Post-market Services
Ensure compliance with a full range of expert-led audits for
Management systems such as a Quality Management Systems (QMS) or Information Security Management System (ISMS) continue to be subject to both medical device internal audit and external audits after the initial certification has been granted by a certification body or Regulatory Authority.
Information Security Management Systems per ISO/IEC 27001 and NEN 7510-1 require the organization to execute internal audits on a periodic basis to assess the effectiveness of the management system, and the implemented information security technical and organizational controls.
Quality Management Systems per ISO 13485, ISO 9001, QSR or QMSR, MDSAP and ISO/IEC 42001 similarly require the organization to execute internal audits on a periodic and planned basis to assess the compliance of the QMS, the implemented quality controls, procedures and changes implemented over time.
In addition, organizations may wish to exercise control over suppliers and subcontractors (supplier audits) or execute due diligence audits to understand the level of regulatory compliance to applicable regulations from an external party prior to entering into an acquisition.
At MedQAIR, our team of qualified auditors is ready to support Quality, Regulatory, Information Security and Privacy audits. Together with our expert auditors, we help draft an audit plan, plan for the relevant dates, execute the (hybrid) audits, and provide a detailed report with the relevant findings from the audit.
Explore our blog posts on MDR, IVDR, and EU AI Act medical device compliance to stay ahead of regulatory changes.
ISO/IEC 27001 has been the reference standard for information security management systems since 2005, and its third edition, ISO/IEC 27001:2022, was published on 25 October 2022 (ISO/IEC 27001:2022 and Amendment 1:2024). The transition from
Manufacturers have been able to register in EUDAMED, the European database on medical devices, since December 2020 for the Actor module and since October 2021 for UDI and device data, but only on a voluntary basis. That changed on 28
Using the EUDAMED UDI/Devices module became mandatory on 28 May 2026. This follows the Commission Decision (EU) 2025/2371, which formally declared the first four modules functional. Published in the Official Journal back on 27 November 2025, that decision kicked off
We are pleased to welcome Eva Kurilova-Sahin to the MedQAIR team. Eva brings a background in medicine, clinical science, radiology, and oncology research, together with experience in AI-enabled medical technology. Over the past 10 years, her work has brought her
The regulatory landscape for medical devices is becoming more complex as artificial intelligence becomes part of diagnosis, monitoring, treatment, and clinical decision support. For manufacturers, understanding the EU AI Act medical devices requirements is now essential alongside the existing Medical
Artificial intelligence is evolving faster than the regulatory frameworks around it. But that gap is beginning to close, with a growing body of AI medical device standards now moving towards publication and wider regulatory recognition.
Find answers to common questions about our services, compliance processes, and how we can assist your business.
Internal audits help organisations assess whether their quality, regulatory, information security, and operational processes remain compliant with applicable requirements. They also help identify gaps, verify implementation of procedures, and prepare for external audits and regulatory inspections.
Internal audits are required or expected under various frameworks, including ISO 13485, ISO 9001, ISO/IEC 42001, ISO/IEC 27001, NEN 7510-1, MDSAP, FDA QMSR, and other management system standards. Audit activities help demonstrate ongoing compliance and system effectiveness.
Audit frequency depends on the applicable standard, organisational risks, previous findings, regulatory obligations, and business activities. Most organisations establish a risk-based audit programme that covers all relevant processes within a defined audit cycle. At the minimum the expectation is to execute audits on a yearly basis.
Internal audits are conducted on behalf of the organisation to assess compliance and identify improvement opportunities. External audits are performed by certification bodies, notified bodies, regulators, customers, or other independent parties to evaluate compliance against specific requirements.
Yes. Depending on the audit scope, available documentation, and applicable requirements, audits may be performed on-site, remotely, or through a hybrid approach that combines both methods.
Supplier audits assess whether suppliers and subcontractors maintain appropriate controls, quality processes, and compliance activities. They are often used for critical suppliers whose products or services may impact product quality, safety, cybersecurity, or regulatory compliance.
Regulatory due diligence involves reviewing compliance status, quality systems, technical documentation, regulatory approvals, and operational risks before acquisitions, investments, licensing activities, or strategic partnerships.
Yes. Audit activities may include reviewing technical files, quality system documentation, software lifecycle records, cybersecurity documentation, clinical evidence, and other regulatory documentation relevant to the audit scope.
Yes. Information security audits may assess compliance with ISO/IEC 27001, NEN 7510-1, cybersecurity controls, supplier security management, vulnerability management processes, and related governance activities.
Common findings include incomplete procedures, insufficient records, gaps in supplier oversight, inadequate training evidence, weak change management controls, inconsistencies in technical documentation, and deficiencies in cybersecurity or risk management processes.
Preparation typically includes reviewing procedures, ensuring documentation is current, closing known gaps, verifying training records, assessing supplier controls, and conducting internal audits or mock audits to identify potential findings before the external assessment.
Yes. MedQAIR provides qualified auditors and specialists to support internal audits, supplier audits, information security audits, due diligence assessments, audit readiness activities, and remediation programmes across medical device, software, and AI-enabled healthcare technologies.