Audit

MDR Gap Analysis Guide

An MDR gap analysis compares existing documentation and processes against Regulation (EU) 2017/745 and produces a prioritised list of what is missing or insufficient. Run it per device against Annexes I, II, III and XIV and against Article 10(9) for the QMS, rate each gap by its impact on safety and on certification, and convert the result into actions with owners and dates.

Topic: Audit

Author
MDRpilot Editorial Team
Reviewer
Independent regulatory review not yet assigned
Last updated
Applies to
EU MDR 2017/745

When to run a gap analysis

  • Moving a device from MDD or AIMDD to MDR
  • Taking over a technical file after an acquisition or a change of consultant
  • Before a notified body technical documentation review
  • After a significant change to the device or its intended purpose
  • After publication of new common specifications or relevant MDCG guidance

Inputs

The current technical file, the Essential Requirements or GSPR checklist, test reports, the risk management file, the clinical evaluation and its literature, labels and IFU, PMS documents, and the QMS procedure list. Ask also for the latest notified body report, if one exists: it shows where the reviewer has already raised questions.

A structured review

AreaQuestions to ask
ClassificationIs the class still correct under Annex VIII? Has Rule 11 or Rule 21 changed it?
Annex IIs there a GSPR checklist? Are new requirements such as Section 10.4 on substances addressed?
Annex IIAre all sections present? Are design and manufacturing sites and suppliers identified?
Risk managementIs the file aligned with ISO 14971:2019? Are risk controls verified?
Clinical evaluationDoes the CER meet Article 61 and Annex XIV? Does equivalence meet MDCG 2020-5?
Annex IIIIs there a device-specific PMS plan? Is the PSUR or PMS report scheduled?
LabellingDoes the IFU meet Section 23? Is UDI on the label?
QMSDo procedures cover Article 10(9)? Is a PRRC designated?

Prioritising findings

Rate each gap on two axes: impact on patient safety and impact on certification. Gaps in clinical evidence and risk control verification usually rank highest because they take the longest to close, sometimes requiring new testing or a PMCF study. Formatting and cross-reference gaps rank lower but are numerous and should be batched.

From gaps to a plan

  • Assign an owner and a due date to each gap
  • Group gaps that share evidence, for example one biocompatibility test closing several GSPR rows
  • Track the status of each gap until the evidence is linked and approved
  • Re-check dependent documents when a gap closes with a design change

How MDRpilot supports gap analysis

In MDRpilot gaps are derived from the state of the workspace: missing technical file sections, GSPR rows without evidence, test reports with a fail verdict, clinical gaps, missing or unapproved QMS documents and documents flagged by product changes. The list updates as evidence is added, so the gap analysis stays current. Judging whether existing evidence is adequate remains with qualified reviewers.

References

  1. Regulation (EU) 2017/745 on medical devices (MDR) — EUR-Lex, Publications Office of the European Union.
  2. Regulation (EU) 2023/607 amending the MDR transitional provisions — EUR-Lex, Publications Office of the European Union.
  3. MDCG 2020-5 Clinical evaluation — equivalence — Medical Device Coordination Group. Listed under clinical investigation and evaluation.
  4. MDCG 2020-6 Sufficient clinical evidence for legacy devices — Medical Device Coordination Group. Listed under clinical investigation and evaluation.
  5. MDCG 2021-24 Guidance on classification of medical devices — Medical Device Coordination Group. Listed under classification.

Always check the consolidated text of the regulation and the current version of each guidance document before relying on it.

This guide is general information about the regulation and standards named above. It is not legal or regulatory advice for a specific device.

MDRpilot is documentation and workflow software. It is not a medical device, not a notified body and not a regulatory authority. It does not certify devices or guarantee compliance; AI-generated drafts must be reviewed and approved by qualified people in the manufacturer's organisation.

See it with your own device

Create an account, add your company and one real device. The Suite demo runs for 3 days and the first procedure opens straight away, not an empty dashboard.