What quality system does the law require, and who answers for it?

Introduction#

A company that places a medical device or an in vitro diagnostic medical device (IVD, a device for testing samples taken from the body, such as blood) on the European Union (EU) market has to run a quality management system (QMS). The QMS is the documented set of processes through which the company designs, makes, checks, and monitors its devices. Where the company's route to the CE mark uses Annex IX of the regulations, a notified body, an independent organisation designated to assess devices, audits that system and issues a certificate if it conforms. The notified body then audits the system again at least once every 12 months. Some devices are still placed on the market under certificates from the former directives. For those devices, one of the conditions for continued sale under the transitional provisions is that the manufacturer had a QMS in place by a fixed date.

The rules are in the Medical Device Regulation, Regulation (EU) 2017/745 (MDR), and the In Vitro Diagnostic Medical Device Regulation, Regulation (EU) 2017/746 (IVDR).

This chapter sets out what the system has to cover under these regulations and what the notified body audits. It then explains what the company gains by following EN ISO 13485:2016, the European edition of the international QMS standard. It also covers who must own the system, including the qualified person the law makes responsible for ensuring that devices are properly checked before release, and how the software the system runs on is validated. Four illustrative products, used throughout the book, show how the answers apply.

The monitor is a wearable cardiac monitor from a US company, and the triage tool is software enabled by artificial intelligence (AI) from a company based in Germany. The implant is a spinal implant certified under the former Medical Devices Directive, and the near-patient test is a cardiac troponin test from a Swiss company. The chapter states the MDR as consolidated on 19 July 2026 and the IVDR as consolidated on 10 January 2025, and the sources were checked on 29 September 2026.

1. Which manufacturers need a quality system, and who carries the duty?#

Manufacturers of devices other than investigational devices have to establish, document, implement, maintain, keep up to date and continually improve a QMS. The system has to ensure compliance with the MDR in the most effective manner, in proportion to the risk class and the type of device. The IVDR makes the same demand of manufacturers of devices other than devices for performance study. (MDR Art. 10(9); IVDR Art. 10(8))

Both provisions also require procedures that keep series production in conformity. Changes in the device's design have to be adequately taken into account in a timely manner. So do changes in the harmonised standards or common specifications it is declared against. Chapter 5, on standards and connected evidence files, covers both kinds of specification. (MDR Art. 10(9); IVDR Art. 10(8))

A notified body is a conformity assessment body designated under the MDR or the IVDR. Where the conformity assessment route uses Annex IX, a notified body audits the system. Chapter 1 sets out which classes take that route, and chapter 8 covers the wider work of the notified body. (MDR Art. 2(42); Annex IX s. 2.3; IVDR Art. 2(34); Annex IX s. 2.3)

Outside the exceptions below, a manufacturer of a class I device declares conformity after drawing up the technical documentation, and no notified body takes part. Class A under the IVDR works the same way. The QMS duty still applies to these manufacturers, although no notified body audits their system. (MDR Art. 10(9), 52(7); IVDR Art. 10(8), 48(10))

The exceptions are class I devices placed on the market sterile, with a measuring function, or as reusable surgical instruments, and sterile class A devices. For these, the notified body's part is limited to aspects such as sterility or metrological conformity. (MDR Art. 52(7); IVDR Art. 48(10))

Another conformity assessment route pairs type examination under Annex X with Annex XI. Under Annex XI Part A, production quality assurance, the manufacturer implements the quality system approved for manufacture, and that system is subject to surveillance. For class IIa devices, Annex XI can also be combined with technical documentation under Annexes II and III. Chapter 8 covers the notified body's work on those routes, and the rest of this chapter uses Annex IX. (MDR Annex XI s. 4, 10, 18)

The duty stays with the manufacturer. An authorised representative is a person established in the Union who has accepted a written mandate to act for a manufacturer outside the Union on specified tasks. That mandate does not delegate the QMS obligation. (MDR Art. 2(32), 11(4); IVDR Art. 2(25), 11(4))

What guidance is worth#

The Medical Device Coordination Group (MDCG) is made up of members appointed by each Member State to represent its competent authorities, and is chaired by a representative of the Commission. It endorses guidance under numbers such as MDCG 2021-5. (MDR Art. 103(2), (5); MDCG 2021-5 rev.1, p. 1)

Each MDCG document cited in this chapter states on its cover page that its views are not legally binding. The Commission's Blue Guide on EU product rules says it is purely a guidance document, and chapter 1 sets out what guidance is worth. (Blue Guide, Important notice)

Guidance from the US Food and Drug Administration (FDA) on computer software assurance (CSA) describes itself as nonbinding. US rules are cited by their place in Title 21 of the Code of Federal Regulations (CFR), such as 21 CFR Part 820. (CSA guidance, p. 1)

2. What does the system address, at a minimum?#

The system has to cover all parts and elements of the manufacturer's organisation dealing with the quality of processes, procedures and devices. It governs the structure, responsibilities, procedures, processes and management resources needed to comply with the MDR. It then has to address at least thirteen aspects, lettered (a) to (m). (MDR Art. 10(9))

(MDR Art. 10(9))

The IVDR list is the same, with two differences. Point (f) is performance evaluation with post-market performance follow-up (PMPF), and the article numbers in points (h) and (i) follow the IVDR's own numbering. (IVDR Art. 10(8))

Article 10(9) names no particular standard. Its words are "at least", so the list is a minimum. Our reading, a label that marks the authors' own interpretation, is that a system covering all thirteen points has met the list. It still has to show that it ensures compliance with the regulation as a whole. (MDR Art. 10(9))

Where the device is a high-risk AI system, Article 17 of the AI Act lists aspects that the provider's QMS has to address. The provider may include them in the device QMS. Chapter 10, on AI and cybersecurity obligations, covers whether and from when that applies. (AI Act, Art. 17(1), (3))

3. What does the notified body audit?#

What the documentation contains#

Under Annex IX, everything the manufacturer adopts for the system is documented systematically and in order. The documents take the form of a quality manual and written policies and procedures, such as quality programmes, quality plans and quality records. (MDR Annex IX s. 2.2)

The documentation describes the quality objectives and the organisation of the business. That includes the organisational structures, with staff responsibilities for critical procedures, and the responsibilities and authority of managerial staff. It also includes how the manufacturer monitors that the system works, including control of devices that fail to conform. (MDR Annex IX s. 2.2(b))

Another party may carry out design, manufacture or final verification and testing, or part of them. The documentation then describes how the system is monitored, and the type and extent of control applied to that party. A manufacturer with no registered place of business in a Member State adds the draft mandate for its authorised representative. It also adds the representative's letter of intention to accept it. (MDR Annex IX s. 2.2(b))

The documentation also describes how the manufacturer monitors, verifies, validates and controls the design of the devices. The documentation, data and records that result from those design procedures are part of it. Those design procedures have to cover, specifically:

• The regulatory compliance strategy, including identification of legal requirements, qualification, classification, handling of equivalence, and the choice of conformity assessment procedures.
• The applicable general safety and performance requirements, and the solutions that fulfil them.
• Risk management under Annex I, Section 3.
• The clinical evaluation under Article 61 and Annex XIV, including PMCF.
• Solutions for the design and construction requirements, including pre-clinical evaluation.
• Solutions for the requirements on the information supplied with the device.
• Device identification procedures, kept up to date at every stage of manufacture.
• Management of design or QMS changes.

(MDR Annex IX s. 2.2(c))

The documentation then describes the verification and quality assurance techniques at the manufacturing stage, particularly for sterilisation. It sets out the tests and trials before, during and after manufacture, and how often they run. It also sets out the test equipment, whose calibration has to be traceable. The notified body also has access to the technical documentation in Annexes II and III. (MDR Annex IX s. 2.2(d), (e))

IVDR Annex IX asks for the same, with performance evaluation and PMPF in place of clinical evaluation and PMCF. (IVDR Annex IX s. 2.2)

Application, audit and certificate#

The application for assessment includes the QMS documentation and a documented description of the procedures in place to fulfil the obligations arising from the system. It also describes the procedures that keep the system adequate and effective, each with the manufacturer's undertaking to apply them. (MDR Annex IX s. 2.1)

The application also includes the clinical evaluation plan, with the procedures that keep the plan up to date, taking into account the state of the art. Under the IVDR it is the performance evaluation plan. (MDR Annex IX s. 2.1; IVDR Annex IX s. 2.1)

The notified body audits the system against the Section 2.2 requirements. The audit takes place on the manufacturer's premises and, if appropriate, on those of its suppliers or subcontractors. If the system conforms, the body issues an EU quality management system certificate. Its decision contains the conclusions of the audit and a reasoned report. (MDR Annex IX s. 2.3; IVDR Annex IX s. 2.3)

Changes and surveillance#

After certification, the manufacturer informs the body of any plan for substantial changes to the system, or to the device range it covers. The body assesses the change, decides whether further audits are needed, and approves a substantial change as a supplement to the certificate. (MDR Annex IX s. 2.4; IVDR Annex IX s. 2.4)

Neither regulation defines "substantial" in this section. MDCG 2019-6 rev.5, which is guidance, says the body needs to make clear what it considers a substantial change to the system. Its terms and conditions are one place to do so. Our observation, a label for the authors' practical judgement, is that the notified body's terms and conditions are where a manufacturer checks whether a planned change, such as moving the QMS to new software, counts as substantial. The manufacturer does best to put the planned change to the notified body in writing. (MDCG 2019-6 rev.5, p. 18)

In surveillance, the body carries out audits and assessments at least once every 12 months. They make sure the manufacturer applies the approved system and the post-market surveillance plan. (MDR Annex IX s. 3.3; IVDR Annex IX s. 3.3)

The body also performs unannounced audits at random, at least once every five years, on the manufacturer's site and, where appropriate, its suppliers'. It plans them and does not disclose the plan to the manufacturer, so an unannounced audit can fall during a system change. (MDR Annex IX s. 3.4)

4. What does the harmonised standard EN ISO 13485:2016 add?#

A standard is a technical specification adopted by a recognised standardisation body, with which compliance is not compulsory. A harmonised standard is a European standard adopted on a request made by the Commission for the application of Union harmonisation legislation. The definition says nothing about publication in the Official Journal, as the Blue Guide notes. (Regulation (EU) No 1025/2012, Art. 2(1); Blue Guide, s. 4.1.2.2)

Some harmonised standards have their references published in the Official Journal of the European Union. Devices conforming to them are presumed to conform to the requirements those standards cover. The same presumption applies to the system or process requirements of the regulations, and requirements relating to quality management systems are named among them. (MDR Art. 8(1); IVDR Art. 8(1))

The QMS standard is EN ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes. Its full European reference has three parts: EN ISO 13485:2016, EN ISO 13485:2016/AC:2018 and EN ISO 13485:2016/A11:2021. (Implementing Decision (EU) 2021/1182, Annex; Implementing Decision (EU) 2021/1195, Annex)

As an example tied to a date, the consolidated texts of the two decisions as of 17 June 2026 list the reference at entry 10 of the annex to the MDR decision and at entry 7 of the annex to the IVDR decision. A consolidated text has no legal effect, and the authentic text is in the Official Journal. For the current entries, the source is the Commission's harmonised standards page, which lists the latest decisions. (Implementing Decision (EU) 2021/1182, consolidated text, p. 1; Commission harmonised standards page)

Where the manufacturer uses a harmonised standard related to a QMS, the notified body assesses conformity with it. The notified body presumes that a system satisfying the relevant harmonised standards conforms to the requirements those standards cover, unless it duly substantiates why it does not apply that presumption. (MDR Annex IX s. 2.3; IVDR Annex IX s. 2.3)

What limits the presumption?#

Using the standard stays voluntary. A manufacturer that chooses not to apply it has to demonstrate conformity by other means of its own choice. MDCG 2021-5 rev.1 adds that, apart from cases where Union law makes a standard mandatory, neither national authorities nor notified bodies can impose a specific standard. (Blue Guide, s. 4.1.2.3; MDCG 2021-5 rev.1, s. 2.2, p. 9)

The same guidance says notified bodies must, where relevant, take harmonised standards into consideration even if the manufacturer does not claim compliance with them. The Blue Guide puts the relationship plainly: "Harmonised standards never replace legally binding essential requirements". Our reading is that every requirement outside the Annex Z coverage still needs its own evidence. (MDCG 2021-5 rev.1, s. 2.2, p. 9; Blue Guide, s. 4.1.2.2)

ISO, which publishes the international text, lists ISO 13485:2016 as edition 3, published in March 2016 and confirmed in 2025. That confirmation concerns only the ISO text. The European reference adds two further documents to it, dated 2018 and 2021. (ISO 13485:2016 catalogue page)

Which clauses do public texts name?#

The clauses themselves are in the licensed standard, and two public texts cite some of them by number. The Medical Device Single Audit Program (MDSAP) is intended to let one audit of a manufacturer's QMS satisfy the regulators taking part. Its Audit Approach cites ISO 13485:2016 clauses for its audit tasks, including those below. (MDSAP AU P0002.009, pp. 5, 6)

The requirements the programme covers include ISO 13485:2016 and the QMS rules of Australia, Brazil, Canada, Japan and the United States. No EU instrument is among them. The US rule, 21 CFR Part 820, names some clauses by title, such as clause 7.3. The numbers below are those of ISO 13485:2016, as these two texts cite them. (MDSAP AU P0002.009, pp. 5, 6; 21 CFR 820.10(c))

(MDSAP, Chapter 6, Task 15; Chapter 3, Task 10; 21 CFR 820.10(c))

What each clause requires is in the licensed text. In the Union, the binding list is MDR Article 10(9), or IVDR Article 10(8). Its point (l) makes corrective and preventive action (CAPA), and verification of its effectiveness, a required aspect. (MDR Art. 10(9)(l); IVDR Art. 10(8)(l))

5. Who owns the system, and who is the person responsible for regulatory compliance?#

Point (c) of the list is responsibility of the management, and point (d) is resource management, including selection and control of suppliers and subcontractors. The Annex IX documentation assigns staff responsibilities for critical procedures and sets out managerial authority. Our observation is that each process in the system needs one named owner, recorded in that organisational structure. (MDR Art. 10(9); Annex IX s. 2.2(b))

Who can be the PRRC?#

The manufacturer needs at least one PRRC within its organisation, with the requisite expertise in medical devices. The expertise is shown by either of two qualifications. (MDR Art. 15(1))

(MDR Art. 15(1); IVDR Art. 15(1))

Under the IVDR there is no custom-made route, and the experience relates to IVDs. Micro and small enterprises, as defined in Commission Recommendation 2003/361/EC, need not have the person within their organisation. They have to have one permanently and continuously at their disposal. (IVDR Art. 15(1); MDR Art. 15(2); IVDR Art. 15(2))

What the PRRC answers for#

The PRRC is responsible at least for ensuring that the conformity of devices is appropriately checked under the QMS before a device is released. The PRRC also ensures that the technical documentation and the EU declaration of conformity are drawn up and kept up to date. (MDR Art. 15(3))

The PRRC's list of responsibilities continues with post-market surveillance obligations, reporting obligations under Articles 87 to 91, and the Annex XV statement for investigational devices. The IVDR list is the same in substance, with its own article numbering and a narrower last point. (MDR Art. 15(3); IVDR Art. 15(3))

Where several persons are jointly responsible, their areas of responsibility are stipulated in writing. The PRRC is to suffer no disadvantage within the manufacturer's organisation for properly fulfilling the duties, whether or not the PRRC is an employee. (MDR Art. 15(4), (5); IVDR Art. 15(4), (5))

What the guidance adds#

MDCG 2019-7 rev.1 takes "within their organisation" to mean that the PRRC would need to be an employee of the manufacturer. It says that where several legal manufacturers sit under one parent company, each needs its own PRRC. For micro and small enterprises, the regulations' own exception applies. (MDCG 2019-7 rev.1, p. 5)

The guidance also says it must be assumed that a manufacturer outside the Union has its PRRC outside the Union, and that a manufacturer inside the Union has its PRRC inside the Union. Its reason is the close, permanent and continuous link it expects between the PRRC and the manufacturing activities. (MDCG 2019-7 rev.1, p. 5)

A micro or small enterprise may, in the guidance's reading, subcontract the role to a third party under a contract that secures permanent and continuous availability. Availability there means reacting in a timely manner, which the guidance says does not necessarily mean 24-hour cover. (MDCG 2019-7 rev.1, p. 5)

The guidance makes the manufacturer responsible for gathering evidence that the PRRC meets the qualifications, such as a curriculum vitae and certificates. It recommends keeping that evidence, because competent authorities may ask for it. Experience limited to the administrative handling of documents and to shadowing regulatory affairs professionals would not be considered sufficient. (MDCG 2019-7 rev.1, p. 4)

The MDCG expects the manufacturer to involve the PRRC in the processes it deems relevant. It also expects information such as identified nonconformities to be passed on. Before release, the PRRC may audit or sample whether the documents exist and are consistent, and whether the tests the QMS provides for have been done. (MDCG 2019-7 rev.1, pp. 6, 7)

The authorised representative's PRRC#

An authorised representative needs its own PRRC permanently and continuously at its disposal. That PRRC and the PRRC of the non-EU manufacturer it represents cannot, in the guidance's reading, be the same person. For a micro or small enterprise, the two should not belong to the same external organisation. (MDR Art. 15(6); IVDR Art. 15(6); MDCG 2019-7 rev.1, p. 9; MDCG 2022-16, p. 9)

Registration of the PRRC in EUDAMED, the European database on medical devices, is covered in chapter 9, on registering the actors and the device.

6. Does the software the system runs on need validating?#

Article 10(9) and its thirteen aspects do not name validation of the software the system runs on. Two public texts place it in ISO 13485:2016, at clauses 4.1.6, 7.5.6 and 7.6: the MDSAP Audit Approach and FDA's CSA guidance. Our reading is that a manufacturer relying on EN ISO 13485:2016 for the presumption of conformity takes on those clauses wherever it claims the presumption for the requirements they address. (MDR Art. 8(1), 10(9); MDSAP, Chapter 6, Task 15; CSA guidance, s. II, footnote 6)

A manufacturer that does not apply the standard still has to demonstrate conformity by other means. MDCG 2021-5 rev.1 says notified bodies take the standard into consideration where relevant, as section 4 sets out. EU guidance on UDI also expects the software involved to stay validated. Our observation is that validating QMS software belongs in the plan whether or not the manufacturer applies the standard. (Blue Guide, s. 4.1.2.3; MDCG 2021-5 rev.1, s. 2.2, p. 9)

What the audit texts ask for#

The MDSAP Audit Approach has the auditor verify that software used in production equipment or the QMS is validated for its intended use. Software validation may be part of equipment qualification. (MDSAP, Chapter 6, Task 15, p. 109)

MDCG 2021-19, which is guidance, speaks to one kind of software used within the QMS, for UDI. It says manufacturers should ensure, as part of the QMS, that the label printing process is verified and validated. UDI software, such as labelling software or uploads to EUDAMED, should remain in a validated state. (MDCG 2021-19, p. 5)

Some manufacturers capture UDI data in an enterprise resource planning system. They should keep validation documentation for the steps that create the UDI and upload it. The guidance says the notified body audits the UDI processes, including the labelling process and its software validation. (MDCG 2021-19, pp. 6, 10)

How much validation effort?#

FDA's CSA guidance, issued on 3 February 2026, covers software used in production or the QMS, as nonbinding recommendations. (CSA guidance, p. 1)

It is risk-based. The level of assurance effort follows the risk to device safety or quality if the software fails. The burden of validation is no more than necessary to address that risk. A feature is high process risk when its failure may cause a quality problem that foreseeably compromises safety. (CSA guidance, s. V)

It supersedes Section 6 of FDA's General Principles of Software Validation, and does not cover the device's own software functions, which chapter 5 covers. (CSA guidance, s. I, III; General Principles, front note)

Our reading is that the CSA method transfers to an EU system as one documented way to meet the ISO 13485 validation clauses. It carries no EU presumption. On the same reading, buying software leaves the duty with the manufacturer, because the QMS obligation is the manufacturer's. What the manufacturer validates in that case is the configuration it chose, for the use it makes of the software. (MDR Art. 10(9))

7. Can one system serve the Union and the United States?#

FDA's final rule of 2 February 2024 amended 21 CFR Part 820 primarily by incorporating the QMS requirements of ISO 13485. It named the result the Quality Management System Regulation (QMSR). It took effect on 2 February 2026. Technical amendments published on 4 December 2025, also effective on 2 February 2026, are editorial, in FDA's words. (89 FR 7496; 90 FR 55978)

Part 820 incorporates ISO 13485:2016(E), the third edition of 1 March 2016, for five of its sections. A manufacturer documents a QMS that complies with ISO 13485 and with the other applicable requirements of Part 820. (21 CFR 820.7(b), 820.10)

Where a clause conflicts with the Federal Food, Drug, and Cosmetic Act (FD&C Act) or its regulations, the Act controls, and its definitions supersede the standard's. Section 820.35 adds record content, such as records of the review, evaluation and investigation of complaints. (21 CFR 820.1(b), 820.3(b), 820.35)

Our reading is that a system built to the US rule gains no EU presumption from that alone. The US rule incorporates the ISO version of the standard, whereas the EU presumption requires the European version, as section 4 sets out. One system can still serve both markets, on the same reading, if it carries both the EU additions and the US additions in Part 820. The EU additions include the thirteen aspects, the PRRC and the Annex IX documentation.

What MDSAP reports are worth in the Union#

MDSAP runs on a three-year cycle: a complete initial audit, a partial surveillance audit in each of the next two years, and a complete recertification audit in the third. Annex IX, for its part, requires surveillance audits every year as a legal minimum, and adds unannounced audits at least once every five years. (MDSAP, Overview; MDR Annex IX s. 3.3, 3.4)

MDCG 2020-14 stresses that the MDR and IVDR remain applicable in their entirety. MDSAP reports can be used only where the MDSAP audit covers similar or equivalent requirements, and the notified body keeps full authority over its judgement. Recent reports could be an input to planning yearly surveillance audits, which still take place. (MDCG 2020-14, p. 3)

The guidance lists requirements an MDSAP report does not cover, or covers only partly, on which a notified body may focus. They include clinical or performance evaluation, authorised representative contracts, EU UDI assignments, financial coverage for liability, and the PRRC's qualification and role. They also include records control, risk management, and vigilance and post-market surveillance with the related CAPA. (MDCG 2020-14, pp. 3, 4)

MDCG 2020-14 adds that MDSAP reports cannot be taken into account for unannounced audits, or for the initial QMS audits needed for an EU QMS certificate. Notified bodies conduct those initial audits in their entirety. (MDCG 2020-14, p. 4)

8. How the answer is reached#

The answers depend on one another, in this order:

1. The class, route and role come first. Article 10(9) names no class or route as a condition of the QMS duty. It makes the system proportionate to the risk class and type of device, so the class, route and role established in chapter 1 are the starting point. (MDR Art. 10(9); IVDR Art. 10(8))
2. The thirteen aspects set the minimum content, in the wording of the regulation that applies. Annex IX adds items the list does not name. They are quality objectives, the organisation, control of other parties, and the representative's mandate for a manufacturer outside the Union. (MDR Art. 10(9); Annex IX s. 2.2; IVDR Art. 10(8))
3. Ownership follows, because management responsibility is itself on the list, at point (c). The Annex IX documentation sets out responsibilities for critical procedures. (MDR Art. 10(9); Annex IX s. 2.2(b))
4. The PRRC is appointed on one of the qualification routes, with the evidence the guidance expects. Where several persons share the role, their areas are stipulated in writing. The guidance on location and on the representative's PRRC then applies. (MDR Art. 15(1), (4); MDCG 2019-7 rev.1, pp. 4, 5, 9)
5. The decision whether to apply the harmonised standard determines which requirements rely on the presumption. A system built to EN ISO 13485:2016 follows the full three-part European reference. Each requirement it relies on for presumption is checked against Annex Z, as section 4 explains. (Implementing Decision (EU) 2021/1182, Annex; MDCG 2021-5 rev.1, s. 2.2, p. 9)
6. The procedures come before the software. Our observation is that the list of requirements for the QMS software follows from the procedures, so any software under consideration is tested against the manufacturer's own procedure documents.
7. Each tool used in the QMS or in production is validated for its intended use, including UDI labelling software. On our reading of the CSA method, the risk if the software fails sets how much validation effort is needed. (MDSAP, Chapter 6, Task 15; MDCG 2021-19, p. 5; CSA guidance, s. V)
8. Supplier control covers each party that designs, manufactures, or does final verification and testing. The documentation describes the type and extent of control, and the notified body may audit on that party's premises. (MDR Art. 10(9); Annex IX s. 2.2(b), 2.3)
9. Internal audit and CAPA are separate stages. Point (l) requires verification that each corrective and preventive action worked. The MDSAP internal audit task looks for corrections, corrective actions, follow-up and verification. Our observation is that each of those stages needs a named owner. (MDR Art. 10(9); MDSAP, Chapter 3, Task 10)
10. The notified body cycle closes the sequence. That cycle runs from the application documents to surveillance at least every 12 months and unannounced audits. After certification, a planned substantial change goes to the body before it is made. (MDR Annex IX s. 2.1, 2.4, 3.3, 3.4)
11. A manufacturer that also sells in the United States carries both the EU and the US additions to the standard, since Part 820 requires ISO 13485 plus its own requirements. A requirement gains the EU presumption only if the manufacturer relies on the European version of the standard for it. If the manufacturer holds MDSAP reports, MDCG 2020-14 says they are not taken into account for the initial EU audits. (21 CFR 820.10; MDCG 2020-14, p. 4)

9. The four running cases#

The monitor: a wearable cardiac monitor from a US company#

The monitor is a wearable cardiac monitor with a companion application. Chapter 1 puts the hardware in class IIa under Rule 10, on our reading, and classifies the application separately: class IIa if it only records for later review, class IIb if it analyses the rhythm to guide a physician's diagnosis.

This book plans on recording only, and assumes, as an illustration, that the company is already cleared and selling in the United States. Suppose also that it runs a QMS built for the QMSR, and takes the Annex IX route.

Four points of the list cite an EU provision by number. They are (e) Annex I, Section 3, (f) Article 61 and Annex XIV, (h) Articles 27(3) and 29, and (i) Article 83. Points (a), (b), (j) and (k) name conformity assessment, the general safety and performance requirements, notified bodies and competent authorities, and vigilance. (MDR Art. 10(9))

Our reading is that a system written for the QMSR has no reason to address those EU concepts, so these eight points need new or revised procedures. MDCG 2021-19 gives guidance on building UDI into the QMS, which bears on point (h).

The triage tool: AI-enabled software from a company based in Germany#

The triage tool is AI-enabled software from a Union manufacturer whose home Member State is Germany. Chapter 1 finds classes IIa to III all arguable under Rule 11, and the planning assumption is class IIb. Suppose, as an illustrative assumption, that the company releases software many times a year.

Whether a release needs the notified body's approval before it ships is in chapter 8.

The implant: a spinal implant from a European company with a directive certificate#

The implant is a spinal implant system from a European company: an interbody cage with screws, plates, hooks and rods. Chapter 1 classes it by component. The cage is class III, and the screws and plates class IIb. The hooks are class IIb on MDCG 2021-24 rev.1's reading, and the rods, wires and pins stay open, because Rule 8 does not name them.

In this book's case, the system is CE marked under Directive 93/42/EEC, the Medical Devices Directive, and the company is seeking its first MDR certificate under the Article 120 transition. Suppose, as an illustrative assumption, that its Annex IX application is with the notified body, and that machining and sterilisation are subcontracted.

Article 120(3a) covers certificates issued under Directive 90/385/EEC or Directive 93/42/EEC, and the implant's is under the second. The 26 May 2024 date has passed, so a manufacturer that had not met the condition is outside the transition. Our observation is that a company that met the condition keeps on file the evidence that it did. The end dates are in Article 120(3a) of the current consolidated MDR. (MDR Art. 120(3a), (3c))

The near-patient test: a cardiac troponin test from a Swiss company#

The near-patient test is a cardiac troponin blood test, used near the patient in hospital emergency departments. A Swiss company with no Union entity already sells it through distributors in Germany, the Netherlands, Belgium and Austria. Chapter 1 gives it two intended purposes, and both are planned as class C until a notified body confirms otherwise.

In this book's case, the test is also a legacy device: its declaration of conformity was drawn up under Directive 98/79/EC before 26 May 2022, with no notified body involved.

The performance evaluation plan, and the procedures that keep it up to date, go into the Annex IX application. (IVDR Annex IX s. 2.1)

10. When specialist help is worth paying for#

• The presumption is relied on for particular requirements. Establishing which requirements the Annex Z of EN ISO 13485:2016/A11:2021 lists as covered requires a copy of the standard itself and someone able to read it. (MDCG 2021-5 rev.1, s. 2.2, p. 9)
• The system is to change, before or after certification, and the notified body's terms on what counts as a substantial change decide when the change has to go to the body. (MDR Annex IX s. 2.4; MDCG 2019-6 rev.5, p. 18)
• The company is outside the Union, or a micro or small enterprise sharing a PRRC arrangement. The guidance on location and on the representative's PRRC shapes the contracts. (MDCG 2019-7 rev.1, pp. 5, 9)
• One system has to serve the Union and the United States. Each market adds its own requirements, and the EU presumption depends on applying the European version of the standard. (21 CFR 820.10)
• The devices rely on the transitional provisions, where the QMS condition is one of several in MDR Article 120(3c) or IVDR Article 110(3c). (MDR Art. 120(3c); IVDR Art. 110(3c))

Conclusion#

The device's class and conformity assessment route come first, because they decide whether a notified body, the independent organisation designated to assess devices, audits the company's quality management system (QMS). Every manufacturer still has to run a QMS, and the system has to be proportionate to the device's risk class and type. Its minimum content is the list of thirteen aspects in Article 10(9) of the MDR, or Article 10(8) of the IVDR. Where the route uses Annex IX, the notified body audits documentation that goes beyond the list, such as quality objectives and control of other parties that design or make the device.

Whether the company follows EN ISO 13485:2016, the European edition of the international QMS standard, decides which requirements can rest on the legal presumption that a conforming system meets them. The presumption arises only when the European version is applied, and only for the requirements listed in its Annex Z, the table that links the standard's clauses to the regulation. On our reading, every requirement outside that coverage needs its own evidence.

Ownership of the system follows from the list, which includes management responsibility. Article 15 adds a duty to appoint a person responsible for regulatory compliance (PRRC), a qualified individual responsible for ensuring that the conformity of each device is properly checked before release. The requirements for the software the QMS runs on, and so its validation, follow from the procedures the system adopts, so on our observation the procedures are settled first.

In the running cases, the monitor is a wearable cardiac monitor from a US company. Its company runs a QMS built for the US Quality Management System Regulation (QMSR), the FDA rule that incorporates the international standard. On our reading, that system needs new or revised procedures for eight points of the Article 10(9) list, those that rely on EU concepts such as clinical evaluation and vigilance. The company may hold reports from the Medical Device Single Audit Program (MDSAP), in which one audit serves several non-EU regulators. MDCG 2020-14 says those reports are not taken into account for the initial EU audits, which the notified body conducts in full. On the guidance's assumption, the company's PRRC is outside the Union. Its authorised representative, the Union-based person mandated to act for it, needs its own PRRC, a different person on the guidance's reading.

The triage tool is AI-enabled software from a company based in Germany. On the illustrative assumption that it releases software many times a year, its procedure for design changes is, on our reading, in constant use. That procedure therefore sits near the top of the list of requirements for its QMS software. Chapter 10 sets out when the QMS aspects of the AI Act apply to the tool.

The implant is a spinal implant system from a European company, sold under a certificate from the former Medical Devices Directive while it seeks its first MDR certificate. Continued sale under that certificate depends on conditions in Article 120(3c), one of which was a QMS in place by 26 May 2024. That date has passed, so a manufacturer that had not met the condition is outside the transition. Our observation is that a company that met it keeps on file the evidence that it did. On our reading, a move of the QMS to new software before the MDR certificate is issued changes the system the notified body is auditing. The company therefore tells the notified body in writing before the move.

The near-patient test is a cardiac troponin blood test from a Swiss company. Its QMS addresses the same thirteen aspects, with performance evaluation and post-market performance follow-up (PMPF), the gathering of performance data after launch, at point (f). It is a legacy device: its declaration of conformity was drawn up under the former IVD directive before 26 May 2022, with no notified body involved. Continued sale on that basis depends on the Article 110(3c) conditions, one of which was a QMS in place by 26 May 2025. On the guidance's reading, the PRRC of its authorised representative in the Union is a different person from the Swiss company's own PRRC.

Later chapters build on these answers. Chapter 5 covers the other standards and the device's own software, chapter 6 the evidence, chapter 7 the technical documentation and chapter 8 the notified body. Chapter 9 covers registration, chapter 10 the AI Act, chapter 11 the obligations after launch, and chapter 17 the costs and staffing of the system.