Article 10 of Regulation (EU) 2017/745, known as the MDR, is one of the most important articles for medical device manufacturers. It is not limited to stating that a device must be compliant before being placed on the market. It describes the manufacturer’s general responsibilities throughout the device life cycle: design, manufacture, technical documentation, risk management, clinical evaluation, quality management system, post-market surveillance, vigilance and cooperation with the authorities.
For a manufacturer, and in particular an SME or a medtech start-up, Article 10 is an essential reading grid. It makes clear that MDR compliance does not rest solely on a technical file or a CE marking. It rests on a complete system that is documented, maintained and able to demonstrate control of the device over time.
Why Article 10 is central to the MDR
Article 10 is titled “General obligations of manufacturers”. This wording matters: these are general obligations, but they are far from theoretical. They structure the majority of the regulatory work a manufacturer must carry out before and after placing a device on the market.
Article 10 refers in particular to several key elements of the MDR: the general safety and performance requirements of Annex I, risk management, clinical evaluation, technical documentation, the EU declaration of conformity, CE marking, the UDI, registration, the quality management system, post-market surveillance and vigilance.
In practice, this article is often the most useful entry point for understanding what a manufacturer must put in place. It gives the general structure; the annexes and other MDR articles then detail the modalities.
An obligation of conformity from the moment of placing on the market
The first principle is simple: when placing a device on the market or putting it into service, the manufacturer must ensure that this device has been designed and manufactured in accordance with the MDR.
This obligation refers directly to the general safety and performance requirements of Annex I. The manufacturer must therefore be able to demonstrate that its device achieves the claimed performance, that the risks are controlled, that the information provided to the user is appropriate and that the benefit-risk ratio is acceptable in light of the intended use.
This point is essential: conformity is not merely declared. It is demonstrated by means of documented, consistent elements that are kept up to date.
Risk management and clinical evaluation: two structuring requirements
Article 10 requires the manufacturer to put in place a risk management system in accordance with Annex I of the MDR. This risk management must cover the entire life cycle of the device. It is not limited to an initial analysis at the development stage.
In practice, this means identifying hazards, estimating and evaluating risks, implementing control measures, then verifying their effectiveness. Data from production, complaints, post-market surveillance and vigilance must also feed into this risk management.
Article 10 also requires the manufacturer to carry out a clinical evaluation in accordance with Article 61 and Annex XIV. This clinical evaluation must demonstrate, on the basis of sufficient clinical data, that the device complies with the applicable safety and performance requirements. It must be kept up to date, in particular through post-market clinical follow-up (PMCF) where this is required.
Technical documentation, EU declaration and CE marking
The manufacturer must establish and keep up to date the technical documentation of the device. This documentation is built in accordance with Annexes II and III of the MDR (or XIII for custom-made devices). It must allow the conformity of the device with the applicable requirements to be assessed.
The technical file is therefore not a fixed document drawn up solely for the initial audit. It must evolve with the device, with design or manufacturing changes, clinical data, market feedback, incidents, corrective actions and relevant regulatory developments.
Once conformity has been demonstrated according to the applicable conformity assessment procedure, the manufacturer draws up an EU declaration of conformity in accordance with Article 19, then affixes the CE marking in accordance with Article 20. This logic does not apply in the same way to custom-made devices and to devices that are the subject of a clinical investigation, which follow specific provisions.
The manufacturer must also keep the technical documentation, the EU declaration of conformity and, where applicable, the certificates issued by the notified body. The MDR provides for a retention period of at least 10 years after the last device covered by the EU declaration of conformity has been placed on the market, and at least 15 years for implantable devices. It should be noted that manufacturers located outside the European Union must also keep the technical documentation of their products available to their authorised representative. The latter is their entry point to the European market and must be able to make this documentation available to the competent authorities on request.
UDI, registration and EUDAMED obligations
Article 10 also refers to the obligations relating to the UDI system and to the registrations provided for by the MDR, on EUDAMED in particular. The manufacturer must assign the applicable UDI identifiers and comply with the registration obligations set out notably in Articles 27, 29, 30 and 31.
Since 28 May 2026, the first four EUDAMED modules are mandatory to use, following Commission Decision (EU) 2025/2371, published in the Official Journal of the European Union on 27 November 2025. These modules cover the registration of actors, UDI/device registration, notified bodies and certificates, and market surveillance. In concrete terms, every new economic operator and every new device placed on the market must now be registered in EUDAMED. Devices already marketed before 28 May 2026 benefit from a grace period and must be registered no later than 28 November 2026. The two remaining modules, Vigilance and Clinical Investigations, are not yet mandatory to use at this stage.
This ramp-up reinforces the operational importance of the quality of UDI data and registration data.
For a manufacturer, this subject should not be treated as a mere administrative formality. UDI data, EUDAMED information, technical documentation, certificates and commercial information must remain consistent. An inconsistency between these elements can become a critical point during an audit, a regulatory review or an interaction with a competent authority.
The QMS: the major organisational obligation of Article 10
One of the most structuring obligations of Article 10 is the establishment and maintenance of a quality management system. The MDR requires the manufacturer to establish, document, implement, maintain, keep up to date and continuously improve a QMS proportionate to the risk class and the type of device.
This QMS must cover numerous processes: regulatory strategy, identification of applicable requirements, management responsibilities, resource management, risk management, clinical evaluation, product development, production and provision of services, control of suppliers and subcontractors, UDI identification, post-market surveillance, vigilance, communication with authorities and economic operators, complaints handling, corrective and preventive actions, data analysis and product improvement.
ISO 13485 certification is not framed by the MDR as a stand-alone general obligation for all manufacturers. However, ISO 13485, a harmonised standard since Commission Implementing Decision (EU) 2022/6 of 4 January 2022, is a very relevant basis for structuring a QMS that meets the sector’s expectations. This list of harmonised standards is regularly updated, the most recent version for the MDR being Implementing Decision (EU) 2026/760 of 1 April 2026. A manufacturer certified to ISO 13485 will nevertheless have to check that its system properly covers all the specific requirements of the MDR, because certification alone does not replace the demonstration of regulatory compliance. From experience, the approach of notified bodies is more relaxed during audits of manufacturers certified to ISO 13485.
Post-market surveillance, vigilance and corrective actions
Article 10 requires the manufacturer to put in place a post-market surveillance system in accordance with Article 83. This system must make it possible to collect, analyse and use information relating to devices already placed on the market.
PMS is not a secondary activity. It feeds into risk management, clinical evaluation, updates to the technical file, PMS or PSUR reports, corrective actions and, where necessary, decisions to withdraw or recall.
If the manufacturer considers that a device placed on the market is not in conformity with the MDR, it must take the necessary corrective measures without delay. Depending on the situation, these measures may consist of bringing the device into conformity, withdrawing it from the market or recalling it. The manufacturer must also inform the economic operators concerned, in particular the distributors, the importers, the competent authorities and, where applicable, the authorised representative.
Where the device presents a serious risk or where it is a falsified device, the competent authorities must be informed. Vigilance obligations, in particular the reporting of serious incidents and field safety corrective actions, are specified by Articles 87 and 88 of the MDR.
Labelling, instructions for use and information supplied with the device
Article 10 also requires the manufacturer to ensure that each device is accompanied by the information needed to identify it, to use it safely and to obtain the claimed performance. These requirements are detailed in Chapter III of Annex I of the MDR.
In concrete terms, this concerns in particular the labelling of the device, the information on the packaging, the instructions for use as well as the information made available in electronic format where this modality is authorised. These documents must be drafted in one or more official languages of the European Union, understandable for the intended users, and comply with the national requirements applicable in the Member States where the device is marketed.
The manufacturer must ensure that the information provided is consistent with the intended use, the claims, the clinical data, the risk management and the content of the technical documentation. Updates to the instructions for use or the labelling must be integrated into the quality management system and assessed with regard to their regulatory impact. During MDR audits, notified bodies regularly check the consistency between the information intended for the user, the technical file and the data registered in EUDAMED.
Cooperation with the authorities and information of patients
The manufacturer must be able to provide, on request from a competent authority, the information and documents necessary to demonstrate the conformity of the device, in an official language required by the Member State concerned. The authority may also request the free supply of samples or, where this is not possible, access to the device. This obligation implies that the documentation is available, controlled and usable within timeframes compatible with the authority’s expectations.
Article 10 also provides for cooperation with the authorities in the context of corrective measures aimed at eliminating or mitigating the risks presented by devices placed on the market. This cooperation may concern investigations, samples, technical information or field actions.
The MDR also provides for a specific mechanism where harm is suspected. If a competent authority considers, or has reason to believe, that a device has caused harm, it is the authority that facilitates, on request, the communication of relevant information and documents to the potentially injured patient or user and, where applicable, to their successor in title, their insurance company or other third parties concerned, in compliance with data protection and intellectual property rules. The manufacturer therefore has no direct information obligation towards the patient. Its role is to provide the competent authority, on request, with the necessary information and documentation, which then feed into this mechanism.
Finally, Article 10 requires the manufacturer to have measures in place to provide sufficient financial coverage in respect of its potential liability, the risk class, the type of device and the size of the undertaking. This obligation must be articulated with the applicable national law on liability. During audits of manufacturers of devices in classes higher than I, notified bodies systematically ensure that these manufacturers have financial coverage proportionate to the risk class of their devices.
What Article 10 means concretely for a manufacturer
Article 10 should not be read as a mere list of formalities. It creates a system obligation. A manufacturer may have a technically high-performing device, yet remain in difficulty if its technical file is not kept up to date, if its PMS system does not work, if its EUDAMED data is inconsistent, if its QMS does not cover the MDR requirements or if its vigilance processes are not controlled.
The logic of the MDR is clear: the manufacturer remains responsible for the conformity of its device throughout its life cycle. This responsibility does not disappear after obtaining the CE certificate or after the first placing on the market.
For an SME, this means turning Article 10 into an operational action plan: mapping the obligations, identifying the existing processes, spotting the gaps, prioritising the actions, then maintaining the evidence over time.
Conclusion
Article 10 of the MDR is one of the most useful texts for understanding what it means to be a medical device manufacturer in Europe. It brings together the fundamental obligations: designing and manufacturing a compliant device, managing risks, demonstrating clinical performance, maintaining a technical file, drawing up the EU declaration of conformity, affixing the CE marking, complying with UDI and EUDAMED obligations, maintaining a QMS, monitoring the device after it is placed on the market, managing vigilance and cooperating with the authorities. Care should be taken, however, not to restrict the manufacturer’s obligations to this single article. The MDR, in its entirety, contains obligations for each economic operator.
Its scope is very concrete: the manufacturer must be able to demonstrate, at any time, that its device and its organisation remain under control. It is this capacity for demonstration, even more than the mere existence of documents, that constitutes the heart of MDR compliance.
Regulatory source: Article 10 of Regulation (EU) 2017/745 — EUR-Lex