Class I Devices Still Need a Quality Management System: MDR Article 10(9) and Its Thirteen Elements

The most persistent misconception in class I device compliance is that self-certification means self-regulation. It does not. Removing the notified body from the conformity assessment route removes an audit; it does not remove a single obligation in Article 10, and Article 10(9) — the quality management system requirement — applies to a class I sterility indicator strip in the same terms it applies to a class III implant.

This matters commercially because class I is where most first-time EU entrants start, and because a manufacturer that has issued a declaration of conformity without a functioning QMS has made a false declaration. This guide sets out what Article 10(9) actually requires, what each of its thirteen elements means for a small manufacturer, what proportionality does and does not permit, and what an EU authorised representative asks to see before accepting a class I mandate.

What the paragraph says

Article 10(9) opens with series production and moves into the QMS in the same breath. "Manufacturers shall ensure that procedures are in place to keep series production in conformity with the requirements of this Regulation. Changes in device design or characteristics and changes in the harmonised standards or CS by reference to which the conformity of a device is declared shall be adequately taken into account in a timely manner. Manufacturers of devices, other than investigational devices, shall establish, document, implement, maintain, keep up to date and continually improve a quality management system that shall ensure compliance with this Regulation in the most effective manner and in a manner that is proportionate to the risk class and the type of device." (MDR Article 10(9))

The exclusion is investigational devices, and nothing else. There is no class threshold and no size threshold.

Six verbs govern the obligation: establish, document, implement, maintain, keep up to date, continually improve. A written system that is not implemented fails on the third. An implemented system with no revision history fails on the fifth. A system that has not changed in five years despite the company's output changing fails on the sixth.

The scope clause is broad. "The quality management system shall cover all parts and elements of a manufacturer's organisation dealing with the quality of processes, procedures and devices. It shall govern the structure, responsibilities, procedures, processes and management resources required to implement the principles and actions necessary to achieve compliance with the provisions of this Regulation." (MDR Article 10(9))

Not the production department: all parts of the organisation dealing with the quality of processes, procedures and devices. For a small manufacturer that means design, purchasing, production, distribution, complaint handling and management, whether or not those are separate functions or separate people.

The thirteen aspects

Then the list. "The quality management system shall address at least the following aspects: (a) a strategy for regulatory compliance, including compliance with conformity assessment procedures and procedures for management of modifications to the devices covered by the system; (b) identification of applicable general safety and performance requirements and exploration of options to address those requirements; (c) responsibility of the management; (d) resource management, including selection and control of suppliers and sub-contractors; (e) risk management as set out in in Section 3 of Annex I; (f) clinical evaluation in accordance with Article 61 and Annex XIV, including PMCF; (g) product realisation, including planning, design, development, production and service provision; (h) verification of the UDI assignments made in accordance with Article 27(3) to all relevant devices and ensuring consistency and validity of information provided in accordance with Article 29; (i) setting-up, implementation and maintenance of a post-market surveillance system, in accordance with Article 83; (j) handling communication with competent authorities, notified bodies, other economic operators, customers and/or other stakeholders; (k) processes for reporting of serious incidents and field safety corrective actions in the context of vigilance; (l) management of corrective and preventive actions and verification of their effectiveness; (m) processes for monitoring and measurement of output, data analysis and product improvement." (MDR Article 10(9))

Note at least. Thirteen is a floor, not a specification.

The five that catch class I manufacturers

Most of the list maps onto a conventional quality system. Five do not, and these are where class I files fail.

(a) A strategy for regulatory compliance. This has no counterpart in ISO 13485 and it is a document, not a posture. It has to cover compliance with conformity assessment procedures and procedures for the management of modifications to the devices covered by the system. The modification management half is the operative part: a documented process that decides, before a change is made, whether the change affects classification, the technical documentation, the declaration of conformity, the UDI-DI or the intended purpose. A class I manufacturer that changes a material or an intended purpose without running it through such a process is the standard route to an invalid declaration.

(b) Identification of applicable general safety and performance requirements and exploration of options to address those requirements. The second half is easy to miss. It is not enough to list which Annex I requirements apply and how they were met. The QMS has to address the exploration of options — that alternatives were considered and one was chosen. This is what turns a GSPR checklist into evidence of a design process.

(f) Clinical evaluation in accordance with Article 61 and Annex XIV, including PMCF. Class I devices need clinical evaluation. There is no exemption anywhere in Article 61 or Annex XIV for class I, and the QMS has to cover it, PMCF included. The depth is proportionate — a simple, well-established, low-risk device with an extensive state of the art can be evaluated largely on literature — but the process has to exist and produce a clinical evaluation report. Our guide to the PMCF plan and report covers the follow-up half, including the justification route where PMCF is not appropriate.

(h) Verification of UDI assignments. A QMS process specifically for checking that UDIs have been assigned under Article 27(3) and that the data provided under Article 29 is consistent and valid. Class I devices carry UDIs; only custom-made devices are excluded. The obligation here is verification as a controlled process, not assignment as a one-off task. Our notes on the Basic UDI-DI and UDI carrier requirements cover what is being verified.

(i) A post-market surveillance system in accordance with Article 83. Class I devices are inside Chapter VII. Article 84 requires a post-market surveillance plan, and Article 85 requires a post-market surveillance report for class I devices, updated when necessary and made available to the competent authority on request. Class I does not produce a PSUR — that is Article 86 and starts at class IIa — but the plan and the report are both required. Our guide to the periodic safety update report sets out the distinction between the two documents.

What proportionate actually permits

The phrase proportionate to the risk class and the type of device is the most misread clause in the paragraph. It governs the depth, formality and documentation burden of each element. It does not govern which elements exist.

Proportionality permits a class I manufacturer to have a short risk management file rather than a long one; to run clinical evaluation on literature and post-market data rather than on an investigation; to hold a single combined procedure where a larger organisation would have five; to have management review as a documented quarterly meeting rather than a formal committee. It permits process controls calibrated to a simple product.

It does not permit the absence of a regulatory compliance strategy, of a clinical evaluation, of UDI verification, of a post-market surveillance system, or of a corrective and preventive action process. Every one of the thirteen is present for every class; only the weight changes.

The test a competent authority applies is not whether the system is large. It is whether it is capable of ensuring compliance for this device, and whether it did.

Where the notified body still appears

Article 52(7) sets the class I route. "Manufacturers of class I devices, other than custom-made or investigational devices, shall declare the conformity of their products by issuing the EU declaration of conformity referred to in Article 19 after drawing up the technical documentation set out in Annexes II and III. If those devices are placed on the market in sterile condition, have a measuring function or are reusable surgical instruments, the manufacturer shall apply the procedures set out in Chapters I and III of Annex IX, or in Part A of Annex XI." (MDR Article 52(7))

The paragraph continues that the involvement of the notified body in those procedures shall be limited — for sterile devices, to the aspects relating to establishing, securing and maintaining sterile conditions; for devices with a measuring function, to the aspects relating to conformity with metrological requirements; and "in the case of reusable surgical instruments, to the aspects relating to the reuse of the device, in particular cleaning, disinfection, sterilization, maintenance and functional testing and the related instructions for use." (MDR Article 52(7))

These are the class Is, Im and Ir subcategories. A manufacturer in one of them has a notified body for a defined slice of the file and self-certifies the rest, which is a common source of confusion about what the certificate actually covers. Whichever route applies, the full Annexes II and III technical documentation has to be drawn up — the same annexes as for higher classes. Our guide to MDR technical documentation covers what that contains.

The obligations that come with the QMS

Article 10 does not stop at paragraph 9. Paragraph 10 requires manufacturers to implement and keep up to date the post-market surveillance system in accordance with Article 83. Paragraph 11 requires the device to be accompanied by the Annex I Section 23 information "in an official Union language(s) determined by the Member State in which the device is made available to the user or patient", with label particulars that are "indelible, easily legible and clearly comprehensible to the intended user or patient" (MDR Article 10(11)). Our note on label language requirements covers the Member State dimension.

Paragraph 12 is the one the QMS has to be able to execute. "Manufacturers who consider or have reason to believe that a device which they have placed on the market or put into service is not in conformity with this Regulation shall immediately take the necessary corrective action to bring that device into conformity, to withdraw it or to recall it, as appropriate. They shall inform the distributors of the device in question and, where applicable, the authorised representative and importers accordingly." (MDR Article 10(12))

Two things follow for a class I manufacturer. The trigger is consider or have reason to believe, which is lower than knowledge. And the authorised representative is named as a party to be informed — which means the QMS needs a defined communication path to it, and the mandate needs to specify how and how quickly. Our guide to the EU authorised representative mandate agreement covers how that is written.

Article 15 adds the person responsible for regulatory compliance. Micro and small enterprises are not required to have one within their organisation, but they must have such a person permanently and continuously at their disposal — an availability requirement, not an exemption. Our guide to the person responsible for regulatory compliance covers the qualification routes.

ISO 13485 is a route, not the requirement

MDR requires no certification to any standard. Article 10(9) states an outcome and lists thirteen aspects; a harmonised standard is one way of demonstrating that the outcome has been achieved.

In practice almost every manufacturer builds on ISO 13485, and that is sensible. But three of the thirteen — the regulatory compliance strategy in (a), UDI verification in (h), and PMCF within (f) — are MDR-specific and are not delivered by a generic implementation of the standard. A certificate is not by itself evidence that they are addressed, and a competent authority reviewing a class I file will look for them by name.

Nor does a certificate cover the whole obligation. Certification scope is set by the certificate; Article 10(9) scope is set by the Regulation and covers all parts of the organisation dealing with the quality of processes, procedures and devices.

What the authorised representative asks for

Article 11(3)(a) requires the representative to verify that the EU declaration of conformity and the technical documentation have been drawn up and, where applicable, that an appropriate conformity assessment procedure has been carried out. For a self-certified class I device there is no certificate to inspect, so the verification rests on the file and on the system behind it. A representative accepting a class I mandate should be asking for:

The QMS documentation, mapped against the thirteen aspects of Article 10(9) rather than against a standard's clause numbering — the mapping is what shows (a), (h) and PMCF are covered.

The regulatory compliance strategy, and specifically the modification management procedure within it.

The GSPR list with the options considered, not only the requirements met.

The clinical evaluation report, and the PMCF plan or the documented justification that PMCF is not appropriate.

The post-market surveillance plan under Article 84 and the Article 85 post-market surveillance report, with a date on it.

The UDI verification records, and confirmation that the Article 29 EUDAMED data is consistent with the label and the declaration. Our note on EUDAMED registration and the SRN covers that side.

The declaration of conformity itself, checked against Annex IV content and against the actual conformity assessment route — including whether class Is, Im or Ir applies and whether the corresponding notified body certificate exists.

Evidence that the Article 10(12) process has a defined path to the representative.

A class I file is faster to review than a class III file, but it is not lighter in kind, and the absence of a notified body means nobody has looked at it before the representative does. That is the practical reason class I mandates carry more diligence risk per device than higher classes, not less. Our note on authorised representative liability sets out what the representative is exposed to.

Common failures

The declaration of conformity is issued before the QMS exists, on the reasoning that class I is self-certified. The declaration asserts compliance with a Regulation whose Article 10(9) was not met at the time it was signed.

Clinical evaluation is omitted because the device is simple. Simplicity affects the depth of the evaluation and the sources it relies on; it does not remove Article 61.

Post-market surveillance is treated as complaint handling. Article 83 requires a system that plans, collects, analyses and acts; Article 85 requires a report that summarises results and conclusions with a rationale for actions taken.

UDI verification is done once at registration and never becomes a process, so a later packaging or model change is never checked against the UDI-DI rules.

A class Ir or class Is manufacturer treats the limited notified body certificate as covering the device, and stops maintaining the rest of the file.

If you place class I devices on the EU market from outside the Union and want an authorised representative that reviews the Article 10(9) system rather than accepting a declaration at face value, our authorised representative service covers class I portfolios, including the Is, Im and Ir subcategories.

Medex Kurumsal as your EU authorised representative

If you place medical devices or in vitro diagnostics on the European market from outside the Union, Article 11 of MDR 2017/745 — and Article 11 of IVDR 2017/746 for in vitro diagnostics — requires a single authorised representative established in a Member State before those devices reach the market. Medex Kurumsal Danismanlik acts as EU authorised representative under both Regulations, registered in EUDAMED under SRN TR-AR-000057550.

What the mandate covers: verification of the EU declaration of conformity and the technical documentation before signature rather than after; the Article 11(3)(a) copy of the file kept available for the full retention period; EUDAMED actor and device registration and the Basic UDI-DI submission; the registered EU address printed on your label and instructions for use; handling of competent authority requests, samples and information in the language of the Member State concerned; and the vigilance interface under Articles 87 to 90.

We review the file before accepting a mandate, because Article 11(5) makes the authorised representative jointly and severally liable for defective devices where the manufacturer has not complied with Article 10. A file we have not read is a liability we cannot price. Our fee structure is published on the EU authorised representative cost page, and the scope of the service is set out under EU authorised representative. Send us the declaration of conformity and the device list and we will tell you within two working days whether the file is ready for a mandate and what is missing if it is not.