Continual improvement under MDR is the obligation to run a QMS that does not stand still. MDR Article 10(9) requires every manufacturer to establish, document, implement, maintain, keep up to date, and continually improve a quality management system proportionate to the risk class and type of device. EN ISO 13485:2016+A11:2021 operationalises that obligation in two adjacent clauses. Clause 8.4 requires the manufacturer to determine, collect, and analyse appropriate data to demonstrate the suitability, adequacy, and effectiveness of the QMS. Clause 8.5.1 requires the manufacturer to identify and implement any changes necessary to ensure and maintain the continued suitability and effectiveness of the QMS through the use of the quality policy, quality objectives, audit results, post-market surveillance, data analysis, corrective actions, preventive actions, and management review. Together, 8.4 and 8.5.1 make continual improvement a loop with specific inputs and a specific output. Change. The failure mode to avoid is improvement theatre: a section in the QMS that says "we continually improve" and a record trail that shows nothing ever actually changed.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Continual improvement is a legal obligation under MDR Article 10(9), not an optional maturity add-on. The QMS must be continually improved.
  • EN ISO 13485:2016+A11:2021 clause 8.4 requires the manufacturer to determine, collect, and analyse appropriate data to demonstrate QMS suitability, adequacy, and effectiveness.
  • EN ISO 13485:2016+A11:2021 clause 8.5.1 requires the manufacturer to identify and implement changes needed to maintain the continued suitability and effectiveness of the QMS, using audit results, PMS, data analysis, CAPA, and management review as inputs.
  • The output of 8.5.1 is concrete change. Procedures revised, processes rebuilt, resources reallocated. A QMS where nothing ever changes between audits is not meeting 8.5.1.
  • A startup does not need a separate improvement programme. It needs the loop between 8.4 data analysis and 8.5.1 action to run honestly on the data the QMS is already producing.

Why this matters for your startup

A founder we worked with asked the question most startups eventually ask in the year before their first Notified Body audit. "We have CAPA, we have PMS, we have internal audits, we have management review. Why does the standard also have a continual improvement clause? Isn't that what all the other processes are for?" The answer is that 8.5.1 is the clause that makes everything else actually change something. Without 8.5.1 the other clauses produce data. With 8.5.1 the data produces decisions, and the decisions produce change.

The Notified Body auditor's version of the same question sounds like this. "Show me three things in your QMS that changed in the last twelve months because your data analysis told you they needed to change." If the answer is "nothing changed," the auditor has a finding against clause 8.5.1 regardless of how clean the other records look. A QMS that produced data, surfaced signals, and changed nothing is a QMS that was not continually improved.

This is where the MDR Article 10(9) phrase "continually improve" lands in practice. It is not a slogan. It is a loop with specified inputs in clause 8.4 and a specified output in clause 8.5.1, and the loop has to visibly run.

Clause 8.4. The data sources you must analyse

Clause 8.4 of EN ISO 13485:2016+A11:2021 requires the manufacturer to document procedures to determine, collect, and analyse appropriate data to demonstrate the suitability, adequacy, and effectiveness of the QMS. The clause names the minimum sources the data analysis must include.

The required data sources under 8.4 are feedback from monitoring and measurement activities (including customer feedback), conformity to product requirements, characteristics and trends of processes and product (including opportunities for improvement), suppliers, audits, and service reports where applicable. The analysis must include determination of appropriate methods, including statistical techniques, and the extent of their use.

Read that list like the 5.6.2 management review input list and you will see the same pattern: every bullet is already a QMS process producing records. Complaints and customer feedback come from the complaint-handling process. Conformity to product requirements comes from verification and validation records. Process and product trends come from the production records and from the PMS data required under MDR Articles 83 to 86. Supplier data comes from supplier monitoring. Audit data comes from clause 8.2.2 internal audits. Service reports come from the service process if the device is serviced.

Clause 8.4 is therefore not asking the manufacturer to generate new data. It is asking the manufacturer to consolidate and analyse the data that other QMS processes are already producing, and to draw conclusions from that analysis about whether the QMS is working. The analysis must be documented, and the conclusions must be traceable. A startup that cannot answer the question "where is your 8.4 analysis?" has a clause 8.4 gap regardless of how much raw data is sitting in folders.

The appropriate methods question is important. For most startups, "appropriate statistical techniques" does not mean control charts and process capability indices from day one. It means the right method for the volume and type of data you actually have. A Class I startup with ten complaints per year applies descriptive categorisation and trend review. A higher-volume manufacturer applies control charts where the data supports them. The test is whether the method lets you see a signal when a signal exists. If the method could not detect a drift, the method is the wrong method.

Clause 8.5.1. The improvement obligation

Clause 8.5.1 of EN ISO 13485:2016+A11:2021 is the sentence that closes the loop. The manufacturer shall identify and implement any changes necessary to ensure and maintain the continued suitability, adequacy, and effectiveness of the quality management system, as well as medical device safety and performance, through the use of the quality policy, quality objectives, audit results, post-market surveillance, data analysis, corrective actions, preventive actions, and management review.

Note the exact language. "Identify and implement any changes necessary." Not "consider." Not "discuss." Implement. The clause is an action obligation, and the action is change. Changes to the QMS, changes to processes, changes to resources, changes to the device where safety or performance requires it.

Note also the list of inputs. Quality policy and quality objectives sit at the top because improvement has to be measured against a stated direction. Audit results, PMS, data analysis (clause 8.4), CAPA (clauses 8.5.2 and 8.5.3), and management review (clause 5.6) are the operational sources. Every one of these is already running under other clauses. Clause 8.5.1 is the clause that says: these are not just logs, they are inputs to action. If they do not produce action, the QMS is not being continually improved.

The relationship to management review is not redundancy. Management review (clause 5.6) is where top management looks at the data and takes decisions. Clause 8.5.1 is the obligation that those decisions turn into implemented change, and that change to the QMS itself is a named output of the system. A management review that produces a decision that never gets implemented is also an 8.5.1 failure, traceable back to the action list.

The QMS metrics that actually matter

Startups waste a lot of effort picking the wrong metrics for clause 8.4 analysis. The wrong metrics are vanity numbers that go up and to the right and never flag anything. The right metrics are the ones that would surface a real problem before the Notified Body finds it.

For most startup QMSs, the metrics that actually matter are the following. Complaint volume and categorisation, tracked by period, with breakdown by severity and root cause category. CAPA volume, age, and closure rate, with overdue CAPAs called out. Internal audit findings by process area, tracked across cycles to see whether the same processes keep producing findings. Supplier non-conformance rate and supplier corrective action response time. PMS signal counts from each PMS source, tracked for drift. Training completion and competency assessment outcomes. Document control health. The count of overdue document reviews and the count of records missing required fields. Release criteria pass rate for production or software releases.

None of these are exotic. All of them are already being produced by the QMS processes required elsewhere in EN ISO 13485:2016+A11:2021. The clause 8.4 move is to consolidate them into one place and read them together, not to invent new measurements.

The test for whether a metric belongs in the clause 8.4 analysis is whether a deterioration in that metric would, or should, trigger action under clause 8.5.1. If the answer is no. If the metric would simply be noted and the QMS would continue unchanged. The metric is decorative and can come out. Subtraction applies to metrics as much as it applies to documents.

Clause 5.6.2 lists management review inputs. Clause 8.4 lists data analysis sources. The overlap is deliberate. The data analysis under clause 8.4 is, in most startups, the single largest input to the management review inputs package, and the management review is where the clause 8.5.1 decisions are typically made and recorded.

The practical pattern that works: the quality lead or RA lead runs the clause 8.4 analysis on a defined cadence. Often quarterly. And the most recent analysis becomes a section of the management review inputs package. The CEO and the team read the analysis as part of the pre-read. The meeting then works through the conclusions and makes the clause 8.5.1 decisions, which land in the management review minutes with owners and dates. The action list is tracked through to implementation evidence, and the next management review checks the status under the "follow-up from previous reviews" input.

This is the loop the standard is asking for, stitched out of clauses that already exist. Clause 8.4 is the sensor. Clause 5.6 is the decision. Clause 8.5.1 is the action. Without any one of the three, the loop does not close.

Post 285 on management review describes the mechanics of the meeting itself. Post 307 on CAPA describes the mechanism by which most clause 8.5.1 actions get executed. Post 311 on internal audits describes one of the most important clause 8.4 input sources. The cluster is designed so that each post carries its own clause and the continual improvement loop is visible when the posts are read together.

What is not continual improvement theatre

Continual improvement theatre is the pattern where the QMS contains a document called "Continual Improvement Procedure," the procedure references clauses 8.4 and 8.5.1, and nothing in the QMS ever actually changes between audits except the version dates on documents that were reviewed without modification.

Signals that a QMS is in theatre mode. The clause 8.4 analysis exists as a template that gets re-filed each period with the same conclusions. "QMS performing as intended, no changes required." The management review minutes list no changes implemented in the period under the clause 8.5.1 output area. The document control register shows document reviews happening but almost no revisions issued. The CAPA log contains closed records but the closed records did not produce any change to the procedures the CAPA was meant to fix. Internal audit findings repeat across cycles in the same process areas because nothing structurally changed after the previous findings.

The real version looks different. The clause 8.4 analysis contains actual trends and actual observations, including uncomfortable ones. The management review outputs contain concrete decisions with owners and dates. Process X gets revised, resource Y gets added, supplier Z gets re-qualified. The document control register shows revisions being issued as a consequence of those decisions. The CAPA log shows closed records that produced visible changes in procedures or resources. Internal audit findings do not repeat, because the structural cause was addressed after the first finding.

The diagnostic an auditor applies is simple. Pick three things in the QMS that changed in the last twelve months. Can the team point to the data that surfaced the need, the decision that authorised the change, and the implementation evidence? If yes, clause 8.5.1 is operating. If no, it is theatre.

Common mistakes

Treating 8.4 as a reporting exercise. The team produces a quarterly metrics report, files it, and never uses it to decide anything. Clause 8.4 requires analysis, not reporting. The test is whether the analysis changes any decision.

Collapsing 8.4 into 8.5.1. The team argues that because CAPA and management review already exist, there is no separate 8.4 analysis needed. This misses the consolidation step. Clause 8.4 is the place where all the process data is read together as one picture. Without that step, individual process data stays siloed and trends across processes go unseen.

Implementing without recording the trigger. A change gets made, but nothing in the QMS records that the change was triggered by a data signal. The change appears in the document history but not in any analysis or management review output. Clause 8.5.1 wants the change to be traceable to its cause.

Using vanity metrics. The clause 8.4 analysis tracks metrics that always look good because they are designed to look good. A deteriorating metric is a gift. It is the clause doing its job. A metric that never deteriorates is usually the wrong metric.

No statistical technique judgment. The team either applies heavy statistical analysis the data cannot support or applies no structured method at all. Clause 8.4 asks for appropriate methods. The judgment is part of the obligation.

Confusing software feature work with QMS improvement. A startup ships product improvements constantly and treats those as continual improvement of the QMS. Product changes are product changes. Clause 8.5.1 is specifically about the QMS and its processes. The two are different, and the clause is not satisfied by the first.

The Subtract to Ship angle

Subtract to Ship applied to continual improvement means removing everything that does not trace to the loop. No separate improvement programme. No innovation council. No parallel metrics dashboard disconnected from the QMS processes. What remains is a clause 8.4 analysis built from the data the QMS already produces, read at a fixed cadence, fed into management review, and producing clause 8.5.1 actions that get tracked through to implementation evidence.

Two practical moves. First, define the clause 8.4 analysis as one document with one owner and a fixed cadence that aligns with management review. Do not scatter the analysis across five tools and three spreadsheets. Second, for every clause 8.5.1 action, require the change itself to leave a visible trace. A new procedure version, a new resource in the org chart, a new line in the training matrix, a new supplier control. If the action did not produce a visible artefact, the action did not happen.

Every element of the loop must trace to clause 8.4, clause 8.5.1, or MDR Article 10(9). Anything else is overhead.

Reality Check. Where do you stand?

  1. Can you point to the document that contains your current clause 8.4 data analysis, and does it cover every source the clause names that applies to your company?
  2. Does the 8.4 analysis run on a fixed cadence, or does it get reconstructed the week before the audit?
  3. Pick three things in your QMS that changed in the last twelve months. Can you trace each one back through a management review output to a clause 8.4 data signal?
  4. If the answer to question 3 is "nothing changed," what does your clause 8.5.1 obligation look like to a Notified Body auditor?
  5. Are the metrics in your 8.4 analysis ones where a deterioration would actually be visible and actually trigger action. Or are they vanity numbers?
  6. Does the management review inputs package include the clause 8.4 analysis as a named section, or is data analysis scattered across other sections?
  7. If a Notified Body auditor asked "how do you continually improve the QMS?", could you walk them through the loop without improvising?

Frequently Asked Questions

What does MDR Article 10(9) say about continual improvement? MDR Article 10(9) requires every manufacturer to establish, document, implement, maintain, keep up to date, and continually improve a quality management system that ensures compliance with the MDR in the most effective manner and in a manner proportionate to the risk class and type of device. "Continually improve" is a named obligation inside the QMS requirement, not a separate option.

Which clauses of EN ISO 13485:2016+A11:2021 cover continual improvement? Clause 8.4 covers analysis of data to demonstrate the suitability, adequacy, and effectiveness of the QMS. Clause 8.5.1 covers the obligation to identify and implement changes needed to maintain continued suitability and effectiveness. Together they form the continual improvement loop that satisfies the MDR Article 10(9) obligation to continually improve the QMS.

Is continual improvement different from CAPA? Yes, and the distinction matters. CAPA under clauses 8.5.2 and 8.5.3 addresses specific non-conformities and potential non-conformities. Continual improvement under clause 8.5.1 is the broader obligation to keep the QMS as a whole suitable and effective, using CAPA as one of several inputs alongside audits, PMS, data analysis, and management review. A QMS can have clean CAPA records and still fail clause 8.5.1 if nothing else changes.

How often does the clause 8.4 data analysis need to run? The standard does not set a specific frequency. The analysis must be frequent enough to detect signals in time to act on them. For most startups, quarterly analysis aligned with management review cadence is the defensible pattern. Annual is usually too slow, especially in the build-up year before first Notified Body assessment.

What statistical techniques does clause 8.4 require? Clause 8.4 requires the manufacturer to determine appropriate methods, including statistical techniques, and the extent of their use. The judgment about which methods are appropriate belongs to the manufacturer and must be documented. For low-volume startup data, descriptive analysis and trend review are often appropriate; heavier statistical techniques come in when the data supports them.

Can a small startup really meet clause 8.5.1 without a dedicated improvement programme? Yes. Clause 8.5.1 does not require a programme. It requires that changes be identified and implemented from the listed inputs. A small team that runs management review on cadence, reads the clause 8.4 analysis honestly, makes decisions, and implements them meets the clause completely. A programme without implemented change does not.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10, paragraph 9 (obligation to establish, document, implement, maintain, keep up to date, and continually improve a quality management system proportionate to the risk class and type of device). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016+A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes, clause 8.4 (Analysis of data) and clause 8.5.1 (Improvement. General).

This post is part of the Quality Management Under MDR cluster in the Subtract to Ship: MDR blog. Authored by Tibor Zechmeister and Felix Lenhard. The MDR is the North Star. EN ISO 13485:2016+A11:2021 is the tool. Clause 8.4 is the sensor, clause 5.6 is the decision, clause 8.5.1 is the action. And together they are what continual improvement actually looks like in a startup QMS that is not running on theatre.