MDR Stage 1 Audit Preparation for Reusable Surgical Instruments

Preparing for an MDR Stage 1 audit: reusable surgical instruments (Class Ir)

The one thing that shapes everything: your scope is narrow

Reusable surgical instruments are Class I devices under the MDR, in the special sub-category "Class Ir." They are the only reusable-instrument case where a notified body must be involved, even though the device is otherwise self-certified Class I ¹². The consequence for your audit is decisive: the notified body's assessment is limited to the aspects relating to reuse of the device. In practice that means cleaning, disinfection, sterilisation, maintenance, functional testing, and the related instructions for use (IFU) ¹.

Everything else about the device (its general safety and performance, its clinical evidence, its general labelling) remains the manufacturer's self-declared responsibility under Annex IX Chapter I, but the notified body will not certify it. Getting this scope right before the audit avoids two common failures: over-preparing a full Class IIa-style file, or under-preparing the reprocessing evidence that is the actual object of the assessment. Confirm the classification rationale in your technical documentation and be ready to defend the Class Ir determination against the classification rules ².

What a Stage 1 audit actually examines

The notified body audit runs as a programme, and the initial phase is a documentation review, recorded in the audit history as the outcome of the preceding documentation review and/or Stage 1 audit ³. Before any full on-site (Stage 2) assessment, the auditors examine that Stage 1 output as a pre-audit activity, set the audit plan, and agree the audit duration with the manufacturer ³. Audit-duration determination follows recognised methodologies, so expect the notified body to justify the time booked against your organisation's size and complexity ²¹.

Two further mechanics are worth anticipating. First, the notified body assesses technical documentation on a sampling basis, so your Class Ir reprocessing file may be pulled for review as part of the programme ⁴. Second, if your QMS is already covered by a Medical Device Single Audit Program (MDSAP) certificate, the notified body may use those audit reports as input, which can streamline (but not replace) the MDR assessment ¹⁶. The Stage 1 review is where gaps in documentation, scope definition, and QMS completeness surface, so it functions as your last low-cost opportunity to fix them before findings become nonconformities.

Have a QMS that is documented and implemented, not just written

Under Article 10 and Annex IX Chapter I, the manufacturer must have a QMS that is documented, implemented, maintained, kept up to date, and continually improved ¹. Auditors distinguish sharply between procedures that exist on paper and processes that generate records. Before Stage 1, make sure the QMS demonstrably covers at least these elements ¹:

A strategy for regulatory compliance, including conformity assessment and change management
Identification of applicable general safety and performance requirements (GSPRs) and the means used to address them
Management responsibility and resource management, including selection and control of suppliers and subcontractors
Risk management across the device lifecycle
Clinical evaluation, including post-market clinical follow-up (PMCF)
Product realisation: planning, design, development, production, and service provision
Verification of UDI assignments
Setting up, implementation, and maintenance of the post-market surveillance (PMS) system
Communication processes with competent authorities, notified bodies, other economic operators, and users
Vigilance processes for serious incidents and field safety corrective actions (FSCA)
Corrective and preventive action (CAPA), with verification of effectiveness
Monitoring, measurement, data analysis, and product improvement

For the internationally harmonised ISO 13485 detail behind these clauses (document and record control, competence, management review, internal audit, control of nonconforming product), GHWP's risk-based QMS guidance is a useful cross-reference when tuning your procedures ahead of the audit ¹⁸.

Prepare the reprocessing evidence as the core of the file

Because the notified body's remit is the reuse aspects, the reprocessing evidence is the part of your technical documentation most likely to be scrutinised. Be ready to demonstrate validated cleaning, disinfection, sterilisation, maintenance, and functional testing, together with IFU that contain the information needed for safe reprocessing ¹. The IFU is not optional for a Class Ir device: an instruction is specifically expected precisely because reprocessing (cleaning and sterilisation) requires one ¹.

Two practical points. First, validation should follow recognised standards for the reprocessing of reusable devices, and the validation reports (with methods, parameters, and acceptance criteria) should be identifiable in the file, not merely referenced by location. Second, if your reprocessing or your device sterilisation relies on ethylene oxide, be aware of the regulatory status considerations set out in MDCG 2024-13 and confirm your approach is consistent with current guidance ¹⁷. Where sterilisation is performed by a supplier, the process must be validated and the manufacturer remains responsible, with validation records accessible and a supplier agreement in place ¹⁹.

Technical documentation and the GSPR matrix

The technical documentation must be drawn up, kept up to date, and made available when requested; it should be clear, organised, readily searchable, and unambiguous ¹⁴. Expect it to include the qualification and classification rationale (including the classification rule applied), the device description and specification, technical specifications and quality control procedures, and the information supplied by the manufacturer (labels and IFU) ¹.

For the GSPRs in Annex I, prepare a checklist or matrix that shows, for each applicable requirement, the means used to address it (standards, common specifications, or internal procedures) and the specific evidence (report references) that demonstrates conformity ¹. A list of standards is not sufficient, and a pointer to a file location is not sufficient; the actual evidence must be identifiable. Justify any GSPR you treat as not applicable ¹. Even though the notified body will only certify the reuse aspects, a complete GSPR matrix is the backbone of a defensible Class Ir file and is what a technical-documentation sample review looks for ⁴.

Clinical evaluation: right-sized for well-established technology

A clinical evaluation report (CER), supported by a clinical evaluation plan, is required and must sit within the QMS alongside risk management, PMS, and the IFU ⁶. For many reusable surgical instruments this is well-established technology, and the evaluation can often rely on existing clinical data and literature rather than new clinical investigations, provided the data are sufficient ⁶⁸. If you rely on equivalence, demonstrate it rigorously: identify differences from the equivalent device, justify why they are not clinically significant, and document the equivalence in the CER ⁷. MDCG 2023-7 sets out the conditions for exemption from performing clinical investigations, which is the relevant framework for legacy, well-established instruments ⁸. The point for Stage 1 is that the CER must exist, be current, and be internally consistent with your risk and PMS files, even when the underlying clinical burden is light.

Post-market surveillance, vigilance, and PMCF

Auditors expect a documented and implemented PMS system, not a placeholder. Before the audit, have in place a PMS plan that states the devices in scope, what is monitored, at what frequency, and by what methods, with procedures for trend reporting (observation period, thresholds, indicators) and for vigilance communication and reporting to competent authorities and notified bodies ¹¹¹³. Serious incidents and FSCA reporting procedures must be operational, and trend reporting is required for statistically significant increases in non-serious incidents or expected side effects ¹¹¹³.

You also need a PMCF plan or a documented justification for why PMCF is not applicable; the PMCF plan is an integral part of the PMS plan, and its findings feed a PMCF evaluation report that flows back into the clinical evaluation ⁹¹⁰. On reporting cadence, note the class distinction: Class I devices (including Class Ir) prepare a post-market surveillance report under Article 85, whereas the Periodic Safety Update Report (PSUR) regime applies to Class IIa and above ¹¹¹². Do not build a PSUR process you are not required to run, but do have the Article 85 PMS report process defined and evidenced.

PRRC, economic operators, UDI, and EUDAMED

The manufacturer must have a Person Responsible for Regulatory Compliance (PRRC) available under Article 15, with the qualifications set out there: a relevant degree plus at least one year in regulatory affairs or QMS for medical devices, or four years of such experience ⁵. Micro and small enterprises need not employ the PRRC internally but must have one permanently and continuously at their disposal ⁵. Keep documented evidence of the PRRC's qualifications, because it can be requested during the audit or by a competent authority ⁵. The PRRC is expected to check, by audit or sampling, that devices released have followed the QMS procedures and that the technical documentation contains the documents quoted in the GSPR checklist ⁵.

On identification and registration, assign the Basic UDI-DI, UDI-DI, and UDI-PI before placing the device on the market, and include verification of UDI assignments in the QMS ¹⁴¹⁵. For reusable devices, plan for direct marking of the device in addition to label and package UDI, and confirm when direct marking is triggered ¹⁴. Register the manufacturer and device data in EUDAMED; this registration duty sits with the manufacturer and cannot be delegated to the authorised representative ¹⁵. Have the roles of any authorised representative, importers, and distributors documented and their agreements in place, since economic-operator obligations are part of the compliance picture the QMS must control.

Supplier and sterilisation controls (especially if outsourced)

Where you outsource sterilisation or other special processes whose output cannot be fully verified by inspection, the process must be validated, and the manufacturer stays responsible even when the supplier performs the validation ¹⁹. Before Stage 1, confirm you have supplier evaluation and selection records, supplier agreements that define risk-control responsibilities, and access to sub-tier validation records; be prepared to audit the steriliser or review its validation records ¹⁹²⁰. An agreed change-control process for validated processes, defining when re-validation is required, should also be in place ¹⁹.

A practical Stage 1 readiness checklist

Classification rationale documented and defensible as Class Ir, with the notified body scope explicitly limited to reuse aspects ¹²
QMS documented and demonstrably implemented against Article 10 / Annex IX, with records, not just procedures ¹
Reprocessing validation (cleaning, disinfection, sterilisation, maintenance, functional testing) complete, with IFU covering safe reprocessing ¹¹⁷¹⁹
Technical documentation current, searchable, with a real GSPR evidence matrix ¹⁴
CER and clinical evaluation plan current and consistent; equivalence or exemption rationale documented where used ⁶⁷⁸
PMS plan, trend and vigilance procedures, and Article 85 PMS report process in place; PMCF plan or justified non-applicability ⁹¹⁰¹¹¹²¹³
PRRC appointed with documented qualifications and defined tasks ⁵
UDI assigned (including direct marking plan) and EUDAMED registration prepared ¹⁴¹⁵
Supplier controls and outsourced-sterilisation validation records accessible; supplier agreements executed ¹⁹²⁰
MDSAP certificate identified if held, and audit duration/plan discussed with the notified body ¹⁶²¹

Limitations and what to confirm next

MDCG guidance describes the audit programme and the Class Ir scope, but it does not publish a single prescriptive "Stage 1 checklist"; the two-stage structure here reflects ISO 13485 / notified body certification practice mapped onto MDR conformity assessment ³. Your notified body's own procedures, the exact reprocessing standards it expects, and its technical-documentation sampling approach are the details to confirm directly with the body before the audit ³⁴. Good follow-up questions to pose to Rhizome: which harmonised standards your notified body maps to each reuse aspect, how MDSAP inputs are weighted in an MDR QMS audit, and how the EUDAMED registration timeline interacts with your certification schedule.