EU quality system requirements for medical devices

A manufacturer placing medical devices on the Union market must establish, document and implement a quality management system that ensures compliance with Regulation (EU) 2017/745. The manufacturer must also maintain the system, keep it up to date and continually improve it. The obligation sits in Article 10(9) and applies to manufacturers of devices other than investigational devices. The system covers all parts and elements of the organisation dealing with the quality of processes, procedures and devices, and it governs structure, responsibilities, procedures, processes and management resources.¹

The system operates from the earliest stage of product realisation. Article 10(9)(g) places planning, design, development, production and service provision inside the scope of the system, and Annex IX requires the manufacturer to maintain the effectiveness of the system throughout the life cycle of the devices concerned.¹

The obligation in Article 10(9)

Article 10(9) requires procedures that keep series production in conformity with the Regulation. Changes in device design or characteristics, and changes in the harmonised standards or common specifications by reference to which conformity is declared, must be taken into account adequately and in a timely manner. The quality management system itself must ensure compliance in the most effective manner and in a manner proportionate to the risk class and the type of device.¹

The system must address at least the following aspects:

• a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for managing modifications to devices covered by the system
• identification of the applicable general safety and performance requirements and exploration of options to address them
• responsibility of the management
• resource management, including selection and control of suppliers and sub-contractors
• risk management as set out in Section 3 of Annex I
• clinical evaluation in accordance with Article 61 and Annex XIV, including post-market clinical follow-up
• product realisation, which covers planning, design, development, production and service provision
• verification of the UDI assignments made under Article 27(3) and the consistency and validity of information provided under Article 29
• setting-up, implementation and maintenance of a post-market surveillance system in accordance with Article 83
• handling of communication with competent authorities, notified bodies, other economic operators and customers
• processes for reporting serious incidents and field safety corrective actions in the context of vigilance
• management of corrective and preventive actions and verification of their effectiveness
• processes for monitoring and measurement of output, data analysis and product improvement.¹

Design and development inside the system

Annex IX, Section 2.2(c) sets out what the design part of the system contains. The manufacturer must have procedures and techniques for monitoring, verifying, validating and controlling the design of the devices, together with the corresponding documentation and the data and records arising from those procedures. Those procedures specifically cover the regulatory compliance strategy, identification of the applicable general safety and performance requirements, risk management under Section 3 of Annex I and the clinical evaluation under Article 61 and Annex XIV.¹

The same provision requires solutions for the design and construction requirements of Chapter II of Annex I, including appropriate pre-clinical evaluation, and solutions for the information requirements of Chapter III of Annex I. It also requires device identification procedures drawn up and kept up to date from drawings, specifications or other relevant documents at every stage of manufacture. Management of design changes and of quality management system changes forms part of the same set of procedures.¹

Because the records arising from these procedures are the evidence the notified body assesses, the system must be operating while design decisions are taken. Annex IX, Section 2.2(d) and (e) then extend the same logic to production. These points cover verification and quality assurance techniques at the manufacturing stage, particularly for sterilisation. They also cover the tests and trials carried out before, during and after manufacture. The calibration of the test equipment used must be adequately traceable.¹

The person responsible for regulatory compliance

Article 15 requires the manufacturer to have available within its organisation at least one person responsible for regulatory compliance with the requisite expertise in the field of medical devices. That expertise is demonstrated either by a university-level qualification in law, medicine, pharmacy, engineering or another relevant scientific discipline together with one year of professional experience in regulatory affairs or in quality management systems relating to medical devices, or by four years of such professional experience. Manufacturers of custom-made devices may demonstrate the requisite expertise by two years of professional experience within a relevant field of manufacturing.¹

Micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC are exempt from the requirement to hold the person inside the organisation. Those enterprises must have such a person permanently and continuously at their disposal. Authorised representatives are subject to the same arrangement under Article 15(6), with the same two qualification routes.¹

The person responsible for regulatory compliance is responsible at least for ensuring that:

• the conformity of devices is appropriately checked in accordance with the quality management system before a device is released
• the technical documentation and the EU declaration of conformity are drawn up and kept up to date
• the post-market surveillance obligations under Article 10(10) are complied with
• the reporting obligations in Articles 87 to 91 are fulfilled
• for investigational devices, the statement in Section 4.1 of Chapter II of Annex XV is issued.¹

Where several persons share the role, their respective areas of responsibility must be stipulated in writing. Article 15(5) provides that the person suffers no disadvantage within the manufacturer’s organisation in relation to the proper fulfilment of those duties. That protection applies whether or not the person is an employee of the organisation.¹

What the notified body receives and assesses

Under Annex IX, Section 2.1, the manufacturer lodges an application for assessment of its quality management system with a notified body. The application identifies the manufacturer, its registered place of business and any additional manufacturing site covered by the system. It includes a written declaration that no application for the same device-related quality management system has been lodged with another notified body, a draft EU declaration of conformity, the quality management system documentation and documented descriptions of the procedures in place. Documentation on the post-market surveillance system, the post-market clinical follow-up plan where applicable and the clinical evaluation plan forms part of the same application.¹

Section 2.2 requires all elements, requirements and provisions adopted for the system to be documented in a systematic and orderly manner. The documentation takes the form of a quality manual and written policies and procedures such as quality programmes, quality plans and quality records. The documentation must describe the quality objectives and the organisation of the business, including organisational structures with staff responsibilities for critical procedures and the organisational authority of managerial staff. Where design, manufacture or final verification and testing is carried out by another party, the documentation must describe the methods of monitoring that party and the type and extent of control applied. The manufacturer must also grant the notified body access to the technical documentation referred to in Annexes II and III.¹

Audit, certification and surveillance

The notified body audits the system against Section 2.2. Where the manufacturer uses a harmonised standard or common specification related to a quality management system, the notified body assesses conformity with it and presumes conformity with the requirements covered, unless it duly substantiates doing otherwise. The audit team includes at least one member with past experience of assessments of the technology concerned. The procedure includes an audit on the manufacturer’s premises and, where appropriate, on the premises of suppliers and sub-contractors. Where the system conforms, the notified body issues an EU quality management system certificate and notifies the manufacturer of its decision, which contains the conclusions of the audit and a reasoned report.¹

Surveillance continues for as long as the certificate is in force. Notified bodies carry out audits and assessments at least once every 12 months to confirm that the manufacturer applies the approved system and the post-market surveillance plan. They also perform unannounced on-site audits at random at least once every five years, following a plan that is withheld from the manufacturer. During unannounced audits the notified body tests an adequate sample of the devices produced or an adequate sample from the manufacturing process, and instead of or in addition to that sampling it takes samples of devices from the market.¹ Where a divergence is found between a sample and the technical documentation or approved design, the notified body suspends the certificate, withdraws it or imposes restrictions on it.¹

Surveillance content varies by class. For class IIa and class IIb devices, the surveillance assessment includes assessment of technical documentation for further representative samples. For class III devices, it includes a test of the approved parts and materials essential to the integrity of the device, with a check where appropriate that quantities of parts and materials correspond to quantities of finished devices. As a general rule, a lead auditor neither leads nor attends audits for more than three consecutive years for the same manufacturer.¹

Changes to the system and to approved devices

The manufacturer must inform the notified body that approved the system of any plan for substantial changes to the system or to the device range covered. The notified body assesses the proposed changes, determines whether additional audits are needed and verifies continued compliance with Section 2.2. Approval of a substantial change takes the form of a supplement to the EU quality management system certificate.¹

Where an EU technical documentation assessment certificate has been issued, changes to the approved device require approval from the issuing notified body if they could affect safety, performance or the prescribed conditions of use. The notified body decides whether the change requires a new conformity assessment under Article 52 or can be handled through a supplement to the certificate.¹

Records and legacy devices

Article 10(8) requires the manufacturer to keep the technical documentation, the EU declaration of conformity and copies of relevant certificates available to competent authorities for at least 10 years after the last device covered has been placed on the market. For implantable devices the period is at least 15 years. A manufacturer with a registered place of business outside the Union must ensure that its authorised representative has the necessary documentation permanently available.¹

For devices still relying on certificates issued under Directive 90/385/EEC or Directive 93/42/EEC, Article 120(3c)(d) made a quality management system in accordance with Article 10(9) a condition of the extended transition. That system had to be in place no later than 26 May 2024. The extended placing dates run to 31 December 2027 for class III devices and class IIb implantable devices other than the listed exceptions, and to 31 December 2028 for other class IIb devices, class IIa devices and class I devices placed on the market in sterile condition or having a measuring function. Article 120(3d) applies the Regulation’s requirements on post-market surveillance, market surveillance, vigilance and registration to those devices in place of the corresponding requirements in the directives. Article 123(3)(d) sets the application of Article 120(3d) at six months from publication of the notice referred to in Article 34(3).¹

Questions people also ask

Does the quality management system requirement apply to class I devices?

Article 10(9) applies to manufacturers of devices other than investigational devices and draws no distinction by risk class. The provision requires the system to ensure compliance in a manner proportionate to the risk class and the type of device, so the depth of the system scales with the device. Notified body assessment of the system under Annex IX arises where the conformity assessment procedure for the device involves a notified body.¹

Is certification to a particular quality standard required?

The Regulation states the required content of the system in Article 10(9) and Annex IX rather than naming a standard. Annex IX, Section 2.3 provides that where a manufacturer uses a harmonised standard or common specification related to a quality management system, the notified body assesses conformity with it. The notified body then presumes that a system satisfying those standards conforms to the requirements they cover, unless it duly substantiates a different conclusion.¹

How often does a notified body audit a certified quality management system?

Annex IX, Section 3.3 requires audits and assessments at least once every 12 months. These include audits on the premises of the manufacturer and, where appropriate, of suppliers and sub-contractors. Section 3.4 adds random unannounced on-site audits at least once every five years, which may be combined with the periodic surveillance assessment or carried out in addition to it. The notified body provides a surveillance audit report and, where a test has been carried out, a test report.¹

Can a small company use an external person responsible for regulatory compliance?

Article 15(2) provides that micro and small enterprises within the meaning of Commission Recommendation 2003/361/EC must have such a person permanently and continuously at their disposal. Those enterprises are not required to have the person within their organisation. The qualification requirements in Article 15(1) apply in the same way, and Article 15(5) protects the person from disadvantage regardless of whether they are an employee.¹

What must a manufacturer tell the notified body before changing its quality management system?

Annex IX, Section 2.4 requires the manufacturer to inform the notified body that approved the system of any plan for substantial changes to the system or to the device range covered. The notified body assesses the proposed changes and decides whether further audits are needed. Approval is given through a supplement to the EU quality management system certificate.¹

Footnotes

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC. Consolidated version of 2026-07-19. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0745-20260719 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²² ↩²³ ↩²⁴ ↩²⁵ ↩²⁶