The QMS should therefore define when clinical evaluation plans, clinical evaluation reports, PMCF plans, PMCF evaluation reports, risk files, claims, instructions for use, and technical documentation are updated together.

Article 83 makes post-market surveillance an integral part of the Article 10 QMS. The QMS should specify how complaints, service data, trend signals, user feedback, literature, registry data, clinical follow-up, distributor information, and field data are gathered, analysed, escalated, and used to update risk management, clinical evaluation, labelling, technical documentation, and product improvement.

Vigilance needs a separate reporting workflow with intake triage, causal-assessment records, serious-incident decisions, field safety corrective action decisions, field safety notices, authority communication, notified-body communication where applicable, and CAPA linkage. UDI and EUDAMED controls should verify Basic UDI-DI and UDI-DI assignments, device-registration data consistency, and the data used in certificates, declarations of conformity, labels, technical files, and EUDAMED submissions.

A QMS record set should let a notified body or competent authority reconstruct the manufacturer's decisions without relying on staff memory. Article 10 requires current technical documentation, an EU declaration of conformity after the applicable conformity assessment, UDI and registration compliance, and long-term availability of the technical documentation, declaration, and relevant certificates.

For conformity assessment, keep the QMS evidence tied to the device or device group under review: scope and classification rationale, regulatory strategy, design history, manufacturing controls, supplier files, risk-management file, clinical evaluation file, PMS plan and outputs, vigilance file, UDI records, EUDAMED records, CAPA logs, management-review records, internal audits, change-control records, notified-body submissions, and certificate conditions.