Medical device manufacturer obligations: from design to post-market surveillance

Who is a manufacturer under the MDR?

A manufacturer is a natural or legal person who manufactures or fully refurbishes a device, or has a device designed, manufactured or fully refurbished, and markets it under their own name or trademark. Article 2(30) of Regulation (EU) 2017/745 contains the definition. 1 

A company can therefore be the manufacturer even when contractors carry out design and production. Agreements should provide access to the information and evidence needed to demonstrate conformity. Outsourcing the work does not remove the obligations associated with this role.

The MDR also sets out circumstances in which an importer, distributor or another entity assumes manufacturer obligations. Article 16 covers, among other things, making a device available under one's own name, subject to a specific contractual exception, changing its intended purpose and modifying it in a way that may affect compliance. Not every activity performed on a finished device automatically has that effect; check the scope of the provision and its exceptions. 1 

What must be established before sales begin?

First define the product's intended purpose, qualification and risk class. These determine the appropriate conformity assessment procedure and whether to plan for a notified body. 1 

A recommended checkpoint before starting a project is to agree on the medical purpose, intended user, patient population and claimed performance. These should be consistent across the design, clinical evaluation, instructions for use and commercial materials. Article 7 MDR prohibits, among other things, claiming functions and properties that a device does not have. 1 

Safety, risk and clinical evaluation

Article 10(1) requires compliant design and manufacture. Paragraph 2 requires a risk management system to be established and maintained. Paragraph 3 concerns clinical evaluation in accordance with Article 61 and Annex XIV, including post-market clinical follow-up (PMCF). 1 

The manufacturer identifies the applicable general safety and performance requirements in Annex I. It needs evidence that the device meets those requirements for its intended purpose. The scope of clinical evaluation and the need for new clinical investigations depend on the particular device; the product name alone cannot determine them.

Documentation, conformity assessment and CE marking

For devices other than custom-made devices, Article 10(4) requires technical documentation in accordance with Annexes II and III. The manufacturer must keep it up to date. Custom-made devices follow the specific documentation requirements in Annex XIII. 1 

After demonstrating conformity through the appropriate procedure, the manufacturer draws up an EU declaration of conformity and affixes the CE marking. This principle does not apply in the same way to custom-made or investigational devices. Notified body involvement also depends on the applicable route, rather than simply on being a manufacturer. 1 

Which obligations does the quality management system cover?

Article 10(9) MDR requires manufacturers of devices other than investigational devices to have a quality management system (QMS) proportionate to the risk class and type of device. It covers the regulatory strategy and processes that affect compliance. 1 

The company needs defined responsibilities for areas including:

• requirements, documentation and change control,
• supplier and contractor qualification and control,
• design, production, servicing and device release,
• risk management and clinical evaluation,
• PMS, incident reporting and communication with the relevant parties,
• corrective and preventive actions and assessment of their effectiveness.

For each obligation, it is useful to identify an owner, a deputy, a deadline and where the evidence will be kept. This allocation helps deliver tasks within the system, whose full scope is set out in Article 10(9). The manufacturer chooses how to document responsibilities.

Who is the PRRC and what are their responsibilities?

PRRC stands for person responsible for regulatory compliance. Article 15 requires a manufacturer to have at least one such person within its organization, with the necessary expertise and qualifications. Micro and small enterprises may instead have a PRRC outside the organization permanently and continuously at their disposal. 1  2 

Their minimum responsibilities include ensuring appropriate checks of device conformity before release, ensuring that documentation and declarations of conformity are drawn up and kept current, and ensuring compliance with PMS and reporting obligations. If several people share these duties, their respective areas of responsibility must be defined in writing. 1 

The PRRC needs access to data and the decision-making process. Appointing one does not relieve management of its responsibility to provide resources or process owners of their assigned tasks. Putting a name in a procedure alone will not make oversight work.

The particular status of legacy devices requires separate assessment. MDCG 2021-25 rev.1 does not list Article 15 among the requirements applicable to these devices under the transitional provisions. 8 

What does the manufacturer do after placing a device on the market?

PMS and updating knowledge about the device

Post-market surveillance (PMS) involves actively and systematically collecting, recording and analyzing relevant data on device quality, performance and safety. Articles 83 and 84 require a PMS system and plan. 1 

Reporting depends, among other things, on the class. Article 85 provides for a PMS report for class I, while Article 86 requires a periodic safety update report (PSUR) for classes IIa, IIb and III. The manufacturer uses surveillance findings to update the risk assessment, clinical data and device-related decisions. For legacy devices, check the scope and applicable classification separately.

Serious incidents and safety actions

Article 87 sets out the rules for reporting serious incidents and field safety corrective actions (FSCAs). Serious incidents have different maximum reporting periods depending on the circumstances: 1  3 

• serious public health threat: no later than 2 days after the manufacturer becomes aware of the threat,
• death or unanticipated serious deterioration in health: no later than 10 days after becoming aware of the serious incident,
• other cases covered by the general rule: no later than 15 days after becoming aware of the serious incident.

Report immediately, taking account of the conditions in the provision. A manufacturer cannot wait until an internal investigation is complete before starting the clock. MDCG 2023-3 rev.2 explains the date of awareness, how reporting periods are calculated and the option of submitting an initial report with further information to follow. 3 

A signal received by service staff, a salesperson or reception should therefore reach the person assessing reportability quickly. The procedure should also identify who covers that person's absence.

What are the UDI and EUDAMED obligations?

Article 10(7) refers to the UDI system and registration under Articles 29 and 31. The manufacturer determines which identification and registration requirements apply to its device. These extend beyond simply placing a code on the packaging. 1 

Since 28 May 2026, the EUDAMED modules for actor registration, UDI and device registration, notified bodies and certificates, and market surveillance have been mandatory. The market surveillance module is for competent authorities and the Commission. The vigilance and PMS module had not become mandatory by the verification date. 4 

Separate transitional provisions apply to existing devices and certificate data. Assess their application to the particular portfolio. The absence of a mandatory vigilance module does not suspend incident reporting: use the appropriate current reporting channel.

When must an interruption of supply be reported?

Article 10a MDR has applied since 10 January 2025. It covers an anticipated interruption or discontinuation of supply of a device other than a custom-made device where serious harm, or a risk of serious harm, to patients or public health in one or more Member States can reasonably be foreseen. 5 

The manufacturer informs the competent authority of the Member State where it or its authorized representative is established, as well as the economic operators, health institutions and healthcare professionals it supplies directly. As a rule, the information must be provided at least six months in advance. The provision allows for exceptional circumstances. 1  5 

Not every change in a supply plan requires this notification. The manufacturer should assess the conditions and document the outcome. Revision 2 of the Commission's Q&A, published in April 2026, helps with that assessment. The obligation may also be relevant when supply is discontinued because a legacy device no longer has a regulatory route forward. 5 

How long must documents be kept and what financial cover is required?

Article 10(8) requires technical documentation, the EU declaration of conformity and relevant certificates to be kept for at least 10 years after the last device covered by the declaration has been placed on the market. For implantable devices, the period is at least 15 years after the last device has been placed on the market. 1 

Do not automatically count retention from the creation of a file or the issue date of a certificate. The manufacturer must also remain able to provide the required documents to the competent authority and cooperate in actions concerning risks under Article 10(14).

Article 10(16) requires measures providing sufficient financial coverage for potential liability for a defective device, proportionate to the risk class, type of device and size of the enterprise. This must not be simplified into one identical insurance policy and coverage amount required for every manufacturer. 1 

What else should be checked when selling in Poland?

The Polish part of the assessment must also consider the Act of 7 April 2022 on medical devices (official act record ). Article 12 differentiates language requirements according to the user and type of information. For devices intended for lay persons, information in Polish is the general rule, subject to the exceptions in the provision. For users other than lay persons, Polish or English is permitted within a specified scope, but information intended for the patient needs separate treatment. 6 

Check the particular case before approving the label, instructions for use and interface. "English is always sufficient in Poland" is too broad a conclusion. Advertising rules also need a separate review; URPL discusses them in its current information materials. 7 

What does this mean in practice across the company?

Organize obligations around the events that trigger action. A new device version needs a different route from a serious incident or a plan to discontinue supply. For each route, the company can define these steps:

This is a suggested way to organize work. In any particular case, deadlines and sequencing must respect legal requirements, especially the urgency of safety-related action.

Hypothetical example: information reaches the service team

How does Neximed support these activities?

The CAPA module in Neximed supports root cause analysis, assigning actions with deadlines, attaching evidence of completion and assessing effectiveness. Training includes training plans, records and evaluation of the effectiveness of training needed to carry out procedures.

These tools support internal tasks. Assessing reporting obligations, submitting reports to the competent authority and confirming device conformity remain the manufacturer's responsibility. A discussion about implementation should start from how these tasks actually run.

Manufacturer checklist

Verified on 15 October 2026. Educational material on the MDR and the cited Polish legislation. It is not a complete assessment of the obligations of a particular manufacturer or device.