Retention periods

Medical device manufacturers are obliged to observe and comply with legal retention periods for documents and records.

This article provides an overview of the regulatory requirements for the retention periods for the various document classes.

1. Retention periods for different classes of documents

The legal requirements regarding retention periods usually distinguish between the following types of documents:

1. Technical documentation (e.g., product specifications, clinical evaluation, risk management files, usability files)
2. Declarations of conformity, certificates from notified bodies
3. Documentation of the quality management system, in particular, specification documents (e.g., process and standard operating procedures) and records

2. Retention periods: Regulatory requirements

a) Medical Device Directive MDD

The MDD writes in Annex VII to the declaration of conformity in the second section:

“The manufacturer must prepare the technical documentation described in Section 3. The manufacturer or his authorised representative must make this documentation, including the declaration of conformity, available to the national authorities for inspection purposes for a period ending at least five years after the last product has been manufactured. In the case of implantable devices the period shall be at least 15 years after the last product has been manufactured.“

Annexes III (type examination) and VIII (“Devices for special purposes”) contain almost identical requirements.

b) Medical Device Regulation MDR

Technical documentation and declaration of conformity

The central Article 10 in the MDR (“General obligations of manufacturers”) doubles the retention period for non-implantable devices compared to the MDD:

“(8) Manufacturers shall keep the technical documentation, the EU declaration of conformity and, if applicable, a copy of any relevant certificate, including any amendments and supplements, issued in accordance with Article 56, available for the competent authorities for a period of at least 10 years after the last device covered by the EU declaration of conformity has been placed on the market. In the case of implantable devices, the period shall be at least 15 years after the last device has been placed on the market.”

Importers must also comply with this retention period for declarations of conformity and certificates.

The longest period is decisive if different periods apply to the devices belonging to a system or procedure pack (Article 22).

QM documentation

The requirements for the quality management system and its documentation are described in Annex IX, where Chapter III with the administrative provisions deals with the retention period:

“The manufacturer or, where the manufacturer does not have a registered place of business in a Member State, its authorised representative shall, for a period ending no sooner than 10 years, and in the case of implantable devices no sooner than 15 years, after the last device has been placed on the market, keep at the disposal of the competent authorities:

• the EU declaration of conformity,
• the documentation referred to in the fifth indent of Section 2.1 and in particular the data and records arising from the procedures referred to in point (c) of the second paragraph of Section 2.2,
• information on the changes referred to in Section 2.4,
• the documentation referred to in Section 4.2, and
• the decisions and reports from the notified body as referred to in this Annex”.

The documents referenced in the second point mean “the documentation on the manufacturer’s quality management system,” including all records and process descriptions of

• verification, validation
• conformity assessment
• determination and verification of the general safety and performance requirements including proof of corresponding “Common Specifications”
• risk management
• clinical evaluation, post-market clinical follow-up
• product identification (UDI)
• specifications at various manufacturing stages
• “management of design or quality management system changes”

For devices placed on the market in accordance with Annex X (type examination), manufacturers or authorized representatives must at least comply with the retention period for

• technical documentation in accordance with Annexes I and II
• type examination certificates, expert opinions
• applications for amendments

Comparable requirements apply to the conformity assessment procedures according to Annex XI (product verification).

c) ISO 13485:2016

ISO 13485:2016 is not as specific as the MDD or MDR. The organization must determine the retention period. This period must be selected so that the documents are “available for at least the lifetime of the medical device as defined by the organization.” When choosing the retention period, manufacturers must ensure that

• it is not less than “the retention period of any resulting record“, which in turn must not be shorter than “2 years from the medical device release by the organization.”
• it is not shorter than the regulatory requirements.

This means that the MDR’s requirements for the retention period are generally higher than those of ISO 13485:2016.

d) EK MED 3.9 A1

The ZLG also felt compelled to discuss the requirements for retention periods. EK-MED 3.9 A1 (German), refers to the MDD, to an EU guideline from 1994, and to the completely outdated and long-withdrawn DIN EN 46001, which in turn contains the requirement that has since been adopted by ISO 13485:

“This period shall ensure that documents to which medical devices have been manufactured and tested are available for at least the lifetime of the medical device as defined by the organization.”

The authority does not provide a reliable answer to questions about retention periods.

e) FDA

The FDA specifies the requirements for the retention period in 21 CFR part 820.180. There, the authority writes:

„(b) Record retention period. All records required by this part shall be retained for a period of time equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release for commercial distribution by the manufacturer.“

Summary

Regulatory requirement	Technical documentation	QM documents	Declaration of conformity, certificates
MDD	5 years from the date of manufacture of the last device (implants: 15 years)		5 years from the date of manufacture of the last device (implants: 15 years)
MDR	10 years from the date of placement on the market of the last device (implants: 15 years)	10 years from the date of placement on the market of the last device (implants: 15 years)	10 years from the date of manufacture of the last device (implants: 15 years)
ISO 13485:2016	According to regulatory requirements, but at least lifetime of the medical device, but not shorter than 2 years after (initial) release	According to regulatory requirements, but at least lifetime of the medical device, but not shorter than 2 years after (initial) release
FDA 21 CFR part 820-170	At least lifetime of the device, but not less than 2 years after initial placement on the market	At least lifetime of the device, but not less than 2 years after initial placement on the market

3. Challenges in complying with retention periods

a) Determination of the retention period

The MDR’s requirements are pretty clear. However, for very durable devices, manufacturers should ensure that their lifetime does not exceed the retention period.

This would be the case for devices with a specified lifetime of more than 10 years or more than 15 years for implants. In these cases, ISO 13485 would require longer retention periods.

b) Readability

These long retention periods mean quite a lot of work for manufacturers. A device that has been produced for over 10 years and has an intended lifespan of 10 years forces manufacturers to keep the documents for at least 20 years.

Paper requires a lot of storage space and must always be kept legible. Suitable climate control in the storage rooms is an essential requirement.

With digital records, the challenge is to make the formats readable over such long periods of time. Can you still open a Lotus 1-2-3 file today? PDF-A can only be part of the solution.

If the documents are encrypted because they contain personal data, for example, encryption must be updated regularly.

c) Manufacturer goes bankrupt

Manufacturers cannot escape the obligation to comply with the retention period by going bankrupt. The MDR requires EU member states to oblige manufacturers to hand over the documentation to the authorities in such cases. The authorities must then comply with the retention periods.

d) Operator

If the manufacturer becomes the operator, completely different regulatory requirements, such as the X-ray Ordinance, the professional code of conduct for doctors, and many more, will also apply. For example, companies that produce medical apps and operate a server for this purpose should consider this.

4. Summary and conclusion

As much as the MDR may be condemned, it at least sets precise requirements for the retention periods:

As a rule, all documents created during the manufacturing, production, and monitoring of a medical device must be kept for at least 10 years after the last placing on the market of the device.

This gives us clarity. The inaccuracy of German authorities (see EC MED 3.9 A1) has at least been put to an end when it comes to the retention period for documents and records. That is a positive development.