Evidence an auditor or authority will ask for: MDR audit preparation for distributors

This document outlines the essential evidence distributors and importers of medical devices in the European Union must prepare for audits by competent authorities or notified bodies. Compliance with the Medical Device Regulation (MDR) 2017/745, particularly Articles 13 and 14, is paramount. This guide will detail the types of documentation and records typically requested during such inspections.

#Understanding the Regulatory Framework for Distributors and Importers

The Medical Device Regulation (MDR) establishes specific obligations for economic operators, including distributors and importers. These obligations are distinct from those of manufacturers, focusing on ensuring devices placed on the market meet regulatory requirements. Distributors and importers act as critical links in the supply chain, responsible for verifying compliance before making devices available to end-users.

#Obligations of Distributors: Article 14 MDR

Distributors must act with due care in relation to the requirements of the MDR. Prior to making a device available on the market, a distributor must verify several key aspects, as specified in Article 14(2) MDR:

• The device has been CE marked.
• A declaration of conformity has been drawn up for the device.
• A UDI has been assigned by the manufacturer, where applicable.
• The device is labelled in accordance with the MDR and accompanied by instructions for use (IFU).
• The manufacturer has assigned a single registration number (SRN) and is registered in EUDAMED.
• The importer (if applicable) is identified and registered in EUDAMED.

Distributors must also ensure that, while a device is under their responsibility, storage and transport conditions comply with the manufacturer's instructions. They must have a quality management system (QMS) or established procedures to manage these activities. If a distributor considers that a device does not conform to the requirements of the MDR, they must not make it available on the market and must inform the manufacturer, importer, and the competent authority. This is stipulated in Article 14(4) MDR.

#Obligations of Importers: Article 13 MDR

Importers bear significant responsibility as the first economic operator within the EU. Before placing a device on the market, an importer must verify, as per Article 13(2) MDR:

• The device has been CE marked and an EU declaration of conformity has been drawn up.
• The manufacturer has been identified and has designated an authorised representative.
• The device is labelled in accordance with the MDR and accompanied by instructions for use (IFU).
• A UDI has been assigned by the manufacturer.
• The manufacturer has complied with its registration obligations in EUDAMED.

Importers must indicate their name, registered trade name or registered trade mark, registered place of business, and the address at which they can be contacted on the device, its packaging, or in a document accompanying the device. This is a crucial identifier for market surveillance, as per Article 13(6) MDR.

Importers are also required to register in EUDAMED, as outlined in Article 31 MDR. They must ensure that the storage and transport conditions of the device comply with the manufacturer's instructions, as per Article 13(8) MDR. Furthermore, importers are responsible for informing manufacturers, authorised representatives, and competent authorities if they believe a device does not comply with the MDR. This is specified in Article 13(4) MDR.

#Key Areas of Audit Scrutiny

Auditors typically focus on specific aspects of a distributor's or importer's operations to verify compliance. These areas are directly linked to the legal obligations outlined in Articles 13 and 14 MDR.

#1. Quality Management System (QMS) Documentation

A robust QMS is the cornerstone of regulatory compliance. Auditors will expect to see comprehensive documentation demonstrating the establishment, implementation, and maintenance of a QMS proportional to the level of risk of the devices and the type of activity. This may include:

• QMS manual and procedures: Evidence of documented procedures covering all relevant MDR requirements, including those for verification, storage, transport, and incident reporting. When Spreadsheets Stop Being Defensible for EU Medical Device Compliance offers insights into managing such processes effectively.
• Organisational structure and responsibilities: Clearly defined roles, responsibilities, and authorities for personnel involved in MDR compliance activities.
• Management review records: Documentation of periodic reviews of the QMS to ensure its continuing suitability, adequacy, and effectiveness.
• Internal audit reports: Records of internal audits, including findings, corrective actions, and their effectiveness.
• Personnel training records: Evidence that personnel are adequately trained and competent for their assigned tasks, particularly concerning MDR requirements.

#2. Device Verification Records

This is a critical area for both distributors and importers. Auditors will seek evidence that the verifications mandated by Article 14(2) MDR for distributors and Article 13(2) MDR for importers have been systematically performed prior to making devices available on the market.

• CE Mark verification: Procedures and records confirming the presence of the CE mark on devices.
• EU Declaration of Conformity (DoC): Records of obtaining and reviewing the DoC for each device type. This includes verifying the manufacturer's details and the scope of the DoC.
• Unique Device Identification (UDI) verification: Procedures and records confirming the assignment and presence of the UDI on devices or their packaging, where applicable.
• Labelling and Instructions for Use (IFU): Procedures and records confirming that devices are labelled according to MDR requirements and accompanied by IFUs in the correct languages, as required by the Member State where the device is made available.
• Manufacturer and Authorised Representative details: For importers, evidence of verifying the manufacturer's identity, the designation of an authorised representative, and their registration status in EUDAMED. For distributors, verification of manufacturer and importer (if applicable) registration.

#3. Supply Chain Control and Traceability

Maintaining the integrity of the supply chain is essential.

• Supplier agreements: Contracts or agreements with manufacturers and/or authorised representatives, outlining responsibilities.
• Storage and transport records: Evidence that devices are stored and transported in conditions compliant with the manufacturer's instructions. This may include temperature monitoring logs or transport condition checks.
• Traceability records: Systems and records for identifying the supplier, the devices supplied, and to whom they were supplied, to facilitate recalls or field safety corrective actions.

#4. Post-Market Surveillance and Vigilance Activities

Distributors and importers play a role in post-market surveillance (PMS) and vigilance.

• Complaint handling procedures and records: Documented processes for receiving, evaluating, and processing complaints, and records of all complaints received, including their resolution and reporting to manufacturers/competent authorities.
• Incident reporting: Procedures and records demonstrating compliance with Article 14(4) and 14(5) MDR for distributors, and Article 13(4) and 13(7) MDR for importers, regarding informing relevant parties of non-conforming devices, serious incidents, and field safety corrective actions.
• Recall procedures and records: Documented procedures for handling recalls and evidence of participation in any recall or field safety corrective action initiated by the manufacturer.

#5. EUDAMED Registration and Data Management

EUDAMED is the European database for medical devices. Its modules are being implemented in stages. Readers should confirm the current status and scope of EUDAMED modules and their national obligations with their national competent authority.

• Economic Operator Registration Module: Importers must register themselves and obtain an SRN, as per Article 31 MDR. Distributors may also register. Auditors will request evidence of this registration.
• Device Registration Module: While primarily a manufacturer's obligation, importers and distributors must verify the manufacturer's compliance with device registration (Article 29 MDR) and UDI assignment (Article 27 MDR).
• Vigilance and Post-Market Surveillance Modules: Importers and distributors must understand their responsibilities regarding reporting serious incidents and field safety corrective actions within EUDAMED, once these modules are fully functional and mandated.

Managing EUDAMED data requires robust systems. More information on leveraging digital tools for compliance can be found at: https://eudamedai.com/#platforma.

#Audit Documentation Checklist

This table provides a concise checklist of common documents and records an auditor may request.

#Common mistakes in practice

• Lack of documented procedures: Relying on informal processes instead of clear, written Standard Operating Procedures (SOPs) for key activities such as incoming device verification, complaint handling, or incident reporting.
• Incomplete verification records: Failure to maintain detailed records demonstrating that all mandated checks under Article 13(2) or 14(2) MDR were performed for every batch or device before making it available on the market.
• Insufficient training: Personnel involved in regulatory activities lacking documented training on the specific requirements of the MDR and internal QMS procedures.
• Ignoring national language requirements: Devices or their IFUs not provided in the official language(s) required by the Member State where the device is made available, as specified in Article 13(2) and 14(2) MDR.
• Poor traceability: Inability to quickly and accurately trace devices from receipt to supply, hindering effective recall or field safety corrective action processes.
• Delayed incident reporting: Failure to promptly report serious incidents or field safety corrective actions to manufacturers, authorised representatives, and competent authorities as required by Article 13(7) or 14(5) MDR.
• Outdated QMS: A Quality Management System that has not been regularly reviewed, updated, or subjected to internal audits to ensure its continuing effectiveness and compliance with current regulations.
• Neglecting EUDAMED obligations: Importers failing to register in EUDAMED, or both distributors and importers not verifying the registration status of other economic operators and devices where applicable, in accordance with Articles 29 and 31 MDR.

Preparing for an MDR audit is an extensive but necessary process for distributors and importers. A structured approach to document control and a commitment to regulatory compliance are essential for demonstrating conformity. Digital platforms can support the collation and management of required evidence, ensuring readiness for scrutiny.

This material is for information only and is not legal advice. For binding interpretation consult your national competent authority.