The notified body eIFU checklist

Eligibility was established in the risk assessment, and every condition below assumes it exists. It is the one document the rest of the list refers back to.

1. 1

   Risk assessment on file

   Covering at least the eleven elements listed at Article 4(1), with a process to update it from post-market experience. Article 4(2) is what makes it a live document rather than a one-off annex.

   Art. 4(1) Art. 4(2)

Article 5 runs to point (13), and point (12) was deleted in 2025, so twelve conditions remain. Points (6), (11) and (13) were also amended. What remains is the substance of an eIFU file.

1. 2

   Safety demonstration

   Recorded as a conclusion rather than implied: the electronic form maintains or improves the level of safety obtained on paper. It is drawn from the eleven elements above, and it is device-specific.

   Art. 5(1)
2. 3

   Coverage of every Member State

   Where the product is made available or put into service, unless the risk assessment justifies otherwise. Where a market is left out, that justification belongs in the assessment rather than in correspondence.

   Art. 5(2)
3. 4

   Paper-on-request procedure

   Naming the intake route, the internal owner, who prints, and the committed period. The outer limit is 7 calendar days from the request, or delivery with the device where paper is asked for at the time of order.

   Art. 5(3)
4. 5

   Request records

   Showing the committed period was met in practice, at no additional cost to the user. The provision asks for a system in place, so the evidence is a procedure with records against it rather than the procedure alone.

   Art. 5(3)
5. 6

   Emergency information

   On the device or a leaflet, with start-up information where the device has a built-in display. Some printed material travels with a paperless device.

   Art. 5(4)
6. 7

   Verification and validation records

   For the proper design and functioning of the electronic instructions. The scope of this one is unsettled — see below — so record what you checked and why you scoped it that way.

   Art. 5(5)
7. 8

   Built-in display assessment

   Where the device has one, showing that displaying the instructions does not impede safe use, in particular life-monitoring or life-supporting functions.

   Art. 5(6)
8. 9

   Hardware and software requirements

   The hardware and software needed to display the instructions, published in the catalogue or other appropriate device information support — which means somewhere a customer will actually find them.

   Art. 5(7)
9. 10

   Revision procedure

   Covering how a revision is signalled clearly, and how each user is informed where the revision was necessary for safety reasons.

   Art. 5(8)
10. 11

    Retention period determined

    Per device family, with the reasoning. 10 years for devices with a defined expiry date, implantable devices excepted, and at least 2 years beyond the end of that expiry date; 15 years for implantable devices and for devices without a defined expiry date. Both run from the last device placed on the market.

    Art. 5(9) Art. 5(10)
11. 12

    Language matrix

    The instructions are available on the website in an official language of the Union determined by the Member State in which the device is made available. The matrix is what turns that into something checkable.

    Art. 5(11)
12. 13

    Version history published

    All issued electronic versions and their date of publication, available on the website for the retention periods, with a route for supplying obsolete versions on request.

    Art. 5(13)

Article 6 governs what a user holding the box can find out.

1. 14

   Label artwork

   The label states that the instructions are electronic, on the packaging for each unit or, where appropriate, on the sales packaging. For fixed installed devices the information also appears on the device itself, and for software at the location from which access to the software is granted.

   Art. 6(1)
2. 15

   Access information supplied with the device

   The access information goes where that label statement goes: on the packaging for each unit or, where appropriate, on the sales packaging, and on the device itself for fixed installed devices. Where that is not practicable, it goes in a paper document supplied with each device.

   Art. 6(2)
3. 16

   Access information complete on all four points

   What is needed to view the instructions; the Basic UDI-DI and/or UDI-DI with further identification; manufacturer contact details; and how and within what time paper can be requested at no additional cost. That time is the paper-on-request period set in the risk assessment and capped at 7 calendar days, so the label, the procedure and the assessment all have to state the same thing.

   Art. 6(3)
4. 17

   Instructions available entirely as text

   Which may contain symbols and graphics, carrying at least the same information as the paper version. Video or audio may be added to the text, never substituted for it.

   Art. 6(5)

Article 6 is where the label and the platform have to agree. The time period given in the access information under Article 6(3)(d) is the period Article 5(3) takes from the risk assessment, evaluated under Article 4(1)(i) , and both have to match what the request procedure actually delivers.

Article 7 covers the website itself. Five points remain in paragraph 2 after the 2025 amendment.

1. 18

   Website access even where the instructions travel with the device

   Where the instructions are supplied on an electronic storage medium or through a built-in display, they are also made accessible through a website.

   Art. 7(1)
2. 19

   Commonly used format

   A commonly used format that can be read with software that is freely available.

   Art. 7(2)(a)
3. 20

   Access control and tamper protection

   Protection against unauthorised access and tampering of content, with the performance of those safeguards assessed under Article 4(1)(e) . The cross-reference is what turns a setting into evidence.

   Art. 7(2)(b)
4. 21

   Availability records

   Showing that server downtime and display errors are reduced as far as possible. Demonstrating this is a matter of monitoring records over time rather than a statement.

   Art. 7(2)(c)
5. 22

   GDPR position documented

   Compliance with Regulation (EU) 2016/679, documented for the website that carries the instructions.

   Art. 7(2)(d)
6. 23

   Written commitment that the internet address is stable

   Stable and directly accessible for the whole of the 10- or 15-year retention period that applies to the device. The address is committed for that period, not for the life of the current website.

   Art. 7(2)(e)
7. 24

   eIFU address registered in the UDI database

   The address is provided to the UDI database at the latest from the date on which device registration applies. The cross-references run to Articles 28 and 123(3)(d) or (e) of the MDR and to Annex VI, Part B, point 22 — and while point 22 describes the URL field as optional, this provision makes populating it an obligation where the instructions are electronic.

   Art. 7(3)

One line that is not in the implementing regulation at all, and the one that decides whether a reviewer finds any of the rest.

1. 25

   Labels and instructions for use filed

   In the languages accepted in the Member States where the device is envisaged to be sold, so a reviewer reading the technical documentation finds the evidence above without having to ask for it.

   MDR Annex II, 2