The testing is done. The clinical evaluation report is signed. The technical file goes to the notified body — and comes back with a long list of questions. Very few of them say a test is missing. Most say the reviewer could not find the evidence, could not tell which version applies, or could not see which requirement a report was meant to prove.
Every one of those questions is a review cycle, and review cycles, more than testing, decide when a CE certificate is issued. This guide sets out what Annexes II and III of the EU Medical Device Regulation (EU) 2017/745 actually require, how notified bodies want the file laid out, and the gaps we see most often when manufacturers bring us a file that has stalled.
What the MDR requires
Article 10(4) of the MDR obliges every manufacturer of a device other than a custom-made device to draw up and keep up to date technical documentation. That documentation must allow the conformity of the device with the Regulation to be assessed, and must include the elements in Annexes II and III.
Three further points in Article 10 shape how the file is kept:
- It is a living file. “Keep up to date” means the documentation follows every design change, every risk review and every post-market finding — not just the day of certification.
- It must be retained. Under Article 10(8), the technical documentation and EU declaration of conformity must be available to competent authorities for at least 10 years after the last device covered by the declaration is placed on the market, and at least 15 years for implantable devices.
- It may be requested in another language. Under Article 10(14), a competent authority can ask for the documentation demonstrating conformity in an official Union language chosen by that Member State.
Annex II opens with a requirement many files fail before the reviewer reaches the content: the documentation must be presented in a “clear, organised, readily searchable and unambiguous manner”.
The six parts of Annex II
1. Device description and specification, including variants and accessories. Trade name, intended purpose and intended users; the Basic UDI-DI; patient population, indications, contraindications and warnings; principles of operation; the rationale for qualifying the product as a device; the risk class and the Annex VIII classification rules applied; novel features; accessories and combination products; all variants and configurations; key functional elements and materials in contact with the body; and technical specifications that match the brochures and catalogues. Section 1.2 adds an overview of previous generations and of similar devices on the market.
2. Information supplied by the manufacturer. A complete set of labels on the device and its packaging, and the instructions for use, in the languages accepted in the Member States where the device will be sold.
3. Design and manufacturing information. The design stages applied; the manufacturing processes and their validation, ongoing monitoring and final product testing; and every design and manufacturing site, including suppliers and subcontractors.
4. General safety and performance requirements (GSPR). Which Annex I requirements apply and why the others do not; the method used to show conformity with each; the harmonised standards, common specifications or other solutions applied; and precise identification of the controlled documents that provide the evidence, cross-referenced to where they sit in the file.
5. Benefit-risk analysis and risk management. The benefit-risk analysis under Annex I sections 1 and 8, and the risk management solutions and results under Annex I section 3.
6. Product verification and validation. Results and critical analyses of all verification and validation. Section 6.1 covers pre-clinical and clinical data: biocompatibility, physical, chemical and microbiological characterisation, electrical safety and EMC, software verification and validation, stability and shelf life, performance and safety, the clinical evaluation plan and report, and the post-market clinical follow-up (PMCF) plan and evaluation report — or a justification for why PMCF does not apply. Where no new testing was done, the file must give the rationale. Section 6.2 adds information for specific cases: medicinal substances, tissues of human or animal origin, substances absorbed by the body, CMR or endocrine-disrupting substances, sterile devices (including sterilisation and packaging validation), devices with a measuring function, and devices connected to other devices.
Annex III: the post-market half of the file
Annex III makes post-market surveillance part of the technical documentation, not a separate system. It requires the post-market surveillance plan under Article 84, which must set out a proactive and systematic process for collecting data, methods for assessing it, indicators and threshold values for reassessing benefit-risk, complaint investigation tools, trend reporting methods, procedures for corrective action, tools to trace devices, and the PMCF plan or a justification for not having one.
It also brings in the periodic reports:
- Class I devices: a post-market surveillance report under Article 85, updated when necessary and provided to the competent authority on request.
- Class IIa devices: a periodic safety update report (PSUR) under Article 86, updated when necessary and at least every two years.
- Class IIb and Class III devices: a PSUR updated at least annually.
Article 86 states that the PSUR forms part of the technical documentation (except for custom-made devices). A file submitted without a working PMS plan is incomplete, however strong the design evidence.
The GSPR checklist is the spine of the file
Section 4 of Annex II is where most files are won or lost. Team-NB, the association of European notified bodies, says in version 4 of its best-practice guide (21 April 2026) that a “simple collection of test/verification reports” does not satisfy the requirement. What reviewers want is a compliance matrix that, for every requirement in Annex I:
- states whether it applies, with a reason when it does not;
- names the method used to show conformity and the standard applied, with its edition;
- points to the exact controlled document, by number and version, that holds the evidence;
- links verification and validation evidence back to the risk controls it supports.
Built this way, the checklist becomes the map the reviewer follows through the rest of the file. Built as a tick-box list, it sends the reviewer searching — and searching produces questions.
How notified bodies want the file presented
The Team-NB guide is not law, but it reflects what reviewers at your notified body will expect. Its practical points:
- Follow the logical order of Annex II, keep folders to a minimum, and agree the folder structure with your notified body before submission.
- Provide an index or table of contents with hyperlinks; bookmark PDFs; give any document of ten pages or more its own internal table of contents.
- Use PDF where possible and avoid scanned documents. Keep path and file name under 160 characters, and no single PDF over 100 MB.
- Submit complete, final reports. The guide states that abbreviated or partial test reports are not considered acceptable, and draft documents should not be provided.
- Keep the product name, intended purpose and Basic UDI-DI identical across every document, including the declaration of conformity and the labels.
- Confirm language requirements with the notified body, and invest in good translations — the guide warns that poor translations cause more questions.
Where this goes wrong
The same device described three ways. The intended purpose in the clinical evaluation report differs slightly from the IFU, which differs again from the declaration of conformity. Team-NB lists inconsistent intended use and Basic UDI-DI among the most common deficiencies. Write one controlled statement of intended purpose and copy it, word for word, everywhere.
“Not applicable” with no reason. A GSPR marked not applicable without justification is a question waiting to happen. One sentence per exclusion closes it.
A folder of test reports in place of a GSPR checklist. The evidence may all be there, but if the checklist does not name the document and version for each requirement, the reviewer has to rebuild the link — and will ask you to do it instead.
Summary reports instead of full reports. A two-page summary from a test laboratory is convenient for internal use. Submit the full report, with protocol, raw results and conclusions.
Validation from one site only. If the same sterilisation or sealing process runs at two sites, Team-NB expects validation for each. The same applies when only a re-validation is supplied without the initial validation.
Brochure specifications that do not match the file. Annex II section 1.1(l) requires the technical specifications in the file to match those in brochures and catalogues. Marketing material written separately often claims a wider range or a different accuracy.
Labels in one language only. Section 2 asks for labels and IFU in the languages accepted where the device will be sold. An English-only label set for a device intended for several Member States is incomplete.
A PMS plan copied from a template. Annex III asks for indicators and threshold values specific to the device. A generic procedure with no device-specific thresholds does not meet it.
A file frozen at certification. Article 10(4) requires the documentation to be kept up to date. Surveillance audits look for changes made since the last review, and an out-of-date file is a finding.
What the proposed MDR revision changes — and what it does not
On 16 December 2025 the European Commission published a proposal, COM(2025) 1023, to amend the MDR and the IVDR. Among other changes, it proposes less frequent PSUR updates — for Class IIb and III devices, a first update one year after certification and then every two years unless the benefit-risk determination changes significantly, and for Class IIa only when considered necessary. It also proposes that technical documentation for Class IIa and IIb devices could be assessed on a representative device for a generic device group, rather than device by device.
These are proposals. They must pass the European Parliament and the Council before they become law, and the text may change on the way. Until then, Annexes II and III apply exactly as written, and a file built to them now will not be wasted under the revised rules. Pausing work to wait for the revision means arriving late to a notified body queue.
A practical build order
- Fix the intended purpose, classification and Basic UDI-DI first. Everything else references them.
- Build the GSPR checklist as a skeleton before testing is complete, so every report has a destination.
- Close the risk management file and link each risk control to its verification evidence.
- Assemble the clinical evaluation, PMCF and PMS documents together — they must tell one consistent story.
- Run a final consistency check across the declaration of conformity, labels, IFU and clinical evaluation report before submission.
Frequently asked questions
What is the difference between Annex II and Annex III technical documentation?
Annex II covers the device itself: description, labelling, design and manufacture, GSPR conformity, risk management, and verification and validation including clinical data. Annex III covers post-market surveillance: the PMS plan and the PSUR or post-market surveillance report. Article 10(4) requires both.
How long must EU MDR technical documentation be kept?
Under Article 10(8), at least 10 years after the last device covered by the EU declaration of conformity is placed on the market, and at least 15 years for implantable devices.
Do Class I devices need technical documentation?
Yes. Article 10(4) applies to all devices other than custom-made devices. Class I manufacturers prepare a post-market surveillance report under Article 85 rather than a PSUR.
How often must a PSUR be updated?
Under Article 86 as it stands today: at least annually for Class IIb and III devices, and when necessary and at least every two years for Class IIa. The Commission’s December 2025 proposal would reduce these frequencies, but it is not yet law.
Can the technical file be in English?
Many notified bodies accept English, but language for the conformity assessment should be confirmed with your notified body. Labels and IFU must be in the languages accepted in each Member State where the device is sold, and a competent authority can ask for documentation in an official language of its choosing under Article 10(14).
Should we wait for the MDR revision before preparing the file?
No. COM(2025) 1023 is still a proposal and must be agreed by the European Parliament and the Council. The current Annexes II and III apply until any amendment is adopted and becomes applicable.
Medfins prepares and remediates EU MDR technical documentation — GSPR checklists, risk management files, clinical evaluation and PMS documents — and manages the file through notified body review, drawing on 175+ regulatory projects. If your file is in preparation or has come back with questions, contact our team or see our CE marking under EU MDR services.
