MDR Unannounced Audits: The Five-Year Floor, Not the Cap

Every device manufacturer with an MDR certificate knows, in the abstract, that its notified body can show up unannounced. What fewer teams have built into their planning is what Annex IX, Section 3.4 actually requires: an unannounced audit at least once every five years, on a plan the notified body does not disclose — and, where appropriate, at the site of a supplier or subcontractor rather than the manufacturer's own. The five-year figure is the floor auditors must clear, not the only way one gets scheduled.

What Annex IX actually requires

The notified body must randomly perform unannounced audits at the manufacturer's site at least once every five years; it may combine the visit with a periodic surveillance assessment, but it does not have to, and it is not required to tell the manufacturer which cycle carries the unannounced visit. The audit team must include at least one member with prior experience assessing the technology involved — the same qualification bar as a scheduled assessment. None of this is exotic once it is named, but a five-year floor described only in the abstract tends to get treated as a distant, low-priority risk rather than the standing requirement it is.

The audit doesn't stop at your own front door

The detail manufacturers most often miss is scope. Annex IX allows the notified body to extend the unannounced audit to "the manufacturer's suppliers and/or subcontractors, where appropriate" — a provision aimed squarely at outsourced critical processes: sterilization, key subassembly manufacture, software components built by a third party. A manufacturer that has built excellent internal audit readiness but never confirmed a critical supplier can support an unannounced visit has closed the wrong gap. Supplier and vendor oversight under MDR is not a paperwork exercise for exactly this reason: it is the extension of the manufacturer's own exposure to a site the manufacturer does not control day to day.

• Sampling and testing. The notified body tests an adequate sample of produced devices, or an adequate sample from the manufacturing process, to verify conformity with the technical documentation — not a document review alone.
• Team qualification. The audit team includes at least one member with prior experience assessing the relevant technology, matching the qualification standard for scheduled assessments.
• Combinable, not required to be. The unannounced audit may be combined with a periodic surveillance assessment, at the notified body's discretion.
• Vigilance-triggered audits are discretionary. Under Annex VII §4.10, the notified body decides whether an unannounced audit is warranted following a vigilance notification — the report itself does not automatically schedule one.

A five-year floor sounds distant until the audit that actually arrives is the one a vigilance report triggered, at a supplier's site the manufacturer assumed was out of scope. Why unannounced-audit readiness can't stop at the manufacturer's own facility

Building readiness that holds up with no notice

Scheduled surveillance assessments reward preparation done in the weeks beforehand. An unannounced audit rewards only preparation that was already true on an ordinary Tuesday: technical documentation that reflects the current design and process, a quality management system operating the way its procedures describe, and a supplier base that can produce the same evidence without a warning call from the manufacturer first. Inspection readiness built for FDA does not automatically transfer here — the notified body is testing conformity against the technical documentation and sampling actual production, not running an FDA-style systems inspection, and a program built for one without the other leaves a real gap.

None of this requires treating every day as audit day in some theatrical sense. It requires building the quality system so that the answer to "could the notified body walk in today" is genuinely yes — for the manufacturer's own site and for the suppliers doing the work the manufacturer's certificate still stands behind. Reconciling that readiness with the wider EU MDR & IVDR compliance program, rather than treating it as a standalone audit-prep task, is what keeps the five-year floor from becoming a surprise.