Non-Conformities and Deviations in the EU MDR & IVDR

Support for Audit Findings from German and European Notified Bodies

Non-conformities and deviations are a key risk factor in MDR and IVDR audits and conformity assessment procedures. If they are documented in the non-conformity report by Notified Bodies such as TÜV SÜD or TÜV Rheinland, manufacturers enter a time-sensitive response phase with direct consequences for their MDR or IVDR certificate and market access within the European Economic Area.

WQS Management Consultants supports medical device manufacturers and in-vitro diagnostic manufacturers in the structured resolution of non-conformities: from analyzing the non-conformity report and creating standards-compliant non-conformity records to formal closure by the Notified Body.

What Are Non-Conformities under the MDR and IVDR?

Non-conformities are documented instances of failure to meet regulatory, normative, or internal requirements. As part of the conformity assessment under the EU Medical Device Regulation (EU) 2017/745 (MDR) and EU In Vitro Diagnostic Regulation (EU) 2017/746 (IVDR), Notified Bodies conduct regular audits and technical documentation reviews. When auditors identify gaps or failures to meet regulatory requirements, these are documented as non-conformities and formally communicated to the manufacturer in a non-conformity report and officially communicated to the manufacturer.

Notifies Bodies do not merely require isolated compliance with individual requirements, they demand a consistent, complete, and traceable system. Non-conformities typically arise where requirements are not fully met or cannot be sufficiently demonstrated, often at the interfaces between documents or systems.

Non-Conformities MDR
Non-Conformities MDR

Typical Non-Conformities in Medical Device Certification

Non-conformities can affect all areas of MDR compliance. The following examples are taken from real-world audit situations and illustrate how varied non-conformities can be in practice:

  • Technical documentation: incomplete or non-compliant evidence in accordance with MDR Annexes II and III
  • Quality Management System (QMS): missing processes, inadequate records in accordance with ISO 13485
  • Clinical evaluation: insufficient clinical evidence in accordance with MDR Article 61 and MDCG 2020-1 or
  • Performance evaluation: in accordance with IVDR Article 56 and MDCG 2022-2
  • Risk management: incomplete risk file, missing residual risk assessment according to EN ISO 14971
  • Post-Market Surveillance (PMS) and Post-Market Clinical Follow-up (PMCF): missing planning or evaluation
  • Development documentation: Development documentation incomplete with regard to regulatory requirements
  • Training records for medical device consultants (Section 83 MPDG): No regularly documented training or competency records verifiable (applies only to manufacturers based in Germany / Austria)
  • CAPA process: Internal process for handling corrective and preventive actions not followed
  • Consistency: Between technical documentation, clinical evaluation or performance evaluation, and risk management

Major Non-Conformities

A major non-conformity exists when fundamental requirements of the MDR (e.g., Annex I, II, or III) are not met or when product safety and clinical or analytical performance are directly affected. The manufacturer must submit a complete corrective action plan (CAPA) within a short timeframe. 

Minor Non-Conformities

Minor non-conformities relate to systemic or documentary gaps that do not present an immediate safety risk. The deadline for submitting the non-conformity protocol and evidence of correction is typically 60 to 90 days. Importantly, multiple minor non-conformities may be combined and classified as a major non-conformity.

Our Support for Non-Conformity Handling

WQS supports manufacturers in resolving non-conformities through a structured and regulatory-compliant process, from the initial analysis of the non-conformity report to formal closure by the Notified Body.

01

Analysis & Prioritization

We analyze the non-conformity report from the Notified Body (e.g., TÜV SÜD, TÜV Rheinland, BSI) and evaluate each non-conformity based on severity (Major / Minor Non-Conformity), regulatory basis (MDR or IVDR), and impact on the certificate.

02

Root Cause Analysis

For each non-conformity, we develop a robust root cause analysis together and document the requirements to create a solid foundation for the next steps.

03

CAPA Development & Non-Conformity Report

We define CAPA measures: Corrective Actions and Preventive Actions, and incorporate these into a comprehensive Non-Conformity Report. This report meets the MDR and IVDR requirements as well as the expectations of the Notified Body.

04

Technical File Report & Documentation Revision

Where non-conformities are caused by technical documentation gaps, we revise the Technical File in accordance with MDR Annexes II and III, the Clinical Evaluation, or the Risk Management File.

05

Submission & Follow-Up

WQS coordinates the timely submission of all documentation to the Notified Body, responds to follow-up queries, and accompanies the process through to formal confirmation that all non-conformities and deviations have been closed and your MDR or IVDR certificate has been maintained.

Have you received non-conformities from an MDR audit?

WQS helps you respond in a structured, timely, and audit-compliant manner.
For any further questions or individual consulting, feel free to contact us directly.

Frequently asked Questions

Non-conformities (deviations) are documented failures to meet regulatory requirements. Under the MDR, they most commonly relate to technical documentation, quality management per ISO 13485, clinical evaluation per Article 61 MDR, and risk management per EN ISO 14971. Under the IVDR, comparable requirements apply, supplemented by performance evaluation per Article 56 IVDR and Post-Market Performance Follow-up (PMPF).

A Non-Conformity is a finding by the Notified Body, identified during an audit or documentation review, that a regulatory requirement under the MDR or IVDR has not been met. It is formalized in a non-conformity report and must be addressed by the manufacturer within defined deadlines through a corrective action plan.

Areas particularly frequently affected include technical documentation in accordance with MDR Annex II/III, risk management according to EN ISO 14971, clinical evaluation, post-market surveillance, and QMS processes according to ISO 13485.

The deadlines depend on the severity. For major non-conformities, an immediate response is required; the corrective action plan must typically be submitted within 15 to 30 days. For minor non-conformities, the standard response window is 30 to 90 days.

The Non-Conformity Protocol Documents the identified finding, its root cause, and the defined corrective actions (CAPA), including evidence of effectiveness. A Technical File Report is a comprehensive review or re-creation of the technical documentation per MDR Annex II and III. It is requested when non-conformities indicate structural gaps in the technical file.

WQS supports manufacturers certified with all Notified Bodies recognized in Europe, including TÜV SÜD, TÜV Rheinland, BSI, Dekra, and others. Our experts are familiar with the specific expectations and formats of each body and provide support from initial assessment through to closure confirmation.

Sources and Regulatory References

  • European Parliament & Council of the EU: Regulation (EU) 2017/745 on Medical Devices (MDR), Official Journal of the European Union, 5 May 2017 – eur-lex.europa.eu
  • European Parliament & Council of the EU: Regulation (EU) 2017/746 on In Vitro Diagnostics (IVDR)eur-lex.europa.eu
  • European Commission – Medical Devices: MDCG 2019-9: Summary of Safety and Clinical Performance and MDCG guidance on technical documentation – health.ec.europa.eu
  • TÜV SÜD: Conformity Assessment for Medical Devices under MDRtuvsud.com
  • European Commission – NANDO Database (List of Notified Bodies under MDR) – ec.europa.eu/growth/tools-databases/nando/