Quality & Risk Management

Quality management and risk management sit at the centre of everything MDR requires. Your QMS is the operating system that makes the rest of compliance possible — clinical evaluation, technical documentation, post-market surveillance — all of it depends on documented processes, controlled outputs, and evidence that what you said you would do is what you actually did. ISO 13485 is the harmonised standard, and Annex IX and XI to MDR define the conformity assessment routes that require a certified QMS. If your QMS has gaps, those gaps tend to show up everywhere else at once.

One thing that catches a lot of teams off guard is the depth of QMS scrutiny under MDR versus what MDD Notified Body audits typically looked like. Under MDR, auditors are not just checking that procedures exist — they're looking for evidence of execution. Design reviews, CAPA records, management review outputs, complaint handling decisions — these need to show a functioning system, not a paper trail assembled for the audit. Teams that built lightweight QMS documentation under MDD often find the gap is significant when they face a full Annex IX audit.

Risk management under ISO 14971 is tighter under MDR than many manufacturers expected. The regulation requires that your risk management file directly supports your GSPR demonstration in Annex II. Residual risks documented under ISO 14971 must connect to the benefit-risk assessment in your technical file — they're not separate exercises. Getting this wrong means one of the most common audit findings: a risk management file that is internally consistent but disconnected from the rest of the technical documentation. If the connection between risk and GSPR is not traceable on paper, it will be found.

Usability engineering (IEC 62366) and biocompatibility (ISO 10993) live within the QMS world for most manufacturers. IEC 62366 is often underweighted — teams do summative evaluation but skip the formative evidence that shows how use errors were identified and addressed during design. Notified Bodies have become more rigorous here since 2021. ISO 10993 biological evaluation is similarly often treated as a checkbox: a biocompatibility report referencing a standard rather than a genuine risk-based evaluation of the materials used. Both areas have specific MDCG guidance that is worth reading before an audit.

The resources in this category cover ISO 13485 implementation and audit preparation, how to build a risk management file that satisfies both ISO 14971 and MDR's GSPR traceability requirement, conformity assessment route selection (Annex IX versus XI), usability engineering evidence under IEC 62366, and biological evaluation under ISO 10993. Whether you're preparing for a Notified Body audit for the first time or reviewing what you have ahead of a surveillance audit, start with the QMS and risk management file — those are the areas where most of the systemic issues are found.