EU MDR requirements checklist

Decide first whether the product is a medical device, an accessory, an Annex XVI product without an intended medical purpose, software driving or influencing a device, a system or procedure pack, a custom-made device, or outside MDR scope. The decision should be based on the manufacturer's intended purpose, claims, functionality, patient or user context, and how the product is placed on the EU market.

Once the product is in scope, classify it under MDR Article 51 and Annex VIII. Record the class I, IIa, IIb, or III outcome, the classification rule used, any sterile, measuring, or reusable-surgical-instrument status for class I devices, and any special features such as implantable use, medicinal substances, animal or human tissue derivatives, nanomaterials, active diagnosis or therapy, or software functions.

For each in-scope device, build a General Safety and Performance Requirements matrix against Annex I. The matrix should state whether each GSPR is applicable, the rationale for exclusions, the standard, common specification, test, analysis, label, usability file, risk-control record, or clinical evidence used to show conformity, and any open gap.

Technical documentation should be maintained under Article 10 and Annexes II and III. It should contain device identification, intended purpose, design and manufacturing information, risk management, verification and validation evidence, clinical evaluation outputs, labels and instructions, PMS planning, and any declarations, certificates, notified-body submissions, or authority correspondence needed to show the conformity route.

The manufacturer's QMS should cover the MDR obligations listed in Article 10(9), including regulatory strategy, GSPR identification, management responsibility, supplier and subcontractor control, risk management, clinical evaluation and PMCF, product realization, UDI verification, PMS, authority and notified-body communications, vigilance, corrective and preventive action, and data-driven product improvement.

Clinical evaluation is not a one-time attachment. Article 10 and Article 61 require a clinical evaluation, and Annex XIV expects the clinical evaluation plan, report, evidence, PMCF plan, and PMCF evaluation outputs to support conformity and feed the PMS and risk-management system. For higher-risk routes, record expert-panel or notified-body interactions where they apply.

UDI work should be part of the requirements register, not a packaging afterthought. Article 10 links the manufacturer's QMS to UDI assignment and consistency of information submitted under Article 29. Article 29 requires a Basic UDI-DI before placing devices other than custom-made devices on the market, and Article 31 covers actor registration for manufacturers, authorised representatives, and importers.

Post-market surveillance and vigilance should close the loop back into the technical documentation and risk file. PMS should proactively collect and review experience from devices on the market; vigilance should capture serious incidents, field safety corrective actions, trend and periodic reporting where applicable, and follow-up with competent authorities, notified bodies, distributors, importers, users, and customers.

Economic-operator duties depend on role. Manufacturers own design, manufacturing, conformity, technical documentation, QMS, clinical evaluation, PMS, UDI, registration, corrective action, and vigilance obligations. Authorised representatives, importers, and distributors have separate verification, registration, cooperation, traceability, and record-keeping duties that should be assigned in contracts, procedures, and release controls.

A requirements file is useful only if it can be audited. Keep one register that links each obligation to the device, intended purpose, class, role, owner, source article or annex, evidence record, status, approval, review trigger, and unresolved issue. Review it when claims, software functions, design, manufacturing, suppliers, standards, clinical evidence, PMS signals, complaints, incidents, notified-body feedback, or EUDAMED data change.