The MDR tells you exactly what your technical documentation must contain — it's all in Annexes II and III. What it doesn't tell you is how to keep a hundred living documents consistent with each other. Here's the full structure, section by section, and where files actually fail review.
The MDR's own term is technical documentation: the body of evidence, defined in Annexes II and III of Regulation (EU) 2017/745, that demonstrates your device conforms to the regulation. "Technical file" is the old MDD name, and everyone still says it — including us. What matters is that the content follows the MDR annexes, not an MDD-era index.
Three things about it surprise teams doing this for the first time:
| Section | What goes in it | Watch out for |
|---|---|---|
| 1 · Device description & specification | Intended purpose, Basic UDI-DI, classification and the Annex VIII rule that justifies it, variants and accessories, key functional elements, novel features, previous generations and similar devices on the market. | The intended purpose written here is the anchor for everything else — claims, clinical evaluation, risk file. Write it precisely; every word becomes something to evidence. |
| 2 · Information supplied by the manufacturer | Labels on the device and its packaging, and the instructions for use — in the languages accepted by the Member States where the device is sold. | Labels and IFU are checked word-by-word against your claims and residual risks. Inconsistency here is one of the most common findings. |
| 3 · Design & manufacturing information | The design stages applied to the device, the complete manufacturing process, and the identity of all sites where design and manufacturing are performed — including suppliers and subcontractors. | Small companies often under-document suppliers. If a subcontractor builds your PCB or hosts your software, they belong in this section. |
| 4 · General safety & performance requirements | The GSPR matrix: which Annex I requirements apply, justification for those that don't, methods and standards used, and precise references to the evidence. | This is the section your whole file converges on — we've written a dedicated guide to building the GSPR checklist. |
| 5 · Benefit-risk analysis & risk management | The benefit-risk analysis required by Annex I (GSPRs 1 and 8) and the results of your ISO 14971 risk management process — the risk management file, or a faithful summary that points into it. | The risk file must agree with sections 2 and 6: every residual risk disclosed in the IFU, every risk control verified in V&V. |
| 6 · Product verification & validation | The results of all verification and validation testing: pre-clinical data, biocompatibility, electrical safety and EMC, software V&V, stability and shelf life, the clinical evaluation report with its plan, and the PMCF plan. Section 6.2 adds extra requirements for specific cases — sterile devices, measuring functions, medicinal substances, CMR/endocrine substances and more. | The largest section by volume and the one most scrutinised — see below. |
Two parts of section 6 deserve special attention if you're a small company shipping your first device:
Software verification and validation. For any device that incorporates software — or is software — Annex II requires evidence describing the design and development process and validation of the software as used in the finished device, in a simulated or actual user environment, across all the hardware configurations and operating systems named in your information supplied. Unit tests alone don't satisfy this; reviewers want system-level validation in conditions that resemble real use. Your IEC 62304 lifecycle documentation is the backbone of this evidence.
Clinical evaluation. Every device needs a clinical evaluation report (per Article 61 and Annex XIV) and a post-market clinical follow-up plan — or a documented justification for why PMCF is not applicable. Under the MDR this is examined far more closely than it ever was under the MDD, and it must support each clinical claim made anywhere in the file, label or marketing material.
Annex III folds your post-market surveillance documentation into the technical file. Three documents, depending on class:
How you will proactively and systematically collect post-market data — complaints, trends, field experience, literature — and feed it back into risk management and the clinical evaluation (Article 84).
A summary of post-market surveillance results and any corrective or preventive actions taken, updated when needed and available to the competent authority on request (Article 85).
The Periodic Safety Update Report: post-market conclusions plus benefit-risk confirmation, updated at least every two years for Class IIa and at least annually for IIb and III (Article 86).
The practical consequence: whatever the PMS process learns has to land back in the risk management file, the clinical evaluation and — when it changes the picture — the IFU. A technical file that hasn't changed since certification is, under the MDR, a finding waiting to happen.
Regulation (EU) 2017/745 (MDR), consolidated text — Annex II (technical documentation), Annex III (post-market surveillance), Articles 10, 61, 84–86.
Team-NB Best Practice Guidance on Technical Documentation (EU MDR) — the notified bodies' own recommendations for structuring and submitting the file.
Threeqa keeps your requirements, risks, V&V evidence and GSPR matrix linked by construction — so the technical file is the current state of your work, not a document sprint before the conformity assessment. Book a 30-minute walkthrough.