Documentation is the product regulators actually see
Regulators rarely see a device being designed or built. They see documents: submissions, technical files, procedures, records. Under FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, those documents must meet ISO 13485:2016 plus FDA-specific requirements, and more of them are now open to inspection, including management review, internal audit and supplier audit reports (FDA QMSR FAQ).
At the same time, regulators have fewer people to read them. FDA lost about 21% of its staff by April 2026, and device makers report less consistent reviewer feedback (MedTech Dive). Documentation that is complete and consistent the first time is the best protection against delays.
What medical device documentation is required?
US (FDA)
| Documentation | Requirement | Purpose |
|---|---|---|
| Quality manual and procedures | QMSR §820.10; ISO 13485 clause 4.2 | Define how the QMS works |
| Medical device file (MDF) | ISO 13485 clause 4.2.3; referenced in §820.3 | Device description, intended use, labeling, specifications, production, servicing |
| Design and development file | ISO 13485 clause 7.3.10; §820.10(c) | Evidence of design controls |
| Risk management file | ISO 14971:2019 | Hazards, risk controls, residual risk, benefit-risk |
| Production and release records | ISO 13485 clause 7.5 | Proof each device or batch conforms |
| Complaint and servicing records | §820.35 plus ISO 13485 clause 4.2.5 | FDA-specific record content |
| Labeling and packaging records | §820.45 | Labeling inspection and release |
| Premarket submission | 510(k), De Novo (eSTAR) or PMA | Evidence for market authorization |
Source for QMSR sections: eCFR Part 820. eSTAR is mandatory for 510(k)s and, since October 1, 2025, De Novo requests (FDA).
EU (MDR)
| Documentation | MDR reference | Notes |
|---|---|---|
| Technical documentation | Annex II | Device description, labeling, design and manufacturing, GSPRs, benefit-risk, verification and validation |
| Post-market surveillance documentation | Annex III | PMS plan, PMS report or PSUR |
| Clinical evaluation report | Article 61, Annex XIV | Updated with PMCF data |
| EU declaration of conformity | Annex IV | Signed by the manufacturer |
| EUDAMED registrations | Articles 29–31 and others | First modules mandatory since May 28, 2026 (HPRA) |
Documentation changes to account for in 2026
- EUDAMED deadlines. Under Decision (EU) 2025/2371, device registration, including legacy devices, is due by November 28, 2026 (TÜV NORD).
- Electronic instructions for use. Regulation (EU) 2025/1234 expanded the devices that may use eIFU instead of paper (NSF).
- Biocompatibility. ISO 10993-1:2025 was published November 18, 2025 (ISO); FDA has partially recognized it, excluding clause 6.9 (Exponent). Biological evaluation plans and reports may need updating.
- Software and cybersecurity. FDA’s cybersecurity guidance was updated February 3, 2026 (FDA), and the Computer Software Assurance guidance on the same date (FDA).
- QMSR terminology. DHF, DMR and DHR are no longer regulatory terms; documents should use ISO 13485 language.
How to review medical device documentation
Documentation review is more than proofreading or a signature in a document control system. A useful review answers four questions, usually in this order:
| Review layer | Question | Typical reviewer |
|---|---|---|
| 1. Completeness | Is every required element present for this document type and market? | QA/RA specialist |
| 2. Requirement coverage | Does the content satisfy each applicable clause (ISO 13485, QMSR, MDR Annex II, FDA guidance)? | RA or subject matter expert |
| 3. Evidence and traceability | Is every claim backed by a referenced, controlled record, and do the references point to the right versions? | Technical reviewer |
| 4. Consistency | Do intended use, specifications, risk controls, test results and labeling match across all documents? | Independent reviewer |
The fourth layer is where most real problems hide. An intended use statement that differs between the 510(k), the IFU and the clinical evaluation, or a risk control cited in the risk file but missing from the verification report, is the kind of gap that leads to deficiency letters and 483 observations.
A practical review workflow
- Define the requirement set. List the clauses, guidance documents and internal procedures the document must meet. For a technical file, start from MDR Annex II and the general safety and performance requirements; for a procedure, the ISO 13485 clause and Part 820 section it fulfills.
- Pre-screen for completeness. Use a checklist or tool to find missing sections before experts spend time.
- Review by requirement, not by page. Assess one requirement at a time and record where the evidence is, or that it is missing.
- Cross-check related documents. Compare key values and statements across the submission, labeling, risk file and test reports.
- Record findings with evidence. Each finding should cite the requirement, the passage reviewed and the gap.
- Resolve and verify. Track each finding to closure and re-review changed sections.
Medical device documentation review checklist
General
- Document is controlled: ID, version, approval, effective date
- Regulatory references are current (ISO 13485 and QMSR, not legacy QSR sections; current standard editions)
- Terminology consistent with ISO 13485 and the MDR
Content
- Every applicable requirement addressed or justified as not applicable
- Claims supported by referenced, controlled evidence
- Intended use and indications identical across submission, labeling and clinical documents
- Risk controls traced to verification evidence
- Standards cited with the edition FDA recognizes or the EU harmonized version
Records
- Complaint and servicing records include §820.35 content
- Labeling and packaging records meet §820.45
- Audit and management review reports factual and specific, since FDA can read them
Submissions and registrations
- eSTAR sections internally consistent
- EUDAMED and GUDID data match labeling and technical documentation
Using AI for documentation review
AI can speed up every layer of review, especially completeness, requirement coverage and cross-document consistency. But AI that summarizes or answers without showing its source is risky in a regulated setting. Stanford researchers found that even retrieval-based legal AI tools gave incorrect information in more than 17% of benchmark queries (Stanford HAI). Three safeguards matter:
- Passage-level citations. Every finding must point to the exact passage it relies on, so a reviewer can check it in seconds.
- Requirement-by-requirement assessment. Focused checks are more reliable than one broad question over a 300-page file.
- Human decisions, validated tools. People approve findings. When AI tools are used in the QMS, FDA’s Computer Software Assurance guidance applies its risk-based framework to “artificial intelligence/machine learning tools” (FDA).
Review documents with evidence, not guesswork
AskDona assesses medical device documentation requirement by requirement against ISO 13485, QMSR, the EU MDR or your own checklist, and cites the passage behind every finding. Reviewers see the evidence first, then decide.
Run a sample regulatory document assessment on one technical file section or procedure, and check every citation yourself.
FAQ
What documentation is required for a medical device? In the US, a QMS documented to ISO 13485 under QMSR, a medical device file, design and development file, risk management file, production and complaint records, and the premarket submission. In the EU, technical documentation under MDR Annexes II and III, among others.
What is the medical device file? The ISO 13485 clause 4.2.3 file for each device type or family, covering description, intended use, labeling, specifications and production, servicing and installation procedures. QMSR refers to it in §820.3 (eCFR).
What is a medical device documentation review? A structured check that documents are complete, meet applicable requirements, are backed by evidence and are consistent with related documents.
Can AI review medical device documentation? It can pre-screen and cite evidence, but people must verify findings and make decisions, and the tool should be validated proportionate to its risk.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QMSR FAQ | Regulator | 2026 | Records open to FDA |
| eCFR: 21 CFR Part 820 | Regulation | Current | QMSR sections |
| FDA: CDRH Portal | Regulator | Current | eSTAR |
| MedTech Dive: CDRH workloads | Trade press | Apr 1, 2026 | FDA staffing |
| HPRA: EUDAMED | Regulator (EU) | 2026 | EUDAMED |
| TÜV NORD: EUDAMED | Notified body | 2026 | Registration deadline |
| NSF: EU eIFU expansion | Consultancy | 2025 | Regulation (EU) 2025/1234 |
| ISO: ISO 10993-1:2025 | Standards body | Nov 18, 2025 | Biocompatibility |
| Exponent: ISO 10993-1 recognition | Consultancy | Jun 5, 2026 | FDA recognition |
| FDA: Cybersecurity guidance | Regulator guidance | Feb 3, 2026 | Cybersecurity documentation |
| FDA: CSA guidance | Regulator guidance | Feb 3, 2026 | AI tools |
| Stanford HAI: AI on Trial | Academic | May 23, 2024 | AI error rates |