A useful audit-readiness plan starts with the assessment you actually need. MDR or IVDR conformity assessment, ISO 13485 certification and ISO 9001 certification have different scopes. Identify the applicable route, the evidence gaps and the responsible people before commissioning support. Preparation can reduce avoidable rework; it cannot guarantee certification or a market-access date.
Confirm the regulatory route and transition position
Record the device’s intended purpose, classification, manufacturer, target markets and existing certificates. Conditional transition arrangements still apply to some eligible legacy devices. An extended end date alone does not establish eligibility: earlier application, agreement and quality-system conditions may also matter. Check the Commission’s MDR transition guidance and IVDR transitional provisions against your own records.
Keep a dated decision record with the applicable provision, evidence of eligibility, next deadline and person responsible. Escalate missing evidence before treating a transition date as your project timetable.
Choose the right assessment organisation
Where notified-body involvement is required, check its designation for the relevant legislation and device scope through the Commission’s notified-body information and NANDO links. A consultant, testing laboratory and ISO certification body perform different roles; one appointment does not automatically cover the others.
Ask for a written assessment plan covering scope, submission requirements, review stages, availability, fees and arrangements for responding to findings. Separate your preparation time from the assessor’s review time. The effect of a finding depends on its nature, the assessment route and the action required; there is no universal 12-to-18-month exclusion following an ISO audit finding.
Connect the clinical, quality and post-market evidence
For MDR devices, clinical evaluation follows Article 61 and Annex XIV of the Medical Device Regulation. MEDDEV 2.7/1 revision 4 alone is not a complete MDR compliance test. Identify the relevant current MDCG guidance; guidance supports interpretation but is not legislation.
For IVDs, use the performance-evaluation framework in Article 56 and Annex XIII of the IVDR. Do not simply rename an MDR clinical evaluation report.
Check that complaints, post-market data, risk assessments and corrective actions inform the relevant documents. Under the MDR, a PMCF plan or a justification for non-applicability belongs in the post-market surveillance documentation. Avoid assuming every corrective action requires a new PMCF study. Document the evaluation and resulting actions for the particular device.
Use standards for their actual purpose
ISO 13485 concerns medical-device quality management systems. ISO 9001 addresses quality management across sectors. Neither a management-system certificate nor purchasing a standard establishes complete MDR or IVDR conformity. Check the exact edition, amendments, scope and certification arrangements.
Harmonised standards are generally voluntary. Where you rely on presumption of conformity, verify the reference published in the Official Journal, the legislation, covered requirements and any restrictions or withdrawal dates. The newest international edition is not automatically the applicable harmonised reference. See the Commission’s conformity-assessment guidance.
For ISO 9001 projects, check the edition and transition guide. Customer or tender requirements should be checked individually; certification is not a universal entry condition for every EU contract. ISO itself does not issue certificates.
Assign responsibilities and control the records
Check the PRRC requirements in Article 15. Qualifying micro and small enterprises may use an external person who is permanently and continuously available; this is not a blanket outsourcing option for every manufacturer. Verify qualifications, responsibilities and availability against the MDCG PRRC guidance.
For each evidence gap, record an owner, deliverable, due date and review decision. If selecting an electronic quality-management system, assess record control, access, retrieval and validation needs. Buying software or commissioning a readiness review does not itself demonstrate conformity.
For software or AI projects, assess the applicable obligations separately. ISO/IEC 27001 addresses information-security management; it is not a blanket AI Act compliance certificate. Application dates and duties depend on the system and the organisation’s role. Check the Commission’s current AI Act guidance.
Commission a clearly defined next step
Start with a brief stating the device or organisational scope, existing assessment status, specific gap, desired deliverable, working language and target date. Ask the provider to identify assumptions, exclusions, dependencies and who will review the work. Avoid offers that promise guaranteed approval.
- Medical-device regulatory support: describe your MDR or IVDR project.
- Management-system support: compare consultants, internal auditors and certification bodies, then request the appropriate ISO support.
Keep the initial enquiry to a non-confidential summary. Agree secure document exchange with the selected provider before sharing patient information, technical files or other sensitive records.