We are manufacturing a final device with our customer's name on them. They hold the FDA 401K and the technical design files. I do have a risk procedure with a plan and analysis for each product family, (we make surgical instruments.)
In all the previous audits, (I am new here and the QMS is kinda a mess . . ) there were exclusions to Design and Development, but no mention of DMRs by the auditors. No mention of the risk files either . . .but I knew we needed those. Could be because the QMS was sooooo terrible, the auditors just kept it to the stuff we need, and we do not do design.
I wasn't sure about Vigilance because at my previous employer, we were going for MDR, but here we are not. But still wasn't sure if that was just a MDR-EU thing.