What Notified Bodies Actually Check Under MDR 2017 — The Six Mandatory Audit Items Most Manufacturers Miss

What Notified Bodies Actually Check During MDR 2017 Audits — A Manufacturer's Preparation Guide

By Ankur Khare — Biomedical Engineer | Regulatory Affairs Specialist | Founder, MedReg Intel

There is a common assumption among medical device manufacturers preparing for their first MDR 2017 audit.

The assumption is this: get ISO 13485 certified, and the Notified Body audit will take care of itself.

The assumption is partially right. And partially wrong in ways that create real problems during the audit process.

This article tells you exactly what MDR 2017 requires Notified Bodies to check — from the primary source — and what that means for your audit preparation.

What MDR 2017 Actually Says About Notified Body Audits

The audit mandate for Notified Bodies under MDR 2017 comes from two places.

Rule 14 — which specifies duties of Notified Bodies.

The Third Schedule — which specifies the procedure Notified Bodies must follow during audits.

Both are worth reading carefully before you prepare for an audit.

The Six Things a Notified Body Must Verify

The Third Schedule of MDR 2017 — Part II — specifies the audit procedure that every registered Notified Body must follow. It is not discretionary. These are the mandatory checklist items under Indian law.

One — Technical document review against the Fourth Schedule.

The Notified Body must conduct a technical review of documents prescribed in the Fourth Schedule. These are the same documents required for your manufacturing licence application — device description, intended use, classification rationale, test reports, labelling, and technical specifications. Your documents must be complete, consistent, and cross-referenced before the auditor arrives.

Two — On-site QMS audit against the Fifth Schedule.

This is the central audit activity. The Notified Body must conduct an on-site audit of your quality management system to establish conformity with the requirements of the Fifth Schedule. Not ISO 13485. The Fifth Schedule. The distinction matters — because the Fifth Schedule is the legal standard against which your system will be assessed.

In practice, as discussed in a previous article, the Fifth Schedule and ISO 13485 are substantively aligned. But the audit framework is the Fifth Schedule, and your QMS documentation should reference it explicitly — not only ISO 13485.

Three — Conformity with essential principles.

The Notified Body must establish conformity with essential principles laid down by the Central Government from time to time. These essential principles cover safety and performance requirements for medical devices. Your technical documentation must demonstrate that your device meets these principles — through design verification, validation records, risk management documentation, and clinical evidence where applicable.

Four — Design conformity review.

For devices where design and development is within scope, the Notified Body must review design documents to ensure quality, safety, and performance. This means your Design History File — design inputs, design outputs, design reviews, design verification, design validation, and design transfer records — must be complete and audit-ready.

Five — Post-approval change records.

The Notified Body must record post-approval changes. If your device or manufacturing process has changed since your last audit or licence grant, those changes must be documented, assessed against the Sixth Schedule major versus minor change classification, and the appropriate approval or intimation process followed before the audit.

Six — Product and process standard conformity.

The Notified Body must assess conformity to product and process standards as per the provisions of MDR 2017 rules. This links back to Rule 7 — your device must conform to applicable BIS standards where they exist, ISO or IEC standards where BIS standards do not exist, and validated manufacturer standards where neither applies.

What Happens When the Notified Body Finds a Non-Compliance

MDR 2017 specifies this explicitly in the Third Schedule.

The Notified Body must inform the manufacturer about observed non-compliances during the audit and provide a copy of the audit report.

Where a major non-compliance is observed — one that may affect device quality — the Notified Body may provide reasonable time to rectify the non-compliance, followed by a compliance verification visit.

The Notified Body then submits a detailed report to the State Licensing Authority covering findings on each aspect of the audit, along with its recommendations.

This report determines whether your licence is granted, conditional, or refused.

The Timeline Reality for Class A and Class B

For Class A manufacturers — Rule 20(4):

Your licence is granted first. The Notified Body audit must be completed within 120 days of licence grant. This means you have 120 days from licence receipt to be fully audit-ready. Manufacturers who treat this window as additional preparation time often find themselves scrambling. The audit-ready state should exist before you file your application.

For Class B manufacturers — Rule 20(6):

The Notified Body audit must be completed before your licence is granted. The Notified Body furnishes its report to the State Licensing Authority within 30 days of audit completion. The SLA then has 20 days to make a licensing decision after receiving the report. Your QMS must be fully functional and audit-ready before your application is filed — not after.

What This Means for Your Audit Preparation

Based on what MDR 2017 requires Notified Bodies to check, your audit preparation should cover six areas in parallel.

Fourth Schedule documents — complete and consistent.

Fifth Schedule QMS — implemented, documented, and internally audited at least once before the NB audit.

Essential principles conformity — demonstrated through your technical file.

Design history file — complete for all in-scope design activities.

Post-approval change records — all changes documented and processed correctly.

Product standards compliance — applicable BIS, ISO, or IEC standards identified and conformity documented.

The manufacturers who fail NB audits under MDR 2017 are not usually failing on ISO 13485 knowledge. They are failing on one of these six areas — most commonly incomplete Fourth Schedule documentation, undocumented design history, or post-approval changes that were implemented without following the Sixth Schedule process.

The One-Sentence Summary

A Notified Body audit under MDR 2017 is not an ISO 13485 audit — it is a Fifth Schedule, Fourth Schedule, and essential principles audit conducted by an organisation that uses ISO 13485 as its assessment framework.

Know the difference. Prepare accordingly.

MedReg Intel tracks regulatory developments, compliance strategy, and policy analysis relevant to India's medical device sector at medregintel.com

Ankur Khare is a Biomedical Engineer and Regulatory Affairs Specialist and the founder of MedReg Intel. This article is for informational purposes and does not constitute formal regulatory or legal advice.

Comments

Post a Comment

Popular posts from this blog

The ₹50 Lakh Mistake Killing Indian MedTech Startups — And How to Avoid It

The One Regulatory Mistake That Costs Indian MedTech Startups ₹50 Lakh and 2 Years — And How to Avoid It By Ankur Khare — Biomedical Engineer | Regulatory Affairs Specialist | Founder- MedReg Intel There is a mistake so common in Indian MedTech startups that I have started calling it the Silent Killer of early stage medical device companies. It does not show up in your pitch deck. Your investors will not catch it. Your product team will not flag it. Even your legal counsel may miss it — unless they have specific medical device regulatory experience. By the time most startups discover this mistake, they have already spent ₹30 to ₹50 lakh in product development, hired a team, signed letters of intent with hospital procurement departments, and told their investors they are six months from launch. Then CDSCO sends a deficiency notice. Or worse — a rejection. And suddenly those six months become two years. This article is about that mistake. What it is, why it keeps happening, what ...
Read more

A Practical Roadmap for Developing Medical Devices in India

A Practical Roadmap for Developing Medical Devices in India From Idea to Market — Without Costly Regulatory Mistakes By Ankur K. Khare – Biomedical Engineer | Regulatory Affairs Specialist | AI Ethics & Medical Innovation Developing a medical device in India is not just an engineering challenge. It is a regulatory, clinical, manufacturing, and ethical journey — and most failures happen not because the product is bad, but because the roadmap is wrong . Too many teams build first and think about regulation later. By the time CDSCO enters the picture, timelines are already broken. This guide lays out a clear, India-specific roadmap for medical device development — grounded in MDR 2017, CDSCO scrutiny patterns, and real-world failures — so teams can build right , not just fast. Why This Matters An incorrect development sequence can: Delay approvals by months Multiply compliance costs Force redesigns late in the lifecycle Undermine regulatory credibility Most of this is preventable —...
Read more

Make in India for Medical Devices — The Reality No One Is Talking About

Make in India for Medical Devices — The Honest Truth About What Is Working, What Is Not, and What It Will Take to Build a World-Class MedTech Industry By Ankur Khare — Biomedical Engineer | Regulatory Affairs Specialist | Founder, MedReg Intel India imports approximately 70 to 80 percent of its medical devices. Read that again. The world's most populous country — a nation with one of the fastest-growing economies on earth, a massive domestic healthcare need, and a government that has made manufacturing self-sufficiency a centrepiece of national policy — still depends on foreign manufacturers for most of the devices used in its hospitals every single day. The Make in India initiative for medical devices has been running for nearly a decade. The Production Linked Incentive scheme has committed thousands of crores in government support. CDSCO has been strengthened and modernised. Medical device parks have been established. And yet the import dependence persists. This is not a s...
Read more