EU MDR compliance is document-heavy by design. Regulation (EU) 2017/745 does not hand you a checklist — it hands you Annexes II, III, IX, and XIV and expects you to understand how they connect. This guide translates the legal architecture into a practical document list, organised by what the law requires, what Notified Bodies expect in practice, and what changes by device class. It draws on MegaCert's experience conducting MDR audits and technical file reviews across multiple device categories.
The legal foundation — where the document requirements actually come from
The obligation to prepare technical documentation sits in a single sentence in Article 10(4) of Regulation (EU) 2017/745:
"Manufacturers of devices other than custom-made devices shall draw up and keep up to date technical documentation for those devices. The technical documentation shall be such as to allow the conformity of the device with the requirements of this Regulation to be assessed. The technical documentation shall include the elements set out in Annexes II and III."
Two things in that sentence are worth pausing on. First, the requirement applies to all manufacturers except custom-made device manufacturers — regardless of risk classification. A Class I non-sterile, non-measuring device with no Notified Body involvement still requires complete technical documentation under Annexes II and III.
Second, Annexes II and III are not the only source of document requirements. The QMS obligation flows from Article 10(9). The Declaration of Conformity from Article 19. The PRRC appointment from Article 15. EUDAMED registration from Article 31. The technical file itself typically includes an administrative Section 0 — Declaration of Conformity, Notified Body agreements, ISO certificates — that MDR does not explicitly mandate but that every experienced practitioner includes as standard.
The core document set — required for all device classes
Seven document categories are required regardless of device class. These are the non-negotiables before any Notified Body involvement question arises.
1. Technical Documentation (Annex II)
The primary evidence dossier for your device. Structured across six sections covering device description, labelling and IFU, design and manufacturing information, GSPR compliance demonstration, risk management, and verification and validation data. Per MDR Article 10(4), this documentation must be kept up to date throughout the device lifecycle — it is not a one-time submission.
2. Post-Market Surveillance Technical Documentation (Annex III)
Separate from Annex II and consistently undertreated. Annex III covers the PMS plan, PSUR or PMSR depending on device class, and for Class IIb and III devices, the PMCF plan and report. The distinction between Annex II and Annex III matters: Annex II documents what your device is and how it was developed; Annex III documents what happens after it reaches the market.
3. EU Declaration of Conformity
A legally binding statement by the manufacturer that the device meets the requirements of MDR. MDR Article 19 and Annex IV specify the mandatory content, including device identification, applicable standards, conformity assessment procedure used, and the manufacturer's name and address. A DoC without a corresponding complete technical file is meaningless — but a complete technical file without a current, accurate DoC prevents CE marking.
4. Risk Management File (ISO 14971)
The risk management file must demonstrate a complete lifecycle approach per ISO 14971, including hazard analysis, risk evaluation, risk control, residual risk assessment, and a concluding benefit-risk determination. MDR does not mandate ISO 14971 by name, but it is a harmonised standard and its use creates a presumption of conformity with the relevant GSPRs in Annex I.
5. Clinical Evaluation Report (CER)
Required for all device classes — including Class I. A common misconception is that low-risk devices can skip clinical evaluation if no clinical investigation was conducted. A CER is still required even where the evidence base is entirely literature-derived. The CER must be kept current and updated with post-market data.
6. QMS Documentation (Article 10(9))
MDR Article 10(9) mandates a quality management system for developing, manufacturing, and post-market monitoring. ISO 13485 certification is not legally mandatory under MDR, but it is the most practical route to demonstrating compliance — Annexes ZA and ZB of ISO 13485:2016+A11:2021 map directly to MDR and IVDR requirements. For Class I devices with no NB involvement, the QMS does not need to be third-party certified, but it must exist and be documented.
7. Labels and Instructions for Use (IFU)
Labels and IFU must comply with Annex I Chapter III of MDR and meet language requirements for each Member State where the device is placed on the market. Labelling compliance is one of the most common sources of NB queries — particularly for manufacturers entering multiple EU markets simultaneously.
What goes inside the Technical File — Annex II section by section
Annex II of MDR specifies six sections, each with defined content requirements. In practice, NB reviewers do not read technical files linearly — they move between sections to verify internal consistency. Dossiers that require reviewers to search for connections between claims and evidence are the primary cause of review delays.
- Section 1 — Device description: intended purpose, variants, accessories, classification rationale, principles of operation. Most common gap: vague intended purpose statements that do not support classification rationale.
- Section 2 — Information supplied by manufacturer: labels, IFU, UDI. Most common gap: missing language versions; IFU not updated to reflect design changes.
- Section 3 — Design and manufacturing: design inputs/outputs, manufacturing process, critical suppliers. Most common gap: supplier controls not documented; manufacturing flowchart absent.
- Section 4 — GSPR compliance: mapping of each applicable GSPR to evidence of conformity. Most common gap: incomplete GSPR checklist; claimed standards not verified against current versions.
- Section 5 — Risk/benefit analysis: risk management summary referencing ISO 14971 file. Most common gap: summary not linked to full risk management file; residual risk not addressed.
- Section 6 — Verification, validation, clinical evaluation: V&V protocols and reports; CER with literature review and clinical data appraisal. Most common gap: CER not updated post-market; literature search methodology not documented.
Annex III — the PMS documentation most manufacturers underestimate
Annex III is legally separate from Annex II and covers post-market surveillance documentation specifically. It is the part of MDR compliance that most manufacturers underestimate at first submission — and the part most frequently cited as the cause of NB review delays.
The specific Annex III documents required vary by device class:
- For all device classes: Post-Market Surveillance Plan (PMSP) — a documented, proactive system for collecting and analysing post-market data.
- For Class IIa devices: Post-Market Surveillance Report (PMSR) — periodic summary of PMS conclusions; must be updated when significant changes occur or at least every two years.
- For Class IIb and Class III devices: Periodic Safety Update Report (PSUR) — more comprehensive than PMSR; updated annually for Class III and annually for Class IIb implantable devices. Plus a Post-Market Clinical Follow-Up (PMCF) Plan under Annex XIV Part B, and a PMCF Evaluation Report used to update the CER.
The PMCF plan is where manufacturers most frequently underinvest at initial certification. Notified Bodies are increasingly scrutinising PMCF plans at the point of initial certification, not just at reassessment.
How document requirements change by device class
All device classes share the core document set above. What changes is the depth of evidence required, the conformity assessment route, and the degree of Notified Body involvement. Class I (non-sterile, non-measuring) devices need technical documentation, a self-declaration DoC, a risk management file, a CER, and a documented QMS — without third-party certification. Class IIa adds NB involvement, a PMSR, and a PMCF plan. Class IIb requires an annual PSUR (for implantables), and Class III adds the Summary of Safety and Clinical Performance (SSCP) and scrutiny procedures. Class Is (sterile) and Class Im (measuring function) require partial Notified Body involvement even though they are otherwise Class I devices — a distinction that consistently catches first-time MDR manufacturers unprepared.
Three documents manufacturers consistently get wrong
MegaCert's experience conducting MDR technical file review and audit work reveals three documents that are systematically underprepared — not because manufacturers do not know they exist, but because MDR's requirements for them are more demanding than most guides suggest.
1. The Clinical Evaluation Report — treated as a one-time document
The most common finding is a CER that was prepared for initial certification and has not been updated since. MDR requires the CER to be a living document, updated with post-market data. A CER that does not incorporate PMCF outputs, vigilance data, or updated literature searches will not satisfy NB reviewers at reassessment — and is increasingly being raised at initial certification review as well.
2. The GSPR compliance table — incomplete or disconnected from evidence
Section 4 of the technical file requires a complete mapping of every applicable General Safety and Performance Requirement from Annex I to the specific evidence of conformity — whether a harmonised standard, a Common Specification, or an alternative method. A GSPR table is only as useful as the document references it contains.
3. The Post-Market Clinical Follow-Up plan — submitted as a template
PMCF plans are frequently submitted as lightly modified versions of generic templates, with methods, timelines, and acceptance criteria that do not reflect the specific device, its intended patient population, or the clinical questions that remain open after initial certification. A PMCF plan that reads like a template will be treated like one.
Administrative documents — required in practice, not always in law
Experienced MDR regulatory practitioners typically organise an administrative Section 0 at the front of the technical file. This section is not explicitly mandated by MDR but is expected by every NB reviewer: Declaration of Conformity (current and signed), Notified Body cover letter, Notified Body agreement, EU Authorised Representative agreement (mandatory for manufacturers outside the EU/EEA), ISO 13485 certificate (if held), previous NB audit findings and responses, and current in-scope EU certificates from the NB. Presenting these in a clearly organised Section 0 reduces NB query volume at the start of a review.
PRRC, EUDAMED, and UDI — the obligations outside the technical file
MDR compliance extends beyond the technical file. Three additional obligations apply to all manufacturers placing devices on the EU market.
Person Responsible for Regulatory Compliance (PRRC): MDR Article 15 obliges all manufacturers to designate at least one qualified PRRC, permanently and continuously at their disposal. The qualification criteria are specific — a degree in law, medicine, pharmacy, engineering, or a natural science, plus at least one year of professional experience in regulatory affairs or QMS. Manufacturers that cannot meet this internally can appoint an external qualified individual.
EUDAMED registration: All economic operators must register in the European database on medical devices. Device registration in EUDAMED is required before CE marking can be applied. The phased rollout of EUDAMED modules is ongoing; the European Commission declared the first four modules functional in 2025.
Unique Device Identification (UDI): Every device placed on the EU market must carry a UDI — a unique numeric or alphanumeric code that identifies the device model and the specific production unit. UDI data must be submitted to EUDAMED.
Frequently asked questions
Is technical documentation required for Class I medical devices?
Yes. MDR Article 10(4) requires technical documentation for all manufacturers except custom-made device manufacturers, regardless of device class. Class I devices with no Notified Body involvement for conformity assessment still require a complete technical file under Annexes II and III, a risk management file, a clinical evaluation report, and QMS documentation.
Do I need a Clinical Evaluation Report for a low-risk device?
Yes. A CER is required for all device classes under MDR. For low-risk devices where no clinical investigation was conducted, the CER will be literature-based — but it must still be prepared, documented, and kept current with post-market data. There is no device class for which a CER can be omitted.
What is the difference between Annex II and Annex III documentation?
Annex II covers the core technical documentation — device description, design and manufacturing information, GSPR compliance, risk management, and clinical evaluation. Annex III covers post-market surveillance technical documentation — the PMS plan, PSUR or PMSR, and for Class IIb and III devices, the PMCF plan and report.
Does ISO 13485 certification satisfy the MDR QMS requirement?
Not automatically, but effectively. MDR Article 10(9) mandates a QMS — it does not mandate ISO 13485 certification. However, ISO 13485:2016+A11:2021 is a harmonised standard for MDR, and its Annex ZA maps directly to MDR QMS requirements. In practice, ISO 13485 certification is the most efficient route to demonstrating Article 10(9) compliance.