MDR Article 10(9) · Annex IX · ISO 13485 · Interactive review
MDR quality management system checklist
Check whether the QMS controls regulatory work in practice, not merely whether procedures exist.
Review 84 concrete checkpoints, record evidence and gaps, and issue a clean assessment report. Your draft stays in this browser and is not sent to MDRC.
Start the checklist ↓84 checkpoints · 12 controlled sections
Project details
Define the organisation and QMS scope before reviewing the system
Only completed fields are carried into the issued report. The organisation name is required.
Entries are stored in this browser only. They are not uploaded or submitted.
System review
Review the complete MDR quality-system chain
Use Completed, Open or Not applicable. Add a document reference, decision or short rationale only where it helps the review.
The legal manufacturer and every QMS site are identified
Confirm legal names, addresses, SRNs where available, activities performed at each site and consistency with certificates, registrations and labels.
The QMS scope covers all device families, risk classes and conformity routes
Map each device family to its intended purpose, MDR class, applicable Annex VIII rules and conformity assessment route.
All processes needed for MDR conformity are mapped with owners and interfaces
Include regulatory strategy, design, risk, clinical, suppliers, production, release, UDI, PMS, vigilance, CAPA and change control.
Outsourced processes remain inside the manufacturer’s controlled QMS
Identify external design, testing, software, sterilisation, warehousing, service and regulatory activities and the controls applied to each.
The quality manual or equivalent explains the system and its process sequence
A reviewer should be able to understand the scope, process interactions, governing procedures and controlled-document hierarchy without guessing.
Any exclusion or non-applicable process is justified against actual manufacturer responsibilities
Do not use an ISO 13485 exclusion to remove an obligation that the MDR places on the legal manufacturer.
The ISO 13485 certificate scope matches the activities and sites represented as certified
Where certification is used, verify the current edition, accredited certification body, products, activities, sites, expiry and exclusions.
A current regulatory compliance strategy exists for every device family
Record qualification, classification, conformity route, standards, clinical strategy, registration, PMS obligations and market-specific constraints.
Device qualification and MDR classification are documented and approved
State the intended purpose, applicable Annex VIII rules, rationale and resolution of borderline or combination-product questions.
The selected conformity assessment route is valid for the device and manufacturer
Distinguish Class I self-declaration from routes requiring a Notified Body and define the assessment scope for Is, Im and Ir devices.
Applicable GSPRs are identified with methods and controlled evidence references
Each Annex I requirement should show applicability, method of conformity, standards or common specifications, and exact evidence location.
Standards, common specifications and MDCG guidance are monitored for change
Define owners, review frequency, transition decisions and actions when editions, harmonisation status or guidance change.
Intended purpose and claims are approved before external use
Control consistency across technical documentation, clinical evidence, labels, instructions, registrations, website and promotional material.
Regulatory impact assessment is mandatory for product and QMS changes
Define when the Notified Body, competent authority, authorised representative or other economic operators must be notified before implementation.
Management has approved a quality policy and measurable quality objectives
Objectives should address product conformity, regulatory performance and process effectiveness and be reviewed using defined indicators.
Responsibilities, authority and reporting lines are documented
Define who can approve designs, release product, stop production, report incidents, initiate field action and accept residual risk.
Management provides resources based on QMS and product risk
Link staffing, competence, facilities, equipment, digital systems and external expertise to planned work and unresolved quality risks.
Process owners monitor performance and escalate missed requirements
Owners should know their criteria, data sources, review frequency, thresholds and escalation route.
A qualified PRRC is continuously and permanently available
Verify Article 15 qualification evidence, employment or contractual arrangement, availability and deputy or continuity arrangements.
PRRC responsibilities are integrated into release, documentation, PMS and vigilance
The process should let the PRRC verify conformity before release, technical-documentation maintenance, PMS obligations and required reporting.
Quality and regulatory personnel can escalate concerns without disadvantage
Document independence, access to management, conflict handling and the MDR protection against disadvantage for the PRRC.
Competence requirements are defined for work affecting quality or regulatory compliance
Specify education, training, skills and experience for design, clinical, risk, production, release, audit, complaint and vigilance roles.
Training records show competence and effectiveness, not attendance alone
Use observed work, tests, supervised performance, record review or outcome data appropriate to the role and risk.
Role changes, temporary staff and external experts are controlled
Define induction, supervision, access, authorisation and competence verification before independent work.
Infrastructure and work environment requirements are specified and maintained
Cover premises, utilities, environmental conditions, cleanliness, contamination control, IT, security and maintenance as applicable.
Monitoring and measuring equipment is calibrated or verified and traceable
Define intervals, standards, status identification, out-of-tolerance assessment and impact on previously accepted product.
Software used in the QMS or production is validated for its intended use
Use a risk-based plan covering requirements, testing, access, configuration, data integrity, backup, changes and periodic review.
Business continuity protects critical QMS records and regulated operations
Address backup restoration, cyber incidents, utility or supplier failure, facility loss and continuity of vigilance and field-action communication.
Controlled documents have an identifier, version, owner, approval and effective date
Procedures, forms, specifications, work instructions and templates should be unambiguous at every point of use.
Document changes state the reason, impact and required implementation actions
Link changes to training, validation, regulatory assessment, affected product and withdrawal of obsolete copies.
External documents and standards are identified and kept current
Control legislation, guidance, standards, customer specifications, supplier documents and translated information used in regulated work.
Obsolete documents cannot be used unintentionally
Remove superseded versions from points of use while preserving clearly identified archive copies where retention is required.
Records are legible, attributable, contemporaneous, original and accurate
Define correction rules, audit trails, signatures, access rights, protection, retrieval and backup for paper and electronic records.
Retention periods meet MDR requirements and other applicable obligations
Keep required documentation for at least 10 years after the last device is placed on the market and 15 years for implantable devices.
Technical documentation, declarations and certificates are current and readily available
Control Annex II and III files, EU declarations of conformity, certificates and records needed by authorities, the PRRC and the Notified Body.
A lifecycle risk management process is applied to every device
The plan should define scope, responsibilities, criteria, reviews and production and post-production information sources.
Hazards and foreseeable misuse are systematically identified and evaluated
Include device, software, usability, cybersecurity, biological, electrical, mechanical and information-related risks as applicable.
Risk controls follow the required priority and are verified for effectiveness
Prefer safe design, then protective measures and finally information for safety, with traceable implementation and test evidence.
Residual risk and overall benefit-risk conclusions are documented and current
Connect conclusions to clinical evidence, state of the art, supplied information and new production or post-market data.
The clinical evaluation plan and report support the current intended purpose and claims
Define the evidence strategy, appraisal, gaps, conclusions, update frequency and traceability to risk and GSPRs.
PMCF is planned and performed or a device-specific justification explains why it is not applicable
State objectives, methods, timelines, acceptance criteria, findings and the decisions each activity informs.
Risk, clinical, PMCF and PMS outputs remain mutually consistent
A change in one record should trigger review of the others, including labels, claims, benefit-risk conclusions and technical documentation.
Design plans define stages, responsibilities, reviews and interfaces
Keep the plan current as development changes and identify required verification, validation, transfer and regulatory deliverables.
Design inputs are complete, measurable, approved and free of unresolved conflict
Include intended use, user needs, GSPRs, risk controls, clinical requirements, standards, usability and cybersecurity where applicable.
Design outputs define the product and support production and acceptance
Control drawings, specifications, software, formulations, labels, packaging, instructions and acceptance criteria for the released configuration.
Formal design reviews resolve actions before the next stage
Use independent expertise where appropriate and record participants, evidence reviewed, decisions, actions and closure.
Verification demonstrates that outputs meet approved inputs
Protocols should define methods, samples, acceptance criteria and deviations, with traceability to the exact released configuration.
Validation demonstrates that the device meets user needs and intended use
Use representative product and intended users and environments, including clinical, usability, software and packaging validation as applicable.
Transfer and design changes preserve the validated state
Confirm production readiness and apply risk, verification, validation, regression and regulatory assessments before change approval.
Suppliers are classified and qualified using risk-based criteria
Consider criticality, substitutability, process validation, regulatory status, performance history and the consequence of failure.
Critical suppliers and outsourced processes are explicitly identified
Include design, software, testing, sterilisation, special processes, packaging, warehousing, calibration and regulatory services as applicable.
Quality agreements define responsibilities and change notification
Cover specifications, records, deviations, complaints, audits, traceability, retention, subcontracting and access for authorities or the Notified Body.
Purchasing information states complete and approved requirements
Use current specifications, drawings, acceptance criteria, process requirements and regulatory or traceability conditions.
Incoming product and supplied services are verified before acceptance
Match inspection, testing, certificates and sampling to risk and retain objective evidence of acceptance or authorised concession.
Supplier performance is monitored and re-evaluated using defined thresholds
Use quality, delivery, audit, complaint, deviation and change data with escalation, development or disqualification rules.
Supplier changes and failures trigger product and regulatory impact assessment
Connect notifications, nonconformities and CAPA to risk management, validation, technical documentation and Notified Body communication.
Current specifications and work instructions control production and service
Operators should have approved requirements for materials, equipment, parameters, environment, workmanship, inspection and records.
Product identity and acceptance status remain clear throughout processing
Prevent mix-up and unauthorised use through lot, serial, software, configuration, inspection and quarantine controls.
Processes whose output cannot be fully verified later are validated
Include sterilisation, sealing, welding, cleaning, moulding, software deployment or other special processes as applicable.
Equipment, utilities and environmental controls are maintained within limits
Define qualification, preventive maintenance, monitoring, alarm, excursion assessment and requalification requirements.
In-process and final acceptance criteria are applied and recorded
Use authorised methods, sampling plans, trained personnel and traceable results, with deviations resolved before release.
Release records identify the approved product and authorised releaser
Confirm all required records, tests, deviations, labels and PRRC-related conformity checks are complete before release.
Packaging, storage, transport, installation and service preserve conformity
Control environmental limits, shelf life, handling, shipping qualification, field records and feedback into complaints and PMS.
Basic UDI-DI and UDI-DI assignment follows controlled grouping rules
Document the issuing entity, device-family rationale, packaging hierarchy and triggers requiring a new identifier.
UDI production identifiers are applied at the required levels
Control lot, serial, manufacture or expiry data as applicable and verify human-readable and automatic-identification carriers.
UDI, label, certificate and registration data are consistent
Cross-check names, models, risk class, intended purpose, status, manufacturer and authorised representative details.
EUDAMED and other required registrations are created and updated on time
Assign owners for actor, device, certificate, vigilance and market-status data and retain evidence of verification and changes.
Economic operators are verified and linked to the correct devices
Control authorised representative, importer and distributor information, agreements, complaints, cooperation and registration obligations.
Distribution records support rapid and complete recall scope
Trace suppliers, lots or serials, customers, dates, quantities and destinations for the legally required period.
Implant cards, SSCP and other class-specific information are controlled where required
Verify applicability, content, translations, publication, updates and consistency with the technical documentation and registrations.
A device-specific PMS plan defines proactive and reactive data sources
Cover complaints, incidents, trends, literature, registries, user feedback, distributor data, competitor signals and PMCF.
Exposure and denominator data support meaningful signal evaluation
Collect sales, distribution, installed base, procedure or patient-use data appropriate to complaint, incident and trend rates.
Complaints are logged, assessed, investigated and trended consistently
Define intake, duplication checks, reportability, investigation depth, root cause, communication, closure and escalation.
Serious incidents and FSCAs are reported within applicable timelines
Document decision trees, awareness dates, MIR and FSCA workflows, authority interaction, follow-up and final reporting.
Statistically significant increases are assessed for trend reporting
Define reportable events, methods, observation periods, thresholds, expected levels and documented decisions.
The PMS report or PSUR is current, approved and distributed as required
Use the correct class-based output and frequency and ensure conclusions update benefit-risk, PMCF and preventive or corrective actions.
Regulatory communication and supply-interruption processes are controlled
Cover authorities, Notified Body, economic operators and customers, including Article 10a notifications where interruption may cause serious harm.
Nonconforming product and process outputs are identified and controlled
Prevent unintended use or release and document evaluation, segregation, concession, correction, rework, scrap and regulatory impact.
CAPA distinguishes immediate correction from systemic root-cause action
Use proportionate investigation, containment, root-cause analysis, action plans, responsibilities, deadlines and escalation.
CAPA effectiveness criteria are defined before closure
Verify that recurrence and risk were reduced using suitable data over a justified period rather than closing on implementation alone.
Quality data are analysed for adverse trends and improvement opportunities
Combine supplier, production, nonconformity, complaint, vigilance, audit, service and process-performance data.
Internal audits cover the full QMS using independent and competent auditors
Base frequency on process and product risk, audit complete process trails and verify effective closure of findings.
Management review evaluates required inputs and makes recorded decisions
Include objectives, audits, feedback, PMS, CAPA, suppliers, regulatory change, resources and process and product performance.
Management review outputs assign actions, owners, resources and deadlines
Track decisions on QMS effectiveness, product improvement, regulatory needs and resources to verified completion.
Clear the search or turn off the open-items filter.
Issue the review
Create a clean PDF or printed checklist
The report excludes website navigation, guidance text, controls, empty project fields and empty comment boxes. In the print dialog, choose Save as PDF or select a printer.
Regulatory basis
Built around MDR Article 10(9) and Annex IX
Every manufacturer needs a QMS proportionate to the risk class and type of device. ISO 13485 is a recognised implementation framework, but the MDR does not make ISO 13485 certification universally mandatory.
Regulation (EU) 2017/745
Current consolidated MDR text, including Article 10 and Annex IX
ISO 13485:2016
Quality management systems for medical devices
Harmonised standards
European Commission explanation and current references
MDCG 2021-5 Rev.1
Questions and answers on standardisation for medical devices
European Commission guidance
Current MDCG documents for manufacturers and assessors
