EU MDR & IVDR — automating technical documentation.

This guide is built from engagements with medical device manufacturers, IVD companies, and CDMOs adapting to MDR (Regulation EU 2017/745) and IVDR (Regulation EU 2017/746). It's the workflow our team uses inside Sia RegAI for technical-documentation gap analysis and Annex II drafting.

Why MDR / IVDR is structurally harder than the directives

The headline change wasn't a tightening of clinical-evidence requirements (though that happened too). It was the structural shift from "produce a tech file once, refresh occasionally" to "maintain a living technical documentation set, integrated with post-market surveillance, vigilance, and clinical follow-up."

The four practical consequences:

1. More device classes need notified-body involvement. Under IVDR especially, ~80% of devices now require notified-body conformity assessment, vs. ~20% under the legacy IVDD.
2. Annex II is more prescriptive. Twelve sections under MDR (1–12), structured into device description, design, manufacturing, GSPR conformity, risk management, clinical evaluation, PMS, vigilance, etc.
3. Permanent post-market obligations. Annex III (PMS plan, PMS report, PSUR for class IIa+, periodic safety updates, post-market clinical follow-up) is no longer optional. Class IIb and III devices must produce a Periodic Safety Update Report annually; class IIa every two years.
4. Eudamed and UDI. Continuous obligations to register, update, and report through Eudamed plus UDI traceability requirements.

Net effect: the documentation burden per device is roughly 2–3× under MDR/IVDR vs. the legacy directives, and a much larger share of it is ongoing rather than one-time.

The MDR Annex II structure (your gap-analysis target)

Manufacturers that win their notified body audits do one thing in common: they organize the entire technical-documentation set against MDR Annex II / IVDR Annex II's exact structure. The auditor reviews against that structure; the file should mirror it.

The MDR Annex II top-level sections:

1. Device description and specification (including variants and accessories).
2. Information to be supplied by the manufacturer (labelling, IFU).
3. Design and manufacturing information.
4. General safety and performance requirements (GSPR) conformity matrix — the spine of the file.
5. Benefit-risk analysis and risk management.
6. Product verification and validation.

Annex II further references Annex III (technical documentation on post-market surveillance), Annex XIV (clinical evaluation), and Annex XV (clinical investigations). IVDR Annex II mirrors the structure with performance-evaluation language adapted for diagnostics.

The classification problem (Rule 11 and friends)

MDR Annex VIII contains 22 classification rules. IVDR Annex VIII contains 7 rules with sub-rules. The classification determines the conformity-assessment route, the level of clinical evidence required, and the level of notified-body involvement. Get it wrong and the entire file is misaligned.

The notorious cases:

• MDR Rule 11 — software as a medical device. Most software previously class I now lands in IIa or IIb (or III, if used for therapeutic decisions in life-threatening conditions). The reclassification has caught many SaMD developers off-guard.
• IVDR Rule 3 — companion diagnostics, near-patient testing. Most assays for genetic disorders, cancer screening, or therapy decisions land in class C or D — requiring notified-body involvement that IVDD never demanded.
• Borderline products. Substance-based devices, drug-device combinations, devices incorporating medicinal substances all need careful application of MDR Annex VIII rules with potential consultation under Article 117.

Sia RegAI's classification module ingests Annex VIII verbatim, walks the rules in order, and produces a defensible classification memo per device with the rationale per rule. Notified bodies receive that memo as part of the technical documentation; getting the rationale right up front avoids cycles.

Where AI cuts time without breaking compliance

The technical documentation set is mostly text — but compliance-grade text. AI helps where text-heavy work is structured but tedious. AI does not replace the regulatory affairs judgment.

1. GSPR conformity matrix drafting

Annex I lists 23 General Safety and Performance Requirements (GSPRs) for MDR; 20 for IVDR. For each, the manufacturer must show how the device meets it, with reference to harmonised standards or other specifications, and a link to the verification / validation evidence. The result is a 50–200 row matrix per device.

Sia RegAI ingests Annex I, your harmonised-standard references, and your existing test reports — then drafts the matrix row-by-row. RA review tightens; the draft saves 60–70% of the typing.

2. Clinical evaluation / performance evaluation summarization

MEDDEV 2.7/1 rev 4 (clinical evaluation) and MDCG 2020-13 / 2022-2 (clinical evaluation assessment) define the structure. Manufacturers produce a Clinical Evaluation Report (CER) for MDR or Performance Evaluation Report (PER) for IVDR. Both involve systematic literature review, summarization of clinical investigations, comparison with state-of-the-art, and benefit-risk analysis.

Where AI helps: literature triage, study summarization, equivalent-device comparison, gap analysis vs. state-of-the-art. Where AI doesn't: the clinical-evaluator's own assessment of clinical relevance, weighting of evidence, and benefit-risk conclusions. The CER/PER is signed by a qualified clinical evaluator; the AI is producing input, not output.

3. Post-market surveillance and PSUR drafting

MDR Article 86 (PSUR) requires class IIa+ manufacturers to produce a periodic report covering:

• The conclusions of the benefit-risk determination.
• The main findings of the post-market clinical follow-up (PMCF).
• The volume of sales and an estimate of the size and other characteristics of the population using the device.
• The frequency and severity of incidents and field safety corrective actions.

Sia RegAI ingests your incident reports, complaint data, sales data, and PMCF outputs, and drafts the PSUR sections. The qualified person reviews, edits, signs, submits to the notified body or competent authority. Going from blank page to first draft is what AI is great for; the substantive review is human.

4. Eudamed registration and UDI maintenance

Eudamed (the EU medical device database) requires registration of actors, devices, certificates, vigilance, clinical investigations, and market surveillance. UDI assignment and maintenance is continuous. Most of this is structured-data work that doesn't need AI — but the data-integrity checks (consistency between Annex II tech doc and Eudamed entries, UDI version updates) benefit from automated reconciliation.

The MDR / IVDR transition timeline

The deadlines that matter:

• MDR full applicability: 26 May 2021. Legacy MDD certificates extended via Regulation 2023/607 — class III and implantable up to 31 December 2027; class IIa, IIb, I-sterile up to 31 December 2028.
• IVDR full applicability: 26 May 2022. Class D up to 31 December 2027; class C up to 31 December 2028; class B and A-sterile up to 31 December 2029.
• Eudamed mandatory modules: phased through 2027 with the legal-mandate trigger linked to module readiness notice.

The extensions are conditional on the manufacturer having submitted an MDR/IVDR application by specified dates and having a written agreement with a notified body. They are not a free pass.

Where Sia RegAI helps

Sia RegAI ingests MDR and IVDR Level 1 text, all MDCG guidance, MEDDEVs (where still applicable), notified-body group position papers, and harmonised-standard references. For each in-scope device:

• Walks Annex VIII classification rules and produces a memo.
• Maps the device's technical documentation set against Annex II structure and scores coverage.
• Drafts the GSPR conformity matrix, Annex II sections, and PSUR sections from the underlying evidence.
• Surfaces gaps with priority order so RA teams know what to draft first.
• Cross-maps to ISO 13485 (QMS), ISO 14971 (risk management), and IEC 62366-1 (usability) so the QMS evidence and Annex II evidence stay aligned.

Citation graph back to source paragraph at every step; defensible at notified-body audit.

Common pitfalls

• Treating MDR/IVDR as a translation of MDD/IVDD. The structural changes — particularly classification, clinical evidence, and PMS — break direct mapping in many cases. Re-evaluate from scratch.
• Underestimating notified-body bottlenecks. Notified body capacity is finite; engagement well before legacy certificate expiry matters.
• Letting CER/PER quality slip. Notified bodies have published common deficiencies — most CER non-conformities are about state-of-the-art comparison and equivalence claims. Don't shortcut these.
• Forgetting Eudamed. Manufacturers that focus only on the technical file and ignore the Eudamed actor / device / certificate / vigilance flows are surprised by how much continuous data work is required.
• Single-shot delivery. The technical documentation has to update with every significant change. Build the workflow on a system that updates with the source — not a binder.

Closing

MDR and IVDR turned medical device compliance from a project into a permanent program. The right operating model treats the technical documentation as a living system that integrates with QMS, post-market data, and the regulatory landscape. AI works inside that model — drafting, mapping, summarizing, surfacing gaps — under a qualified person who signs the deliverables.

The notified body doesn't audit the AI. It audits your file. Make the file it expects.