EU MDR technical documentation review, explained.

A technical file explained: the proof a device is safe, and the read before anyone outside sees it

One catheter file, from design records to an MDR certificate

1. Departments write the evidenceDesign, labeling, manufacturing, test labs and clinical affairs each release documents on their own schedule. Calvera NC has 186 of them.
2. An author assembles the fileEverything is sorted into the sections of Annex II, and the GSPR checklist is filled in against the company's template: 181 lines.
3. The regulatory lead reviews itEvery applicable line is tied to a document and page, editions are checked, and facts are compared. Here the 36 and the 24 are caught, or they go out to the assessor.
4. The notified body assesses itA completeness check, then specialists, then questions in rounds. Calvera SC, the sister device, took 3 rounds and 61 questions.
5. The certificate arrives, or the date passesThe certificate is needed by December 31, 2027. Without it, new supply into the EU stops on that date.

Step 3 is the subject of this guide. The company, device and figures in this example are fictional.

Why a file with good evidence still draws questions, and three more surprises

GSPR, technical file, notified body, legacy device

The MDR sorts devices into four risk classes: I, the lowest, then IIa, IIb and III, the highest. Fourteen terms are defined in the one-page summary.

What the MDR technical file contains: six Annex II sections set against 23 Annex I sections

In shortAnnex I says what a device must achieve. Annex II says how to prove it. A review reads the second against the first. The proof sits in documents written by many departments, so the person who assembles the file owns almost none of the underlying work and answers for all of it.

Regulation (EU) 2017/745, Annex II.1 Annex III adds post-market documentation, which sits outside this guide.

A reader's eye lands on the big section, and the biggest section gets the most care. Yet the short ones carry the facts that spread: the 74 pages of the checklist point into everything else, and the labels in section 2 repeat values set in sections 1 and 6.

Annex I: 23 sections in three chapters, most of which apply only to some devices

Chapter I holds the general duties: performance, risk reduction, risk management, use error, lifetime, transport and storage. Chapter II covers chemical and biological properties, infection, construction, software, active devices and more. Chapter III is one long section on the label and the instructions for use.1 Sections such as radiation and software simply do not apply to a plain catheter, which is why 79 of the 181 lines on this example are marked not applicable.

The MDR transition rules, and what changed for technical files between 2023 and 2026

In shortThe MDR has applied since May 26, 2021. A 2023 amendment extended the transition for older certificates to the end of 2027 or 2028, on conditions. In 2026 the notified bodies' guidance reached Version 4, the harmonized list moved three times, and the EU's device database, EUDAMED, became mandatory. The Commission's December 2025 reform proposal remains a proposal.

MDCG is the Medical Device Coordination Group, made up of the EU countries' device authorities. It publishes the guidance cited throughout this guide.

MDR legacy devices: which deadline applies, the five conditions, and what a shelf-life change can break

In shortA legacy device may stay on sale until December 31, 2027 or 2028 while five conditions hold. Two of those carried 2024 dates that have passed, and what they put in place must stay in place. The one a file review can break is "no significant changes in the design and intended purpose", and it reaches the repair work on the file, known as remediation: correcting a shelf life on a label can count as a significant change unless the notified body approved the protocol behind it.

Article 120(3a) and (3b), as amended by Regulation (EU) 2023/607.7,8

Five conditions for staying on sale: three still running, two dated in 2024

Correcting a label can itself be a significant change

MDCG 2020-3 Rev.1, sections on intended purpose and sterilization, chart E.6 Wording shortened; read the charts for your own change.

Counting back from December 31, 2027

A legacy device's written agreement could be two years old by now, because a company may have signed to protect the transition and sent the product file later. So the survey bands cannot date your certificate. Put one question to your notified body: given where the file stands today, when could this certificate issue?4,8

How to fill in a GSPR checklist line: requirement, reason, method, standard, and the page that proves it

In shortEach line says whether the requirement applies, why not if it does not, how conformity was shown, under which standard, and which controlled document and page proves it. The last column fails most often. A line naming a document with no page leaves the assessor to search, and a search usually ends in a question.

The notified bodies say why the last column deserves the effort: "The more specific the references are to documents supporting compliance, the faster the assessment can be conducted."2 Only released documents count: "Draft documents should not be provided".2 A citation to revision B of a report now at revision D points at something a reviewer cannot obtain, so every revision of a widely cited report sends someone back through every line that cites it.

181 lines become 88 proved, on one class III catheter

A "not applicable" with a good reason, and one that is a gap in disguise

Where the checklist meets the risk file

Reviewers read these two together. Team-NB asks that verification and validation reports be "linked to the risk IDs indicated in the risk assessment".2 A residual risk, the risk left once every control is in place, that the risk report accepts usually has to reach the user, as a warning, precaution or contraindication, through the label and instructions that Annex I section 23 governs.1 In the example, the risk management report concludes 13 residual risks and the instructions list 11. Reading either document alone shows nothing wrong.

Which standard edition to cite in an MDR file: the harmonized list against the state of the art

In shortTwo clocks run at different speeds. The list in the EU's Official Journal says which edition gives you a presumption of conformity. The state of the art says which edition a reviewer measures you against, and it moves when the standard is published. A file citing a superseded edition needs a gap analysis: a written comparison of the two editions and what the difference means for the device.

What a file needs when it cites a superseded edition

Nothing happens automatically when a standard is revised. A reviewer reads the report against the current method and asks what the difference means. Team-NB says a key standard not applied in full, a newer version than the harmonized one, or an outdated one each needs "a summary or gap analysis", "a risk analysis and a duly justified conclusion". Its biocompatibility pitfalls include "No gap and impact assessment provided to demonstrate validity of evaluation/test when performed according to outdated standard."2

1. Find every citation, because the checklist, declaration of conformity, clinical evaluation and risk file often repeat the same edition.
2. Compare the two editions clause by clause, and say what changed for this device.
3. Decide: accept with a written rationale, repeat the affected tests, or update the document.
4. Send it through change control, so the citation and the document move together.
5. Keep a dated list and re-read it against the Commission's page on a fixed schedule. Monthly fits the pace above.

Cross-reading a technical file: shelf life, rated burst pressure and UDI-DI, worked through with numbers

In shortTeam-NB names different information in multiple locations as a common cause of delay and tells makers to keep duplicated facts correct everywhere. Reading a fact across documents finds what a document-by-document read cannot. Three examples, each with its arithmetic: an aging calculation, a burst pressure claim, and a barcode check digit.

Team-NB, Version 4: "There are many areas of the technical documentation that will require the duplication of information for multiple documents such as device description. Please ensure that the information is correct throughout all areas where this information is duplicated and consider the risk of potential errors/inconsistencies when updating (e.g. Basic UDI-DI, UDI-DI, intended use, indications for use, contraindications, warnings, etc.)."2

Shelf life: the arithmetic behind 36 months

Accelerated aging keeps packaged devices warm so that a shorter test stands in for years on a shelf. The usual conversion in device files, from ASTM F1980, is an aging factor built from a Q10 value, the assumed rate of change per 10 °C.17 With a Q10 of 2, a chamber at 55 °C and a room at 25 °C:

Four places a 36-month aging claim falls down

Team-NB Version 4, common pitfalls.2

A file that passes all of this can still fail on the label, because the number has to reach every document that states it.

Shelf life vs lifetime of a medical device: two claims, two kinds of proof

Annex I and II; Team-NB lists stability and shelf life under section 6.1.1,2 Team-NB: "it should not be considered that product lifetime is equivalent to shelf life."2

Rated burst pressure: 18 atmospheres in the report, 20 in the doctor's instructions

A balloon catheter's rated burst pressure is the pressure a physician must not exceed. In the example, the specification and bench report give 18 atmospheres (atm), shown at 99.9% reliability with 95% confidence. The instructions' compliance chart, the table of balloon size at each pressure, says 20 atm, because it was rebuilt in 2024 from the sister device's template. A doctor reads the instructions, so the wrong number is the one that reaches the catheter lab. Proving the claim by bursting balloons, with no failures allowed, would take this many:

That figure is our arithmetic and explains why bench reports rarely test that way. Testing a smaller sample to failure and applying statistics takes far fewer units, so the claim rests on a calculation inside report TR-2207, and a template copy can overwrite it unnoticed. EN ISO 10555-4 is the standard for these catheters; its 2023 edition replaced 2013.16

UDI-DI: a check digit that proves one of two numbers wrong

The UDI-DI is the device's identifier in its barcode. A GS1 number ends in a check digit calculated from the others, there to confirm the number's integrity.18 Multiply the digits by 3 and 1 in turn, starting from the right of the first 13, add them up, and the check digit brings the total to a multiple of ten.

Fictional numbers; our arithmetic. Team-NB lists "Basic UDI-DI is not consistent across the application, Declaration of Conformity" and other records among its pitfalls.2 With EUDAMED mandatory, the same identifiers now also sit in a public database, so a mismatch has one more place to surface.12,13

Why technical files come back: incomplete submissions and fourteen pitfalls notified bodies publish

In shortThe causes notified bodies publish are specific, and most concern finding the evidence and making documents agree. Team-NB names incomplete submissions, poor structure and inconsistent information as the most common causes of delay. The Commission's survey shows that incompleteness also ends applications outright.

Quotations from Team-NB Version 4, sections on general considerations and common pitfalls.2 The third column is ours. Notified body reviews "often reveal inconsistencies of the intended purpose in application documents", in the words of an account co-written from inside one.3

Why careful reviewers miss a value that changed in one document

A reviewer reads documents in order, and each document here is correct on its own terms. The specification was approved. The label was approved. The fault exists only in the relationship between them, and that relationship appears on no page. The change record is the usual cause: someone answers "which documents state this number?" from memory, and the people in the room own the design file. Answering from memory misses the artwork, the instructions or the risk report.

How long MDR certification takes and what it costs: the published numbers behind a late file

In shortHalf of the notified bodies that have issued one report 13 to 18 months for a new certificate covering the quality system and the product, and four in ten report longer. Fees are a small part of the bill: manufacturers report full costs several times higher, and the Commission's evaluation says the gap is their own compliance work. No one publishes the cost of a round of questions.

A journal account co-written by a notified body specialist agrees: "Data collected in summer 2024 show MDR product certifications take in 75% of all cases more than a year".3 These durations include the maker's own time on questions, and nobody publishes how much. A claim that 58% of that time sits with the manufacturer circulates in trade summaries, drawn from an older survey. We could not find it in the February 2026 data, so treat it with care.

MDR certificates keep climbing and still trail applications

What a product certificate costs, against what the notified body charges

In dollars at $1.1216 per euro, that is about $692,000 against $84,700 for a first certificate.19,20 The Commission's evaluation adds that clinical evaluations alone run about €30,000 to €250,000 (about $33,600 to $280,400), and that 112 of 275 contributions to its call for evidence, 40.7%, named notified body capacity limits and long delays as main obstacles.19

What notified bodies publish per hour of file assessment

The MDR requires these lists, and the coordination group's template tells bodies to name what drives the fee, including the "quality and completeness of the technical documentation, number nonconformities raised and rounds of reviews needed".1,26 One list states that its price "includes a maximum of 1 round of iteration".23 So rounds appear on invoices as well as in calendars.

The European medical technology market behind the notified body queue

What happens after you submit a technical file: who reads what, and how one question travels

In shortA notified body checks the application, allocates specialists by subject, assesses the clinical evidence in a report of its own, and leaves the final review and decision to its own employed staff, as the MDR requires. Written questions travel through several desks on both sides, so a small defect can cost weeks.

Some high-risk devices add an expert panel step. Class III implantables and certain class IIb active devices go through it, with 21 calendar days for a screening panel to say whether it will give an opinion and 60 calendar days to give one.2,28 Coronary dilatation catheters are class III under Rule 6 and are not implantable, so the example's file skips that step.29

One superseded edition, followed from the reviewer's desk and back

AI on a technical file: what a reader can check, what stays a signature, and which rules apply

In shortReading, mapping and comparing can be automated, because anyone can check a result by opening the cited page. Deciding which value is right, accepting a "not applicable" and signing stay with named people, as Article 15 assumes. Most regulators' AI papers are written for medicines. For device makers, the working tests are what the MDR demands of the file and what ISO 13485, the quality management standard for devices, demands of quality system software.

Where automated reading of a technical file falls short, and the control for each

Academic critics of the MDR name "transparency, clarity, and traceability of requirements" as core principles the regulation itself falls short on.36 So traceability has to be built inside your own file.

Testing an automated file read with planted errors

1. Take a released file you know well, and copy it.
2. Plant known defects: a changed shelf life on one page, a swapped digit, a superseded edition, a blank reason.
3. Count what the tool finds, what it misses, and what it flags that is correct.
4. Run the same exercise on your manual review.

It is the only comparison we know of that is fair to both, and Part C sets it out as a pilot.

How regulatory teams review a technical file today: four desks, a spreadsheet, and weeks of reading

In shortA regulatory lead walks a spreadsheet checklist, asks engineers and authors for evidence, and writes the gap list. A quality manager runs change control and often reviews second. Most of the reviewer's days go to mapping lines to pages and cross-reading documents. Teams do this in house, with consultants, or with checklist software.

Regulatory lead, file author, design engineer, quality manager: who owns which question

From released documents to a signed pre-submission review

Mapping lines to pages takes the largest share of an estimated 30-day file read

Cross-reading is usually the band that gets cut when the date is close, since nothing in a checklist forces it. And reviews stack up: at the example's six weeks a file, one reviewer needs 54 weeks for nine files due at the first deadline.

In-house spreadsheet, consultant gap assessment or checklist software

The Calvera NC file: 186 documents read, three contradictions decided, and a signed pre-submission review

In shortThis is the example from the top of the page, inside the product. Five agents, AI programs with one job each, sort, map and cross-read the file. Ingrid Halvorsen, the regulatory affairs lead, opens a board of Annex I sections, finds the shelf life that disagrees, decides it and assigns the change. Annika Brandt, the quality manager, reviews second, and Ingrid signs. The file goes to the notified body with its known issues owned and dated.

1

One ring per Annex I section

Ingrid opens the GSPR board for Calvera NC on Tuesday, October 13, 2026. Each ring is an Annex I section, filled as its lines gain evidence. An empty arc is a gap, a red notch a contradiction, a dashed ring a section that does not apply, and a dot a section the notified body asked about on the sister device.

The file stands at 86%: 88 of 102 applicable lines evidenced, 11 gaps, 3 contradictions, and 79 lines not applicable, all with a reason except the blank one that is gap G-05. Section 23, label and instructions for use, sits at 80% with two red notches.

2

Five agents read the released file

The file came from the document control system on October 9: 186 documents, 9,412 pages. The file indexer sorted them into Annex II and set 14 superseded revisions aside, never cited. The GSPR mapper sorted 181 lines into 102 and 79, then found evidence for 88. The standards checker compared 24 standards, the consistency checker read 8 facts in 46 places, and the review report writer drafted the report.

The run took 4 hours 12 minutes of agent time, each step listed with what it found.

3

Eight facts, read from every document

Classification, sterilization method, shelf life, UDI-DI, Basic UDI-DI, intended purpose, storage conditions and rated burst pressure come from 46 places in 14 documents, each value with its page. Five facts agree everywhere. Three do not, and each red cell opens both pages.

4

Shelf life: two released documents, two numbers

Contradiction C-01 opens the two pages side by side. DS-114 rev C, page 12: 36 months from the date of manufacture. LA-0388 rev B, panel 2: date of manufacture plus 24 months, so lot 260914A prints 2028-09. Change record CR-0412, approved by Annika Brandt on March 18, 2025, extended the shelf life on aging report TR-2291 rev C, and it never listed the artwork or the instructions.

The agents never choose the value. Three options sit on the right: align the label and instructions to 36 months, keep 24 and correct the design file until real-time aging reads out in March 2028, or mark it not a contradiction with a written reason.

5

Decided, assigned, and signed with the open items on the report

Ingrid aligns the label and instructions to 36 months and assigns change CR-0431 to Tomás Reyes, due October 24, with Annika Brandt approving. The ring stays red until the corrected document is released. The notified body's earlier question sits beside the decision: "Provide the evidence supporting the shelf life stated on the label and confirm it is consistent with the device description."

Annika completes the second review at 10:20 am. Ingrid signs with her name, password and the meaning "Review complete, gaps assigned before submission". The two contradictions still open stay on the report as open items.

The solution's design targets are 5 days per file review, down from about 6 weeks by hand, and no rounds of questions expected on what the review covers, down from 3 on the sister device. They are targets to measure on your own files, and clinical questions sit outside what a file read can settle.

Thirteen more screens, from a single checklist line to fourteen legacy devices

In shortOne contradiction is the story. These screens show the rest: the lines inside a section, a gap with its fix, a rejected or accepted reason, the two other contradictions, the gap list, standard editions, the file itself, the device portfolio, the drafted report and the settings that set the rules.

Select any screen to open it larger. The company, devices, people and figures are fictional.

File indexer to review report writer: five agents that find, and a regulatory lead who decides and signs

In shortEach agent has one job and a limit printed beside it. None of them chooses the right value in a contradiction, edits a controlled document, or signs anything. The regulatory lead decides every contradiction and accepts every "not applicable". On class III files a quality manager reviews second.

What each of the five agents does on an MDR file

Two people decide, and the second one reviews class III files

Versions of the checklist and report are kept, and agent steps and human decisions sit apart on the activity record. These controls support your compliance with MDR Article 15 and your quality system; the product itself holds no regulatory certification. Botminds is SOC 2 Type II audited, and manages information security to ISO 27001.

Ingrid, Tomás, Mateo and Annika on the Calvera NC file

From released Annex II documents to a filled GSPR checklist, a gap list and a signed review report

In shortThe solution reads the technical documentation you already hold, against your own checklist template, and hands back a filled checklist, gaps and contradictions with owners, an edition check, and a report for your people to sign. Your document control system stays the source of truth, read only.

Design targets for one class III file and a 14-device portfolio

Systems a technical file review connects to

For each, check whether it has an API, a file export, or only screens, and who owns it. Enterprise rollouts use roles and maker-checker sign-off, where one person prepares and another approves, across device families, with every action on the audit trail.

Your checklist template and change control stay yours

What a round of notified body questions costs you in reviewer weeks, billed hours and EU sales

In shortNobody publishes the cost of a round of questions, so the numbers that matter are yours. A few published figures frame them: the full cost manufacturers report for a certificate, how few files arrive complete, and how long certificates take. Most of the bill is your own people's time.

Finding what your own technical file reviews cost in one week

A lost tender, a lost reviewer and a wrong value in the field: costs beyond the calculator

What a faster file read returns: reviewer weeks, avoided rounds and billed notified body hours

In shortPut in your own numbers. Only the notified body rate is built from published fee lists. Every default marked illustrative is an assumption to replace, and hours with automation start at the solution's design target. The calculator leaves market exposure out on purpose: enter it in your own business case.

Reviewer weeks, rounds avoided and contradictions: where a file read saves

Work out your return from files a year, hours per file and your notified body's rate

A company with a portfolio to clear before 2027 or 2028 passes break-even quickly on these assumptions. A company reviewing one or two low-risk files a year probably does not, and should not buy on this case.

How ready your regulatory team is: portfolio, baseline, checklist discipline, controlled documents and sign-off

In shortPick the answer closest to your team today. Eight questions score 0 to 2; the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

A low score means settling one GSPR template and counting past questions first

What to ask GSPR checklist software or an MDR review service about citations, contradictions and your template

In shortAsk every vendor the same questions, us included. The answers show whether a tool reads your documents or tracks what people type, how it cites, what it does when two documents disagree, whose rules apply and how you would test it on your own file.

We found no published independent test of any GSPR or technical file review tool's accuracy, as of November 2026. A planted-defect test on your own file is the fairest comparison, and it measures your current process too.

Test a technical file review tool on one released file with planted defects, then decide on three numbers

In shortCount your past questions first, then test on your own file with defects you planted, then decide with three numbers. None of these steps commits you to a vendor.

1. Classify past questions on your last three files: which could a reader of your own file have caught?
2. Time one manual review by step, or reconstruct the last one with its reviewer.
3. Choose a released file near your largest size, and get an approval path to share it. Copy it and plant 20 known defects.
4. Run in parallel on your next live file, with your regulatory lead deciding and signing.
5. Decide with three numbers: finds by defect type, false alarms on the clean file, and reviewer days to a signed review.

Finds by defect type, false alarms and page accuracy on a planted-defect file

MDR technical documentation questions answered: GSPR, legacy deadlines, editions, timelines and AI

In shortThe questions regulatory teams and buyers search for most, each answered on its own.