Manufacturer Obligations under EU MDR Article 10

1. Key takeaways

Article 10 of the MDR is the general charter of manufacturer obligations. It covers the risk management system, clinical evaluation, technical documentation, control of series production, conformity assessment, the EU declaration of conformity and the CE marking, document retention (at least 10 years, and at least 15 years for implantable devices), the quality management system, UDI assignment, registration in EUDAMED, post-market surveillance and vigilance. These obligations are not reduced or waived because the manufacturer is not established in the EU. A manufacturer located anywhere in the world that places devices on the Union market carries the same Article 10 duties, which is why the article is the anchor for compliance planning, internal responsibility assignment and external representations alike.

2. Legal basis

3. Expert insights

Insight 1: Article 10 is a full-lifecycle obligation, not a pre-market task.

Article 10 runs from risk management at the design stage (Article 10(2)) all the way to post-market surveillance (Article 10(15)) and vigilance (Article 10(16)). A company that only builds the technical documentation at project stage has covered one segment of the article. The post-market duties, including the post-market surveillance plan, periodic safety update reports, vigilance reporting and trend reporting, only begin in earnest when the device is on the market. Treating them as documentation rather than as operational processes is a common conversion failure: the obligations require procedures, owners, records and periodic review, not a binder prepared once for the notified body and archived afterwards. Companies that build these processes early, with practical estimates for reporting timelines built into the quality system, absorb the post-market workload without emergency rework.

Insight 2: The retention period is 10 years, and 15 years for implantable devices.

Under Article 10(8), the manufacturer must keep the technical documentation, the EU declaration of conformity and, where issued, the relevant certificates, including any amendments and supplements, for at least 10 years after the last device has been placed on the market; for implantable devices the period is at least 15 years. These are hard numbers that competent authorities can verify directly, and they are also the retention parameters of the document management system. The starting point matters as much as the duration: the clock runs from the last unit placed on the market, so product families with long production tails need retention policies that extend far beyond the retirement of any individual batch.

Insight 3: The quality management system is a statutory requirement, and having ISO 13485 alone is not enough.

Under Article 10(9), the manufacturer must establish, document, implement, maintain, continually update and continually improve a quality management system. ISO 13485 is a commonly used evidence framework, but the MDR QMS requirements additionally cover the PRRC (Article 15), post-market surveillance (Article 83), UDI (Article 27) and vigilance (Article 87), which ISO 13485 does not cover as such. Equating the two leads to systemic non-conformities at audit, because the auditor tests the MDR-specific obligations against the actual system. The quality manual should map each MDR requirement to a process, an owner and a record, rather than importing the standard clause numbers as a substitute.

Insight 4: UDI assignment and EUDAMED registration are pre-conditions of placing on the market.

Under Article 10(10) and (11), the manufacturer must assign UDIs in accordance with Article 27 and complete the relevant registrations in EUDAMED (Articles 29 and 31) before placing a device on the market. From 2026-05-28, pursuant to Commission Decision (EU) 2025/2371, the relevant EUDAMED modules become mandatory, and registration changes from an option to a mandatory step. Manufacturers should treat UDI and registration as release checkpoints wired into the shipping process, because a device that is physically ready but unregistered cannot lawfully be placed on the market, and retrofitting registration data under time pressure is where labelling and UDI errors concentrate. Practical estimates for registration lead time should therefore be built into the launch plan, pending verification against the mandatory module dates.

4. Practical recommendations

1. Build an Article 10 obligations matrix mapping all sixteen obligations to internal responsible roles and document numbers.
2. Configure the retention policies of the document management system separately for the 10-year and 15-year categories, and mark the starting point (the date the last device was placed on the market).
3. Map the MDR-specific obligations (PRRC, post-market surveillance, UDI, vigilance) explicitly in the quality management system manual; do not copy ISO 13485 clause numbers as a substitute.
4. Make UDI assignment and EUDAMED registration release checkpoints: no shipment before completion.
5. Legacy devices remain subject to the post-market surveillance, vigilance and registration obligations of the MDR under Article 120(3d); manage them in a separate register.

5. Verification checklist

• □ An Article 10 obligations matrix has been established with named owners
• □ Retention periods are configured for the 10-year and 15-year categories
• □ The quality management system covers the four MDR-specific obligations: PRRC, post-market surveillance, UDI and vigilance
• □ UDI assignment is completed and linked to the Basic UDI-DI
• □ EUDAMED registration status has been confirmed (mandatory modules from 2026-05-28)
• □ Legacy devices are managed in a separate register with MDR post-market obligations fulfilled

Regulatory information verified as of 29 October 2026.

About GRZAN. GRZAN builds manufacturer compliance systems around Article 10 of Regulation (EU) 2017/745 for companies pursuing CE marking in the European Union. From the risk management file and clinical evaluation to the quality management system, UDI and EUDAMED registration, we turn the sixteen obligations of Article 10 into owned processes and audit-ready records, and we keep them running after certification through post-market surveillance and vigilance support. For a complete, inspection-ready compliance build in the EU MDR market, contact info@grzanglobal.com.