MDR General Safety and Performance Requirements: Annex I Compliance Mapping in Practice

The general safety and performance requirements are the normative backbone of the EU Medical Device Regulation. This article explains how the GSPR set out in MDR Annex I is structured, how the applicability-plus-justification logic works, and how electronic instructions for use change the compliance picture.

1. Key takeaways

The general safety and performance requirements (GSPR) are set out in MDR Annex I and are organised in three chapters. Chapter I contains the general requirements, covering performance, safety, benefit-risk determination and risk management, among others. Chapter II contains the requirements on design and manufacture, covering chemical, physical and biological properties, infection and microbial contamination, devices incorporating medicinal products or biological materials, software and cybersecurity, active devices, sterilisation, measurement functions and radiation protection. Chapter III contains the requirements on the labelling and information supplied with the device.

Two structural features define how the GSPR must be handled. First, the GSPR operates as an applicability-plus-justification structure rather than a clause-by-clause mandate: manufacturers identify which requirements apply in view of the intended purpose and justify every requirement that does not apply. Second, the GSPR remains the measuring stick after the device is on the market, because post-market surveillance data and vigilance signals feed back into the conformity conclusions recorded in the matrix.

2. Legal basis

The table below lists the instruments cited in this article and their dates.

The GSPR matrix should always be read against the consolidated text of Annex I on EUR-Lex, and the electronic instructions for use pathway should be checked against the current version of Implementing Regulation (EU) 2021/2226 as amended.

For manufacturers migrating from the directives, the matrix should be rebuilt rather than edited. The Chapter II entries added under the MDR, in particular on software, cybersecurity and reprocessing, cannot be answered by renumbering, because each new entry needs its own justification and its own evidence reference. Rebuilding also forces a fresh applicability pass, which is where most omissions surface.

3. Expert insights

Insight one: the GSPR is an applicability-plus-justification structure, not a clause-by-clause mandate.

The principle of application in Annex I is that the manufacturer identifies, on the basis of the intended purpose of the device, which requirements are applicable, and documents the reasons why non-applicable requirements do not apply. A compliance matrix must therefore include a non-applicability column together with the reasons for each such entry. A matrix that lists only the applicable clauses is incomplete, and it is one of the most frequent reasons for documents being returned by notified bodies during review.

Insight two: the technical density of Chapter II is far higher than that of the old directives.

Chapter II covers software and cybersecurity, the electrical safety and electromagnetic compatibility of active devices, devices incorporating nanomaterials, devices incorporating medicinal products, devices constructed from substances absorbed by the human body, sterilisation and microbial control, measurement functions and metrological traceability, and radiation protection. Compared with the essential requirements of the old directives, the MDR added explicit entries on software safety, cybersecurity and the reprocessing of reusable devices, which means legacy matrices carried over from MDD-era files need genuine rework rather than simple renumbering.

Insight three: Chapter III allows labelling and instructions for use to go electronic, but on conditions.

Section 23 of Annex I defines the information the manufacturer must supply with the device. Under Implementing Regulation (EU) 2021/2226, as amended by (EU) 2025/1234, instructions for use for certain categories of devices may be supplied electronically, subject to the applicable conditions and exceptions laid down in that regulation. The choice between an electronic and a paper version is therefore not a purely commercial decision: eligibility must be assessed clause by clause against the implementing regulation before the electronic route is adopted.

Insight four: the GSPR is also the measuring stick for post-market review.

Post-market surveillance data, vigilance signals and changes to the device all feed back into the conformity conclusions recorded against the GSPR. Chapter I of Annex I requires the benefit-risk determination to rest on acceptability criteria, and those criteria evolve as post-market data accumulate. The compliance matrix must therefore be linked to the PMS and PSUR processes, with defined update points, rather than remaining a static certification-stage artefact.

4. Practical recommendations

1. Build the compliance matrix with six columns: clause number, applicability, reason for applicability or non-applicability, method of demonstration, evidence file number, and conclusion.
2. State the reason separately for every non-applicable clause; never leave cells blank, because an empty cell is indistinguishable from an omission.
3. Issue a dedicated demonstration document for the software and cybersecurity entries, kept under its own version control and referenced from the matrix.
4. Before adopting electronic instructions for use, check the applicability conditions against (EU) 2021/2226 as amended in 2025, and record that check in the device file.
5. Establish defined update points linking the GSPR matrix to the PMS and PSUR cycles, so that post-market conclusions flow back into the matrix on a schedule.

5. Verification checklist

• □ The compliance matrix covers all clauses of Annex I Chapters I, II and III
• □ A reason has been written for every non-applicable clause
• □ The software and cybersecurity entries have been demonstrated in dedicated documents
• □ The applicability conditions for electronic instructions for use have been checked against (EU) 2021/2226 and (EU) 2025/1234
• □ The GSPR matrix has been linked to the PMS and PSUR update cycle
• □ Evidence file numbers and versions can be traced line by line from the matrix

Regulatory information verified as of 2026-10-29.

GRZAN supports medical device manufacturers entering and maintaining the EU market under Regulation (EU) 2017/745. Our team builds and maintains GSPR compliance matrices against MDR Annex I, prepares demonstration files for notified body review, and assesses the electronic instructions for use pathway under Implementing Regulation (EU) 2021/2226. For technical file and conformity support for the EU MDR market, contact info@grzanglobal.com.