Technical File

A technical file (or, under MDR / IVDR, 'technical documentation') is the controlled, structured evidence dossier the manufacturer assembles, maintains and keeps available to demonstrate that a CE-marked product meets every applicable requirement of every applicable EU harmonisation act. It is the substantive basis of the EU Declaration of Conformity — the DoC is the legal statement; the technical file is the evidence behind that statement.

The file is not a one-shot deliverable produced for launch and put on a shelf. It is a living controlled record updated through the product's commercial life: design changes, supplier changes, manufacturing-process changes, harmonised-standard revisions, post-market surveillance data, vigilance reports, FSCAs, significant changes notified to the Notified Body. Inspectors and Notified Bodies expect to see the current state, with version history, change-control rationales, and links to the underlying controlled records (DHF, DMR, batch records, training records, QMS procedures).

The file may be electronic or physical. There is no required format — the requirement is that it be 'clear, organised, readily searchable, unambiguous' (MDR Annex II §1) and available to competent authorities on request. Most manufacturers maintain an electronic file structured exactly against the relevant annex with sectioned PDFs / documents and a master index. Notified Bodies routinely ask for the file in indexed PDF form for technical-documentation assessment.

The manufacturer is the primary holder. For non-EU manufacturers, the authorised representative (per MDR / IVDR Article 11 or the sector analogue) must hold a copy or have permanent access to the file and produce it on request to a competent authority. Importers must hold the EU DoC and ensure the manufacturer holds the technical file; distributors do not need to hold the full file but must verify the DoC is in place.

Retention periods are set by the applicable act:

• MDR Article 10(8) — at least 10 years after the last device covered by the DoC has been placed on the market; 15 years for implantable devices.
• IVDR Article 10(7) — at least 10 years after the last IVD has been placed on the market.
• Machinery Regulation (EU) 2023/1230 — at least 10 years from the date of manufacture (extends to 15 for safety components in some cases).
• LVD / EMC / RED / PPE — typically 10 years from the date the product was placed on the market.
• GPSR (EU) 2023/988 — 10 years for the relevant traceability records and internal documentation for consumer products covered.

Retention runs from the last unit placed on the market — not from initial launch. This makes the file lifecycle obligation extend years past commercial discontinuation. Many manufacturers under-scope retention and lose the ability to defend the device in market-surveillance enquiries arising from field issues 8-12 years after last sale.

Annex II prescribes six main sections for the general technical documentation. The structure is mandatory; the depth scales with risk class.

1. 1. Device description and specification, including variants and accessories — intended purpose, intended user, intended patient population, principles of operation, list of variants / configurations / accessories, novelty claim, reference to predecessor / similar devices and prior generations, photo / drawing / schematic, list of raw materials, software (where applicable) with version / build identifiers.
2. 2. Information to be supplied by the manufacturer — label, packaging, IFU, language requirements per Member State (every EU language for the markets supplied), training materials, accessory IFUs, summary of safety and clinical performance (SSCP) for Class III and implantable per Article 32.
3. 3. Design and manufacturing information — design stages (linked to design controls), manufacturing process flow, identification of all manufacturing and design sites including critical suppliers / subcontractors, in-process and final acceptance criteria, packaging design, sterilisation method validation (where applicable) per ISO 11135 / 11137 / 17665.
4. 4. General Safety and Performance Requirements (GSPR) — the GSPR matrix (Annex I requirements as rows, applicability with rationale, harmonised standards used, cited evidence documents). Inspectors sample rows; incomplete applicability rationale is the #1 opening finding.
5. 5. Benefit-risk analysis and risk management — the ISO 14971 risk-management file (risk-management plan, risk analysis, risk evaluation, risk control, residual-risk evaluation, overall residual-risk acceptability, risk-management report) integrated with the clinical evaluation conclusions.
6. 6. Product verification and validation — design verification + validation evidence per design controls, biocompatibility per ISO 10993, sterilisation validation, software lifecycle per IEC 62304, usability per IEC 62366-1, electrical safety + EMC per IEC 60601 series, performance testing, animal data (where applicable), clinical evaluation report per Article 61 + Annex XIV, PMCF plan + reports per Annex XIV Part B, stability / shelf-life data.

Annex III is the second compartment of the medical-device technical documentation — the post-market surveillance file. It is a separate annex deliberately, so post-market evidence is auditable independently from design / launch evidence.

• PMS plan per Article 84 — proactive + reactive data sources, methods + processes for collection, indicators / threshold values for re-evaluation, methods for investigation of complaints + trends, methods for communication with authorities + Notified Bodies + economic operators, reference to procedures for vigilance + FSCA + trend reporting.
• PMS report per Article 85 (Class I) — updated when necessary, available to the competent authority on request.
• Periodic Safety Update Report (PSUR) per Article 86 (Class IIa, IIb, III) — updated at least every two years (IIa) or annually (IIb, III), reviewed by the Notified Body for Class IIb / III, submitted via EUDAMED when the relevant module is mandatory.
• Trend reporting per Article 88 — methodology + thresholds for statistically significant trends in non-serious incidents.

Annex III is not a slimmed-down Annex II — it is its own annex, with its own audit scope, its own cadence, and its own finding pattern. Stale or template-only PSURs and PMS plans that contain no actual post-market data are the most-cited Annex III findings.

IVDR Annex II + III mirror MDR Annex II + III structurally with IVD-specific adaptations. Key differences:

• The performance evaluation report (PER) per Annex XIII Part A — integrating scientific validity + analytical performance + clinical performance — replaces the medical-device clinical evaluation report (CER). PER must include literature search methodology, traceability per ISO 17511, and lifecycle integration with PMPF data.
• Annex III references PMPF (Post-Market Performance Follow-up) per Annex XIII Part B — analogous to PMCF — and PMPF is default mandatory (absence requires explicit justification).
• PSUR cadence differs by IVD class: Class C every 2 years; Class D annually with submission via EUDAMED; Class A + B PMS report only.
• Class D devices have additional documentation requirements relating to EU Reference Laboratory verification per Article 100 + Implementing Regulation (EU) 2022/944 (where designated for the device category).
• Class IVDs with a measuring function or with self-test / lay-user intended use have additional human-factors deliverables under IEC 62366 and additional comprehension-study evidence under Annex I §20.

Annex I of MDR (and IVDR) contains the General Safety and Performance Requirements — 23 requirements (MDR) / 20 requirements (IVDR) covering safety, performance, design, manufacture and information supplied. The GSPR matrix is the controlled table that maps every requirement to (a) applicability (Yes / No / Not applicable) with rationale for any 'No' / 'NA'; (b) harmonised standards relied upon, cited with year + clause(s); (c) the controlled evidence document(s) in the technical file that demonstrate conformity; (d) verification of conformity status.

The GSPR matrix is the #1 sampled artefact during Notified Body technical-documentation assessment and the #1 source of opening findings. Common failure modes:

• Applicability rationale missing for requirements marked 'NA'.
• Harmonised standard cited without year — the OJ-listed version drives presumption of conformity, so the citation must be precise.
• Standard cited but withdrawn from the OJ — the presumption no longer applies; evidence must be re-anchored.
• Evidence reference points to an obsolete document version or to a document that does not actually demonstrate the requirement.
• Requirement marked conformant by 'manufacturer's internal procedure' with no traceable evidence package.
• Clinical / performance evidence claimed in the matrix but the underlying CER / PER is incomplete or stale.

The technical file is a controlled record under the QMS. Every change that affects an item in the file must be processed through change control, the affected chapter(s) re-issued, the cross-references updated, and (where the change is significant per MDCG 2020-3 / 2022-14 or sector analogue) the Notified Body notified before implementation.

Triggers for technical-file update:

• Design change — new variant, new accessory, new indication, new packaging configuration, new materials, software update.
• Manufacturing-process change — new site, new critical supplier, new sterilisation cycle, new packaging line, contract-manufacturer change.
• Harmonised-standard revision — when a referenced standard is updated and listed in the OJ, the citation + evidence must move to the new version within the OJ-defined transition.
• Risk-management update — new hazard identified, residual-risk re-evaluation following PMS data, ISO 14971 §10 lifecycle activities.
• PMS data — quarterly / annual aggregation; PSUR cycle; complaints + vigilance + FSCA + Article 88 trend reporting.
• Clinical / performance evaluation update — new PMCF / PMPF data, new literature, new clinical study results, equivalence-relied-upon predicate withdrawn.
• Regulatory update — MDR / IVDR amendment, MDCG guidance change, Commission Implementing Act, common-specification publication.
• Significant-change notification accepted by NB — update the file to reflect the post-change state with the NB notification + acceptance correspondence as controlled records.

Outside medical devices, every CE-regulated category has its own technical-documentation requirements. The structure varies but the function is identical — evidence of conformity with the applicable act, lifecycle-maintained, produced on demand.

For multi-act products (e.g. a connected diagnostic device — IVDR + LVD + EMC + RED + RoHS), the manufacturer may maintain a single integrated technical file covering all acts, or separate files per act. Integrated files are more common and reduce duplication of common chapters (device description, manufacturing, risk management); the file index must clearly map each chapter to each applicable act.

• Index missing or out of sync — chapters added / removed without index update.
• Version control inconsistent across chapters — Annex II §1 device description at v4, IFU at v3, GSPR matrix referencing v2 evidence.
• GSPR matrix incomplete applicability rationale.
• Harmonised standards cited without year / clause, or cited with a withdrawn version.
• Clinical / performance evaluation stale — last update >2 years, no PMCF / PMPF integration.
• Risk-management file static — no §10 lifecycle activity, no integration of post-market data.
• Software documentation incomplete — IEC 62304 deliverables thin, SOUP register absent, cybersecurity per MDCG 2019-16 not addressed.
• Sterilisation validation tied to worst-case loading configuration not demonstrated, or transferred to a new site without re-validation.
• Critical suppliers / subcontractors list incomplete — common after CMO change without file update.
• Annex III PMS plan template-only — no actual post-market data sources, no thresholds, no methodology.
• PSUR cadence not aligned to class — Class IIb annual cycle missed.
• Significant changes implemented without Notified Body notification per MDCG 2020-3 / 2022-14 — invalidates the certificate.
• EU authorised representative mandate or details missing / outdated for non-EU manufacturers.
• Retention scope under-set — files removed when product commercially discontinued instead of from last-unit-placed-on-market date.
• EUDAMED registration not maintained for new variants / significant changes / certificate revisions.

• Technical-file completeness score (sections present + signed + in-version).
• GSPR matrix coverage % + evidence-link integrity %.
• Harmonised-standards currency % vs OJ.
• Days since last CER / PER update vs required cadence.
• Risk-management file lifecycle-update cadence vs ISO 14971 §10 plan.
• PSUR on-time submission rate per class.
• Annex III PMS plan currency.
• Significant-change notifications submitted vs NB acceptance turnaround.
• Mean time from change-control approval to technical-file chapter re-issue.
• Critical-supplier list completeness vs PO / receiving data.
• Authorised representative mandate currency for non-EU manufacturers.
• Retention scope compliance (last-unit-placed vs commercial-discontinuation date).

V5 Ultimate treats the technical file as a controlled workspace structured exactly against the applicable annex — MDR Annex II + III, IVDR Annex II + III, or the relevant sector-specific annex. Each chapter is a versioned controlled document with linked evidence, change-control routing, and review / approval e-signatures (CFR Part 11 / Annex 11 compliant). The master index is auto-generated from the chapter manifest with version-state visibility and gap flagging — chapters out of version, missing approvals, or with broken evidence links are surfaced before the file is exported for NB submission.

The GSPR matrix is a live workspace — every applicable Annex I requirement is a row, every applicability marker carries a mandatory rationale, every harmonised standard is cited with year + clause from the standards register (which tracks OJ publication / withdrawal dates), and every evidence link resolves to a current controlled document. Standard withdrawals from the OJ trigger a re-anchoring workflow before the presumption of conformity lapses. The risk-management file, software lifecycle deliverables (IEC 62304), usability engineering file (IEC 62366), biocompatibility (ISO 10993), sterilisation validation, electrical-safety / EMC test reports, and clinical / performance evaluation reports are all controlled chapters with cross-references back into the GSPR matrix.

Annex III PMS documentation is a distinct workspace — PMS plan, PMS report, PSUR, trend-reporting methodology — with cadence enforcement per device class and EUDAMED export packaging for Class IIb / III / D PSURs. Significant-change decision-tree routing (per MDCG 2020-3 / 2022-14) is built in; any change that meets the significant-change criteria is auto-routed to the NB notification queue, blocking implementation until acceptance is recorded. Retention scope is anchored to last-unit-placed-on-market data (not commercial discontinuation), and authorised-representative mandate currency is tracked at the device-record level for every non-EU manufacturer relationship.