EU MDR 2017/745 – Medical Device Regulation

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • EU Medical Device Compliance, UDI/EUDAMED, Clinical & Post‑Market • QA/RA, Manufacturing, Distribution, IT/OT

EU MDR 2017/745 is the European Union’s comprehensive framework governing the safety, performance, and market access of medical devices. Compared to the legacy Directives (MDD/AIMDD), MDR raises the bar on evidence (clinical, post‑market), governance (QMS, Document Control, Internal Audit), and traceability (unique device identification—UDI—and supply‑chain controls in WMS/MES). MDR isn’t only a technical file; it’s an operational system where every design decision, label, and lot can be defended under regulated, auditable controls.

“MDR compliance is not a binder on a shelf—it’s a living system of design control, production evidence, UDI traceability, and post‑market learning.”

1) What MDR Covers—and What It Does Not

Covers: device classification and conformity routes; technical documentation (Annex II/III structure), GSPRs (general safety and performance requirements), clinical evaluation/PMCF, PMS/vigilance and PSUR, economic operators (manufacturer, authorized representative, importer, distributor), UDI assignment/labeling, and oversight by Notified Bodies and competent authorities. MDR expects a living QMS with auditable records (audit trails, retention) across design, manufacturing, and distribution.

Does not cover: replacing your QMS with paperwork. MDR assumes you run to standards—ISO 13485 for QMS, ISO 14971 for risk, process validation/TMV—and it expects your evidence to be attributable, contemporaneous, and complete (Data Integrity, Part 11‑style controls for e‑records).

2) Economic Operators & Governance

MDR defines roles and responsibilities across the supply chain. The manufacturer owns conformity and post‑market duties; the authorized representative acts for non‑EU manufacturers; importers and distributors must verify labeling/UDI and maintain traceability. Internally, appoint a PRRC (person responsible for regulatory compliance) and embed cross‑functional ownership through your Policies, SOPs, and Training Matrix. Tie supplier roles to Vendor Qualification, SQM, and SCAR so outsourced processes remain under control.

3) Classification & Conformity Assessment

Device classification (Class I, IIa, IIb, III) determines the route to conformity assessment and the depth of clinical/performance evidence. Even Class I may require Notified Body involvement when sterile, measuring, or reusable surgical instruments. Build classification logic into Knowledge Management and MOC so design/use changes trigger review. For drug‑device combinations, align with quality and labeling controls (Labeling Control) and ensure manufacturing control plans are validated (PCP, PV, PPQ).

4) Technical Documentation & Design Control

MDR requires structured technical documentation supporting safety and performance claims. Map MDR Annex II/III sections to your controlled records: design inputs/outputs, risk files, clinical evaluation, manufacturing controls, validation, and PMS plan. Maintain a rigorous Design History File (DHF) and downstream production records (DHR) so as‑built equals as‑designed. For software devices, treat requirements, code control, verification/validation, and cybersecurity as formal design elements, governed in the same Document Control system as labeling and manufacturing instructions.

Verification/validation should follow risk‑based methods: V&V strategy, TMV for measurement methods, and process qualification (IQ/OQ/PQ). Capture objective evidence in controlled forms and link to change records so auditors can trace requirement → test → result → release.

5) GSPRs & Risk Management

The MDR GSPRs require a comprehensive, lifecycle risk approach. Implement a top‑to‑bottom risk file per ISO 14971: hazard identification, risk estimation, control selection, and verification of control effectiveness. Feed process risks into manufacturing plans (PFMEA, PCP), then watch them in production using SPC (control limits, X‑bar/R) and capability (Cp/Cpk). Close the loop with CAPA when signals appear.

Support risk decisions with calibrated, qualified measurements: MSA, ISO/IEC 17025 lab references, environmental controls (EM, temperature mapping), and validated cleaning (cleaning validation).

6) Clinical Evaluation, PMCF & Evidence

MDR expects an ongoing clinical evaluation supported by post‑market clinical follow‑up (PMCF) where needed. Evidence should match claims and intended use—clinical literature, investigations, or performance studies, depending on device type and risk class. Integrate clinical plans with QbD and design outputs, then monitor real‑world performance in PMS (complaints, trend reports) to refresh the clinical evaluation with current data.

Treat datasets as controlled records under Data Integrity with audit trails and retention policies. When changes occur (materials, software, labelling), trigger MOC and update clinical documentation accordingly.

7) UDI, Labeling & EUDAMED Readiness

MDR mandates UDI at the unit of use and higher packaging levels, anchored by a Basic UDI‑DI that groups device variants for regulatory submissions. Generate UDIs from governed masters (GS1 GTIN, GS1 AIs), print with controlled templates (Labeling Control), and verify print/scan quality at the line (Label Verification, optional Machine Vision).

Downstream, keep identity consistent through cases/pallets using SSCC and validated packing flows (Cartonization, Pack & Ship). In the warehouse, enforce status and identity with Directed Put‑Away, Directed Picking, and Hold/Release so the label always matches the shippable truth.

8) PMS, Vigilance, PSUR & Trending

Build a proactive PMS system: complaint handling, vigilance, trend reporting, and periodic safety updates (PSUR) for higher‑risk classes. Route each signal into your CAPA and risk files; verify effectiveness through CPV and management review. Use RCA methods, escalate systemic issues via MOC, and ensure Record Retention supports statutory timeframes.

When field actions are required, fuse traceability with distribution reality (WMS, shipping docs) to reach affected customers quickly. Practice with recall readiness drills and measure time‑to‑notification as a KPI.

9) Manufacturing Controls Under MDR

MDR expects controlled, validated production with full genealogy. Anchor operations in an integrated MES and WMS that enforce identity, status, and line clearance. Use eBMR to capture DHR evidence, controlled weighing (gravimetric) with device status (calibration), and qualified utilities/equipment (UQ, IQ/OQ/PQ).

Prevent wrong‑part or wrong‑status usage with hard gating, dual verification on high‑risk steps, and barcode verification at kit/issue. For sterile or measuring functions, respect minimum weight/accuracy (load cells, MSA) and environmental states (EM).

10) Labeling, IFU & Language Control

Labels and IFUs must reflect the approved claims, UDI, symbols, and language requirements for the target markets. Treat content as controlled master data under Labeling Control, tie variable data to the device record (DHR), and verify every print online (Label Verification). For multi‑market packs, centralize templates and drive content by market master to avoid local, uncontrolled edits.

For eIFU (where permitted), govern publication under retention/archival, with access management and audit trails to show integrity over time.

11) Suppliers, Outsourcing & Purchased Product

Notified Bodies expect documented control of suppliers and outsourced processes. Run a risk‑based qualification and monitoring program (SQM), align quality expectations in a Quality Agreement, and manage issues with SCAR. Tie receiving to Goods Receipt with default QA Hold, Incoming Inspection, and controlled Component Release—no uncontrolled stock into production.

For critical services (sterilization, test labs), require accreditation or equivalent evidence (ISO/IEC 17025), and verify transport/handling conditions (dock‑to‑stock rules, temperature controls) to protect product state.

12) Distribution, Returns & Traceability

Maintain identity and status through distribution with WMS enforcement: location topology, FEFO (First‑Expire, First‑Out) for dated items, and blocked moves for quarantined stock. Use Pack & Ship to reconcile scans to picks and shipping docs (manifest, BOL). For returns, run RMA workflows that quarantine on receipt, inspect, and disposition under NCR/CAPA when systemic issues emerge.

End‑to‑end traceability (component → lot → shipment) should be queryable within minutes, not days—practice with recall drills and publish metrics in your KPIs.

13) Data Integrity, Validation & E‑Records

Operate electronic systems under risk‑based CSV (GAMP 5) and Part 11‑style controls—unique users, e‑signatures with meaning, synchronized time, and immutable audit trails. Retire “shadow spreadsheets” and capture execution truth in validated MES/WMS/QMS with governed retention/archival.

Segregate duties with User Access Management, run periodic internal audits, and embed validation tests for negative paths (expired label, wrong UDI, device out of calibration) into your VMP and FAT/UAT.

14) Common Pitfalls & How to Avoid Them

• Paper‑heavy, system‑light MDR. Technical files don’t match operations. Fix: integrate design, labeling, manufacturing, and PMS in the live systems used every day (QMS, MES, WMS).
• Label drift across markets. Local edits cause UDI/claim mismatches. Fix: centralize Labeling Control with on‑line verification.
• Weak supplier oversight. Critical outsources lack controls. Fix: strengthen SQM, VQ, and SCAR with data‑driven scorecards.
• UDI as an afterthought. IDs fail at print/scan or don’t align with masters. Fix: govern UDI as master data tied to device versions; verify at print and at shipment.
• PMS that only reacts. Complaints logged but not trended. Fix: active trending, PSUR cadence, and CAPA effectiveness checks.
• Spreadsheet DHRs. Incomplete/alterable records. Fix: move to eBMR with audit trails and device status checks.

15) Implementation Playbook (Practical & Auditable)

• Lock the QMS. Align to ISO 13485, harden Document Control, Training, and Internal Audit.
• Design control refresh. Trace requirements → risks → V&V → labeling in the DHF; link to DHR.
• Build UDI as data. Govern GTIN/AIs, print with controlled templates, verify scans, and propagate identity through Pack & Ship.
• Validate execution systems. Risk‑based CSV, device IQ/OQ/PQ, negative‑path tests (FAT/UAT).
• Operational gates. Enforce hard gating for status/identity, FEFO, and label checks in WMS/MES.
• PMS that learns. Trend, escalate via CAPA, verify effectiveness, and feed back into design and labeling.

Start with gates, not dashboards. Dashboards describe; gates prevent.

16) How This Fits with V5 by SG Systems Global

V5 QMS. The V5 QMS governs MDR documentation—controlled docs, V&V, CAPA, audits—with attributable e‑signatures and audit trails. Risk files (ISO 14971) and PMS data live alongside change control (MOC) to keep the technical file synchronized with reality.

V5 MES. The V5 MES captures DHR evidence (eBMR), enforces device status and line clearance, verifies weighing/printing devices (calibration status), and blocks execution when pre‑requisites fail.

V5 Label & WMS. Controlled labels (UDI with GTIN and AIs) are verified online; the V5 WMS enforces quarantine, FEFO, and scan reconciliation at Pack & Ship. Bottom line: V5 makes MDR evidence the by‑product of normal work.

17) FAQ

Q1. Is ISO 13485 certification enough for MDR?
Helpful but not sufficient. MDR adds regulatory elements—classification logic, GSPRs, clinical evaluation/PMCF, UDI/EUDAMED readiness, PMS/PSUR—that must be demonstrated in your QMS and technical documentation.

Q2. What is the Basic UDI‑DI and how is it used?
It’s the identifier that groups related device variants at the regulatory level. Use it to anchor submissions and keep labeling/UDI data aligned through Labeling Control and master data.

Q3. How do we prove manufacturing controls to a Notified Body?
Show validated processes (PV/PPQ), controlled DHRs (eBMR), qualified equipment (IQ/OQ/PQ), calibrated devices (calibration), and enforced identity/status via hard gates.

Q4. Do distributors and importers have MDR obligations?
Yes. They must verify labeling/UDI presence, maintain traceability, and cooperate on PMS/vigilance. Embed checks in WMS receiving and outbound flows.

Q5. How do we keep PMS from becoming a filing exercise?
Automate signal capture (complaints, returns), trend routinely, link to CAPA, verify effectiveness, and refresh clinical evaluation with real‑world data on a defined cadence.

Related Reading
• Core Governance: QMS | ISO 13485 | ISO 14971 | Document Control | Internal Audit
• Design & Evidence: DHF | V&V | TMV | QbD
• Manufacturing & Trace: MES | WMS | eBMR | Lot Traceability
• Labels & UDI: UDI | GS1 GTIN | GS1 AIs | Labeling Control | Label Verification
• PMS & Improvement: CAPA | RCA | Recall Readiness | CPV