Document Retention Period for Critical Supplier Technical Agreements to ensure alignment with EU MDR Annex IX Chapter III

[Becky2025]

Our company is working to update our technical agreements with critical suppliers in response to feedback from a regulator. Specifically, the regulator has requested that we include a clause requiring suppliers to retain device-related records for 15 years, as mandated by EU MDR Annex IX, Chapter III.

Our device is implantable, and the regulation states that these records must be kept for 15 years after the sale of the last device. We are currently facing challenges in implementing practical controls that align with this requirement.

Currently, our supplier agreements include a provision allowing us to retrieve documents from the supplier once their retention period of 5 years has passed. We then retain those documents in line with our internal retention policies. However, the auditor did not agree that this approach is sufficient to meet the MDR's specific requirements, particularly because the records retrieved would not cover all essential information such as training records and calibration logs.

My main concern with the new approach is that the supplier may not have visibility into when the last device is sold. Without this information, maintaining compliance with the MDR’s 15-year retention requirement seems practically impossible.

I would appreciate any insights or experiences from other companies on how they have successfully addressed this requirement. How are other organizations ensuring compliance with the 15-year retention rule with respect to suppliers, especially considering the complexities surrounding tracking the sale of the last device?

 

[yodon]

I was hoping someone would jump on this. I don't have any direct experience. I guess the auditor isn't wrong, but that is quite a can of worms being opened (and I question the usefulness of a lot of that). To retain training records of the supplier, for example, seems rather excessive and useless. I agree that the supplier wouldn't have a clue about the sale of the last device so putting the entirety of the retention period on them is not feasible.

I do think it's pretty common practice to retrieve the records after some (shorter than 15 years) period so I think the approach may be sound. I suppose they're just complaining about the depth. I wonder if the auditor would accept a more detailed list of records to retrieve? For a test lab that might not be too bad. For a CM that might get pretty extensive (and especially if the supplier outsources any work!).

 

[ChrisM]

.. then there is the issue of what happens if your supplier ceases trading. how do you, and possibly many others of their customers get hold of the records, or ensure that the Liquidator or whoever keeps them for the full retention period whilst still allowing you access when required?

 

[Ronen E]

Our company is working to update our technical agreements with critical suppliers in response to feedback from a regulator. Specifically, the regulator has requested that we include a clause requiring suppliers to retain device-related records for 15 years, as mandated by EU MDR Annex IX, Chapter III.

Our device is implantable, and the regulation states that these records must be kept for 15 years after the sale of the last device. We are currently facing challenges in implementing practical controls that align with this requirement.

Currently, our supplier agreements include a provision allowing us to retrieve documents from the supplier once their retention period of 5 years has passed. We then retain those documents in line with our internal retention policies. However, the auditor did not agree that this approach is sufficient to meet the MDR's specific requirements, particularly because the records retrieved would not cover all essential information such as training records and calibration logs.

My main concern with the new approach is that the supplier may not have visibility into when the last device is sold. Without this information, maintaining compliance with the MDR’s 15-year retention requirement seems practically impossible.

I would appreciate any insights or experiences from other companies on how they have successfully addressed this requirement. How are other organizations ensuring compliance with the 15-year retention rule with respect to suppliers, especially considering the complexities surrounding tracking the sale of the last device?

Hello.

My heart goes out to you; the reason is, NB reviewers have practically infinite power over the auditee in such situations. No matter how well/logically you argue, there seems to be a "Yes, but I feel like it" clause somewhere, that they seem to invoke from time to time. You can appeal and so on, but good luck with that when your commercial clock is ticking.

Having said that, here's my opinion/advice. You have to be careful and accurate here. This is not a 5-minute exercise. You have to keep your head cool and not let superficial interpretations take hold without due substantiation. "Show me the shall" is very important here.

We are talking about Chapter III s. 7, right? This is what that section requires the manufacturer to keep:

— the EU declaration of conformity,
— the documentation referred to in the fifth indent of Section 2.1 and in particular the data and records arising from the procedures referred to in point (c) of the second paragraph of Section 2.2,
— information on the changes referred to in Section 2.4,
— the documentation referred to in Section 4.2, and
— the decisions and reports from the notified body as referred to in this Annex.

No more and no less.

Now, this is quite convoluted, and this makes it very easy to slip. A NB reviewer might very easily and comfortably let it slide all the way down, to the "point of lowest energy", i.e. a place where there is absolutely no doubt... The problem for you is that this might drive very unreasonable requirements. The way to deal with this is to conduct, and document in detail, a careful analysis of what's actually required. Break down all the references, and references within references, and vague wordings in all paragraphs downstream from the above. Wherever anything is not plain and simple, don't shy away from spelling out definitions and assumptions (which allows them to be discussed in an adult manner), and if need be, even footnote discussions to explain how you got to your understandings / interpretations. If you do that, and hold your ground firm, I strongly doubt the result will be you needing ANY training records from your supplier, or any other such superfluous takes on the actual MDR text. It just doesn't flow from the above.

Once you complete the above, you will have a list of documentation that can reasonably be obtained, either once per design version (when that design is first released for production), or at most, as part of each batch record (you will then need to negotiate the inclusion of that in the batch records delivered to you with every batch). Obtain those records, and start the 15-years clock. That's it. There is no need or expectation in the MDR (that I'm aware of) to have your supplier maintain documentation (whatsoever) for 15 years, or otherwise for you to have ongoing access to such documentation, over 15 years. The intention is to obtain the relevant information (and that's it; what it means is only as in s. 7 above) on the outset, then keep it for 15 years. Anything above and beyond that is not a reasonable expectation, and honestly, I doubt that that NB reviewer could come up with a solid rationale for requiring so (but then, they don't really have to, do they?).

Please reach out if you need assistance in compiling the above.