EU MDR requirements checklist

Decide first whether the product is a medical device, an accessory, an Annex XVI product without an intended medical purpose, software driving or influencing a device, a system or procedure pack, a custom-made device, or outside MDR scope. The decision should be based on the manufacturer's intended purpose, claims, functionality, patient or user context, and how the product is placed on the EU market.

Once the product is in scope, classify it under MDR Article 51 and Annex VIII. Record the class I, IIa, IIb, or III outcome, the classification rule used, any sterile, measuring, or reusable-surgical-instrument status for class I devices, and any special features such as implantable use, medicinal substances, animal or human tissue derivatives, nanomaterials, active diagnosis or therapy, or software functions.

For each in-scope device, build a General Safety and Performance Requirements matrix against Annex I. The matrix should state whether each GSPR is applicable, the rationale for exclusions, the standard, common specification, test, analysis, label, usability file, risk-control record, or clinical evidence used to show conformity, and any open gap.

Technical documentation should be maintained under Article 10 and Annexes II and III. It should contain device identification, intended purpose, design and manufacturing information, risk management, verification and validation evidence, clinical evaluation outputs, labels and instructions, PMS planning, and any declarations, certificates, notified-body submissions, or authority correspondence needed to show the conformity route. Retain the technical documentation, declaration, and relevant certificates for at least 10 years after the last covered device is placed on the market, or at least 15 years for implantable devices.

The manufacturer's QMS should cover the MDR obligations listed in Article 10(9), including regulatory strategy, GSPR identification, management responsibility, supplier and subcontractor control, risk management, clinical evaluation and PMCF, product realization, UDI verification, PMS, authority and notified-body communications, vigilance, corrective and preventive action, and data-driven product improvement.

Maintain clinical evaluation throughout the device lifecycle. Article 10 and Article 61 require a clinical evaluation, and Annex XIV expects the clinical evaluation plan, report, evidence, PMCF plan, and PMCF evaluation outputs to support conformity and feed the PMS and risk-management system. For higher-risk routes, record expert-panel or notified-body interactions where they apply.

Include UDI work in the requirements register from the start. Article 10 links the manufacturer's QMS to UDI assignment and consistency of information submitted under Article 29. Article 29 requires a Basic UDI-DI before placing devices other than custom-made devices on the market, and Article 31 covers actor registration for manufacturers, authorised representatives, and importers.

Manufacturers must plan, establish, document, implement, maintain, and update PMS for each device in proportion to its risk class and type. The system should proactively collect and review experience from devices on the market; vigilance should capture serious incidents, field safety corrective actions, trend and periodic reporting where applicable, and follow-up with competent authorities, notified bodies, distributors, importers, users, and customers. Feed the results back into the technical documentation and risk file. Since 28 May 2026, four EUDAMED modules are mandatory: Actor, UDI/Devices, Notified Bodies and Certificates, and Market Surveillance. Clinical Investigations and Vigilance/PMS follow separate later milestones.

Article 22 assigns the system or procedure pack statement to the person who combines CE-marked devices and, where applicable, products that comply with the legislation applying to them. The combination must be compatible with each item's intended purpose and manufacturer instructions. That person must verify mutual compatibility, package the combination, supply the relevant manufacturer information to users, and apply suitable internal monitoring, verification, and validation methods.

The route changes when the combination includes a device without CE marking, uses a device outside its intended purpose, or combines products in a way that is not mutually compatible. The combination is then treated as a device in its own right and the assembler takes on manufacturer obligations, including the applicable Article 52 conformity assessment. A person who sterilises an Article 22 combination follows the specified conformity route only for the sterility aspects unless another fact triggers the full device route.

For a covered implantable device, Article 18 requires the manufacturer to provide information that identifies the device, including its name, serial or lot number, UDI, model and manufacturer details. The patient information must also include warnings, precautions, measures for safe interaction with reasonably foreseeable external influences or medical examinations, expected device lifetime and necessary follow-up, and other information needed for safe patient use.

The health institution must make that information available to the patient by a means that allows rapid access and must provide the completed implant card. Sutures, staples, dental fillings, dental braces, tooth crowns, screws, wedges, plates, wires, pins, clips and connectors are excluded from the Article 18 duties unless the Commission changes the list. The implant card remains separate from the instructions for use and the summary of safety and clinical performance.

Economic-operator duties depend on role. Manufacturers own design, manufacturing, conformity, technical documentation, QMS, clinical evaluation, PMS, UDI, registration, corrective action, and vigilance obligations. Authorised representatives, importers, and distributors have separate verification, registration, cooperation, traceability, and record-keeping duties that should be assigned in contracts, procedures, and release controls.

A requirements file is useful only if it can be audited. Keep one register that links each obligation to the device, intended purpose, class, role, owner, source article or annex, evidence record, status, approval, review trigger, and unresolved issue. Review it when claims, software functions, design, manufacturing, suppliers, standards, clinical evidence, PMS signals, complaints, incidents, notified-body feedback, or EUDAMED data change.