Article 10 is the manufacturer's own duty list

Three posts on this blog have already walked through an economic operator's duty list under MDR: the importer's under Article 13, the distributor's under Article 14, and the authorised representative's under Article 11. Each of those articles keeps pointing back at one obligation it assumes is already in place: what the manufacturer itself owes under Article 10. That article runs sixteen paragraphs, and a compliance file that's built out the downstream duties in detail while treating Article 10 as background — the thing everyone else's obligations are relative to, rather than a duty list of its own — has the structure backwards.

One conformity duty everything else sits on

Article 10(1) states the baseline plainly: when placing a device on the market or putting it into service, a manufacturer has to ensure it's been designed and manufactured in accordance with the Regulation's requirements — in practice, the general safety and performance requirements set out in Annex I. A GSPR checklist is the record built to prove that duty was actually discharged, evidence by evidence, rather than assumed from a CE mark on the box. Everything else Article 10 requires is a mechanism for keeping that one conformity claim true over the device's whole life, not a separate set of obligations running alongside it.

Risk management and clinical evaluation are named, not implied

Article 10(2) requires manufacturers to establish, document, implement, maintain, and continually improve a risk management system as described in Annex I, Section 3 — the mechanism a risk management file exists to carry. Article 10(3) requires a clinical evaluation conducted in accordance with Article 61 and Annex XIV, including a post-market clinical follow-up plan or a documented justification for skipping one — the same PMCF-or-justification structure this blog has already traced through Annex XIV Part A. Neither obligation is folded into the general conformity duty by implication; both get their own paragraph, which is what lets a notified body cite a gap in either one specifically rather than arguing about conformity in the abstract.

Technical documentation, and a clock that runs past the sale

Article 10(4) requires manufacturers of devices other than custom-made ones to draw up and keep current technical documentation built to Annexes II and III — the same file structure this blog has already traced as answering to both a notified body and, indirectly, FDA's own design-control expectations. Article 10(8) then sets how long that file, the EU declaration of conformity, and any relevant certificate have to stay available to competent authorities: at least ten years after the last device covered by that declaration is placed on the market, or at least fifteen for an implantable device. That's the same fleet-wide retention clock this blog has already distinguished from ISO 13485's own per-device retention default — and it's Article 10 where that clock actually originates, not a rule invented separately for implant traceability.

A quality management system, spelled out by name

Article 10(9) requires a quality management system proportionate to the device's risk class and type, covering the manufacturer's full organization rather than one department's procedures — a regulatory-compliance strategy, resource and risk management, product realization, post-market surveillance, and the handling of corrective and preventive action all named as elements the system has to address. A quality manual that treats ISO 13485 certification as satisfying this paragraph by default has the right instinct but the wrong citation: certification is evidence toward Article 10(9), not a substitute for reading what the paragraph itself requires the system to cover.

The duty a compliance tracker is most likely to skip

Article 10(16) closes the article with an obligation that rarely makes it onto a document-control checklist at all: manufacturers have to maintain, in a manner proportionate to the device's risk class, type, and the size of the enterprise, sufficient financial coverage for their potential liability under Directive 85/374/EEC — the EU's product liability regime. The Regulation doesn't mandate insurance specifically; a manufacturer can satisfy it through insurance, a dedicated reserve of assets, or another equivalent arrangement, so long as the coverage is actually proportionate to what a defective device from that risk class could plausibly cost. A compliance file with a complete answer to every technical-documentation question and nothing on file for Article 10(16) has covered the questions an auditor asks about the device and skipped the one about what happens if the device turns out to be wrong.

Where this meets the rest of the file

Article 10 also closes the loop the importer, distributor, and PRRC posts already assume is closed upstream: it's where the accompanying-information duty in the required language, the UDI and registration obligations under Articles 27, 29, and 31, and the duty to act immediately on a device already found non-conforming all sit in the manufacturer's own name, before any of those obligations pass to an authorised representative, importer, or distributor further down the chain. A manufacturer's-duties worksheet built around Article 10's own sixteen paragraphs — not just the ones the downstream economic-operator articles happen to cite back to — is previewed in the launch catalog. If your program tracks these duties differently, the shelf takes that correction directly.