Notified Bodies Tell You Exactly What NOT to Do in Technical Documentation. Are You Listening?

There is a document that everyone preparing technical documentation for a medical device for the European market must know. It has existed since 2022, updated three times since, and its fourth version was published in April 2026. This is the Best Practice Guidance from Team-NB, the European Notified Bodies organization, regarding the submission of technical documentation according to Annex II and III of MDR 2017/745.

But what makes it truly rare is not the lists of what it should include; it's the part where the NBs lay out their cards and explicitly state: these are the mistakes we see over and over again. These are the common pitfalls that slow down assessment, cause questions, and in severe cases lead to our negative recommendation.

This is not general advice. Look at it as an official documentation of observed failures in the field, compiled by TD topics. I took the opportunity of the new version's release to go through each chapter and summarize all findings in a useful way here.

1. Device Description and Specification

Three common pitfalls stand out in the first part of the TD:

  • Inconsistency between documents is the most common problem. The DoC uses abbreviations while the labeling uses the full name. Variants and configurations, including packaging configurations, are inconsistent throughout the TD.

  • Insufficiently detailed justifications for classifications and definitions. A classic example: a device that includes a medicinal substance, without an explanation of why that substance is considered ancillary to the mechanical action of the device.

  • Contraindications that do not include specific anatomy or special populations in cases where there is no evidence of safe use in those conditions. If there is no evidence of safe use, there must be a contraindication.

2. Information supplied by the manufacturer (IFU, Labeling, DoC)

Six common failures are identified in this chapter:

  • Basic UDI-DI is assigned incorrectly already at the initial submission stage, leading to corrections during assessment.

  • Basic UDI-DI is inconsistent throughout the application, in the DoC (in draft version), in the TD, in the PSUR, and PMS reports.

  • The IFU mixes Intended Use with Indications. These are two different concepts according to MDCG 2020-6, and interchangeable use is an error.

  • The IFU does not meet all GSPR 23.4 requirements, e.g., compatible accessories/devices for combined use are not listed, and there is no link to the SSCP when required.

  • Lack of 1:1 correspondence between all information. The SSCP will not deviate from the IFU and the Patient Information Leaflet.

  • The patient section of the SSCP is a copy of the healthcare professional section, meaning the knowledge level of a patient/non-expert user is not taken into account.

3. Design and Manufacturing Information

  • Older legacy devices often arrive without any information about the design stages applied to them.

  • The manufacturing flow diagram does not clearly describe the location of the various manufacturing and testing steps.

  • Only re-validation documentation is provided (e.g., due to a change), without the original documentation establishing the initial validation status.

  • Worst case and sample sizes are not justified based on risk analysis.

  • When the same process is performed at multiple sites using similar equipment, validation of only one site is provided.

4. Manufacturing Sites and Subcontractors

  • Addresses of critical subcontractors are incomplete, or secondary sites where manufacturing/design/storage activities are performed are completely missing.

  • Product or service specifications in agreements are missing or reported too generally, e.g., without device description, reference code, BOM specifications, regulatory aspects, etc.

5. General Safety and Performance Requirements (GSPRs)

  • Lack of justification that applied (partially) standards demonstrate conformity to GSPR. A classic example: a manufacturer of a surgical mesh refers in their GSPR checklist to a standard intended for vascular grafts, without explaining why this standard is relevant to their product, and which sections of it are applied. This is not necessarily wrong, but there must be an explicit justification for the connection.

  • Systematic assessment of relevant documents such as scientific literature, best practice guidance, and standards is not part of the TD. Consequently, the reason why the chosen test methods and acceptance tests are valid for predicting safety and performance compliance is unclear.

  • A specific GSPR requirement is identified as "not relevant" without any justification or reasoning.

  • GSPR documentation does not include a clear and unambiguous reference to the location of the evidence used to demonstrate compliance within the TD.

6. Risk Management

Six main pitfalls are identified:

  • The description of risk control measures is not clear enough. For example: regarding the risk of intentional misuse, "IFU" is stated as a risk control, but without specifying what additional information should be documented.

  • When an IFU warning is used as a risk control measure, there is no Usability Engineering backup to verify that the information was correctly understood and that it is effective.

  • Risk control measures in the risk management file do not align with the options under MDR Annex I GSPR 4. A common example: for biological contamination due to reuse of a single-use device, "sterilization validation" is stated as a risk control. But sterilization validation proves that the manufacturing process works. It does not prevent a user from taking the device and using it again. The correct risk control here is a design that physically prevents reuse, or at the very least clear labeling and a warning in the IFU.

  • There is no traceability in the risk management file as to which records refer to implementation verification and which to effectiveness verification.

  • The levels for semi-quantitative determination of occurrence rates do not reflect clinical reality. For example: a manufacturer defines the level "occasionally" as a risk that occurs once every 10 to 100 cases. In clinical reality, a risk that materializes in one out of ten patients (10%) is not "occasionally," it is frequent. Such a loose definition leads to the risk receiving a lower-than-appropriate probability score and improperly passing the acceptability threshold.

  • The risk management plan does not include clear criteria for determining risk acceptability. A common method is to use a risk matrix: any risk that fell into the "green zone" or whose RPN is below a certain threshold—acceptable, and we're done. The MDR does not accept this. It requires that the acceptability of each risk be decided separately, based on predefined criteria that explain why that specific risk is acceptable, taking into account benefit, in accordance with the latest scientific and technological knowledge, and whether the risk has been reduced as far as reasonably practicable.

7. Pre-clinical and Clinical Data

Biocompatibility

  • No evidence of competence of the biological evaluator and/or toxicological risk assessor

  • No evidence of laboratory competence and/or test method validation

  • Cumulative exposure is not considered in classification (contact duration)

  • Incomplete identification of relevant biological effects. For example: biological findings such as Genotoxicity, Carcinogenicity, and Reproductive/developmental toxicity are not examined for devices known to contain CMR substances

  • Incomplete risk assessment of identified endpoints, especially for devices previously certified under the Directives, due to a combination of outdated biological tests, unreasonable references to clinical experience, and missing chemical characterization

  • Test item representativeness is not justified in relation to all relevant biocompatible influencing factors

  • No justification for the selected level of chemical characterization, especially when no analytical tests were performed at all

  • Extraction conditions (solvents, time, temperature) in analytical chemical tests are not justified

  • Reporting threshold in chemical tests (E&L) for organic and inorganic substances is not documented and/or justified

  • Worst-case exposure dose is not considered in the toxicological risk assessment

  • The lowest body weight of the intended target population is not considered

  • No documentation for biological endpoints that should be covered in the toxicological risk assessment

  • No assessment of effects on biocompatibility throughout the device life (storage, transport, use, reprocessing)

  • Insufficient justification for acceptability, or appropriate measures were not taken when tests indicate risk

  • No particulate risk assessment, or it is unreasonable

  • No gap assessment and implications for proving the validity of an assessment/test performed according to an outdated standard

  • Unclear strategy for assessing changes

  • PMS activities do not address biological risks and are not suitable for monitoring them

Software and AI/ML Systems

  • Lack of transparency in the AI model: The manufacturer cannot explain why the system gives a specific output for a given input

  • Insufficient data or inadequate validation of datasets: Missing data sources, poor data labeling, biased or unbalanced datasets

  • Extending clinical performance from training datasets to new domains: Over-generalization

  • Fairness and impartiality were not verified for all patient groups

Sterile Packaging Validation

  • Packaging process validation does not examine process limits

  • Validation of only one sealing/assembly machine out of a pool of machines in current use. Machine equivalence is a theoretical assumption only, without data basis

  • Mechanical and/or climatic risks expected in routine transport are not covered in the transport simulation

  • Worst-case configuration of product/packaging/sterilization is not tested in transport validation

  • The upper limit of the claimed storage temperature range is not covered in the aging time calculation in accelerated aging experiments

  • During accelerated aging, relative humidity must be controlled, or justification for not controlling it must be documented. This is often overlooked

  • Legibility and integrity of labeling after transport simulation and after aging is often not tested

  • The applied test method is not validated at all, or is not suitable for the packaging characterization being tested

Design V&V

  • Lack of clear and traceable justification for the representativeness of tested samples

  • Relevant test reports exist at the manufacturer but were not included in the TD

  • Labeling (including IFU, label, and marketing materials) includes performance claims that are not backed by evidence in the technical documentation. Every claim that appears in the device materials - numbers, percentages, clinical benefits - must be proven.

  • The TD does not include a complete summary of the final device specifications

  • The TD includes test reports but no executive summary report

  • Deficiencies in demonstrating device stability: no assessment of whether the device is damaged during transport/storage, assessment focuses only on sterile packaging stability and ignores the stability of the device itself, device stability throughout its life is not proven

  • Intermediate time points for real-time and/or accelerated aging experiments were not defined; without an passing intermediate result, shelf life cannot be claimed

  • Real-time and accelerated aging experiments should start simultaneously. It must be ensured that the accelerated aging approach adequately reflects the effects of real-time aging

8. Special Cases: Combination Products, Biological Materials, Reprocessing

Drug/Device Combination Products

  • Reference to the Drug Master File (DMF) of the medicinal substance is not provided, including information on the competent authority that approved the DMF, the letter of access to the DMF is not provided

  • Competent authority requirements regarding the drug dossier required for the consultation procedure are not considered

  • Pre-submission meetings with the relevant competent authorities are not held

Devices containing materials of biological origin

  • GSPR 13.2 is considered not relevant for devices manufactured with protein derivatives (e.g., animal milk) as an ancillary material in manufacturing

  • No information on tracking or processing of animal-origin material acquired from a supplier; the manufacturer must provide information on the supply chain and provide full evidence of compliance, including evidence of processing under a stringent process according to Regulation (EU) 722/2012

Locally Absorbable or Dispersible Substances

  • It is not thoroughly examined whether MDS 1008 applies to the device under assessment

  • All characteristics related to MDS 1008 that are stability-indicating should be evaluated at the end of the shelf life.

  • Relevant GSPRs for MDS 1008 were not thoroughly evaluated in light of the device's intended use

  • No justification is provided for the absence of relevant studies related to MDS 1008

  • Insufficient definition of equivalence for literature data from an equivalent device

  • Claims are made that indicate substances that may be considered medicinal products, without scientific, traceable, and reliable justification

  • The correct classification under Rule 14 (i.e., Class III) is not applied when the device contains substances that may be considered medicinal products

Reprocessing

  • The manufacturer has not assessed national and European reprocessing requirements

  • The rationale for selecting the worst case for validation is not traceable

  • No evidence for validation of testing methods during testing

  • Risk analysis does not address all relevant reprocessing points

  • Reprocessing instructions are not identifiable by date/current version

  • No specification of the maximum time between the end of use and the start of initial treatment

  • No automatic cleaning/disinfection process is specified even though the product can withstand it

  • Microbiological water quality for final rinsing is not sufficiently detailed

  • Reprocessing instructions do not consider common processing equipment and processes in the EU

  • Gravity displacement procedures for moist heat sterilization are specified in the instructions, even though they are not state of the art

  • No limitation on the number of reprocessing cycles despite critical design characteristics

  • More than two observational time points are required to establish product safety with unlimited life

  • No evidence that labeling will be legible throughout the intended device life

9. Clinical Evaluation: CEP, CER, PMCF, and SSCP

Clinical Evaluation Plan (CEP)

  • Definition of GSPRs requiring clinical data: GSPRs are not identified, incomplete, and not aligned with other parts of the TD.

  • Intended purpose and indications: The intended purpose is vague or missing, and there is no clear distinction between Intended Purpose and Indications. According to MDCG 2020-6 - indications are the clinical condition the device is intended to treat, and they are not identical to the description of the action.

  • Clinical benefits: The clinical benefit (the device's role in improving patient health) is not clearly described.

  • Specification of methods and parameters: The CEP does not clearly specify the methods for examining qualitative and quantitative aspects of clinical safety, with explicit reference to determining residual risks and side effects.

  • Clinical Development Plan (CDP): The manufacturer does not provide a CDP for legacy devices. According to MDR Annex XIV, a Clinical Development Plan (CDP) is expected for all devices, albeit with different levels of detail for legacy devices.

Clinical Evaluation Report (CER)

  • Update frequency: The CER update frequency is not defined, or the justification for the defined frequency does not consider all relevant circumstances.

  • Definition of State of the Art (SOTA): The SOTA is not clearly defined and/or incomplete. It is unclear how acceptance criteria for each safety and performance outcome were determined based on the SOTA.

  • Sufficient clinical evidence: Insufficient clinical evidence is provided to support applicable GSPRs and all clinical claims made in the technical documentation, including labeling and instructions for use.

  • Benefit-risk analysis: Conclusions regarding the acceptability of the benefit-risk ratio do not take into account all available data.

  • Device life: The device life is not defined, or is claimed to be unlimited without definition.

PMCF Plan and Evaluation Report

PMCF Plan Content:

  • The PMCF plan does not include all elements required by Annex XIV Part B

  • The report is missing and does not detail the status of activities

General and Specific PMCF Methods:

  • The PMCF plan does not clearly distinguish between general and specific PMCF activities

  • No justification is provided for not performing specific PMCF when appropriate

Changes in PMCF Plan:

  • Significant changes to previously assessed and approved PMCF activities are not communicated to the NB in advance before they are implemented

The SSCP

  • Manufacturers do not include quantification of risks in section 4 of the SSCP

  • The wording of the section intended for Lay users is not adapted to the reading level of a person without formal medical education

  • The SSCP is written in regulatory and/or quality systems language, which may not be fully understood by a medical professional or patient

  • Specific information required in MDCG 2019-9 is not provided

  • Partial summary of clinical evidence, when objective evidence is insufficient in terms of quantity and/or quality

  • Missing or incomplete information regarding alternative treatments

10. PMS and PSUR

The PMS Plan

  • Lack of specificity: The PMS plan is not specific to a particular type of medical device.

  • Missing and incomplete information: The level of information in the PMS plan is missing/incomplete relative to all requirements per Annex III 1.1(b).

  • PMCF and PMS Plan: The PMS plan does not provide sufficient justification that PMCF is not relevant.

The PSUR

  • Actions taken as feedback to technical documentation (Risk Management, CER, and other TD elements) are not reflected in the PSUR when relevant.

  • The decision not to update the SSCP based on the information and data presented in the PSUR is not traceable.

Bottom Line

When NBs publish such a document, they are essentially giving you a minefield map. Every item on this list is a mistake someone actually made, in real documentation, and was reviewed by a real assessor.

The smartest way to use this list is not to read it once and set it aside, but to turn it into a checklist for every technical documentation you prepare or review before submission. Each of these pitfalls is a question that needs to be asked: "Are we sure this is not happening with us?"