ISO 13485 · Expert · 15 min lesson
Auditing the MDR QMS (Article 10(9)) and the GSPR (Annex I)
EU MDR 2017/745 Article 10(9), Annex I, Annex II section 4 and Article 15; ISO 19011 audit practice
What you will learn
- Map Article 10(9) elements to QMS evidence.
- Audit the GSPR checklist for justified applicability.
- Check the PRRC role (Article 15).
Key takeaways
- Article 10(9) lists thirteen elements, a) to m); map each to a procedure, an owner and a sampled record.
- The QMS must be proportionate to risk class and device type, and ISO 13485 supports but does not replace the legal list.
- Annex II section 4 requires every GSPR to be addressed, with a reason for any exclusion, the method and the exact evidence.
- A not applicable entry is a claim: test it against the device description, the risk file and the verification records.
- Article 15 requires a qualified PRRC with real duties: release checks, documentation, PMS and vigilance reporting.
Free practice question
Verdane's QMS matrix lists items a) to l) of Article 10(9) with procedure numbers and owners. Item m) monitoring, data analysis and improvement has the entry 'see management review'. No procedure covers complaint trending or nonconformity trending.
What is the best audit conclusion?
Element m) is not shown to be implemented: no procedure or record covers data analysis and trending, which Article 10(9) m) requires.
Correct. Article 10(9) m) requires monitoring, measurement, data analysis and improvement, and a pointer to a meeting is not a process.
No finding, because management review exists under Article 10(9) c).
Not quite. Management review answers element c) and does not by itself analyse complaint or nonconformity data required by Article 10(9) m).
A finding against Annex I section 3, because trending belongs to risk management.
Not quite. Risk management feeds from trending, but the missing process is the data analysis named in Article 10(9) m).
Only advise the company to add a procedure at some point.
Not quite. Advice leaves the Article 10(9) m) gap open; an auditor records the missing element as a finding with evidence.
Key terms
- GSPR: The general safety and performance requirements in Annex I of the MDR that every device must meet where applicable.
- PRRC: The qualified person each manufacturer must have under Article 15, with defined compliance tasks.
- QMS matrix: A table that maps each Article 10(9) element to a procedure, owner and record.
- justified applicability: A stated, testable reason why a requirement does or does not apply to a device (Annex II section 4).
- technical documentation: The documentation set described in Annexes II and III that demonstrates conformity of the device.
- modification management: Controlling device and process changes within the compliance strategy (Article 10(9) a)).
- EU declaration of conformity: The manufacturer's statement that the device meets the Regulation, kept up to date under Article 15.
- micro and small enterprise: A firm that may have the PRRC at its disposal rather than employed, but permanently and continuously (Article 15).
Official sources
- Regulation (EU) 2017/745 on medical devices (MDR), EUR-Lex
- ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes
- ISO 19011:2018 Guidelines for auditing management systems
- European Commission - MDCG endorsed documents and other guidance
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.