MDR Article 10(9)(a) · regulatory route · change control
Regulatory compliance strategy under the MDR
A regulatory strategy is the controlled answer to five questions. What is the device, which route applies, what proves conformity, who owns each decision and what can change it?
This guide turns Article 10(9)(a) into a practical decision register that management can approve, project teams can use and a Notified Body can follow.
Build the decision map ↓defensible
routeDecision · evidence · owner · trigger
- 01DefinePurpose and product
- 02RouteClass and assessment
- 03ProveGSPRs and evidence
- 04ControlRelease and change
- 05LearnPMS and reassessment
Every decision points to an approved record and every trigger has an owner
The direct answer
The strategy is part of the QMS, not a presentation about future intentions
Article 10(9)(a) requires the QMS to address a strategy for regulatory compliance, including conformity assessment and procedures for modifications. The test is whether the strategy controls real product decisions.
A documented operating system
- A justified regulatory route for each device or defensible family
- Procedures that keep series production and records conforming
- Defined responsibility, evidence and regulatory communication
- Controlled assessment of device and QMS modifications
- Post-market information that updates the compliance baseline
One mandatory template
- A document with a legally fixed title or chapter order
- The same depth for every device class and technology
- A strategy written only by regulatory affairs
- A substitute for technical documentation or QMS records
- A one-time plan that remains unchanged after certification
Use one controlled corporate method, a device or family decision record, and links to the authoritative evidence. Do not duplicate whole technical files inside the strategy. Record the decision, rationale, owner, source record, status and reassessment trigger.
Nine decisions the strategy must settle
Write the answer, not merely the topic
“Classification applies” is not a strategy. Record which rule applies, why competing rules do not change the result, who approved it and which product change requires reassessment.
- 01PRODUCT BOUNDARY
What exactly is being placed on the EU market?
Fix the legal manufacturer, intended purpose, users, patient population, indications, contraindications, operating principle, variants, accessories and claims. Identify the configuration covered by the decision.
OUTPUTApproved device definition and family rationale
- 02QUALIFICATION AND CLASS
Why is the product in scope and which class applies?
Document the MDR qualification, device or accessory status, applicable Annex VIII rules and the highest resulting class. Address borderline, combination and software questions where relevant.
OUTPUTQualification and classification rationale
- 03CONFORMITY ROUTE
Which legal assessment path leads to CE marking?
Select the applicable route under Annex IX, X or XI and define the Notified Body scope. For eligible Class I devices, document why self-declaration applies and where limited Notified Body involvement is still required.
OUTPUTRoute decision and assessment scope
- 04REQUIREMENTS
Which requirements and accepted solutions apply?
Map the applicable GSPRs, common specifications, harmonised standards and justified alternative solutions. Record versions, transition decisions and evidence expected for each requirement.
OUTPUTGSPR and standards applicability plan
- 05EVIDENCE
What proves safety, performance and clinical benefit?
Connect claims and risks to verification, validation, biological, electrical, software, usability, sterilisation and clinical evidence as applicable. Define acceptance criteria and unresolved gaps.
OUTPUTEvidence plan with gap closure decisions
- 06QMS AND SUPPLY
Which processes and external parties control conformity?
Identify sites, critical suppliers, subcontractors, authorised representatives and other economic operators. Define controls, agreements, records and escalation duties proportionate to risk.
OUTPUTResponsibility and supply-chain control map
- 07MARKET IDENTITY
How will the approved device remain identifiable?
Define Basic UDI-DI and UDI-DI structure, EMDN, label and declaration data, registration ownership, certificate links and country-language requirements. Align every destination to one master record.
OUTPUTUDI, registration and market-data plan
- 08POST-MARKET CONTROL
Which data can change the benefit-risk conclusion?
Define PMS and PMCF objectives, sources, methods, indicators, thresholds, reporting outputs and escalation. State how complaints, literature, vigilance and trends return to risk and clinical evaluation.
OUTPUTPMS feedback and escalation model
- 09MODIFICATIONS
Which changes require internal or external action?
Set impact-assessment criteria for product, process, supplier, software, claim, standard and regulatory changes. Define when the Notified Body, authority, economic operators and registrations must be updated.
OUTPUTChange categories and notification triggers
Choose the assessment route
The strategy changes with the device class
Select a route to see the minimum decision the strategy should make. These summaries do not replace a device-specific classification and conformity assessment analysis.
Self-declaration after the manufacturer demonstrates conformity
For a Class I device that is not sterile, measuring or a reusable surgical instrument, the manufacturer generally completes the applicable conformity assessment without Notified Body involvement.
- DECIDE
Why every applicable rule results in Class I
- PROVE
Complete technical documentation, clinical evaluation and QMS controls
- CONTROL
Declaration, CE mark, UDI, registration, PMS report and changes
Limited Notified Body involvement for the special Class I aspect
The device remains Class I, but assessment is required for aspects connected to sterile condition, metrology or reuse of reusable surgical instruments.
- DECIDE
Which Is, Im or Ir characteristic applies and why
- PROVE
The specific controlled processes and validations within assessment scope
- CONTROL
Certificate scope, production changes and continuing surveillance
Notified Body conformity assessment before CE marking
Classes IIa, IIb and III require Notified Body involvement. The chosen Annex IX, X or XI route must match the device, QMS, technical documentation and assessment scope.
- DECIDE
Route, codes, device groups, sites and application scope
- PROVE
QMS conformity and the required depth of technical and clinical evidence
- CONTROL
Certificate conditions, surveillance, PSUR and reportable changes
Qualify the function before applying Rule 11
Software is not classified by deployment platform or development effort. Start with the medical purpose and the significance of the information, decision or physiological monitoring performed.
- DECIDE
Medical-device status, module boundary, Rule 11 outcome and class
- PROVE
Lifecycle, risk, cybersecurity, usability, performance and clinical evidence
- CONTROL
Released version, configuration, algorithm and update impact
Purpose and classification come first
The conformity route is a consequence of the device definition and class. Choosing a familiar Annex first and fitting the device to it later creates contradictions in the application, technical documentation and certificate scope.
The minimum decision register
Give every conclusion an owner and a trigger
This is the core of a useful strategy record. The source remains the authoritative controlled document. The register shows why the decision is valid and when it must return for review.
The strategy must name the device version it governs
Record the product and software configuration, relevant document revisions, certificate status and effective date. Without a baseline, a correct decision can be applied to the wrong device.
Management of modifications
Make reassessment event-driven
An annual review is useful, but it is too late for a change that has already altered classification, evidence, certification, registration or market risk.
Purpose, claims or configuration
Indication, user, population, operating principle, accessory, variant, software function or performance claim
Safety-relevant technical change
Material, component, algorithm, interface, cybersecurity control, energy source, packaging, shelf life or sterilisation
Site, process or supplier change
Manufacturing site, critical supplier, outsourced process, test method, acceptance criterion or quality-system process
Legal or state-of-the-art change
Regulation, common specification, harmonised standard, guidance, competent-authority position or accepted clinical practice
New safety or performance signal
Complaint, incident, trend, literature, PMCF result, registry data, CAPA, recall or competitor information
Certificate, operator or market change
Notified Body, authorised representative, importer, Basic UDI-DI, registration, label language or destination country
- 01DescribeWhat changes and why
- 02CompareAgainst approved baseline
- 03AssessClass, evidence and risk
- 04NotifyWhere required
- 05ReleaseAfter approvals close
- 06ReconcileFiles, labels and data
How an assessor tests the strategy
Expect a trace, not a discussion
A Notified Body can sample one device or process and move through the records. The fastest readiness test is to perform the same trace before application or surveillance.
- 01START
Select one current device and version
Confirm its legal manufacturer, purpose, configuration, market status and certificate coverage.
- 02ROUTE
Rebuild the regulatory conclusion
Check qualification, classification rule, conformity assessment, applicable GSPRs and standards.
- 03EVIDENCE
Follow a claim through the file
Trace the claim to risks, requirements, tests, clinical evidence, labelling and acceptance criteria.
- 04CONTROL
Check release and external data
Compare specifications, suppliers, release records, declaration, certificate, label, UDI and registration.
- 05LIFECYCLE
Return market data to the baseline
Verify that PMS, PMCF, vigilance, CAPA and changes update risk and clinical conclusions where required.
Six weak strategies and their correction
Replace broad statements with controlled decisions
A polished strategy can still be unusable. These failures usually become visible when a project changes, an assessor samples a device or post-market data challenges an earlier conclusion.
“We comply with the MDR”
Name the applicable requirements, route, evidence and exclusions for the actual device.
“The product is Class IIa”
Show the device definition, applicable rules, competing rules and reason for the final class.
“ISO 13485 covers the QMS”
Map MDR-specific duties to procedures, records, responsibilities and product controls.
“The Notified Body will confirm it”
Arrive with a justified route. The assessor evaluates the decision and cannot design it for the manufacturer.
“Regulatory affairs owns compliance”
Assign accountable owners across management, clinical, risk, engineering, quality, supply and post-market work.
“Review annually”
Add event triggers so significant decisions return for assessment before a changed device is released.
Practical questions
Regulatory compliance strategy FAQ
Open the question that affects your document structure, product portfolio, ownership or review cycle.
Is a standalone regulatory compliance strategy document mandatory under the MDR?+
The MDR requires the quality management system to address a strategy for regulatory compliance, but it does not prescribe one document title or template. A controlled master strategy with device or product-family annexes is often practical. Whatever the format, the decisions, responsibilities, evidence and change controls must be documented, current and traceable.
Does a Class I manufacturer need a regulatory compliance strategy?+
Yes. Article 10(9) applies to manufacturers of devices other than investigational devices, and the QMS must be proportionate to the device type and risk class. A Class I strategy can be leaner, but it still needs to justify qualification, classification, self-declaration eligibility, applicable requirements, evidence, registration, PMS and change control.
Can one strategy cover the whole product portfolio?+
A corporate framework can define common methods, governance and procedures. Product-specific decisions should sit in controlled device or family records because intended purpose, classification, conformity route, evidence, suppliers, identifiers and post-market obligations may differ. The family rationale must be defensible and exceptions must remain visible.
Is an ISO 13485 certificate enough to demonstrate the strategy?+
No. ISO 13485 is a valuable quality-management framework, but the MDR strategy must show the actual EU regulatory route and product-specific decisions. An assessor will still expect qualification and classification rationales, conformity assessment, GSPR and evidence planning, UDI and registration controls, PMS, vigilance and procedures for modifications.
Who should own the regulatory compliance strategy?+
Regulatory affairs normally maintains the controlled strategy, but management must approve resources and risk decisions. Clinical, risk, quality, engineering, operations and post-market owners provide and approve their parts. The PRRC has the responsibilities assigned by Article 15, but those duties do not transfer every strategic decision away from management and process owners.
How often should the strategy be reviewed?+
Use both scheduled and event-driven review. A periodic review confirms that the strategy still matches the device and current requirements. Immediate impact assessment is needed for changes to purpose, claims, design, software, materials, suppliers, manufacturing, standards, clinical evidence, PMS signals, certificates, economic operators, identifiers or target markets.
What is the clearest evidence that the strategy works?+
Select one marketed device and trace its intended purpose to qualification, class, conformity route, applicable requirements, risks, verification, clinical evidence, label, UDI, release decision, PMS outputs and approved changes. If the same device version and rationale remain visible across that chain, the strategy is operating rather than merely documented.
Primary sources
Verify device-specific decisions against current sources
The legal text and MDCG guidance can change. Confirm the current official version and the Notified Body’s application requirements before relying on a route.
Regulation (EU) 2017/745
Article 10(9), Article 15, Annex VIII and Annex IX
MDCG guidance index
Current European Commission guidance by subject
MDCG 2021-24 Rev.1
Guidance on classification of medical devices
MDCG 2019-11 Rev.1
Qualification and classification of medical-device software
MDCG 2019-7 Rev.1
Guidance on the person responsible for regulatory compliance
NANDO information system
MDR-designated Notified Bodies and their scopes
Turn regulatory assumptions into approved decisions
Need a defensible MDR regulatory strategy?
MDRC can confirm qualification, classification and conformity routes, structure the decision register, map evidence and QMS dependencies, define change triggers and prepare the strategy for Notified Body assessment.
