The worst pattern Tibor sees on the audit floor is an intuitive device paired with a 150-page instructions for use document that no human will ever read. The correct usability test for an IFU is simple and uncomfortable: hand the user the device and the IFU, give no coaching, and watch them try to complete the task. If they cannot, the IFU has failed. MDR Annex I §23 and EN 62366-1 do not grade IFUs on length or completeness; they grade them on whether the intended user can safely use the device with them.

By Tibor Zechmeister and Felix Lenhard.

TL;DR

  • MDR Annex I Chapter III §23 requires that information supplied with the device be understandable to the intended user.
  • EN 62366-1:2015+A1:2020 treats the IFU as a user interface element that must be evaluated inside the usability engineering process.
  • The real summative test for an IFU is: hand the user the device and the IFU, give no coaching, observe.
  • A 150-page IFU that technically contains every required piece of information but which no one can use is a failed IFU under MDR.
  • Warnings, contraindications, and safety-critical procedures must be findable in seconds, not after ten minutes of searching.
  • Safety by information sits at the bottom of the risk control hierarchy; an IFU is never a substitute for inherent safe design or protective measures.

Why the long IFU is a usability failure disguised as completeness

Tibor has a story he tells founders who are proud of their 150-page instructions for use document. The device was well-designed, intuitive at first touch, and shipped with an IFU that contained every warning, every contraindication, every cleaning instruction, every parameter table, every reference to every standard the manufacturer could think of. The regulatory team considered the IFU thorough. The notified body asked one question: had the manufacturer observed a real user trying to complete a critical task using only the device and the IFU? The answer was no. The next question from the auditor: how would the user find the warning about a specific contraindication that was buried on page 97? Silence.

The pattern is consistent. A long IFU is not evidence of safety. It is often the opposite. A user confronted with 150 pages of dense technical content either ignores the document entirely or hunts through it for ten minutes and gives up. The critical warning that the manufacturer legally discharged by including it on page 97 never reaches the user in the moment of use. The regulatory risk is transferred from the manufacturer's conscience to the user's reality, where it fails.

Felix has coached founders who thought a long IFU was their safety margin. It is the opposite. A long IFU is a signal that the device has not been designed around the user and that safety by information is being used to patch over gaps that should have been closed by inherent safe design or protective measures.

What MDR actually says about the IFU

MDR Annex I Chapter III §23 is the core obligation. The information supplied with the device, including the IFU, must be provided in a form, and on a medium, that is accessible to the intended user. It must be written in terms readily understood by the intended user and, where appropriate, supplemented with drawings and diagrams. The IFU must contain the specific items listed in Annex I §23.4, including intended purpose, user profile, residual risks, warnings, precautions, contraindications, and instructions for safe use.

MDR Annex I §5 requires manufacturers to reduce, as far as possible, risks related to the ergonomic features of the device and the environment, taking into account the technical knowledge, experience, education, training, use environment, and medical and physical conditions of the intended users. The IFU is part of how that reduction happens or fails to happen.

MDR Annex I §22 requires that devices incorporating electronic programmable systems and software that is itself a device be developed and manufactured taking into account the principles of development life cycle, risk management, verification, and validation. For connected devices, this extends to in-product instructional content, which is part of the IFU obligation under §23.

EN 62366-1:2015+A1:2020 gives the standard the notified body expects to see. The IFU is a user interface element. Use scenarios that depend on the IFU must be identified, and the effectiveness of the IFU in supporting safe use must be evaluated during summative evaluation. The standard does not grade IFUs on length. It grades them on whether the intended user can perform the intended task safely with the information provided.

Read together, the obligation is not "the IFU must contain the required information". It is "the intended user must be able to use the device safely with the IFU in hand". Those two obligations sound similar. In practice they are different by an order of magnitude.

A worked example: the real IFU usability test

Consider a home-use medical device with a moderate-complexity setup procedure, a cleaning procedure, and a list of contraindications that matter for certain patient populations. Intended users: adults with the target condition, including older adults. Intended environment: the user's home, first use, alone, with no training and no clinical supervision.

The compliant path is not "write the longest IFU possible to be safe". The compliant path is the EN 62366-1 process applied to the IFU.

Use specification. Every real-world procedure the user will perform with the device, including the ones the IFU is meant to support: unboxing, setup, first use, normal operation, cleaning, handling errors, handling a contraindication, disposal.

Hazard-related use scenarios. For each procedure, the scenarios where the IFU is load-bearing. A user who does not find the cleaning instructions may not clean the device. A user who does not find the contraindication list may use the device when they should not. Each of these is a scenario with a clinical consequence.

IFU design. The information architecture of the IFU must match the way the user actually uses it. Critical warnings at the front, not on page 97. Step-by-step procedures with visuals. Contraindications findable in seconds. Language calibrated to the intended user's reading level, not the regulatory team's.

Summative evaluation, Tibor's rule. Give the recruited user the device and the IFU. Do not coach. Do not answer questions during the task. Do not show them where to look. Observe. Record. If the user cannot complete the critical task with the IFU as their only support, the IFU has failed the evaluation and must change. This is the test that separates compliant IFUs from impressive-looking IFUs.

Iteration. Findings from formative evaluation feed back into the IFU design. Summative evaluation gates the release. Post-market surveillance feeds ongoing IFU updates through change control.

The Subtract to Ship playbook for IFU usability

Felix's Subtract to Ship principle for IFUs is identical to the principle for devices: subtract everything that is not load-bearing for safe use, and keep what is left usable for the real intended user.

Step 1. Do not start the IFU by listing required sections. Start it by listing the procedures the user will perform and the information they need for each one. Map the required Annex I §23.4 content onto those procedures, not the other way around.

Step 2. Put safety-critical content where the user will see it in time. Warnings and contraindications do not belong exclusively on a legal back page. They belong where the user is about to perform the action they are being warned about.

Step 3. Use visuals that match the real use environment. A line drawing of a hand in the wrong orientation is misleading. A photograph of the real device in the real hand, in the real environment, is clearer and often shorter than paragraphs of text.

Step 4. Calibrate language to the intended user, not to the regulatory team. Technical jargon that is natural inside the company is often opaque to the user. EN 62366-1 expects the IFU to be understandable to the intended user, not to the manufacturer.

Step 5. Run the real usability test. Device plus IFU, recruited user, no coaching. If the user cannot complete the critical task, the IFU has failed and must change.

Step 6. Remember the risk control hierarchy. Safety by information is the last resort in the hierarchy, after inherent safe design and protective measures. An IFU is never a substitute for a design fix that was available. Auditors notice when a warning is carrying weight that a design decision should have carried.

Step 7. Plan eIFU where allowed and where the user can actually reach it. Electronic instructions for use are permitted under specific conditions in the EU eIFU framework, but only when the intended user can reliably access them. For home-use devices and broad consumer populations, a paper IFU is often still the safer choice.

Reality Check

  1. Has a recruited user, representative of the intended user population, tried to complete the critical task with only the device and the IFU, with no coaching?
  2. Can the user find every safety-critical warning and contraindication in under thirty seconds?
  3. Is the language calibrated to the intended user's reading level?
  4. Do the visuals match the real use environment, or are they generic drawings that look different from reality?
  5. Are there warnings in the IFU that are patching over design decisions that should have been fixed inherently?
  6. Is the IFU structured around the procedures the user will perform, or around the sections the regulation mandates?
  7. Does the post-market surveillance system feed IFU updates back through change control when real-world feedback exposes confusion?

Frequently Asked Questions

Is a longer IFU safer than a shorter one? No. A longer IFU is often less safe because critical information is harder to find. EN 62366-1 and MDR Annex I §23 care about whether the intended user can use the device safely, not about the length of the document.

How do we test the IFU for usability? During summative evaluation. Give the recruited user the device and the IFU, provide no coaching, and observe whether they can complete the critical task safely. Record the observations. If they cannot, the IFU has failed.

Can we rely on the IFU to handle risks we did not design out? Not safely. The risk control hierarchy places safety by information last, after inherent safe design and protective measures. Auditors recognise when an IFU is carrying weight that a design decision should have carried, and they usually challenge it.

Are there cases where no IFU is required? MDR Annex I §23 allows limited exemptions for certain Class I and Class IIa devices where the manufacturer can demonstrate that the device can be used safely without an IFU. The exemption is narrow and must be justified in the file.

Can we ship the IFU electronically? Electronic instructions for use are permitted under specific conditions under the EU eIFU framework, but the intended user must be able to access them reliably. For consumer and home-use devices, paper is often still the safer default.

Where do IFU updates live after release? In change control. Post-market surveillance feedback that reveals IFU confusion feeds back into the usability engineering file and into IFU revisions, and the revisions go through the standard change-control loop.

Sources

  1. Regulation (EU) 2017/745 on medical devices, consolidated text. Annex I §5, §22, Chapter III §23, §23.4.
  2. EN 62366-1:2015+A1:2020, Medical devices. Part 1: Application of usability engineering to medical devices.
  3. EN ISO 14971:2019+A11:2021, Medical devices. Application of risk management to medical devices.
  4. MDCG 2019-11 Rev.1 (June 2025), Guidance on qualification and classification of software in Regulation (EU) 2017/745 MDR and Regulation (EU) 2017/746 IVDR.