The general safety and performance requirements (GSPRs) of Annex I of Regulation (EU) 2017/745 are often presented as a list of regulatory requirements to comply with. In practice, they are far more than that: they form the foundation on which the entire conformity demonstration of a medical device rests.
Whether it concerns risk management, clinical evaluation, biocompatibility, cybersecurity or labelling, all the evidence contained in a technical documentation ultimately exists to demonstrate conformity with the GSPRs.
It is also one of the first things examined by notified bodies when reviewing a file.
The GSPRs are the heart of the conformity demonstration
Annex I of the MDR brings together the requirements that every medical device must satisfy before being placed on the European market.
The principle is simple: a device must be designed and manufactured in such a way as to ensure a high level of protection for the health and safety of patients, users and third parties, while delivering the performance claimed by the manufacturer.
This logic runs through the whole regulation:
- risk management demonstrates that residual risks are acceptable;
- clinical evaluation demonstrates that the expected benefits are achieved;
- verification and validation testing demonstrates that the device performs as intended;
- labelling and instructions for use enable the product to be used safely.
In other words, most of the documents in the technical documentation exist to address one or more requirements of Annex I.
A structure in three main chapters
Annex I is organised around three sets of requirements.
1. The general safety and performance requirements
Sections 1 to 9 establish the fundamental principles of the MDR.
The central concept is that of the benefit/risk ratio. The manufacturer must demonstrate that the expected clinical benefits of the device outweigh the residual risks after the appropriate control measures have been implemented.
This demonstration relies mainly on:
- risk management in accordance with ISO 14971;
- clinical data;
- post-market surveillance;
- field feedback.
Without a robust risk management process, it becomes practically impossible to demonstrate conformity with these first requirements.
2. The design and manufacture requirements
Sections 10 to 22 deal with the technical characteristics of the device. These notably include:
- chemical, physical and biological properties;
- biocompatibility;
- CMR substances and endocrine disruptors;
- sterility;
- implantable devices;
- active devices;
- software;
- programmable electronic systems;
- protection against mechanical, electrical or thermal risks.
For many manufacturers, this is the most substantial part of Annex I, because it requires the production of a large amount of technical evidence: laboratory testing, validations, biocompatibility reports, software evaluations or cybersecurity studies.
3. The requirements relating to the information supplied with the device
Sections 23 and 24 concern all the information communicated to the user. This includes:
- labelling;
- symbols;
- warnings;
- instructions for use;
- traceability information;
- the applicable language requirements.
Non-conformities related to labelling remain among the most frequent findings during regulatory assessments.
What notified bodies actually expect
A common mistake is to treat the GSPRs as a mere administrative checklist. Notified bodies actually expect a documented demonstration. For each applicable requirement, the manufacturer must be able to answer three questions:
- Is the requirement applicable? If the answer is no, a justification must be provided.
- How is the requirement met? The answer must point to objective evidence.
- Where is this evidence located in the technical documentation? Documentary traceability must be immediate.
A requirement without evidence is considered undemonstrated. A requirement that is ignored is generally considered a gap in the file.
The GSPR mapping table: one of the most strategic documents in the file
For this reason, most manufacturers build a GSPR mapping table. This document establishes the link between:
- each requirement of Annex I;
- its applicable or non-applicable status;
- the standards used;
- the documents demonstrating conformity.
When well constructed, this table becomes the navigation map of the technical documentation. When incomplete, it often generates requests for clarification from the very first stages of the assessment.
The four areas that generate the most findings
In practice, certain requirements recur regularly in exchanges with notified bodies.
Benefit/risk ratio
Demonstrations that are too generic or insufficiently substantiated are frequently challenged.
Biological evaluation
Evaluations in accordance with ISO 10993 must be representative of the final device, the materials used and the actual manufacturing processes.
Software and cybersecurity
The requirements relating to software, programmable electronic systems and cybersecurity are often underestimated, particularly by manufacturers for whom software is not the main element of the device.
Labelling and instructions for use
Translation errors, omissions of mandatory particulars or inconsistencies between documents remain frequent grounds for deficiency requests.
Key takeaways
The GSPRs are not just one more regulatory formality. They represent the very structure of the MDR conformity demonstration. A robust technical documentation is ultimately nothing other than a set of evidence organised to demonstrate that every applicable requirement of Annex I is satisfied. The earlier this demonstration is built into the development of the device, the smoother the regulatory assessment process will be.
Regulatory source: Annex I of Regulation (EU) 2017/745 — EUR-Lex.