Annex IX of Regulation (EU) 2017/745 is the conformity assessment route built on two pillars: a Notified Body audit of the manufacturer's full quality management system (Section 2), surveillance assessment during the life of the certificate (Section 3), and an assessment of the technical documentation for the devices covered (Section 4). It is the default route for most Class IIa, IIb, and III devices under Article 52, and the one most startups on an MDR path will actually use.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • Annex IX is the MDR's full QMS-plus-technical-documentation conformity assessment route, anchored in Article 52 and used for most Class IIa, IIb, and III devices.
  • Section 2 covers the initial QMS assessment: the Notified Body audits the quality management system against MDR requirements, with EN ISO 13485:2016+A11:2021 providing presumption of conformity for the QMS obligations.
  • Section 3 covers surveillance assessment: the Notified Body returns each year during the validity of the certificate, re-audits parts of the QMS, and samples the technical documentation again.
  • Section 4 covers the assessment of technical documentation: Class IIa is sampled on a representative basis, Class IIb non-implantable is sampled more deeply, and Class IIb implantable and Class III are assessed for each device or device group.
  • The certificate issued under Annex IX is valid for a maximum of five years, and renewal requires re-assessment.

Why Annex IX is the route most startups actually meet

Most founders first encounter Annex IX the moment a Notified Body sends a quote. The quote lists "QMS assessment," "surveillance audits," "technical documentation assessment," and a five-year certificate term. Those line items are not arbitrary. They are the structure of Annex IX spelled out in contract form. Understanding the annex before reading the quote changes how the quote looks — instead of a pile of Notified Body fees, it becomes a visible map of what the body will actually do, when, and against which section of the regulation.

The founders we coach often skip this step. They treat Annex IX as a black box that the Notified Body handles, and they prepare for the audits reactively. That works, but it costs runway. Reading Annex IX directly — not a summary, not a blog post, not even this one — gives the startup the same mental model the auditor has when they show up. The audit stops feeling like an interrogation and starts feeling like a walkthrough of work the team already did.

This post covers what Annex IX actually says and does: when it applies, what Section 2 covers in the initial assessment, how Section 3 surveillance works, what Section 4 technical documentation assessment looks like across classes, and the mistakes that founders routinely make with this route.

When Annex IX applies

Article 52 of Regulation (EU) 2017/745 lays out the conformity assessment procedures available for each device class. Annex IX is one of the main routes available to Class IIa, Class IIb, and Class III devices, and in practice it is the route most manufacturers take.

For Class IIa devices, Annex IX is available with technical documentation assessment on a representative basis across the devices covered by the certificate. The alternative routes route through Annex XI production quality assurance, but Annex IX is the typical default because it consolidates the QMS and technical documentation work under one Notified Body contract.

For Class IIb non-implantable devices, Annex IX applies with a deeper sampling of technical documentation per category of devices. The alternative is the Annex X plus Annex XI split route — EU type examination combined with production quality assurance or product verification.

For Class IIb implantable devices, Annex IX applies with technical documentation assessment for each device, not on a sample basis. The depth of review scales with the class.

For Class III devices, Annex IX applies with full technical documentation assessment for each device or device group. Certain Class III devices — notably implantable Class III and certain Class IIb active devices — also trigger the clinical evaluation consultation procedure under Article 54, which runs alongside Annex IX rather than replacing it.

Class I standard devices do not go through Annex IX. They self-declare under Annex IV. Class I sterile, Class I with measuring function, and Class I reusable surgical instruments (Is, Im, Ir) bring a Notified Body in for the specific aspect only, not for the full Annex IX procedure.

The practical effect is that any startup shipping a device above Class I is looking at Annex IX as the default. The question is not "will we do Annex IX?" but "what does Annex IX look like for our specific class and our specific device?"

Section 2 — the QMS assessment in detail

Section 2 of Annex IX is the quality management system assessment. It is the gate that every Annex IX certificate passes through, and it is the section most startups prepare for without realising they are preparing for it — because building a QMS is something the company has to do anyway.

What Section 2 requires the manufacturer to submit. The manufacturer files an application with the Notified Body that covers the QMS and the devices for which certification is sought. The application includes the name and address of the manufacturer, a written declaration that no application has been lodged with another Notified Body for the same QMS-related device, documentation on the QMS covering all the relevant requirements, a description of the procedures in place to keep the QMS adequate and effective, a description of the procedures to fulfil the obligations arising from the QMS, and a description of the procedures to maintain the technical documentation up to date.

What the Notified Body actually audits. The Notified Body audits the QMS to determine whether it meets the MDR requirements. In practice, the audit uses EN ISO 13485:2016+A11:2021 as the harmonised standard that gives presumption of conformity for the QMS obligations, and then layers the MDR-specific requirements on top. The auditor looks at the structure of the QMS, the management responsibility, the resource management, the design and development controls, the production and service provision controls, the monitoring and measurement processes, the corrective and preventive action system, and the integration of the QMS with the MDR-specific obligations: clinical evaluation, post-market surveillance, vigilance, risk management, and technical documentation maintenance.

What the on-site audit looks like. The audit is on-site at the manufacturer's premises. The auditor walks through processes, interviews the people responsible for each QMS element, reviews records and evidence, and checks that the documented QMS and the lived QMS are the same thing. That last point is where most startups trip: the paper says one thing, the practice says another, and the auditor is trained to find the gap.

The outcome of Section 2. If the Notified Body is satisfied that the QMS meets the requirements, they issue an EU quality management system certificate. This certificate is a prerequisite for the technical documentation assessment under Section 4 and for the eventual CE marking of the devices covered.

Section 3 — surveillance assessment during the life of the certificate

Section 3 of Annex IX is the surveillance phase. The Annex IX certificate is not a one-time event — it is a five-year relationship with the Notified Body, structured by annual surveillance.

What Section 3 requires. The manufacturer allows the Notified Body to carry out all necessary surveillance activities during the validity of the certificate. The manufacturer keeps the Notified Body informed of any planned change to the QMS or the product range covered by the certificate. The Notified Body assesses any such changes and decides whether the modified QMS and the modified devices still meet the requirements.

What the Notified Body does in surveillance. The Notified Body performs periodic surveillance assessments to ensure that the manufacturer continues to apply the approved QMS. In practice, this means annual surveillance audits at the manufacturer's premises. Each surveillance audit re-audits parts of the QMS on a rotating basis, reviews the changes since the last audit, checks the post-market surveillance data and vigilance records, and samples the technical documentation again for the covered devices.

Unannounced audits. The Notified Body also has an obligation to carry out unannounced on-site audits at the manufacturer's premises, and where appropriate at critical suppliers and subcontractors. These are not punitive — they are part of the Notified Body's obligation to confirm that the approved QMS is being applied in daily practice, not just during the planned audit window.

The practical effect on a startup. Section 3 means that the Annex IX cycle is continuous. The first certificate is not the finish line — it is the start of a five-year cadence of annual audits, unannounced visits, and change assessments. Founders who plan their regulatory budget around the first certificate alone are under-budgeting. The five-year cadence is where the ongoing cost lives.

Section 4 — the technical documentation assessment

Section 4 of Annex IX is the technical documentation assessment. This is the part of the annex that most directly affects the device file and the clinical evidence. It is also the section that scales with device class, and where the difference between Class IIa and Class III becomes concrete.

What Section 4 requires. In addition to assessing the QMS, the Notified Body assesses the technical documentation drawn up in accordance with Annexes II and III. The Notified Body examines whether the technical documentation demonstrates conformity with the relevant requirements of the MDR, in particular the general safety and performance requirements of Annex I.

How the sampling scales with class.

  • For Class IIa devices, the Notified Body assesses technical documentation on a representative basis across the generic device groups covered by the certificate. Not every device file is opened in full — the Notified Body samples, with the selection biased toward higher risk and novelty.
  • For Class IIb non-implantable devices, the sampling is deeper. The Notified Body assesses technical documentation for at least one representative device per category of devices covered, on a basis that ensures adequate coverage over the validity of the certificate.
  • For Class IIb implantable and Class III devices, the sampling model does not apply. The Notified Body assesses the technical documentation for each device or device group. There is no representative shortcut — the file for each device gets opened.

What the Notified Body looks at. The technical documentation assessment covers the design and manufacturing information, the general safety and performance requirements checklist, the risk management file, the clinical evaluation, the verification and validation evidence, the pre-clinical and biological data where applicable, the usability engineering file, the software lifecycle file where applicable, the labelling and instructions for use, and the post-market surveillance plan. The assessment is against Annexes II and III of the MDR, with the assessor checking that the file is complete, internally consistent, and technically sound.

The output. If the technical documentation meets the requirements, the Notified Body issues an EU technical documentation assessment certificate for the device or device group assessed. Together with the Section 2 QMS certificate, this allows the manufacturer to affix the CE marking and place the device on the market.

Scope across classes — what changes as the risk goes up

The same Annex IX applies to Class IIa, IIb, and III, but it does not apply equally. Three things change as the class rises.

Depth of technical documentation review. Class IIa is sampled. Class IIb non-implantable is sampled more deeply. Class IIb implantable and Class III are reviewed per device. The time and cost of the technical documentation assessment scales accordingly.

Involvement of additional procedures. Class III and certain implantable Class IIb devices trigger the clinical evaluation consultation procedure under Article 54 of the MDR. This runs alongside the Annex IX assessment and adds an expert panel review step for certain high-risk devices. The Article 54 step is not a replacement for Annex IX — it is an extra layer on top.

Surveillance intensity. For higher classes, the annual surveillance under Section 3 looks at more of the technical documentation each year, not less. The rotation model is tighter, and the review of post-market data is deeper. The five-year certificate is more work for a Class III manufacturer than for a Class IIa manufacturer, and the Notified Body fees reflect that.

What does not change is the structure. Section 2, Section 3, and Section 4 apply to every Annex IX certificate. Only the depth and cadence change with class.

Common founder mistakes with the Annex IX route

  • Treating the QMS audit and the technical documentation assessment as separate projects. They are one assessment, run by the same Notified Body, against the same MDR. Preparing for them separately doubles the work and creates gaps where the two meet.
  • Under-estimating surveillance. The first certificate is not the end. Section 3 surveillance runs every year for five years, with unannounced audits on top. Startups that budget only for the initial assessment run out of runway in year two.
  • Writing the QMS on paper without living it. The auditor under Section 2 checks that the documented QMS matches the lived QMS. A beautiful QMS manual with no daily evidence of use is the most common Section 2 finding we see.
  • Skipping the technical documentation sampling logic. For Class IIa, founders sometimes assume every device file gets the same review. The sampling logic under Section 4 means the Notified Body focuses on higher risk, higher novelty, or higher change — so files with those characteristics deserve more preparation, not less.
  • Not declaring changes under Section 3. Any change to the QMS or the product range during the certificate has to be notified. Founders who roll out changes between surveillance audits without telling the Notified Body create findings they could have avoided.
  • Choosing Annex IX by default without reading it. The annex is a few pages of regulation. Reading it directly before the Notified Body quote arrives changes the conversation from "what does this line item mean?" to "this is what I expected, here is my question."

The Subtract to Ship angle on Annex IX

Annex IX rewards preparation and punishes performative compliance. The Subtract to Ship framework treats the annex not as a burden to survive but as a structure to build against. Every QMS element the startup builds has to trace to a specific MDR requirement that Annex IX will check. Every piece of technical documentation has to trace to a specific Annex II or Annex III requirement that Section 4 will sample. Anything that does not trace is overhead — a QMS procedure nobody reads, a technical documentation section nobody needs, a process that exists because someone thought it looked like diligence.

Subtracting here means cutting the parts of the compliance programme that do not map to an Annex IX checkpoint. That does not mean cutting corners — the checkpoints are precisely the things the auditor will look for, so building against them is the opposite of cutting corners. It means building exactly what Annex IX asks for, refusing to build more, and having the discipline to say "this does not trace, we are not doing it" when a consultant or a vendor suggests adding process for its own sake.

The founders who ship an Annex IX certificate on startup runway are the ones who read the annex early, built against its structure, and refused to let their QMS become a monument to someone else's idea of diligence.

Reality Check — Where do you stand on Annex IX readiness?

  1. Have you read Annex IX of Regulation (EU) 2017/745 in full, directly from the consolidated text, not from a summary?
  2. Can you map each element of your QMS to a specific MDR requirement that the Notified Body will check under Section 2?
  3. Is your QMS documented and lived — meaning the procedures on paper match what the team actually does day to day?
  4. Have you budgeted for Section 3 surveillance across the full five-year certificate validity, not just for the initial assessment?
  5. Do you have a change-notification process that triggers whenever the QMS or the product range changes between surveillance audits?
  6. For your device class, do you know how deep Section 4 technical documentation sampling goes, and which device files are likely to be opened first?
  7. Are your technical documentation files internally consistent across the risk management file, clinical evaluation, design verification, and post-market surveillance plan?
  8. Can you defend every QMS procedure and every technical documentation section by tracing it to a specific MDR article, annex, or Section of Annex IX — rather than "because we thought we should"?

Frequently Asked Questions

What is MDR Annex IX in plain terms? Annex IX of Regulation (EU) 2017/745 is one of the main conformity assessment routes under Article 52. The Notified Body audits the manufacturer's full quality management system (Section 2), returns annually to re-audit and check changes (Section 3), and assesses the technical documentation for the devices covered (Section 4). It is the default route for most Class IIa, IIb, and III devices.

How long is an Annex IX certificate valid? An Annex IX certificate is valid for a maximum of five years. During those five years the Notified Body conducts annual surveillance assessments under Section 3, including periodic on-site audits and unannounced audits. At the end of the five-year term, the manufacturer must apply for re-assessment to renew the certificate.

Does the Notified Body review every device file under Annex IX? It depends on the class. For Class IIa, the Notified Body samples technical documentation on a representative basis across device groups. For Class IIb non-implantable, sampling is deeper. For Class IIb implantable and Class III, the Notified Body assesses the technical documentation for each device or device group, without sampling.

Does EN ISO 13485:2016+A11:2021 automatically satisfy Section 2? EN ISO 13485:2016+A11:2021 is the harmonised standard that provides presumption of conformity for the QMS obligations under the MDR. A QMS certified to EN ISO 13485:2016+A11:2021 is the baseline — the Notified Body then checks the MDR-specific requirements on top, including the integration of the QMS with clinical evaluation, post-market surveillance, vigilance, and technical documentation maintenance. The standard is necessary but not sufficient on its own.

What happens if the Notified Body finds a non-conformity during surveillance? The Notified Body issues a finding and requires corrective action within a defined timeframe. Minor findings usually allow the certificate to remain in force while the manufacturer corrects them. Major findings can lead to suspension or withdrawal of the certificate if not addressed. Section 3 gives the Notified Body explicit authority to respond to non-conformities, which is why the surveillance phase is not a rubber stamp.

Can a startup survive Annex IX on a small team? Yes, if the team treats the annex as a structure to build against rather than a checklist to complete at the end. Startups that read Annex IX early, build the QMS against its specific checkpoints, and refuse to add process that does not trace to an MDR requirement ship certificates on small teams every year. The failure mode is not team size — it is performative compliance that creates overhead without building against what the Notified Body will actually check.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 52 (conformity assessment procedures), Annex IX (conformity assessment based on a quality management system and on assessment of technical documentation), including Section 2 (quality management system assessment), Section 3 (surveillance assessment), and Section 4 (assessment of the technical documentation). Official Journal L 117, 5.5.2017.
  2. EN ISO 13485:2016+A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes. Harmonised standard providing presumption of conformity for the QMS obligations under the MDR.

This post is part of the Device Classification & Conformity Assessment series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Annex IX is the route most startups will live inside for five years once they ship their first certificate — reading it directly is the cheapest preparation work a founder can do.