Arthur Cox is pleased to present the first of a series of knowledge bites to prepare medical device manufacturers for the new EU medical device regulations, otherwise known as the Medical Device Regulation (“MDR”) and the In Vitro Diagnostic Regulation (“IVDR”) (both referred to as the “Regulations”.)

We all know that notified bodies will have a bigger role to play in the enforcement of the new MDR and IVDR which also brings greater scrutiny over these bodies. One of these roles is the right to carry out unannounced onsite audits and to conduct physical or laboratory tests on medical devices as part of their compliance activities.

While some notified bodies have already begun unannounced audits following Commission Recommendation 2013/473/ EU, the new Regulations will now make this a binding obligation on all notified bodies. Occurrence of unannounced audits is about to grow as unannounced audits will now apply to manufacturers of certain devices, including self-certified IVDs, that did not previously require the involvement of a notified body.



Appropriately qualified notified body site auditors. Their qualifications are prescribed by the Regulations. Assessment teams must be rotated at appropriate intervals. Manufacturers will not continually have the benefit of an auditor who is familiar with the procedures and processes of the manufacturer which could lead to inconsistencies in approach.


On-site audits of the manufacturer, its suppliers and/or its subcontractors. The Regulations will apply to all legal manufacturers who are placing products on the EEA market regardless of where their facilities are located in the world. Unannounced audits may, therefore, occur at sites outside the EEA.


Audits are to be carried out, at least, once every 5 years. Further rules on the minimum frequency of such audits will be included in an Implementing Act to be adopted by the European Commission. These frequency rules will take account of the risk-class and type of device. It remains to be seen if the Implementing Acts will follow the same risk categorisation as the EU Commission recommendation below:

» For High Risk devices - once every two years

» For Medium/Low Risk devices - once every three years.


Either in conjunction with or separate to the notified bodies’ periodic surveillance assessment, which occurs at least once a year. With the exception of custom-made devices, notified bodies can test samples of products from the production line and/or sample products that are already placed on the market. Interestingly, the Regulations state that notified bodies must specify the sampling and testing procedure prior to the audits.

Manufacturers will receive the audit report along with the results of the sample test. If there is a divergence between the sample taken and the specifications in the technical documentation or approved design, the bodies can suspend or withdraw the certificate of conformity or impose restrictions on it.


If not already, you should:

» have processes and procedures in place as part of your quality management system for hosting unannounced audits;

» ensure all staff have been trained and are aware of the requirements and responsibilities;

» assess your key sub-contractors and suppliers and review the contractual arrangements to ensure the notified body has necessary access to perform an unannounced audit at their locations.