How to Pass a Notified Body Audit: EU MDR Preparation Guide

The EU MDR Notified Body Conformity Assessment Process

EU MDR conformity assessment by a Notified Body is required for Class IIa, Class IIb, and Class III medical devices. Unlike FDA 510(k) review, which evaluates a submission document package, EU MDR Notified Body assessment involves direct auditing of your quality management system and technical documentation by the Notified Body's assessment team.

Under EU MDR, Notified Bodies are accredited and designated by EU member state national competent authorities under Regulation (EU) 2017/745. The list of designated Notified Bodies for MDR is significantly shorter than the list that existed under MDD — at the peak of MDD, approximately 80 Notified Bodies were designated. Under MDR, designation has been slower and more rigorous, and manufacturers must queue with one of the designated bodies.

The conformity assessment pathway depends on your device class and whether you choose Annex IX (QMS + technical documentation), Annex X (Type Examination), or Annex XI (Product Verification). Most manufacturers use Annex IX, which combines a QMS audit with technical documentation review. Understanding what the Notified Body will assess at each stage of this pathway allows you to prepare effectively and avoid the most common failure modes.

Stage 1: Application and Document Review

The Notified Body assessment process formally begins with your application, which includes your QMS documentation and technical documentation for the devices in scope. The Notified Body conducts a document review before scheduling the on-site QMS audit.

What the document review covers: The Notified Body's review team will examine your Quality Manual, high-level quality procedures (particularly for design controls, risk management, CAPA, PMS, and supplier management), and the technical documentation for your device or device family. They are assessing completeness, not yet auditing compliance — they want to confirm that you have the required documentation structure in place before committing to an on-site audit.

Common document review findings: Missing or incomplete clinical evaluation reports are the most frequent cause of document review delays. Under EU MDR, clinical evaluation is substantially more rigorous than under MDD. The clinical evaluation report must be current, must reference MDR-current standards and guidance, and must include a systematic literature review. SSCP documents for Class III devices must be submitted as part of the application.

Technical documentation checklist: Ensure your technical files include all elements required by MDR Annex II: device description and specification (including UDI information), design and manufacturing information, general safety and performance requirements (GSPR) checklist from MDR Annex I, benefit-risk analysis, risk management documentation, product verification and validation documentation, and clinical evaluation documentation.

Timing: Document review typically takes 6-12 weeks for complex device families. Plan your application timeline accordingly and build buffer for back-and-forth clarification requests.

Stage 2: QMS On-Site Audit

The on-site QMS audit is the central component of Notified Body assessment for Annex IX pathway manufacturers. The audit assesses whether your quality management system meets the requirements of MDR Annex IX, Chapter I, which is substantially equivalent to ISO 13485:2016 but with MDR-specific additions.

Audit scope: The QMS audit covers all quality system processes relevant to the design, manufacture, and post-market management of the devices in scope. Key processes that receive close scrutiny include: design and development controls, risk management process, post-market surveillance and PMCF, clinical evaluation and clinical data management, vigilance and complaint handling, supplier management, CAPA, and document and record control.

Audit team: Notified Bodies assigning MDR audit teams must include personnel with technical competence in the device category. Auditors will have domain knowledge in your device type — do not expect that generic quality system explanations will satisfy them on device-specific technical points.

Evidence of implementation: The QMS audit goes beyond reviewing procedures — auditors will sample records to verify that procedures are implemented consistently. They will ask to see risk management files for specific devices, CAPA records for recent nonconformances, complaint records, PMS reports, and management review minutes. Be prepared to navigate your electronic document management system efficiently.

Unannounced audits: Under EU MDR, Notified Bodies must conduct at least one unannounced surveillance audit per certification cycle. These are typically shorter than initial audits but focus on implementation evidence. Your quality system must be maintained in audit-ready condition continuously.

Common Notified Body Findings and How to Prevent Them

Understanding the most frequent Notified Body findings allows you to address weaknesses before your audit rather than after. Based on published MDCG guidance and manufacturer experience reports, the following areas generate the highest volume of audit findings under EU MDR.

Clinical evaluation deficiencies: The clinical evaluation report is the single most common source of major findings. Frequent deficiencies include: use of MDD-era equivalence reasoning that does not meet MDR Article 61 requirements, clinical literature reviews that are not systematic (lack documented search strategy, inclusion/exclusion criteria, and complete bibliography), PMCF plans that are not adequately justified or are disconnected from the clinical evaluation, and failure to demonstrate compliance with MDR's benefit-risk standard.

PMS system gaps: Many manufacturers have complaint handling procedures that meet QSR or basic ISO 13485 requirements, but not the comprehensive PMS system required by MDR Articles 83-86. MDR requires an active, systematic PMS process that goes beyond reactive complaint handling — including proactive market feedback collection, systematic literature monitoring, and trend analysis.

GSPR checklist incompleteness: The MDR Annex I General Safety and Performance Requirements checklist must address every applicable requirement and provide specific references to the technical documentation that demonstrates compliance with each. Checklist entries that say "not applicable" without justification, or that reference standards without demonstrating device-specific compliance, will generate findings.

Labeling non-conformances: MDR Annex I Section 23 has specific labeling requirements that differ from MDD requirements. UDI carrier placement, MDR-compliant symbol usage (per ISO 15223-1), and language requirements for all EU market member states are all common finding areas.

Managing the Audit: Practical Tips

Preparation for the audit itself — not just the documentation — significantly affects the audit outcome. How your team presents and responds during the audit influences the auditor's findings and the audit report tone.

Pre-audit preparation: Conduct an internal mock audit at least 3 months before your Notified Body audit. Use external auditors if possible — your internal team is too familiar with your system to identify the gaps that an outside observer will find. Address all findings from the mock audit before the actual audit.

Opening meeting: Use the opening meeting to confirm audit scope, schedule, and logistics. Introduce the key personnel the auditor will interact with. Do not use the opening meeting to provide lengthy justification for your quality system approach — wait for questions.

During the audit: Provide only the evidence that is asked for. Volunteering additional information can expand audit scope or introduce topics you are not prepared to address. When a finding is raised, acknowledge it professionally without becoming defensive. Ask for time to consider the finding if needed — auditors generally allow time to respond.

Closing meeting: All findings should be discussed at the closing meeting before the audit team departs. Major findings (which may prevent certification) and minor findings (which require CAPA within a defined timeframe) will be categorized. Respond to major findings promptly — the timeframe for response is typically 30-60 days depending on the Notified Body.

Post-audit CAPA: CAPA responses to Notified Body findings must be systematic: document the root cause, implement corrections and corrective actions, verify effectiveness, and provide objective evidence of implementation to the Notified Body. Superficial responses that address the symptom without the root cause will be rejected.