MDR · IVDR · Annex I · Annex II
General safety and performance requirements
Turn Annex I into a controlled evidence map linking the intended purpose, risk controls, verification and validation, clinical or performance evidence, labelling and post-market information.
The compliance question
What GSPR conformity actually means
GSPR are the legal safety and performance requirements in Annex I of the MDR and IVDR. Conformity is not established by checking a box. The manufacturer must determine applicability, choose a valid conformity method and identify the controlled evidence.
Product-specific
Applicability follows the intended purpose, users, environment, technologies, materials, operating principle and foreseeable risks.
Evidence-based
Each applicable requirement needs a defined method and evidence that covers the released device and its claimed performance.
Traceable
The matrix should identify exact document numbers, versions, sections and locations rather than broad folders or generic files.
Maintained
Design changes, revised standards and post-market information can change the applicability assessment or invalidate earlier evidence.
Annex I structure
MDR and IVDR follow the same architecture, not the same numbering
Both Annexes contain general requirements, design and manufacture requirements, and requirements for information supplied with the device. Their detailed provisions reflect different product types.
MDR Annex I
23 numbered requirements-
Chapter I
General requirements
Requirements 1–9
-
Chapter II
Design and manufacture
Requirements 10–22
-
Chapter III
Information supplied
Requirement 23
The conformity rationale connects risk management and verification to clinical evaluation under Article 61 and Annex XIV.
IVDR Annex I
20 numbered requirements-
Chapter I
General requirements
Requirements 1–8
-
Chapter II
Design and manufacture
Requirements 9–19
-
Chapter III
Information supplied
Requirement 20
Demonstration of conformity includes performance evaluation under Article 56 and Annex XIII, covering scientific validity, analytical performance and clinical performance.
Safety, performance and risk
Intended performance, benefit-risk acceptability, risk management, lifetime, foreseeable use, transport and storage.
Design and manufacture
Product-specific technical provisions for materials, contamination, software, measurement, energy and other relevant technologies.
Information supplied
Identification, labels, packaging information and instructions for use aligned with residual risks and the intended user.
The evidence chain
Build the matrix from the device outward
Start with the released product definition. A generic template cannot determine applicability, appropriate test methods or the evidence needed for a particular configuration and claim set.
Define
Intended purpose, users, variants, accessories and claims
Assess
Applicability and documented reasons for exclusions
Control
Hazards, risk controls and residual-risk communication
Demonstrate
Testing, evaluation, validation and controlled records
Maintain
Changes, PMS signals and current state of the art
The technical documentation must identify the applicable GSPR, explain why other requirements do not apply, describe the conformity methods, list standards or common specifications used and identify the controlled evidence and its location.
Controlled matrix
Record six decisions for every requirement
The GSPR matrix should function as an index into the technical documentation. It should remain precise enough for an independent reviewer to follow the conformity argument without guessing.
Requirement
Exact MDR or IVDR Annex I clause and subclause
Applicability
Applicable or not applicable with a product-specific reason
Method
How conformity is demonstrated for this device
Technical basis
Standards, common specifications or another justified solution
Evidence
Controlled report, record, specification, evaluation or drawing
Location and status
Document identifier, version, section, approval and dossier location
Trace the requirement to released evidence
- Clause
- Exact Annex I reference
- Decision
- Applicable to defined configurations and users
- Method
- Risk control plus verification against defined acceptance criteria
- Evidence
- Approved protocol, report and linked risk-management records
The example shows the structure of a record. The clause, method and evidence must be selected for the actual device and requirement.
Evidence system
One requirement may depend on several evidence streams
Evidence categories overlap. The relevant set depends on the device, and the same record may support several clauses when its scope and acceptance criteria are suitable.
Risk management
Hazards, risk controls, benefit-risk conclusions and residual-risk communication
Verification and validation
Specifications, test methods, acceptance criteria, reports and configuration control
Materials and biological safety
Material characterisation, toxicological assessment and biological evaluation where relevant
Sterility and packaging
Microbiological controls, validated processes, packaging integrity and shelf-life evidence
Software and cybersecurity
Lifecycle records, architecture, verification, usability, security controls and maintenance
Usability and information
User profiles, use-related risks, validation, labels, instructions and training assumptions
Clinical or performance evidence
Clinical evaluation for MDR or scientific-validity, analytical and clinical-performance evidence for IVDR
PMS, PMCF or PMPF
Post-market data that confirms or challenges risk, performance and conformity conclusions
Standards and common specifications
Use standards as methods, not as substitutes for the requirement
A standard can structure the method and acceptance criteria, but the manufacturer remains responsible for showing that the result covers the applicable legal requirement and the actual device.
Harmonised standards
A cited harmonised standard can provide presumption of conformity only for the requirements and aspects covered by its Official Journal reference.
Other standards
Non-harmonised or international standards may support the state of the art and a conformity method, but do not themselves create EU presumption of conformity.
Common specifications
Where an applicable common specification has been adopted, its requirements and any justified alternative solution need explicit treatment in the conformity rationale.
Controlled application
Record the edition, clauses applied, deviations, acceptance criteria and the device configurations covered by the evidence.
From Directives to Regulations
Do not relabel an old Essential Requirements checklist
MDD, AIMDD and IVDD used the term Essential Requirements. MDR and IVDR use General Safety and Performance Requirements. The change is not merely terminological. The scope, numbering and detail expanded, and the MDR and IVDR Annexes differ from each other.
A transition review should reassess applicability and evidence against the correct Regulation. Renaming columns while retaining Directive-era logic can leave new requirements and changed evidence expectations uncovered.
Frequent failure modes
A complete spreadsheet can still contain an incomplete argument
Review quality depends on the traceability and validity of the reasoning, not the percentage of populated cells.
Generic applicability
Decisions copied from a template without reference to the actual device
Unsupported exclusions
Not applicable entries with no technical or regulatory justification
Uncontrolled references
Document titles without identifiers, versions, approval status or location
Standard-only claims
A certificate or standard citation presented as if it were device evidence
Broken alignment
Claims, risks, testing, clinical evidence and labelling describe different scopes
Frozen conclusions
The matrix is not reviewed after changes, complaints, vigilance or new evidence
Lifecycle control
Keep the GSPR conclusion connected to change and post-market data
The matrix should be reviewed through design control and the QMS, not recreated only when a submission or audit is approaching.
Translate applicable legal requirements into controlled specifications
Connect risks, controls, verification and evaluation activities
Confirm approved evidence covers the commercial configuration
Reassess applicability, standards, evidence and labelling impact
Feed PMS, vigilance, PMCF or PMPF findings back into conformity
Official sources
Start with the Regulation and current EU publications
Confirm the current legal text, applicable common specifications and the latest Official Journal references for harmonised standards when the matrix is prepared or revised.
Regulation (EU) 2017/745
MDR Annex I and Annex II
Regulation (EU) 2017/746
IVDR Annex I and Annex II
European Commission harmonised standards
Current decisions and summary lists for MDR and IVDR
MDCG 2021-5 Rev.1
Guidance on standardisation for medical devices
European Commission common specifications
Adopted specifications and implementation resources
Frequently asked questions
GSPR in practice
The central distinction is between recording a conclusion and controlling the evidence that supports it.
Does every Annex I requirement apply to every device?
No. Applicability depends on the intended purpose, device characteristics, users, use environment, technologies and risks. Each exclusion should have a product-specific justification.
Is a completed GSPR checklist sufficient evidence?
No. The matrix is an index and control tool. It should identify the method and the precise controlled documents containing the evidence.
Are harmonised standards mandatory?
Their use is generally voluntary. A standard cited in the Official Journal can create a presumption of conformity only within the scope covered by its reference. Alternative solutions require an adequate rationale.
How many numbered GSPR are in MDR and IVDR Annex I?
MDR Annex I contains 23 numbered requirements. IVDR Annex I contains 20. Both have three chapters, but the detailed provisions and numbering differ.
Does a test report prove GSPR conformity?
Only within its defined scope. The tested configuration, method, acceptance criteria and result must match the released device and the conformity claim being made.
When should the matrix be updated?
Review it after relevant product, process, supplier, standard, evidence or labelling changes and whenever post-market information may affect the conformity conclusion.
From Annex I to controlled evidence
Build a GSPR matrix that can withstand independent review
MDRC can define applicability, map methods and evidence, identify gaps and align the matrix with risk management, verification, clinical or performance evaluation, labelling and post-market controls.
Discuss your GSPR evidence