I’ve managed Technical Files and CE-marking efforts for Class IIa/IIb devices through MDR audits and notified-body reviews. The media copy on MDR often makes it sound like "more paperwork" — in my experience that's the least useful framing. MDR is a different risk-and-evidence regime. Below is what I found to actually be new in practice, the mistakes teams keep repeating, and the concrete adjustments that helped us survive an audit.
What is genuinely new (or newly enforced)
- A lifecycle approach to evidence: Clinical evaluation and post-market data must be maintained continuously, not delivered as a one-off dossier. Annex II/III of the MDR expect Technical Documentation that evolves.
- Stronger clinical expectations: Clinical data must be commensurate with risk and technology. Relying solely on literature reviews for devices with different indications or substantial changes is risky.
- Post-market surveillance (PMS) is elevated: PMS plans, proactive data collection, PSUR-like periodic evaluation, and explicit links from PMS to CAPA are expected.
- Person Responsible for Regulatory Compliance (PRRC): The role is more explicit and auditors ask for demonstrated responsibility and authority, not just a job title on an org chart.
- Increased scrutiny of software and classification rules: Rule changes and guidance mean software can be higher-risk than teams assume; classification drives conformity routes.
- Supply chain and economic-operator responsibilities: Importers/distributors and manufacturers have clearer obligations; agreements and procedures need updating.
- UDI and traceability expectations: Labeling and traceability requirements tie into vigilance and PMS more tightly.
These are not theoretical: auditors we worked with wanted evidence of how clinical inputs fed risk management, how post-market findings drove design changes, and how someone (the PRRC) could be held accountable for regulatory decisions.
What teams still get wrong
- Treating MDR as "more forms" rather than a systems change
- Common symptom: Teams dump additional documents into the existing Technical File but don’t change workflows that generate evidence (clinical, PMS, supplier surveillance).
- Late clinical strategy work
- Teams often attempt a rushed clinical evaluation just before submission. Auditors look for an ongoing plan: objectives, data sources, acceptance criteria, and updates over time.
- Siloed PMS and CAPA
- PMS and vigilance data are collected but sit in a report library. If you can’t show how a signal triggered a CAPA or risk-control change, that's a gap.
- Underestimating software risk/classification
- We had engineers assume a UI-only device was low-risk; notified body pushed for a higher classification and evidence set.
- PRRC as an afterthought
- Hiring someone with the right CV isn’t enough. Auditors expect to see documented authorities, involvement in releases/changes, and evidence they reviewed / signed regulatory decisions.
- Poor traceability mapping
- Auditors expect to trace clinical claims → risk analysis → design outputs → verification/validation → labeling. Weak matrices make reviews painful.
- Supplier agreements not updated
- Economic-operator responsibilities and MDR’s tighter supply expectations mean legacy supplier clauses are insufficient.
Practical steps that helped us
- Run an Annex II/III mapping workshop
- Assign an owner per Annex section and map existing artifacts (design inputs, risk file, clinical evidence, labeling) to the required headings. This revealed missing process links more than missing documents.
- Make clinical evaluation a living artifact
- Maintain a clinical evaluation plan (CEP) and a clear evidence-log: literature, PMS-derived data, and any studies. Tie the CEP to the risk management file.
- Integrate PMS into change control
- Add a mandatory PMS entry point into your change-request form and require PRRC review for higher-risk changes.
- Tighten supplier governance
- Update supplier contracts with MDR-relevant clauses and add supplier performance indicators into your PMS dashboards.
- Operationalize PRRC responsibilities
- Document explicit approval gates: who signs off on Technical Documentation, clinical strategies, and release of lots/devices. Show evidence of decisions.
- Improve traceability tooling
- We used a traceability matrix that linked clinical claims to risk controls and V&V artifacts. Even a well-structured spreadsheet beats an ad hoc folder structure.
A few caveats from our audits
- Notified bodies differ in focus. Some will dig deep into clinical justification, others into PMS system effectiveness. Expect variability and be ready to demonstrate systemic control, not just artifacts.
- EUDAMED / system rollouts and guidance documents evolve — treat guidance as live and document your interpretation and implementation choices.
If you have 90 days before your audit, prioritize this
- Map Annex II/III to existing evidence
- Produce a current clinical evaluation synopsis and CEP
- Show at least one completed PMS → signal → CAPA → verification chain
- Demonstrate PRRC involvement in a recent release or change
MDR is less about adding a few documents and more about proving your system produces defensible clinical and safety evidence across a device’s lifecycle. Shifting from "file-centric" to "evidence-flow" is the hardest but highest-value change.
What's one practical template, checklist, or trick you used to make Annex II/III traceability effortless during an audit?
Top comments (0)