Medical-device regulatory glossary

Under Regulation (EU) 2024/1689, an AI system that is a device — or a safety component of one — subject to notified-body conformity assessment under the MDR or IVDR is classified as high-risk (Article 6(1), Annex I). Manufacturers of AI-enabled devices must therefore satisfy both frameworks — risk management, data governance, transparency, human oversight — and the regulation allows the conformity assessments to be combined.

Directive 90/385/EEC governed active implantable medical devices until the MDR replaced it. Such devices are now the highest MDR risk tier (Class III). Legacy AIMDD certificates appear in EUDAMED and are subject to the same MDR transitional provisions as MDD certificates.

The Agence nationale de sécurité du médicament et des produits de santé is France's competent authority under the MDR and IVDR: it supervises the French market, handles vigilance reports and field safety corrective actions, inspects operators and clinical investigations, and can take national measures on devices presenting a risk.

The Agência Nacional de Vigilância Sanitária regulates medical devices in Brazil under a four-class risk framework: lower-risk classes are notified, higher-risk classes registered, and manufacturers of the highest classes additionally undergo Brazilian GMP certification — which MDSAP audit outcomes can support. ANVISA is one of the five MDSAP regulatory authorities.

Under MDR Article 11, a manufacturer established outside the EU must designate a single authorised representative for a given device. The representative verifies the declaration of conformity and technical documentation, keeps them available to authorities, cooperates on corrective actions, and registers in EUDAMED. It shares certain legal liabilities with the manufacturer.

Defined by the UDI system in MDR Article 27, the Basic UDI-DI is the access key to a device model: it links the certificate, the declaration of conformity and the summary of safety and clinical performance to a group of devices that share the same intended purpose, risk class and essential design. Unlike the UDI-DI, it is not printed on the device label.

MDR Article 10(9) requires the manufacturer's quality management system to cover processes for corrective and preventive action and verification of their effectiveness, and ISO 13485 dedicates clauses 8.5.2 and 8.5.3 to them. Notified-body auditors and FDA inspectors alike treat a robust CAPA system as the backbone of a compliant QMS.

The Center for Devices and Radiological Health is the FDA organisation that reviews device premarket submissions (510(k), De Novo, PMA), oversees quality systems and postmarket safety, and publishes device guidance for the US market — functionally covering, in one federal agency, ground the EU splits between competent authorities and notified bodies.

Under MDR Article 20, the CE marking is affixed before a device is placed on the market once the relevant conformity assessment is complete. For all but the lowest-risk devices a notified body must be involved, and its four-digit identification number appears next to the CE mark. The CE mark is backed by the manufacturer's EU declaration of conformity.

MDR Annex XIV Part A requires manufacturers to establish and update a clinical evaluation plan: the general safety and performance requirements needing clinical support, the intended purpose and target groups, the methods for appraising clinical data, and the link to the post-market clinical follow-up plan that continues the evaluation after CE marking.

MDR Article 61 requires manufacturers to plan, conduct and document a clinical evaluation: an ongoing assessment of clinical data demonstrating safety, performance and an acceptable benefit-risk ratio. Its output is the clinical evaluation report, part of the technical documentation (Annex XIV Part A sets the process), kept up to date throughout the device's life with post-market clinical data.

Under MDR Article 56, certificates issued by notified bodies are recorded in EUDAMED with a status. A notified body may suspend, restrict or withdraw a certificate (for example after an audit finding), and the validity period and any amendments are tracked. A suspended or withdrawn certificate is a significant signal about a device's continued market access.

MDR Article 56(2): certificates are valid for the period they indicate, which shall not exceed five years. On application by the manufacturer, validity may be extended for further periods, each not exceeding five years, based on a re-assessment under the applicable conformity assessment procedure. A supplement stays valid only as long as the certificate it supplements. Expiry is a date, distinct from a suspension or withdrawal under Article 56(4); the start and expiry dates are part of the record notified bodies enter in EUDAMED under Article 56(5).

MDR Annex VIII sets out 22 rules covering non-invasive, invasive, active and special-purpose devices. The rules consider duration of contact, where the device acts in the body, and its energy or substances. Rule 11 is the one that classifies medical-device software. When several rules apply, the device takes the highest class that any applicable rule assigns.

MDR Annex I §10.4.1 restricts substances that are carcinogenic, mutagenic or toxic to reproduction (CMR, category 1A or 1B) above 0.1% by mass in certain invasive and body-contact devices. Where such substances are present above the threshold the device must be labelled and the manufacturer must justify their presence in the technical documentation.

Under MDR Article 101, each Member State designates a competent authority responsible for implementing the regulation — validating actor registrations and SRNs, designating and monitoring notified bodies, conducting market surveillance, and handling vigilance reports and incidents. EUDAMED records the competent authority alongside the actors and certificates it oversees.

MDR Article 52 maps each risk class to one or more procedures detailed in Annexes IX, X and XI: a quality-management-system plus technical-documentation assessment (Annex IX), an EU type-examination (Annex X) followed by production conformity verification, or product conformity verification (Annex XI). Higher-risk devices require the more comprehensive routes and deeper notified-body involvement.

Under the general safety and performance requirements (MDR Annex I, including the labelling rules in §23.4 and the substances-of-concern provisions in §10.4), devices that contain natural rubber latex must declare it on the label so that healthcare professionals and latex-allergic patients can take precautions.

When no legally marketed predicate exists, the De Novo classification request lets the FDA place a novel device of low or moderate risk into US class I or II with appropriate special controls, instead of defaulting it to class III. A granted De Novo creates a new device type that can then serve as a predicate for future 510(k) submissions.

Under MDR Article 35, each Member State names an authority responsible for the notified bodies established on its territory — assessing applicants, designating them for specific device scopes, and continuously monitoring and, where needed, restricting, suspending or withdrawing the designation. The designating authority is usually the same competent authority that handles the rest of the regulation, but the designation role is distinct; EUDAMED records which authority designated each notified body.

The European Medicines Agency evaluates medicines for the EU. On the device side, notified bodies consult the EMA (or a national medicines authority) when assessing devices incorporating an ancillary medicinal substance under MDR Annex IX, and on companion diagnostics under the IVDR; devices integral to a medicinal product fall under the medicines framework the EMA administers.

Adopted by the Commission to satisfy the nomenclature requirement of MDR Article 26, the European Medical Device Nomenclature organises devices into a tree of categories, groups and types (for example a three-letter category branch down to a specific device type). Manufacturers assign one or more EMDN codes when registering a device; MD Atlas uses the EMDN tree to power its device search filter.

The standard requires manufacturers to identify use scenarios and hazard-related use scenarios, establish the use specification, and validate the user interface through summative evaluation — the records forming the usability engineering file. It supports the MDR's requirement to reduce, as far as possible, the risks related to use error and ergonomic features (Annex I §5).

MDR Annex I §10.4.1 also restricts substances with endocrine-disrupting properties above 0.1% by mass in certain invasive and body-contact devices. As with CMR substances, presence above the threshold requires labelling and a justification in the technical documentation, supported by the latest scientific assessment.

Required by MDR Article 19 and Annex IV, the declaration of conformity is drawn up by the manufacturer, identifies the device and its Basic UDI-DI, states the risk class and the conformity-assessment route followed, references any notified body and certificate, and is kept up to date. Affixing the CE mark is the manufacturer's claim that this declaration exists and is accurate.

Under the MDR Annex X conformity-assessment route, the notified body examines the technical documentation and a representative production sample (the "type") and issues an EU type-examination certificate. The manufacturer then combines this with a production conformity-verification step (Annex XI) to demonstrate that series production matches the approved type.

Established under MDR Article 33, the European Database on Medical Devices (EUDAMED) has modules for actor registration (issuing SRNs), UDI/device registration, notified bodies and certificates, clinical investigations, vigilance, and market surveillance. MD Atlas indexes the public EUDAMED data to make it fast and easy to search.

IVDR Article 100 allows the Commission to designate EU reference laboratories for the highest-risk (class D) in-vitro diagnostics. Where a EURL is designated for a device category, it verifies by laboratory testing the performance claimed by the manufacturer and compliance with any common specifications, and performs batch verification of manufactured class D devices within the notified-body conformity assessment.

The US Food and Drug Administration regulates medical devices through its Center for Devices and Radiological Health. Devices are classified into US classes I, II and III, with premarket routes ranging from 510(k) premarket notification (substantial equivalence) through De Novo classification to full premarket approval, plus quality-system requirements under 21 CFR Part 820 — the QMSR, aligned with ISO 13485 since February 2026.

Named after section 510(k) of the US Food, Drug and Cosmetic Act, the premarket notification is the most common FDA route: the sponsor demonstrates the device is as safe and effective as a legally marketed predicate device. Most class II devices reach the US market this way; a clearance is not an approval, and the review generally rests on comparative rather than new clinical data.

Standardised in IEC 60812, failure mode and effects analysis (and its criticality extension, FMECA) systematically rates failure modes — typically by severity, occurrence and detectability — to prioritise design and process controls. In medical devices it is one of the classic techniques feeding the ISO 14971 risk-management process, alongside top-down methods such as fault-tree analysis.

Defined in MDR Article 2(46), an FSCA can be a return, exchange, modification, destruction or retrofit of a device, or updated instructions. Manufacturers must report FSCAs to the competent authorities through the vigilance system (Article 87) before implementation in most cases, and inform users through a field safety notice.

Defined in MDR Article 2(47), the field safety notice tells customers and users what the corrective action is and why. Article 89(8) requires it to clearly identify the device(s), explain the reasons for the FSCA with reference to the device malfunction and associated risks, and clearly state the actions users must take. It is edited in the language(s) determined by the Member States concerned.

Regulation (EU) 2016/679 treats data concerning health as a special category whose processing is prohibited unless a specific exception applies (Article 9). Device manufacturers meet it when running clinical investigations and PMCF activities, operating software devices and companion apps, and handling vigilance and complaint data — alongside, not instead of, their MDR/IVDR obligations.

The FDA guidance 'Applying Human Factors and Usability Engineering to Medical Devices' expects manufacturers to analyse intended users, use environments and critical tasks, and to validate the user interface with representative users. In the EU, the equivalent discipline is the usability-engineering process of EN 62366-1; both aim to minimise use errors and the harm they can cause.

IEC 60601-1 and its collateral standards (electromagnetic disturbances, usability, alarm systems, home-use environments) form the horizontal safety series for electromedical devices, while particular 60601-2-XX parts cover specific equipment such as ventilators or infusion pumps. European EN versions of the series are widely used to demonstrate conformity with the MDR's general safety and performance requirements for electrical devices.

IEC 62304 sets development, maintenance and risk-related life-cycle requirements for software that is a medical device or embedded in one, with a three-level software safety classification (classes A, B, C). IEC 82304-1 addresses health software products, including standalone software, at product level. Both are widely used to demonstrate the state-of-the-art software engineering that MDR Annex I §17 requires.

MDR Annex I §23.4 lists what the instructions for use must contain: intended purpose, performance characteristics, residual risks and contra-indications, warnings, maintenance and, where relevant, sterilisation or disposal information. For certain device categories the IFU may be supplied in electronic form (eIFU) under the conditions of Implementing Regulation (EU) 2021/2226.

Successor to the Global Harmonization Task Force, the International Medical Device Regulators Forum brings together major device regulators — the EU, US, Japan, Australia, Brazil, Canada, China, Singapore, South Korea, the UK and others, with the WHO as an official observer. Its consensus documents (SaMD definitions and risk framework, MDSAP, adverse-event terminology) feed directly into national and EU rules and guidance.

Defined in MDR Article 2(5), an implantable device is intended, by surgical intervention, to remain in place after the procedure (or to partially remain for at least 30 days). Implantable devices are generally Class III or IIb, require an implant card for patients, and (for Class III) a published Summary of Safety and Clinical Performance.

Under MDR Article 13, the importer must verify that the device is CE-marked, that an EU declaration of conformity exists, that the manufacturer and (where applicable) the authorised representative are identified, and that the device carries its UDI. The importer registers in EUDAMED and indicates its details on the device, its packaging or an accompanying document.

EN ISO 10993-1 structures biological evaluation within a risk-management process: devices are categorised by the nature and duration of body contact, then evaluated against endpoints such as cytotoxicity, sensitisation and irritation. It is listed among the harmonised standards supporting the MDR (Commission Implementing Decision (EU) 2021/1182, as amended) and underpins the biocompatibility part of the technical documentation.

Devices sold sterile must be manufactured and sterilised under appropriately validated processes (MDR Annex I §11.4). EN ISO 11135 covers ethylene-oxide sterilisation and EN ISO 11137 radiation sterilisation; both are listed among the harmonised standards supporting the MDR (Commission Implementing Decision (EU) 2021/1182, as amended), giving a presumption of conformity for the requirements they cover.

EN ISO 13485:2016 is listed in the EU's harmonised standards for medical devices (Commission Implementing Decision (EU) 2021/1182). A manufacturer that certifies its quality management system to EN ISO 13485 gains a presumption of conformity with the corresponding MDR QMS requirements, which is why the standard underpins most QMS certificates issued by notified bodies.

EN ISO 14971:2019 is listed among the harmonised standards supporting the MDR and IVDR (Commission Implementing Decision (EU) 2021/1182, as amended), giving a presumption of conformity with the risk-management requirements of MDR Annex I §3. It structures the process recorded in the risk management file: risk analysis, risk evaluation, risk control and evaluation of the overall residual risk.

Directive 98/79/EC governed in-vitro diagnostic devices until the IVDR became applicable. Under the IVDD most IVDs were self-declared by the manufacturer; the IVDR's class-based system now requires notified-body involvement for the majority of tests. Legacy IVDD classifications (general IVD, Annex II List A / List B, self-testing) still appear in EUDAMED records.

IVDR (Regulation (EU) 2017/746) replaced the In Vitro Diagnostic Directive (98/79/EC), applying from 26 May 2022. It introduces a risk-based classification (classes A to D), greatly expands notified-body oversight of higher-risk tests, and brings IVDs into the same EUDAMED, UDI and post-market-surveillance framework as the MDR.

IVDR Article 47 and Annex VIII classify IVDs into Class A, B, C and D using a set of rules that weigh the individual risk to the patient and the public-health risk. Class D covers the highest-risk tests (for example detecting life-threatening, transmissible agents in blood). Most IVDs above Class A now require notified-body involvement — a major change from the IVDD.

Article 120(3) of the MDR, as amended by Regulation (EU) 2023/607, lets a device covered by a directive certificate or declaration of conformity issued before 26 May 2021 continue to be placed on the market until 31 December 2027 (class III and implantable class IIb) or 31 December 2028 (other class IIb, class IIa, and class I devices that are sterile, measuring or reusable surgical), provided the cumulative conditions of Article 120(3c) were met — a quality management system and a notified-body application by 26 May 2024, a written agreement by 26 September 2024. Regulation (EU) 2024/1860 staggers the IVDR equivalent to 31 December 2027 (class D), 2028 (class C) and 2029 (class B and sterile class A). Separately, every device already on the market, legacy or not, had to be registered in EUDAMED by 28 November 2026 under the mandatory-use notice — that date is a registration deadline, not an Article 120 date. EUDAMED records a legacy device under its directive as applicable legislation, with no Basic UDI-DI.

Under MDR Article 10, the manufacturer is the person who manufactures or fully refurbishes a device, or has one designed/manufactured, and markets it under its name. It carries the core obligations: technical documentation, the quality management system, the risk class assessment, the declaration of conformity, UDI assignment, EUDAMED registration and post-market surveillance. A manufacturer outside the EU must appoint an authorised representative.

Established by MDR Article 103, the Medical Device Coordination Group is composed of members designated by the Member States for their expertise, and is chaired by the European Commission. It advises the Commission, coordinates the competent authorities and the notified-body designation process, and publishes the MDCG guidance series used across the sector — classification, clinical evaluation, EUDAMED, software and more.

Directive 93/42/EEC governed medical devices until the MDR became applicable. Devices certified under the MDD before the cut-off may continue to be placed on the market under transitional provisions until their certificates expire (subject to the extended deadlines in Regulation (EU) 2023/607). EUDAMED still records legacy MDD certificates.

MDR (Regulation (EU) 2017/745) replaced the old Medical Devices Directive (93/42/EEC) and the active-implantable directive (90/385/EEC), applying from 26 May 2021. It sets the obligations of manufacturers, authorised representatives, importers and distributors, the device classification rules, the conformity-assessment routes involving notified bodies, and the EUDAMED registration and UDI traceability requirements.

MDR Article 51 and Annex VIII classify devices into Class I, IIa, IIb and III based on factors such as duration of contact, invasiveness, and whether the device is active or implantable. The higher the class, the more demanding the conformity-assessment route and the deeper the notified-body involvement. Class I devices (non-sterile, non-measuring) are largely self-declared by the manufacturer.

Born out of IMDRF work, the Medical Device Single Audit Program authorises recognised auditing organisations to run a single ISO 13485-based audit covering the regulatory requirements of the TGA (Australia), ANVISA (Brazil), Health Canada, Japan's MHLW/PMDA and the US FDA. Health Canada requires MDSAP certification for device licence holders; the other authorities accept the audit in place of, or alongside, their own routine audits and inspections.

Since Brexit, devices placed on the Great Britain market must be registered with the MHRA and carry UKCA marking — or CE marking during the transitional acceptance periods the MHRA has set; Northern Ireland remains under the EU MDR/IVDR. The MHRA maintains the UK device regulations, handles UK vigilance, and designates and oversees UK approved bodies.

ISO 9000:2015 defines nonconformity as the non-fulfilment of a requirement. In a medical-device QMS, nonconformities detected in products, processes or audits are documented, evaluated and dealt with through the control-of-nonconforming-product and CAPA processes of ISO 13485 (clauses 8.3 and 8.5).

Designated and monitored under MDR Article 35 and Annex VII, notified bodies carry out the conformity assessment for all but the lowest-risk (Class I, self-declared) devices — auditing the quality management system, reviewing technical documentation and issuing certificates. Each notified body has a unique four-digit number that appears next to the CE mark of the devices it certifies.

IVDR Article 56 and Annex XIII require manufacturers of in-vitro diagnostics to demonstrate scientific validity, analytical performance and clinical performance, documented in a performance evaluation report that follows a performance evaluation plan and is kept up to date with post-market performance follow-up data — for class C and D devices, updated when necessary and at least annually.

A PMA (section 515 of the FD&C Act, 21 CFR Part 814) must demonstrate reasonable assurance of safety and effectiveness with valid scientific evidence, typically including clinical data. An approved PMA is in effect a private licence to market the device — the US counterpart of notified-body certification of the highest-risk EU classes, but ending in a federal approval.

MDR Annex XIV Part B frames PMCF as a continuous process updating the clinical evaluation: the manufacturer proactively collects and evaluates clinical data from real-world use of the device to confirm safety and performance over its lifetime, identify previously unknown risks and keep the benefit-risk ratio acceptable. Findings feed the PMCF evaluation report, the clinical evaluation report and, for class III and implantable devices, the SSCP.

Japan regulates devices under the Pharmaceuticals and Medical Devices Act: the PMDA performs the scientific reviews and reliability assessments, while formal approval decisions rest with the Ministry of Health, Labour and Welfare. Registered certification bodies handle designated lower-risk classes, and Japan is one of the five MDSAP jurisdictions.

IVDR Annex XIII Part B requires manufacturers to proactively collect and evaluate performance and scientific data from the use of their in-vitro diagnostic, to confirm safety, performance and scientific validity, identify emerging risks, and keep the benefit-risk ratio acceptable. Results update the performance evaluation report.

MDR Article 83 requires manufacturers to plan, establish, document and maintain a post-market surveillance system proportionate to the risk class and device type, actively and systematically gathering data on quality, performance and safety throughout the device's lifetime. Its findings drive updates to the risk management, the clinical evaluation, the technical documentation and, where applicable, corrective actions and the PSUR.

MDR Article 85 requires manufacturers of class I devices to prepare a post-market surveillance report summarising the results and conclusions of the analyses of post-market surveillance data, with a rationale and description of any corrective or preventive actions taken. It is updated when necessary and provided to the competent authority on request; higher classes prepare a PSUR under Article 86 instead. The IVDR mirrors this split: manufacturers of class A and B devices prepare a post-market surveillance report under IVDR Article 80.

When a device has more than one device identifier (for example across different packaging levels or issuing agencies), the manufacturer marks one as the Primary DI in the UDI system (MDR Article 27). It is the identifier EUDAMED and MD Atlas use as the canonical reference for that device record.

Required by MDR Article 15, the Person Responsible for Regulatory Compliance must hold a relevant degree plus experience (or extended experience). They ensure devices are checked before release, technical documentation and the declaration of conformity are kept up to date, post-market-surveillance and vigilance obligations are met, and (for investigational devices) the required statement is issued. Micro and small enterprises may use an external PRRC.

MDR Article 86 requires manufacturers of class IIa, IIb and III devices to prepare a periodic safety update report summarising post-market surveillance results and conclusions, the benefit-risk determination, the main PMCF findings and sales volumes. It is updated at least every two years for class IIa and at least annually for classes IIb and III; for class III and implantable devices it is submitted to the notified body. Under the IVDR, Article 81 requires a PSUR from manufacturers of class C and D devices.

Issued under the MDR Annex IX conformity-assessment route, the quality-management-system certificate attests that the manufacturer's QMS — covering design, manufacturing and post-market activities — meets the regulation. It is typically underpinned by the harmonised standard EN ISO 13485 and is the foundation for marketing most higher-risk devices.

The Quality System Regulation (QSR) long defined US current good manufacturing practice for devices. The FDA's Quality Management System Regulation (QMSR) final rule amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, with effect from 2 February 2026 — aligning the US framework with the standard that already underpins EU QMS certificates and MDSAP audits.

MDR Annex I §3 requires manufacturers to establish, implement, document and maintain a risk management system: identifying hazards, estimating and evaluating the associated risks, eliminating or controlling them, and evaluating the impact of production and post-market information. The resulting records form the risk management file, structured in practice according to EN ISO 14971.

MDR Article 2(58) defines a serious adverse event as one leading to death; to serious deterioration in health (life-threatening illness or injury, permanent impairment, hospitalisation or its prolongation, intervention to prevent the foregoing, chronic disease); or to foetal distress, foetal death or a congenital physical or mental impairment or birth defect. Article 80 sets the recording and reporting obligations during clinical investigations.

Software intended to drive or influence a device, or that has a medical purpose on its own (medical device software, MDSW — often called Software as a Medical Device, SaMD), is classified under MDR Annex VIII Rule 11. Because Rule 11 tends to push diagnostic and monitoring software into Class IIa or higher, many software products that were unregulated or self-declared now require notified-body involvement.

The IMDRF's SaMD key-definitions document draws the boundary: software as a medical device achieves its medical purpose on its own, running on general-purpose platforms, while software in a medical device is embedded in, or necessary for, a hardware device — firmware controlling an infusion pump, an embedded control algorithm. In the EU both fall under the MDCG's medical device software guidance (MDCG 2019-11), with classification driven by MDR Annex VIII Rule 11.

Defined in MDR Article 2(8), a single-use device is intended to be used on one individual during a single procedure. The label must carry the internationally recognised "do not reuse" symbol. Reprocessing of single-use devices is tightly restricted under MDR Article 17 and national rules.

ISO 13485 requires the quality management system to be documented — quality manual, procedures, work instructions and records (clause 4.2). SOPs are the procedure layer: they define who does what, when and how for each QMS process (document control, CAPA, vigilance, design control), and are themselves controlled documents subject to review and approval.

Under MDR Article 31, economic operators register in EUDAMED and receive a Single Registration Number after their competent authority validates the application. The SRN format encodes the country and actor role (for example a manufacturer code) and is required before the operator can register devices. It is the primary key that links a company to its devices and certificates in EUDAMED.

Required by MDR Article 32 for implantable and Class III devices (other than custom-made or investigational), the Summary of Safety and Clinical Performance is validated by the notified body and published via EUDAMED. It must include sections aimed at healthcare professionals and, where relevant, at patients, making key clinical-evidence information publicly accessible.

Required by IVDR Article 29 for class C and class D devices (other than devices for performance studies), the summary of safety and performance is validated by the notified body and made available to the public via EUDAMED. It covers, among other things, the device's intended purpose, a summary of the performance evaluation and post-market performance follow-up, and the metrological traceability of assigned values, making key performance-evidence information publicly accessible.

The general safety and performance requirements in MDR Annex I (notably §11.4–11.8) govern devices placed on the market in a sterile condition: they must be manufactured and packaged with validated sterilisation processes and labelled to indicate the sterile state and method. Sterile Class I devices require notified-body involvement for the sterility aspect.

Under MDR Article 22, a person who combines CE-marked devices (and possibly other products) into a system or procedure pack draws up a statement that the items are compatible and used within their intended purpose, and registers in EUDAMED. They do not re-certify the individual devices but take responsibility for the combination.

MDR Annex II sets out the technical documentation (device description, design and manufacturing information, general safety and performance requirements, risk-benefit analysis, and clinical evaluation) and Annex III the documentation on post-market surveillance. It must be kept up to date and made available to the notified body and competent authorities on request; it is the evidence base behind the declaration of conformity.

Under MDR Annex IX Chapter II, in addition to assessing the quality management system the notified body examines the technical documentation of the device (or a representative sample for a group). The resulting certificate attests that the design and documentation conform to the regulation for that specific device or Basic UDI-DI group.

The Therapeutic Goods Administration regulates medical devices in Australia under the Therapeutic Goods Act 1989: risk-based classification aligned with international (IMDRF) principles, conformity assessment with recognition of comparable overseas assessments — including EU notified-body certificates — inclusion in the ARTG, and post-market monitoring. Australia is one of the five MDSAP jurisdictions.

Commission Implementing Decision (EU) 2019/939 designated GS1, HIBCC, ICCBBA and IFA as the entities operating systems for the assignment of UDIs. A manufacturer obtains its device identifiers from one of these accredited entities; the code prefix in the identifier reveals which entity issued it (only GS1 codes are valid GS1 GTINs).

Within the UDI system (MDR Article 27), the UDI consists of a device identifier (UDI-DI) and a production identifier (UDI-PI). The UDI-DI is static for a given model/packaging configuration and is issued by an accredited issuing entity (such as GS1). It is the access key to the device's UDI record in EUDAMED.

The production identifier complements the static UDI-DI within the UDI system (MDR Article 27). Depending on the device it may contain the manufacturing date, expiry date, lot/batch number or serial number. Together UDI-DI + UDI-PI provide the traceability of a specific production unit on the market.

Devices placed on the market in England, Scotland and Wales carry the UKCA marking after assessment under the UK Medical Devices Regulations 2002 — by a UK approved body where third-party assessment is required. CE-marked devices remain accepted in Great Britain during the transitional periods set by the MHRA — until 30 June 2030 at the latest for devices compliant with the EU MDR or IVDR (30 June 2028 for most devices under the former directives) — and Northern Ireland continues to follow the EU MDR/IVDR.

IEC 62366-1 deliberately says 'use error' rather than 'user error': the cause is analysed in the user–device system (interface design, task complexity, use environment) instead of being blamed on the user. Use errors identified through usability engineering feed the risk management file, and the MDR requires risks related to use error to be reduced as far as possible (Annex I §5). In this glossary the abbreviation 'UE' stands for use error — not the French abbreviation of the European Union.

In the ISO 13485 documentation hierarchy, work instructions sit below procedures: an SOP describes a process across roles, while a work instruction details the exact steps, equipment and acceptance criteria for one task — an assembly step, a test method, a cleaning operation. Like SOPs, they are controlled documents.