EU MDR Annex IX: QMS Audit and Technical Documentation Assessment Explained

1. Key takeaways

Annex IX is the most frequently used conformity assessment route under the MDR, and its structure consists of three chapters: Chapter I covers the quality management system assessment, Chapter II covers the technical documentation assessment, and Chapter III covers administrative provisions and change management. For Class III devices and certain Class IIb implantable devices, Chapter II additionally requires a per-device technical documentation assessment under Article 56.

The practical consequence of this three-chapter design is that certification under Annex IX is never a paperwork exercise on one front only. The notified body examines whether the quality management system can sustain consistent design and batch production, and separately examines whether the technical documentation for the devices actually demonstrates conformity with the general safety and performance requirements. A manufacturer that prepares heavily for one chapter while neglecting the other will not obtain the certificate, and the audit plan, the documentation package and the change control procedures must all be aligned with the same project timeline. Recent delegated and implementing acts adopted in 2026 have also adjusted the exemption list and the harmonised requirements that shape how this route operates in daily practice, so project teams must verify current texts rather than relying on older summaries.

2. Legal basis

The base regulation was adopted on 2017-04-05 and became applicable on 2021-05-26, and the two 2026 acts sit on top of it as detail-level instruments. Delegated Regulation (EU) 2026/1359, dated 2026-03-20, revises the exemption list, while Implementing Regulation (EU) 2026/977, dated 2026, establishes harmonised requirements for conformity assessment and notified bodies under Annex VII. Both must be checked in parallel with the preparation of the technical documentation, because they change the operational expectations that notified bodies apply during the assessment.

3. Expert insights

Insight one: Annex IX is a two-layer audit of the system and the product, and a certificate is not issued if either layer fails.

Chapter I examines whether the manufacturer’s quality management system can support consistency between design and batch production; Chapter II examines whether the technical documentation for the specific devices demonstrates conformity with the general safety and performance requirements in Annex I. A system that passes while the technical documentation is insufficient, or technical documentation that is complete while the system has gaps, will not result in a certificate. This is a substantive difference from the practice under the former directives, where a system certificate alone often carried most of the weight. Manufacturers transitioning from the directive era must therefore rebuild their evidence packages rather than simply re-presenting their old audit scope to the new notified body.

Insight two: the technical documentation assessment is sampled by device group, not reviewed SKU by SKU.

Chapter II provides for an assessment sampled by device group and requires the manufacturer to list the device groups covered in the application. The practical implication of the sampling mechanism is that an unreasonable grouping of devices, for example merging products with very different risk profiles into a single group, will lead to insufficient representativeness of the sample and a request for additional documentation. Defining device groups is therefore a technical and regulatory judgement that deserves the same rigour as the documentation itself, and the reasoning behind the grouping should be written into the application so that the notified body can follow the logic instead of questioning it midway through the assessment.

Insight three: change management under Chapter III is a high-frequency risk point during the certificate maintenance period.

Changes to the design, intended purpose, materials or software versions of a certified device must be notified or submitted to the notified body as a change notification or change application under Chapter III. Manufacturers frequently conflate an internal engineering change notification with a major change in the regulatory sense: the latter must follow the notified body procedure, the former does not, but the authority to make that judgement rests with the notified body. Companies that treat the internal process as decisive often discover, during a surveillance audit, that changes they classified as minor required prior approval, which can jeopardise the validity of the certificate and the continuity of supply.

Insight four: two new instruments from 2026 have changed the operational expectations for the assessment.

Delegated Regulation (EU) 2026/1359, dated 2026-03-20, revised the list of Class IIb implantable devices exempt from the per-device technical documentation assessment, and Implementing Regulation (EU) 2026/977, dated 2026, establishes harmonised requirements for conformity assessment and notified bodies under Annex VII. Both instruments belong to the detail level of the framework and must be checked in parallel with the technical documentation preparation. A project that starts from the base regulation text alone will systematically miss these operational adjustments, which affect both the exemption status of individual products and the audit depth that the notified body will apply.

4. Practical recommendations

1. Before applying, complete an internal audit of the quality management system together with a gap analysis, and integrate the MDR-specific obligations, including PRRC, PMS, UDI and vigilance, into the system documentation.
2. Justify the device group division along both risk characteristics and technical characteristics, and write that justification into the application documents submitted to the notified body.
3. Structure the technical documentation according to Annex II and attach the conformity matrix for the general safety and performance requirements, so that every claim in the documentation can be traced to evidence.
4. Establish a change determination table that distinguishes changes requiring notification to the notified body from changes recorded internally, and retain the reasoning for each determination as part of the quality records.
5. Check in parallel the impact of (EU) 2026/1359 and (EU) 2026/977 on the specific project, and update the plan whenever either instrument is amended.

5. Verification checklist

• □ The quality management system covers the requirements of Annex IX Chapter I
• □ The technical documentation has been submitted by device group and the sampling representativeness explained
• □ The technical documentation complies with the structure of Annex II
• □ A change determination table has been established and distinguishes the two categories of changes
• □ The impact of (EU) 2026/1359 on this product has been checked
• □ The harmonised notified body requirements of (EU) 2026/977 have been checked

GRZAN supports manufacturers, authorised representatives and importers across the EU MDR market with CE marking pathway selection and classification strategy, including full-scope Annex IX projects: quality management system gap analysis, device group definition, technical documentation structuring and change management design. For a practical estimate of assessment timelines, notified body scoping and documentation effort for your portfolio, contact GRZAN at info@grzanglobal.com.

Regulatory information verified as of 2026-10-29.