What does a surveillance audit do, and how does it differ from the initial evaluation?

Surveillance checks that the manufacturer keeps applying the quality system the notified body approved; it does not re-run the conformity assessment. MDR Annex IX section 3.1 states the aim in those words, and the same "Surveillance under the responsibility of the notified body" section appears in modules D, E and H of Decision 768/2008/EC and the sector acts that copy them. Full re-assessment happens at re-certification, which under the MDR and IVDR occurs at least every five years (Annex VII section 4.11 of each Regulation; Article 56(2) MDR, Article 51(2) IVDR).

How often must a notified body audit an MDR or IVDR manufacturer?

Annex IX section 3.3 of both Regulations requires audits and assessments "at least once every 12 months", including on-site audits at the manufacturer and, if appropriate, at suppliers or subcontractors. Section 3.4 adds unannounced audits "at least once every five years", performed randomly, with tests on a sample of produced devices or devices taken from the market. The notified body plans them but must not disclose the plan to the manufacturer.

Do all quality assurance modules require annual audits?

No. Decision 768/2008/EC modules D, E and H only say "periodic audits" plus possible unexpected visits, and Article 4(5)(h) leaves it to each sector act to fix a frequency. The RED, ATEX Directive, Lifts Directive and Machinery Regulation 2023/1230 set none. The PPE Regulation says at least once a year (Annex VIII, point 4.3). The PED and the Machinery Directive 2006/42/EC require a frequency such that a full reassessment is carried out every three years.

Is Recommendation 2013/473/EU the legal basis for MDR unannounced audits?

No. Recommendation 2013/473/EU of September 24, 2013 was written for Directives 90/385/EEC, 93/42/EEC and 98/79/EC and says it creates no new rights or obligations. Its Annex III recommended unannounced audits at least once every third year, lasting at least one day with at least two auditors. The binding MDR and IVDR rule is Annex IX section 3.4: at least once every five years.

Does the MDR define minor, major and critical non-conformities and their closure deadlines?

No. Annex VII section 4.10 requires the notified body to ask for corrections, corrective actions and, where applicable, preventive actions, and where necessary to restrict, suspend or withdraw the certificate. Article 56(4) gives the manufacturer an appropriate deadline set by the notified body. Grading scales and closure periods come from each notified body's own procedures and contract.

Can a manufacturer switch notified body during the certificate's life?

Yes. Article 58 MDR (Article 53 IVDR) requires an agreement between the manufacturer, the incoming body and, where practicable, the outgoing body, covering at least the date the old certificates become invalid, how long the old body number may still appear, the transfer of documents, the date tasks pass to the new body, and the last serial or lot number under the outgoing body. The outgoing body withdraws its certificates on that date.

NB surveillance audits: cadence and conduct

Hugues Orgitello updated 7 Oct 2026 13 min read

A notified body certificate starts a surveillance relationship. How often the body comes back, and whether it may arrive unannounced, is not set by one general rule: Decision 768/2008/EC only says "periodic audits" and lets each sector act fix a frequency. The MDR and IVDR set the strictest cadence (at least every 12 months, plus unannounced audits at least every five years). The PPE Regulation sets once a year. The Pressure Equipment Directive and the Machinery Directive set a three-year full reassessment cycle. The RED, ATEX, Lifts Directive and the new Machinery Regulation set no frequency at all. This page quotes each rule with its annex and point, then covers what the audit examines, what the texts say about non-conformities, and how a change of notified body works.

Surveillance is not re-assessment

The texts separate three stages: the initial assessment that leads to the approval or certificate, surveillance while it is valid, and re-certification.

Aim of surveillance. MDR Annex IX section 3.1: "to ensure that the manufacturer duly fulfils the obligations arising from the approved quality management system". The quality assurance modules of Decision 768/2008/EC and of the sector acts use the same wording in their point 4.1, under the heading "Surveillance under the responsibility of the notified body".
Re-certification. Under the MDR and IVDR, Annex VII section 4.11 requires re-certification of approved quality management systems and of technical documentation and type-examination certificates "at least every five years". Certificates are valid for at most five years and can be extended for further periods of up to five years after a re-assessment (Article 56(2) MDR, Article 51(2) IVDR). For renewals, the manufacturer submits a summary of changes and scientific findings, including changes not yet notified.
Changes in between. These follow their own route, not the audit calendar: under MDR Annex IX section 2.4 the manufacturer informs the body of any plan for substantial changes to the quality management system or the device range, and under section 4.10 changes to an approved device that could affect safety and performance need the approval of the body that issued the technical documentation certificate. Under RED Annex IV point 3.5 the manufacturer keeps the body informed of any intended change to the quality system.

For module choice in general, see the self-declaration vs notified body comparison and the conformity assessment modules guide. For the general CE procedure, /en/ce/procedure/. For the MDR itself, the MDR guide.

Who sets the frequency

Decision 768/2008/EC is the template. Its module D, E and H texts read: "The notified body shall carry out periodic audits to make sure that the manufacturer maintains and applies the quality system" (point 4.3), and "In addition, the notified body may pay unexpected visits to the manufacturer", during which it may test products (point 4.4). No number appears. Article 4(5)(h) of the Decision then lists among the options open to the legislator: "if the notified body carries out periodic audits, specify their frequency". Some sector acts used that option; most did not.

Where the act is silent, the frequency is set by the notified body procedures and the contract. ISO/IEC 17021-1 surveillance cycles apply to accredited management system certification (ISO 9001, ISO 13485, IATF 16949, AS 9100), which is a separate certificate under its own scheme rules; they do not become the notified body cadence unless the sector act says so. See the QMS standards guide.

Surveillance rules act by act

Act	Procedure and provision	Periodic audits	Unannounced or unexpected visits
Regulation 2017/745 (MDR)	Annex IX, sections 3.3 and 3.4	"At least once every 12 months", including on-site audits at the manufacturer and, if appropriate, suppliers and subcontractors	"At least once every five years", randomly, with sample tests; the plan is not disclosed to the manufacturer
Regulation 2017/746 (IVDR)	Annex IX, sections 3.3 and 3.4	At least once every 12 months	At least once every five years
Directive 2014/53/EU (RED)	Module H only, Annex IV points 4.3 and 4.4 (the RED has no module D, Article 17)	Periodic, no frequency	May pay unexpected visits, with tests if necessary
Directive 2014/34/EU (ATEX)	Module D (Annex IV) and module E (Annex VII), points 4.3 and 4.4	Periodic, no frequency	May pay unexpected visits
Directive 2014/33/EU (Lifts)	Annex VII (full QA, safety components) and Annex XI (H1, lifts), points 4.3 and 4.4	Periodic, no frequency	May pay unexpected visits; under Annex XI also at the installation site of a lift
Regulation (EU) 2016/425 (PPE)	Module D, Annex VIII points 4.3 and 4.4	"At least once a year"	May pay unexpected visits, with examinations or tests of the PPE
Directive 2014/68/EU (PED)	Annex III modules D, D1, E, E1, H (point 4.3) and H1 (point 5.3); Article 14(4)	Frequency "such that a full reassessment is carried out every three years"	Unexpected visits, need and frequency set by the body's visit control system (category of the equipment, previous results, follow-up of corrective action, among other factors). For categories III and IV under quality assurance, Article 14(4) requires sampling during unexpected visits and at least two visits in the first year of manufacturing
Directive 2006/42/EC (Machinery, until January 19, 2027)	Full quality assurance, Annex X points 3.3 and 3.4	Frequency "such that a full reassessment is carried out every three years"	Unannounced visits, need and frequency set by a visit monitoring system
Regulation 2023/1230 (Machinery, from January 20, 2027)	Module H, Annex IX points 4.3 and 4.4	Periodic, no frequency	May pay unexpected visits

Two things stand out. First, only the medical device Regulations make unannounced audits mandatory with a minimum frequency; every other act in the table says the body "may" visit unannounced. Second, the Machinery Regulation 2023/1230 drops the three-year full reassessment rule that Annex X of Directive 2006/42/EC contained: from January 20, 2027, module H for machinery follows the plain Decision 768/2008 wording.

What MDR and IVDR surveillance covers

Annex IX section 3 and Annex VII section 4.10 of each Regulation add content to the calendar:

Requirement	Provision	What the text says
Information the manufacturer must supply	Annex IX 3.2	QMS documentation; findings from the post-market surveillance plan, including PMCF, for a representative sample of devices, and from vigilance (Articles 87 to 92); design data such as risk management results; manufacturing data such as quality control reports, test and calibration data and personnel qualification records
Periodic audits and assessments	Annex IX 3.3	At least once every 12 months; tests where necessary; a surveillance audit report and, if tested, a test report
Unannounced audits	Annex IX 3.4	At least once every five years, at the manufacturer and where appropriate suppliers or subcontractors; may be combined with the periodic assessment; sample of produced devices, or samples taken from the market, tested against the technical documentation
Technical documentation sampling	Annex IX 3.5	Class IIa and IIb (MDR), class C (IVDR): further representative samples assessed. Class III (MDR): test of approved parts or materials essential for device integrity, with a quantity check where appropriate
Auditor rotation	Annex IX 3.6	As a general rule, a lead auditor neither leads nor attends audits of the same manufacturer for more than three consecutive years
Divergent sample	Annex IX 3.7	The body suspends or withdraws the certificate or imposes restrictions
Body procedures	Annex VII 4.10	Surveillance audits "on at least an annual basis"; review of vigilance data; extraordinary measures (document reviews, short-notice or unannounced audits, product testing) or more frequent audits where certification is at risk
PSUR	Article 86(2) MDR	For class III and implantable devices, the manufacturer submits the PSUR to the notified body through the electronic system; the body reviews it and adds its evaluation

Unannounced audits: what the texts require

MDR and IVDR

Annex IX section 3.4 is the binding rule: random unannounced audits at least once every five years on the site of the manufacturer and, where appropriate, of its suppliers or subcontractors. During them the body tests an adequate sample of devices produced or from the manufacturing process, or takes samples from the market, against the technical documentation. Sampling criteria and the testing procedure are specified before the audit. The body issues an on-site audit report, including the sample test result where applicable. Beyond that minimum, Annex VII section 4.10 lists unannounced audits among the extraordinary measures the body may take after vigilance information where certification is at risk.

Recommendation 2013/473/EU, the pre-MDR benchmark

Before the MDR, unannounced audits rested on Commission Recommendation 2013/473/EU of September 24, 2013, addressed to bodies working under Directives 90/385/EEC, 93/42/EEC and 98/79/EC. It states that it "does not create any new rights and obligations". Its Annex III recommended:

unannounced audits "at least once every third year", more often for high-risk devices, frequently non-compliant device types, or where specific information gives reason to suspect non-conformity;
unpredictable timing, at least one day, at least two auditors;
the option of visiting a critical subcontractor or crucial supplier instead of or in addition to the manufacturer;
a check of a recently produced sample against the technical documentation, including traceability of critical components and materials;
for quality system bodies, a detailed check of at least two critical processes, one with a high likelihood of non-conformity and one particularly safety relevant;
contractual arrangements that guarantee access, including open visa invitations from the manufacturer and its critical subcontractors, information on periods without production, and financial compensation for unannounced audits.

The MDR turned the principle into law with a different minimum (five years instead of three). The Recommendation remains useful as a description of how such an audit is organised, not as the source of the MDR obligation.

Legacy devices

For devices still placed on the market under a Directive certificate, Article 120(3e) MDR (as amended by Regulation (EU) 2023/607 of March 15, 2023) keeps the issuing body responsible for "appropriate surveillance", unless the manufacturer agreed with an MDR-designated body that the latter carries it out. From September 26, 2024, the MDR body that signed the written agreement under Article 120(3c)(e) is responsible for that surveillance. The transition runs until December 31, 2027 for class III and class IIb implantable devices (with exemptions) and December 31, 2028 for the other classes.

Proposed change: COM(2025) 1023

On December 16, 2025 the Commission proposed amending the MDR and IVDR (COM(2025) 1023). For surveillance, the proposed Annex IX texts would read:

Point	Text in force	Proposal
Periodic audits (Annex IX 3.3)	At least once every 12 months	Once every 12 months, or only once every 24 months where justified by previous results and in the absence of post-market surveillance or vigilance concerns
Unannounced audits (Annex IX 3.4)	At least once every five years, randomly	Short-notice or unannounced audits when justified by post-market surveillance or vigilance concerns or at the request of a competent authority

The explanatory memorandum also mentions replacing on-site audits by remote audits. This is a proposal. Until it is adopted and published in the Official Journal, Annex IX sections 3.3 and 3.4 apply as quoted above.

What the audit examines

The texts list the evidence the body may require (MDR Annex IX 3.2, the module D, E and H point 4.2 of each sector act) rather than an audit checklist. In practice the audit samples the following, each tied to an obligation in the text:

Quality system documentation and its application: management review, internal audits, follow-up of findings from the previous audit.
Post-market data (MDR/IVDR): PMS plan results, PMCF, vigilance cases, and the PSUR where Article 86 applies.
Design records: risk management results, analyses, calculations and tests (Annex IX 3.2, design part), and the harmonised standards or common specifications the technical documentation relies on.
Manufacturing records: quality control reports, test and calibration data, personnel qualification records (the same list appears in point 4.2 of the sector-act modules).
Suppliers and subcontractors: the MDR allows audits on their premises; Recommendation 2013/473/EU (Annex II) asked bodies to identify critical subcontractors and crucial suppliers with a documented risk-based approach.
Changes, notified or not: changes to the quality system or the approved device that should have gone to the body first.
Production samples: under MDR Annex IX 3.4 and 3.7, a sample that diverges from the technical documentation leads to suspension, withdrawal or restriction of the certificate.

Preparing without a fixed lead time

No act sets a notice period for scheduled audits, and unannounced audits under MDR Annex IX 3.4 come with no notice by definition. The practical consequence is that the evidence listed in Annex IX 3.2 (or point 4.2 of the module) must be retrievable at any time, at the manufacturer and at the subcontractors the contract opens to the body.

Non-conformities: what the texts say

The MDR and IVDR do not define "minor", "major" or "critical" findings, and they set no closure deadline in days. They say:

the body asks the manufacturer, if non-conformities are detected, for corrections, corrective actions and, where applicable, preventive actions (Annex VII section 4.10);
where the requirements are no longer met, the body, taking account of proportionality, suspends or withdraws the certificate or imposes restrictions, unless the manufacturer takes corrective action "within an appropriate deadline set by the notified body", and gives the reasons for its decision (Article 56(4) MDR, Article 51(4) IVDR);
the body enters suspended, reinstated, withdrawn or refused certificates and restrictions in the electronic system, and that information is public (Article 56(5) MDR).

Grading scales, deadlines and verification audits therefore come from the notified body procedures and contract. Ask for them in writing before signing; they are as much a selection criterion as the fee schedule (see notified body selection).

In the sector acts built on Decision 768/2008/EC, the body provides an audit report after each periodic audit and a visit report (and a test report if tests were made) after an unexpected visit. Restriction, suspension and withdrawal of the approval follow from the body obligations in each act; a suspended or withdrawn approval no longer supports the declaration of conformity.

Changing notified body

Article 58 MDR and Article 53 IVDR govern a voluntary change. The agreement is signed by the manufacturer, the incoming body and, "where practicable", the outgoing body. It covers at least:

the date on which the outgoing body certificates become invalid;
the date until which the outgoing body identification number may appear in the information supplied by the manufacturer, including promotional material;
the transfer of documents, including confidentiality aspects and property rights;
the date after which the incoming body takes over the conformity assessment tasks;
the last serial number or lot number for which the outgoing body is responsible.

The outgoing body withdraws its certificates on the date they become invalid. The texts do not say that the incoming body must repeat a full initial assessment or how long a transfer takes; that depends on the incoming body procedures.

Claims the texts contradict

Common claim (including earlier versions of this page)	What the text says
"Modules D, E and H mean an annual audit"	Decision 768/2008/EC says "periodic audits" with no frequency; Article 4(5)(h) leaves the frequency to the sector act. Only the PPE Regulation sets "at least once a year" among the non-medical acts in the table
"Machinery quality assurance means an annual audit"	Directive 2006/42/EC Annex X 3.3 requires a full reassessment every three years; Regulation 2023/1230 Annex IX (from January 20, 2027) sets no frequency
"The RED has a module D with annual production audits"	Article 17 RED offers module A, modules B and C, and module H (Annex IV) only
"MDR: at least one unannounced audit per certificate life"	Annex IX 3.4: at least once every five years, randomly
"Recommendation 2013/473/EU sets the MDR unannounced audit regime"	It predates the MDR, targets the Directives, creates no obligations, and recommended once every third year
"Recommendation 2013/473/EU targets sites where UDI traceability is generated"	Annex III targets the manufacturer, critical subcontractors and crucial suppliers; it does not mention UDI
"Implementing Regulation 920/2013 sets the framework for unannounced audits of manufacturers"	It concerns the designation and supervision of notified bodies by designating authorities under Directives 90/385/EEC and 93/42/EEC; its unannounced on-site assessments target the bodies
"MDR Annex VII section 4.5.6 requires unannounced audits"	Section 4.5.6 covers specific procedures (consultations); surveillance is Annex VII 4.10 and Annex IX 3.3 and 3.4
"Article 56(3) MDR covers EU type-examination certificates"	Article 56(3) lets the body restrict the intended purpose or require specific PMCF studies; validity of all certificates is Article 56(2)
"Article 56(8) MDR requires notification of changes"	Article 56 has six paragraphs; changes are notified under Annex IX 2.4 (quality system) and 4.10 (approved device)
"Surveillance samples every technical file for class III and implantable class IIb (Article 52(6))"	Annex IX 3.5 adds representative samples for class IIa and IIb and a parts and materials test for class III
"MDCG 2020-3 sets which changes must be notified under the MDR"	MDCG 2020-3 concerns significant changes for legacy devices under Article 120(3); it is not the change-notification guidance for MDR certificates
"RED Annex VI part III separates initial evaluation from surveillance"	RED Annex VI is the EU declaration of conformity; module H surveillance is Annex IV point 4
"Minor findings close in 30 to 90 days, majors in 30 to 60"	No act sets these periods; Article 56(4) MDR refers to an appropriate deadline set by the body

Links to other pages

For module choice, the self-declaration vs notified body comparison.
For the MDR overview, the MDR guide, and for Annex IX in context, MDR class IIb and III.
For choosing a body and checking its NANDO scope, notified body selection.
For the general CE procedure, /en/ce/procedure/.
For budget framing, the certification costs guide.
For definitions (notified body, NANDO, PSUR, PMCF, EUDAMED), the glossary.

Frequently asked questions

What does a surveillance audit do, and how does it differ from the initial evaluation?: Surveillance checks that the manufacturer keeps applying the quality system the notified body approved; it does not re-run the conformity assessment. MDR Annex IX section 3.1 states the aim in those words, and the same "Surveillance under the responsibility of the notified body" section appears in modules D, E and H of Decision 768/2008/EC and the sector acts that copy them. Full re-assessment happens at re-certification, which under the MDR and IVDR occurs at least every five years (Annex VII section 4.11 of each Regulation; Article 56(2) MDR, Article 51(2) IVDR).
How often must a notified body audit an MDR or IVDR manufacturer?: Annex IX section 3.3 of both Regulations requires audits and assessments "at least once every 12 months", including on-site audits at the manufacturer and, if appropriate, at suppliers or subcontractors. Section 3.4 adds unannounced audits "at least once every five years", performed randomly, with tests on a sample of produced devices or devices taken from the market. The notified body plans them but must not disclose the plan to the manufacturer.
Do all quality assurance modules require annual audits?: No. Decision 768/2008/EC modules D, E and H only say "periodic audits" plus possible unexpected visits, and Article 4(5)(h) leaves it to each sector act to fix a frequency. The RED, ATEX Directive, Lifts Directive and Machinery Regulation 2023/1230 set none. The PPE Regulation says at least once a year (Annex VIII, point 4.3). The PED and the Machinery Directive 2006/42/EC require a frequency such that a full reassessment is carried out every three years.
Is Recommendation 2013/473/EU the legal basis for MDR unannounced audits?: No. Recommendation 2013/473/EU of September 24, 2013 was written for Directives 90/385/EEC, 93/42/EEC and 98/79/EC and says it creates no new rights or obligations. Its Annex III recommended unannounced audits at least once every third year, lasting at least one day with at least two auditors. The binding MDR and IVDR rule is Annex IX section 3.4: at least once every five years.
Does the MDR define minor, major and critical non-conformities and their closure deadlines?: No. Annex VII section 4.10 requires the notified body to ask for corrections, corrective actions and, where applicable, preventive actions, and where necessary to restrict, suspend or withdraw the certificate. Article 56(4) gives the manufacturer an appropriate deadline set by the notified body. Grading scales and closure periods come from each notified body's own procedures and contract.
Can a manufacturer switch notified body during the certificate's life?: Yes. Article 58 MDR (Article 53 IVDR) requires an agreement between the manufacturer, the incoming body and, where practicable, the outgoing body, covering at least the date the old certificates become invalid, how long the old body number may still appear, the transfer of documents, the date tasks pass to the new body, and the last serial or lot number under the outgoing body. The outgoing body withdraws its certificates on that date.