MDR Article 10: The QMS Clause Isn't the Only Obligation

Ask a device-company quality lead what Article 10 of the EU MDR requires, and the answer is almost always the same: a quality management system. That is correct as far as it goes — paragraph 9 of Article 10 does require one. It is also a small fraction of what the article actually obligates. General Obligations of Manufacturers runs to a long list of separate duties spanning risk management, clinical evaluation, documentation retention, liability coverage, and registration — and the ones that do not map onto a familiar ISO 13485 clause are exactly the ones compliance programs leave unbuilt.

What Article 10 actually requires

Article 10, General Obligations of Manufacturers, is the MDR's catch-all for what a legal manufacturer owes the regulation across a device's lifecycle. It opens with the basic conformity duty — devices must be designed and manufactured to meet the MDR's requirements when placed on the market — then layers on a risk management system run under Annex I, Section 3, and a clinical evaluation under Article 61 and Annex XIV that includes post-market clinical follow-up. It requires technical documentation under Annexes II and III for anything other than custom-made devices, an EU declaration of conformity under Article 19, and CE marking under Article 20. It requires UDI assignment under Article 27 and registration obligations under Articles 29 and 31. None of that is controversial; most device-company QMS programs already build process steps against each of these because they map cleanly onto familiar design-control and documentation practices.

The clause everyone builds to

Article 10(9) requires manufacturers to establish, document, implement, maintain, keep up to date, and continually improve a quality management system proportionate to risk class and device type. It reads like a restatement of ISO 13485 because it largely is one — the MDR's conformity-assessment annexes were written with the standard in view, and a certified ISO 13485 quality system covers most of what 10(9) asks for. That overlap is exactly why it absorbs the compliance attention: it is the paragraph a notified body audits hardest, because Annex IX's technical-documentation and QMS-assessment routes are built against it directly. The rest of Article 10 does not get the same structural advantage. It does not map onto a single ISO 13485 clause, it is not the thing a notified body's QMS audit is scoped to test, and it is where gap assessments most often find daylight between what a company believes it has covered and what Article 10 actually asks.

• The documentation retention clock (Art. 10(8)). Ten years for technical documentation, the declaration of conformity, and relevant certificates — 15 for implantables — running from the date the last covered device is placed on the market, not from certification or a product's discontinuation date.
• Financial liability coverage. Manufacturers must have measures in place providing coverage proportionate to risk class, device type, and company size, in respect of potential liability under Directive 85/374/EEC — a standing obligation, not a one-time insurance purchase filed and forgotten.
• UDI assignment and EUDAMED registration. The Article 27 UDI duty and the Article 29/31 registration obligations continue as the device portfolio changes; they are not satisfied once at initial market entry.
• Cooperation with competent authorities. On request, a manufacturer must provide technical documentation in full or as a summary — a duty that only becomes visible the moment a competent authority actually asks.

A notified body audits the QMS clause because Annex IX is written against it. Nothing audits the rest of Article 10 until a competent authority asks for it directly — and by then, the gap is already a finding. Why the Article 10 gap stays invisible

Where the gap surfaces

The practical risk is not that these duties are obscure — they are written into the same article as the QMS clause everyone already reads. The risk is sequencing: a company stands up its QMS against Annex IX, passes its notified body assessment, and treats Article 10 as closed. The documentation retention clock then runs unmanaged in the background, often confused with the QMS's own records-retention procedure, which is not scoped to run 10 or 15 years past a device's last placement on the market. Importers and distributors carry their own separate duties under Articles 13 and 14, but the manufacturer's Article 10 obligations do not transfer, and a competent authority's market surveillance request — not a notified body's QMS audit — is typically what surfaces whichever piece was never built out.

None of this calls for a new program. It calls for treating Article 10 as the full list it is, rather than a synonym for the QMS paragraph that happens to sit inside it. A clause-by-clause map against your existing EU MDR & IVDR compliance program, with the retention clock, financial coverage, and registration duties each owned and tracked on their own, closes the gap before a competent authority finds it first.