Quality Management System under MDR Article 10(9) and ISO 13485

The quality management system obligation under the EU Medical Device Regulation goes beyond ISO 13485. This article explains what MDR Article 10(9) requires element by element, where the mapping gaps against ISO 13485:2016 concentrate, and why the establishment date of the QMS has become an evidentiary question.

1. Key takeaways

Under MDR Article 10(9), manufacturers must establish, document, implement, maintain, continually update and continually improve a quality management system (QMS), whose organisational structure, responsibilities, procedures, processes and resource management ensure conformity with the MDR. ISO 13485:2016 is the commonly used evidence framework, but the MDR quality management system also carries independent obligations that ISO 13485 does not cover: the person responsible for regulatory compliance (PRRC, Article 15), post-market surveillance (Article 83), UDI (Article 27), and vigilance and trend reporting (Articles 87 and 88).

The practical consequence is that an ISO 13485 certificate does not by itself demonstrate Article 10(9) conformity. Four gap areas dominate nonconformity findings in MDR transition audits, and Article 120(3c)(d), as inserted by (EU) 2023/607, required the Article 10(9) QMS to be in place no later than 2024-05-26 for legacy devices to benefit from the extended transition periods. That date has passed, so the establishment of the QMS is now a matter of historical fact that must be evidenced with documents.

The wording of Article 10(9) also matters for how the system is operated. Because the obligation covers continual updating and continual improvement, the QMS must have defined review cycles: management review, internal audit and periodic re-assessment of the regulatory compliance strategy. Evidence of these cycles running is precisely what surveillance auditors sample, and a system whose records stop at the certification date will fail that sampling.

2. Legal basis

The table below lists the provisions and standards cited in this article.

The audit of the quality management system under Annex IX Chapter I covers both the initial certification and all subsequent surveillance activity, which is why the QMS must be treated as a continuously maintained object rather than a certification-stage deliverable.

The four gap areas should be closed with dedicated procedure documents rather than with amendments to existing ISO 13485 procedures, because the MDR obligations carry their own terminology, timelines and records. A separate document set keeps the mapping auditable and makes the Article 10(9) coverage visible to the notified body without interpretation.

3. Expert insights

Insight one: Article 10(9) lists the specific elements the QMS must cover.

Article 10(9) is not an abstract statement. The provision enumerates the elements the QMS should include: the regulatory compliance strategy, identification of the general safety and performance requirements, management responsibility, resource management including the selection and supervision of the PRRC, risk management, clinical evaluation, product realisation with verification and validation, UDI assignment and EUDAMED registration, post-market surveillance and vigilance, corrective actions and change management. Mapping the quality manual against these elements one by one systematically reduces audit gaps.

Insight two: the mapping gaps between ISO 13485 and the MDR concentrate in four places.

In practice, nonconformities in MDR transition audits cluster around four items: first, no PRRC appointed or its responsibilities not recorded; second, the post-market surveillance plan not integrated into the technical documentation or not linked to risk management; third, the processes for UDI assignment and EUDAMED registration not written into the system; fourth, the deadline control for vigilance and trend reporting not proceduralised. None of these four items has a direct counterpart in the ISO 13485 clauses, which is why certified companies still fail them.

Insight three: the transition eligibility of legacy devices also points to Article 10(9).

Under Article 120(3c)(d), as inserted by (EU) 2023/607, manufacturers must have established a quality management system conforming to Article 10(9) no later than 2024-05-26 in order to benefit from the extended transition periods. That date has now passed, so the establishment date of the QMS has become a question of historical fact. Objective documentary evidence, such as document issue records and internal audit records, is needed to demonstrate it if challenged.

Insight four: the QMS remains under continuous notified body surveillance.

Under Annex IX Chapter I, the notified body audit of the quality management system does not end with initial certification; it continues through periodic surveillance audits. A system that is tidied up once before certification will keep generating nonconformities at every surveillance visit. The practical answer is to operate the Article 10(9) elements as living procedures with owners, update triggers and audit trails, rather than as a static documentation set.

In operational terms, the mapping table should be reviewed at every surveillance audit cycle, because both sides move: the MDR obligations are supplemented by implementing acts over time, and ISO 13485-based procedures are revised during internal improvement work. Keeping the mapping under document control with a named owner makes the coverage demonstrable at any point rather than reconstructed after the fact.

4. Practical recommendations

1. Build a mapping table of Article 10(9) elements against ISO 13485 clauses, and mark the four gap areas with the new procedure documents created to close them.
2. Write the appointment, responsibilities and substitute arrangement for the PRRC into the quality manual, so the obligation is visible at the system level.
3. Draft standalone procedure documents for the post-market surveillance plan, PSUR compilation, and the deadline control for vigilance and trend reporting.
4. Make UDI assignment and EUDAMED registration mandatory checkpoints before product release, so no unit leaves without the identifiers being in order.
5. Retain objective evidence of the QMS establishment date, such as document issue records and internal audit records, in preparation for transition eligibility checks.

5. Verification checklist

• □ A mapping table between the Article 10(9) elements and ISO 13485 clauses has been established
• □ The PRRC appointment and responsibilities are written into the system documentation
• □ PMS, PSUR, vigilance and trend reporting exist as standalone procedure documents
• □ UDI and EUDAMED registration are configured as pre-release checkpoints
• □ Objective documentary evidence of the QMS establishment date exists (before 2024-05-26)
• □ A routine mechanism for Annex IX Chapter I surveillance audits has been prepared

Regulatory information verified as of 2026-10-29.

GRZAN supports medical device manufacturers entering and maintaining the EU market under Regulation (EU) 2017/745. Our team maps quality management systems against MDR Article 10(9), closes the ISO 13485 gap areas, and prepares documentation for notified body certification and surveillance audits. For technical file and conformity support for the EU MDR market, contact info@grzanglobal.com.