The MDR, Regulation (EU) 2017/745, was adopted on 5 April 2017 and has applied since 26 May 2021, replacing Directives 93/42/EEC and 90/385/EEC. Regulation (EU) 2023/607 extended the transition for legacy devices to 31 December 2027 or 31 December 2028, depending on class. The first four EUDAMED modules have been mandatory since 28 May 2026 (European Commission).
The MDR is easier to work with when each obligation is traced to the article that creates it and the annex that defines the evidence. This article does that for manufacturers, in one table and a short explanation of each block. Our article on Europe MDR regulation covers the same regulation from a software angle.
Article 10: where the obligations start
Article 10 lists the manufacturer's general obligations. Read on its own, it produces policies. Read with the annexes, it tells you what evidence a notified body or competent authority will expect.
In summary, a manufacturer must:
meet the general safety and performance requirements (GSPR) in Annex I;
have a risk management system and a quality management system (Article 10(2) and 10(9));
carry out a clinical evaluation (Article 61 and Annex XIV);
draw up and keep up to date technical documentation (Article 10(4), Annexes II and III);
complete the applicable conformity assessment, draw up the EU declaration of conformity and affix the CE mark (Articles 19, 20 and 52);
meet the UDI and registration obligations (Articles 27, 29 and 31);
run a post-market surveillance system (Article 10(10) and Articles 83 to 86);
report serious incidents and field safety corrective actions (Articles 87 to 89);
have measures to provide sufficient financial coverage for liability (Article 10(16)).
Since Regulation (EU) 2024/1860, Article 10a also requires manufacturers to give advance notice of an anticipated interruption or discontinuation of supply of certain devices.
The reference table
| Obligation | MDR article | Annex or guidance |
|---|---|---|
| Qualification and scope | Art. 2(1) | Annex XVI; MDCG 2019-11 Rev.1 (software) |
| Classification | Art. 51 | Annex VIII; MDCG 2021-24 Rev.1 |
| General safety and performance requirements | Art. 5(2) | Annex I |
| Quality management system | Art. 10(9) | Annex IX (where applicable) |
| Person responsible for regulatory compliance | Art. 15 | MDCG 2019-7 Rev.1 |
| Technical documentation | Art. 10(4) | Annexes II and III |
| Clinical evaluation | Art. 61 | Annex XIV; MDCG 2020-1 (software) |
| Clinical investigations | Arts. 62 to 82 | Annex XV |
| Conformity assessment | Art. 52 | Annexes IX to XI |
| EU declaration of conformity | Art. 19 | Annex IV |
| CE marking | Art. 20 | Annex V |
| UDI and registration | Arts. 27, 29 and 31 | Annex VI |
| Post-market surveillance plan and system | Arts. 83 and 84 | Annex III; MDCG 2025-10 |
| PMS report (class I) | Art. 85 | Annex III |
| PSUR (class IIa, IIb and III) | Art. 86 | MDCG 2022-21 |
| Serious incidents and FSCAs | Art. 87 | MDCG 2023-3 Rev.2 |
| Trend reporting | Art. 88 | MDCG 2023-3 Rev.2 |
| Supply interruption | Art. 10a | Regulation (EU) 2024/1860 |
Sources: MDR; MDCG guidance documents.
In our view, the table is only useful if each row ends in a record. For every obligation that applies to your device, you should be able to point to a document, a record set or a controlled process.
Classification decides the workload
Article 51 and the 22 rules in Annex VIII set the class: I, IIa, IIb or III. The class determines the conformity assessment route, the level of notified body involvement, the clinical evidence expected and the PSUR frequency. MDCG 2021-24 Rev.1 explains the rules.
For software, Rule 11 applies. Software that provides information used for diagnostic or therapeutic decisions is class IIa, class IIb where those decisions may cause a serious deterioration of health or a surgical intervention, and class III where they may cause death or an irreversible deterioration of health. Software that monitors physiological processes is class IIa, or IIb for vital parameters where variations could result in immediate danger. All other software is class I. MDCG 2019-11 Rev.1 covers qualification and classification of software.
Our article on classification of medical devices compares the EU rules with FDA's system.
GSPR and technical documentation
Annex I sets the general safety and performance requirements. Annexes II and III say how the evidence is organised: the technical documentation, and the technical documentation on post-market surveillance.
For software, Annex I Section 17 is the key provision. Software must be developed and manufactured in accordance with the state of the art, taking into account the development life cycle, risk management including information security, and verification and validation. Section 17.4 requires the manufacturer to set out the minimum hardware, IT network and IT security requirements needed to run the software as intended. MDCG 2019-16 Rev.1 gives guidance on cybersecurity.
In our view, a GSPR checklist is only as good as the evidence it points to. Each applicable requirement should reference a specific record, and each non-applicable requirement should have a short justification. Our article on SaMD technical documentation shows how this works for software.
Clinical evaluation and PMS
Article 61 and Annex XIV require a clinical evaluation for every device, planned and kept up to date. Our article on the clinical evaluation report covers this in detail.
Post-market surveillance runs on a PMS plan under Article 84 and Annex III. The output depends on the class:
| Class | Output | Minimum update |
|---|---|---|
| I | PMS report (Art. 85) | When necessary |
| IIa | PSUR (Art. 86) | When necessary and at least every two years |
| IIb and III | PSUR (Art. 86) | At least annually |
Source: MDR Articles 85 and 86.
Our article on the post-market surveillance plan explains how to write one.
Vigilance deadlines
Article 87 sets the reporting periods for serious incidents:
immediately, and not later than 15 days after becoming aware of the incident (Article 87(3));
not later than 2 days in the event of a serious public health threat (Article 87(4));
not later than 10 days in the event of death or an unanticipated serious deterioration in a person's state of health (Article 87(5)).
Trend reporting under Article 88 covers statistically significant increases in non-serious incidents or expected undesirable side-effects. MDCG 2023-3 Rev.2 explains the terms and concepts.
The PRRC
Article 15 requires manufacturers to have at least one person responsible for regulatory compliance (PRRC) within their organisation. Micro and small enterprises do not need one in-house, but must have such a person permanently and continuously at their disposal. Our article on the role of the PRRC covers the qualifications and tasks.
Transition and EUDAMED
Under Article 120 as amended by Regulation (EU) 2023/607, eligible legacy devices may stay on the market until:
31 December 2027: class III devices and class IIb implantable devices, except items such as sutures, staples, screws and plates;
31 December 2028: other class IIb devices, class IIa devices, and class I devices that need notified body involvement under the MDR.
The extension only applies if the conditions in Article 120(3c) are met. These include continued compliance with the directive, no significant changes in design or intended purpose, an MDR quality management system in place, and a formal application to and written agreement with a notified body by the set deadlines. The Commission Q&A explains the conditions.
The Actor, UDI/Device, Notified Bodies and Certificates, and Market Surveillance modules of EUDAMED have been mandatory since 28 May 2026. Our EUDAMED and UDI registration checklist sets out what to register.
Is the MDR changing?
On 16 December 2025 the Commission adopted COM(2025) 1023, a proposal to amend the MDR and IVDR to simplify the rules and reduce the burden. It is still going through the legislative procedure. Until it is adopted, it does not change any current obligation.
Conclusion
The MDR is a connected set of obligations. Article 10 sets the duties, the annexes define the evidence, and Article 51 with Annex VIII decides how heavy the conformity route is.
In our view, the most useful thing a manufacturer can do is keep one traceable line from intended purpose to classification, GSPR evidence, clinical evaluation and post-market action. If one link changes, the others should be reviewed.
If you need help mapping the MDR to your device, our regulatory strategy team can help, or contact MedQAIR.
Frequently asked questions
Does the MDR apply to software?
Yes, when the manufacturer intends the software for a medical purpose within Article 2(1). Software is classified under Article 51 and Annex VIII, mainly Rule 11.
How often must a PSUR be updated?
At least annually for class IIb and III devices, and when necessary and at least every two years for class IIa devices (Article 86). Class I devices need a PMS report instead (Article 85).
Who needs a PRRC?
Manufacturers and authorised representatives (Article 15). Micro and small enterprises may have the PRRC permanently and continuously at their disposal rather than in-house.
When does the transition end for legacy devices?
31 December 2027 for class III and class IIb implantable devices, and 31 December 2028 for other eligible devices, provided the Article 120(3c) conditions are met.
What is the deadline for reporting a serious incident?
Not later than 15 days after becoming aware of it, 10 days for a death or unanticipated serious deterioration in health, and 2 days for a serious public health threat (Article 87).
