ISO 13485 scope and, where the class requires it, the notified body certificate covering the devices to be represented.
Quality systems
QMSR compliance and MDR conformity: what still separates them
On 2 February 2026 the FDA replaced the Quality System Regulation with the Quality Management System Regulation, which incorporates ISO 13485:2016 by reference and keeps a set of US-specific requirements around it. For a manufacturer looking at Europe this closed a real gap. It did not close the file.
What QMSR changed and what it deliberately kept
The new Part 820 incorporates ISO 13485:2016 and retains FDA provisions where US law needs them: medical device reporting, unique device identification, corrections and removals, device tracking, and the applicability of design and development activities. Terminology moved as well, with the device master record replaced by the medical device file.
A US manufacturer that has already restructured its system for QMSR is therefore closer to the European baseline than it was two years ago. The remaining distance is not in the standard. It is in the Regulation.
The processes MDR requires that a QMSR system does not produce
Article 10(9) MDR lists the elements the quality system must cover. These are the ones that regularly turn up as findings in files arriving from the United States.
| MDR obligation | Reference | Nearest US equivalent |
|---|---|---|
| Person responsible for regulatory compliance, with defined qualifications | Article 15 | No equivalent; responsibility is assigned by company practice |
| Post-market surveillance plan proportionate to risk class | Article 84 and Annex III | Complaint handling and MDR reporting, without a planned surveillance system |
| Periodic safety update report, updated annually for class IIb and III | Article 86 | No equivalent |
| Post-market clinical follow-up plan and evaluation report | Annex XIV Part B | Post-market studies only where a condition of approval |
| Summary of safety and clinical performance for implantable and class III devices | Article 32 | No equivalent; public summaries exist only for PMA devices |
| Vigilance reporting within 15, 10 or 2 days depending on the incident | Article 87 | Medical device reporting on a 30-day and 5-day cycle |
| Technical documentation kept up to date to Annex II and III | Article 10(4) | Design history file and medical device file |
| UDI assignment and EUDAMED submission | Articles 27 and 29 | GUDID submission with a different data structure |
Certification is not conformity assessment
An ISO 13485 certificate is issued by a certification body against a standard. An MDR quality system certificate is issued by a notified body designated under the Regulation, against Annex IX, and it covers the specific devices in scope. The two audits look similar on the agenda and answer different questions.
For most classes above class I, the notified body assesses both the quality system and the technical documentation. A manufacturer that arrives with a strong ISO 13485 system and a thin technical file will fail on the second, and the finding will be about evidence rather than procedures.
What we check before accepting a mandate
An authorised representative shares responsibility in the situations described in Article 11(5), so the review is not a formality.
Structure against Annex II and III, with a general safety and performance requirements list mapped to Annex I and to evidence, not to intentions.
Who the person responsible for regulatory compliance is and how they are available to us and to authorities.
Whether a surveillance plan exists, and for class IIb and III whether the periodic safety update report is being produced.
Product liability cover appropriate to the class and to the volumes placed on the EU market.
Questions from quality managers
We are QMSR compliant and ISO 13485 certified. How much more work is the EU?
For a class IIa device with a mature file, the work concentrates on technical documentation restructuring, clinical evaluation and post-market processes. For class III it is a project, not an adjustment.
Can our PRRC be an employee in the United States?
Article 15 requires the manufacturer to have at least one qualified person available within its organisation, with micro and small enterprises allowed to have such a person permanently and continuously at their disposal instead. The authorised representative must have its own person, separately. We agree the arrangement in the mandate before signature.
Does the notified body audit our US site?
Yes, quality system audits under Annex IX cover the manufacturing sites in scope, including sites outside the Union, and include unannounced audits.
Official basis checked on 15 August 2026
The MDR provisions cited on this page were checked against the official EUR-Lex text.
Regulation (EU) 2017/745 (MDR) in EUR-Lex →
Plan the EU route
Map the work before committing to a certification timeline.
Use the US-to-EU hub to separate reusable evidence from European work, or review the wider service scope for manufacturers established outside the Union.