Preparing for your first EU MDR compliance audit is a significant undertaking, and the gap analysis you conduct beforehand will determine how confident and prepared you walk into that audit. A well-executed EU MDR gap analysis compares your current quality management and technical documentation practices against the specific requirements of the Medical Device Regulation, revealing exactly where work still needs to be done. Done properly, it transforms an overwhelming regulatory landscape into a structured, manageable action plan.
This guide walks you through each stage of that process, from gathering your foundational documents to validating that every identified gap has been closed before the auditor arrives. Whether you are preparing your own product for MDR certification or working with a contract manufacturing partner, these steps apply directly to your situation. If you are looking for a manufacturing partner already familiar with MDR requirements, explore our healthcare and hygiene product services to see how we support clients through this process.
What You Need Before Starting the Gap Analysis
Before you can identify gaps, you need a clear picture of what you are measuring against and what you already have in place. Rushing into the analysis without the right inputs leads to incomplete findings and a false sense of security. Invest time upfront to gather everything in one place.
The primary reference document for your EU MDR gap analysis is Regulation (EU) 2017/745 itself, particularly Annex I (General Safety and Performance Requirements), Annex II (Technical Documentation), and Annex III (Post-Market Surveillance). You will also need the relevant harmonized standards applicable to your device classification. Alongside the regulation, pull together your existing documentation, processes, and records so you have something concrete to compare against.
Assemble the following before you begin:
- The full text of EU MDR 2017/745 and any applicable implementing acts or guidance documents (MDCG guidance documents are particularly useful)
- Your current technical file or device dossier, even if incomplete
- Your existing quality management system documentation, including your ISO 13485 certification if applicable
- Previous audit reports, notified body correspondence, or any prior compliance assessments
- A list of all devices in scope, including their classification under MDR rules
- Contact details for internal stakeholders across regulatory, quality, clinical, and production functions
Once these materials are assembled and your team is aligned on the scope of the analysis, you are ready to begin the structured comparison process.
Map Your Current Compliance Status Against MDR Requirements
This is the core analytical step of the EU MDR gap analysis. The goal is to systematically work through each MDR requirement and record, honestly, whether your current documentation and processes meet it, partially meet it, or do not meet it at all. Avoid the temptation to be optimistic here. Auditors will find what you miss.
Build a gap analysis matrix using a spreadsheet or dedicated quality management tool. Structure it so that each row represents a specific MDR requirement or sub-requirement, and columns capture your current status, supporting evidence, the responsible owner, and the gap description if one exists.
- Work through Annex I systematically, clause by clause, and document what evidence you have for each General Safety and Performance Requirement
- Review your technical documentation against Annex II requirements, including device description, design and manufacturing information, and post-market surveillance plan
- Assess your clinical evaluation report against the requirements of Annex XIV and relevant MDCG guidance
- Check your labelling and instructions for use against Annex I, Chapter III requirements
- Review your post-market surveillance and vigilance procedures against Articles 83 to 87
At the end of this mapping exercise, you should have a populated matrix that gives you a clear, evidence-based view of your MDR compliance status across every major requirement. This document becomes the foundation for everything that follows. Verify that each row has a clear status designation and that no requirements have been skipped or marked as “assumed compliant” without supporting evidence.
Identify and Prioritize Critical Compliance Gaps
Not all gaps carry equal risk. A missing signature on an internal form is a very different problem from an incomplete clinical evaluation for a Class IIb device. The next step is to review your gap matrix and assign each gap a priority level based on its regulatory significance, the effort required to close it, and the time remaining before your audit.
Use a straightforward prioritization framework. Classify each gap as critical, major, or minor based on the following logic:
- Critical gaps are those that would result in a non-conformity finding or prevent certification entirely, such as missing clinical evidence, absent post-market surveillance procedures, or no documented risk management file meeting ISO 14971
- Major gaps are significant deficiencies that require substantial work to resolve but do not immediately block certification if remediation is underway and documented
- Minor gaps are documentation inconsistencies, formatting issues, or procedural gaps that can be resolved quickly without deep technical work
Once you have classified every gap, sort your matrix by priority and review the critical and major items as a team. Discuss whether any gaps are interconnected, as closing one may automatically resolve another, or may depend on another being resolved first. This dependency mapping saves significant time during remediation. With your prioritized gap list finalized, you are ready to build the remediation plan.
Build a Remediation Plan with Clear Ownership and Deadlines
A gap analysis without a remediation plan is just a list of problems. The remediation plan converts your findings into accountable, time-bound actions. Each gap needs a named owner, a defined action, and a realistic deadline that gives you enough buffer before the audit date to validate the closure.
Structure the remediation plan as an extension of your gap matrix. For each identified gap, document the following:
- The specific action required to close the gap, described in concrete terms rather than vague intentions
- The person or team responsible for executing that action
- Any dependencies on other gaps, external parties, or resources that could affect the timeline
- The target completion date, working backwards from your audit date with a minimum two-week buffer for validation
- The evidence that will confirm the gap has been closed, such as a completed document, a signed validation record, or an updated procedure
For complex gaps, particularly those involving clinical evaluation updates, post-market surveillance plan development, or risk management file revisions, break the action down into sub-tasks with their own intermediate deadlines. This prevents large items from sitting unaddressed until the last moment. If you are working with a contract manufacturing partner on device production, ensure that they are included in the plan for any gaps that touch manufacturing processes or technical documentation they contribute to. We support our clients through exactly this kind of documentation and regulatory alignment as part of our MDR expertise. Contact us to discuss how we can assist with your specific situation.
Review the plan with all owners in a kick-off meeting so that responsibilities are understood and accepted, not just assigned. Establish a regular cadence for progress check-ins, weekly for critical items and biweekly for major items, so that delays surface early rather than close to the audit date.
Validate Gap Closure Before the Audit Date
Completing a remediation action is not the same as closing a gap. Validation is the step that confirms the action actually resolved the compliance deficiency rather than simply producing a document that exists on paper. This is the final quality gate before your MDR compliance audit, and it deserves the same rigor as the original gap analysis.
For each closed gap, conduct a brief review to confirm that the remediation meets the original MDR requirement it was intended to address. This is not a full re-audit, but it should be a structured check rather than a casual sign-off.
- Return to the original MDR clause or requirement that the gap was mapped against and re-read it carefully
- Review the remediation output, whether a document, record, procedure, or test result, against the specific language of the requirement
- Confirm that the evidence is complete, version-controlled, approved by the appropriate person, and accessible in the location where the auditor will expect to find it
- Update your gap matrix to reflect the closed status, the date of closure, and the reference to the supporting evidence
Once all critical and major gaps have been validated as closed, conduct a final internal walkthrough of your complete technical documentation package. Simulate the auditor’s perspective by asking whether a reviewer unfamiliar with your product could follow the documentation trail from device description through risk management, clinical evaluation, and post-market surveillance without encountering missing links or unanswered questions. Any remaining inconsistencies should be resolved before the audit date.
A thorough EU MDR gap analysis and remediation cycle not only improves your audit outcome but also strengthens the long-term quality of your compliance program. If you are managing this process alongside product development or production, having the right manufacturing partner makes a meaningful difference. Discover how our healthcare and hygiene manufacturing services are built around MDR compliance from the ground up, so your technical documentation and production processes are aligned from day one.
This content was generated with the help of AI and it may contain mistakes