IFU Content Requirements Under EU MDR: What Section 23.4 Actually Requires

Why the IFU is now a substantive compliance document

Instructions for use have always been part of device documentation, but under MDR they carry more specific requirements than most MDD IFUs were designed to meet. Section 23.4 of Annex I lists the mandatory content items, and the list is extensive — covering everything from intended purpose and contraindications through to serious incident reporting instructions and implant-specific information.

The main trap for teams updating legacy IFUs is assuming that if a section exists in the current document, it probably meets the new requirements. In most cases that is not true. The difference between an MDD-era IFU and an MDR-compliant one is usually not a missing section header — it is missing depth, precision, or specific required content within sections that nominally already exist. Your Notified Body reviewer will read the IFU against the Section 23.4 list item by item, and the questions they ask will be about specific content, not structure.

What the regulation requires — in practice

The IFU must cover the intended purpose in full. Not a one-line summary, but a statement that captures who uses the device, what clinical condition it is used for, what patient population it is indicated for, what anatomical sites are involved, and what the intended clinical benefit is. If your current IFU intended purpose section is two sentences, it almost certainly needs expanding.

Contraindications must be stated explicitly, not left to inference. If there are patient populations, clinical conditions, or anatomical situations where the device should not be used, they must be listed. Many MDD IFUs left this section as "none identified" or listed only one or two obvious contraindications. Under MDR, the contraindication list needs to reflect the current state of clinical knowledge — which means it connects back to the findings in your Clinical Evaluation Report.

Residual risks that the user needs to be aware of must be communicated in the IFU. This is not the same as your risk management file — it is the user-facing subset of residual risks that a healthcare professional or patient needs to understand to use the device safely. The content here should be derived from your ISO 14971 risk management output, but written in plain language appropriate to the intended user.

The serious incident reporting requirement — the part most MDD IFUs miss

One of the most commonly absent items in MDD-era IFUs is the requirement under Section 23.4(t): the IFU must instruct the user on how to report a serious incident. This means telling the user what counts as a serious incident involving the device, and providing the information they need to report it — either to the manufacturer or to the competent authority.

This requirement is new relative to most MDD practice and is missing from the vast majority of legacy IFUs. It is also not a minor addition — it requires the manufacturer to have thought through what serious incidents look like for their specific device and to have committed to a description of that in the IFU. A generic paragraph about incident reporting that does not reference the device category or the applicable regulatory framework does not satisfy this requirement.

Installation, commissioning, and maintenance

Where the device requires installation, commissioning, or maintenance, the IFU must contain instructions for each. This includes: preparation of the device or system before use; if the device requires installation by a qualified professional, a statement to that effect; calibration requirements if applicable; and maintenance schedules with the procedures involved.

Many MDD IFUs cover installation in broad terms. What Section 23.4 requires is enough specificity that a qualified person following the IFU can actually complete the installation correctly. If your device requires software configuration, network connectivity, or integration with other equipment, those steps need to be described. Vague references to "consult installation guidance" are not sufficient if a standalone IFU is your primary installation document.

Single-use devices and reprocessing

If your device is single-use, the IFU must state this clearly, include a "do not reuse" symbol reference, and — where reprocessing of single-use devices is a real-world risk — contain information to assist the user in identifying a reprocessed device. This is not just a statement that reprocessing is not permitted; Section 23.4(l) requires you to address the reprocessing risk practically.

For reusable devices, the IFU must contain instructions for reprocessing including validated decontamination and sterilisation methods, the number of times the device can be reused, and criteria for determining that the device has deteriorated to a point where it should no longer be used.

A practical approach to the IFU update

Start with a Section 23.4 compliance matrix — list every item in the regulation against your current IFU, and for each one note whether it is present, whether the depth is adequate, or whether it is absent. Do not assume that a section exists means the content within it is sufficient.

Prioritise the items that are most commonly absent in MDD IFUs: full intended purpose, explicit contraindications, residual risk communication, serious incident reporting instructions, and PMCF-related information for the user (where applicable). For complex devices with installation or reprocessing requirements, those sections usually need the most substantial work.

The IFU update also needs to feed into your EUDAMED registration — specifically, if you move to eIFU, the availability and opt-out conditions need to be addressed (see the eIFU resource in this category). If you are issuing a new paper IFU version, the version tracking needs to be managed through your QMS document control system, and the existing inventory in the supply chain with the old IFU version needs to be addressed in your change management documentation.