EU Medical Device Regulation QMS and technical file

Treat each QMS process as the owner of a technical-file evidence stream. Article 10 ties together design and manufacture, risk management, clinical evaluation and PMCF, technical documentation, UDI and registration, PMS, vigilance, CAPA, supplier control, change management, and communication with authorities and notified bodies.

For each device or device family, the QMS should say who creates the record, who approves it, where the controlled evidence lives, and which Annex II or Annex III section it supports. That makes the technical file a live output of design control, PMS, complaint handling, risk review, and release decisions rather than a document assembled only for certification.

Annex II expects technical documentation to be clear, organised, readily searchable, and unambiguous. A useful evidence map therefore starts with the exact device identity and version, then traces each claim to design, manufacturing, verification, validation, risk, clinical, PMS, UDI, and label records.

Annex III turns PMS into technical documentation. The PMS plan should show how the manufacturer collects and uses complaints, incident data, field safety corrective actions, trend data, literature, registers, user feedback, distributor and importer feedback, and publicly available information about similar devices.

Article 10 requires manufacturers to take timely account of changes in device design or characteristics and changes in harmonised standards or common specifications used to declare conformity. Annex IX also expects QMS documentation to cover design and QMS change management and gives notified bodies a role in assessing substantial changes to the approved QMS or device range.

Change control should therefore start before implementation. The review should decide whether the change affects intended purpose, claims, design, risk controls, clinical evidence, software, materials, supplier controls, sterilisation, packaging, labels, IFU, UDI data, PMS thresholds, certificates, or the conformity assessment route.

For higher-risk conformity assessment routes, the notified body does not review a marketing summary. Annex IX describes QMS audits, representative technical-documentation sampling for class IIa and IIb devices, technical-documentation assessment for class III and certain class IIb devices, review of clinical evidence, and surveillance after certification.

The record should let a reviewer see that the QMS owns the evidence. That means roles, document control, supplier controls, design controls, PMS inputs, vigilance reports, CAPA, PMCF, clinical evaluation updates, and certificate conditions need to point back to the current device and its approved scope.

UDI and EUDAMED data are part of the same evidence chain as the technical file. Article 10 requires manufacturers to comply with UDI and registration obligations, Annex II expects Basic UDI-DI or another clear identifier in technical documentation, and Annex III expects PMS methods that can trace devices for corrective action. Since 28 May 2026, the Actor, UDI/Device, and Notified Bodies and Certificates modules have been mandatory for the actors and records in scope; the Market Surveillance module is mandatory for competent authorities and the Commission. The Vigilance and PMS and Clinical Investigations modules remain under development.

The practical control is reconciliation: the device identity in the technical documentation, EU declaration of conformity, certificate, label, IFU, UDI assignment record, EUDAMED entry, complaint file, vigilance report, and field safety corrective action should describe the same device version and scope.