EU MDR Technical Documentation: From Annex II Skeleton to Notified-Body Sign-Off

Annex II sets out six sections that every technical file must contain in this order: device description and specification, information to be supplied by the manufacturer (labelling and IFU), design and manufacturing information, general safety and performance requirements (GSPR) conformity, benefit-risk analysis and risk management, and product verification and validation. The order is not optional — notified body reviewers navigate by section number, and a file that puts risk management ahead of GSPR or buries the IFU inside the design section gets sent back before substantive review begins. Build the file with the Annex II headings as top-level chapters and the GSPR table as the navigation spine across them.

Annex I lists 23 general safety and performance requirements with sub-clauses running into the hundreds. The GSPR conformity table maps each applicable requirement to the harmonised standard you used to meet it, the document inside your technical file that demonstrates it, and the location (section and page) of that evidence. Reviewers test the table at random: pick a GSPR, follow the citation to your file, and see if the evidence actually addresses the requirement. Two failure modes recur — citing a standard without showing the test report, and citing 'risk management file' without pointing to a specific hazard and control. The table has to be auditable, not aspirational.

Article 61 and MDCG 2020-13 require a clinical evaluation that is rigorous, documented, and proportionate to the device's risk class. The Clinical Evaluation Report (CER) draws on clinical investigations, published literature, and equivalence assessments (now sharply restricted under MDR), and is updated throughout the device lifecycle. Notified bodies have toughened their review of equivalence claims and routinely reject CERs that lean on equivalence without full technical, biological and clinical comparison data. Class IIb and III devices increasingly need post-market clinical follow-up (PMCF) data feeding the CER, not just legacy literature.

Annex III requires a post-market surveillance (PMS) plan covering the data sources you'll use (complaints, vigilance, scientific literature, registries, user feedback), the methods you'll use to evaluate them, the frequency of evaluation, and the linkage back to the risk management file, the CER, and the GSPR conformity table. For Class IIa and above, the plan output is a Periodic Safety Update Report (PSUR) on a defined cadence; for Class I, a PMS Report. The big inspection finding is a PMS plan that exists in isolation — written, signed, and never fed by real data. Reviewers want to see complaint trends, vigilance reports, and PMCF data actually changing the risk file and the IFU.

Articles 87 to 92 set the vigilance reporting obligations. Serious incidents must be reported via EUDAMED within 15 days (or 2 days for serious public health threat, 10 days for death or serious deterioration). Field Safety Corrective Actions (FSCAs) require a Field Safety Notice, regulator notification, and effectiveness verification. The most common gap is intake — complaints captured at the call centre but not triaged for serious-incident criteria within hours. Build the triage decision into the complaint workflow itself, with a documented rationale for every 'not reportable' decision, not just the reportable ones.

Month 1: gap assessment of the existing technical file against the Annex II structure; identify missing sections, weak GSPR rows, and CER currency issues. Months 2 to 3: rebuild the GSPR table as the navigation spine; close the top 20 highest-risk gaps with verification evidence, risk controls or updated standards citations. Month 4: refresh the CER with current literature and any PMCF data; update the risk management file. Month 5: build or refresh the PMS plan and run a PSUR/PMS Report cycle against real post-market data; wire vigilance triage into the complaint workflow. Month 6: internal review with the PRRC, pre-submission meeting with the notified body if available, then submit. Expect at least one round of clarification questions — that is normal, not a failure.

Notified-body capacity remains the binding constraint, and most NBs are now booking initial reviews 9 to 12 months out. Reviewers have published their top non-conformities year after year, and the list is stable: weak GSPR coverage, equivalence claims unsupported by data, CER without recent PMCF, PMS plan without evidence of use, and vigilance triage that misses the 15-day clock. Manufacturers who fix those five themes proactively cut their certification timeline by months; those who hope the reviewer won't notice end up in a clarification spiral that can add a full review cycle.