GSPR: The General Safety and Performance Requirements of Annex I and How to Build the Checklist

Both acts are regulations, directly applicable in every member state: Regulation (EU) 2017/745 on medical devices and Regulation (EU) 2017/746 on in vitro diagnostic medical devices, set out side by side under EU MDR and IVDR.

Both regulations have been in force since 25 May 2017. Annex I has applied since 26 May 2021 under the MDR (Article 123(2), as amended by Regulation (EU) 2020/561) and since 26 May 2022 under the IVDR (Article 113(2)).

Below follow the reach of the requirements, the three chapters of MDR Annex I with the Section 10.4 change of 1 January 2026, the IVDR differences, the demonstration of conformity, the GSPR checklist and the pending changes.

What Are the General Safety and Performance Requirements?

General safety and performance requirements (GSPR) are the requirements set out in Annex I of Regulation (EU) 2017/745 and Regulation (EU) 2017/746 on the safety and performance of a device, its design and manufacture, and the information supplied with it, and the technical documentation of each device demonstrates conformity with them (Annex II Section 4). That demonstration, and the other sections of Annexes II and III, are set out under MDR and IVDR technical documentation.

Annex I is the first annex of both regulations and carries the heading "General safety and performance requirements". Two Article 2 definitions run through it. Risk is "the combination of the probability of occurrence of harm and the severity of that harm" (MDR Article 2(23), IVDR Article 2(16)). Benefit-risk determination is the analysis of all assessments of benefit and risk of possible relevance for the use of the device for its intended purpose (MDR Article 2(24), IVDR Article 2(17)).

How the GSPR Replaced the Essential Requirements of the Directives

The GSPR replaced the essential requirements of the repealed directives: Directive 93/42/EEC (MDD) and Directive 90/385/EEC (AIMDD) were repealed with effect from 26 May 2021 (MDR Article 122), and Directive 98/79/EC (IVDD) from 26 May 2022, with the exceptions of IVDR Article 112.

The essential requirements still matter for legacy devices. A legacy device placed on the market under the MDR transition continues to comply with the MDD or the AIMDD (MDR Article 120(3c)(a)), and the IVDD still applies to the extent necessary for legacy IVDs (IVDR Article 110). The differences between the two sets of requirements are compared under MDD vs MDR.

Where the GSPR Apply Beyond CE-Marked Devices

Four regimes outside the standard CE-marking route also refer to Annex I, and each is listed below with its legal basis.

• In-house devices: the health institution's public declaration states that the GSPR are met, with a reasoned justification for any requirement not fully met (MDR Article 5(5)(e), IVDR Article 5(5)(f)); MDCG 2023-1 (January 2023) gives a template whose Annex A has a "GSPR fully met" column, and for in-house devices under Article 5(5) of the IVDR the GSPR condition has applied since 26 May 2022.
• Custom-made devices: the statement under MDR Annex XIII Section 1 declares conformity with the GSPR and names any requirement not met, with the grounds, as explained under custom-made devices under the MDR.
• Drug-device products: where medicines law governs the product, the device part still meets MDR Annex I (MDR Article 1(8) and Article 1(9), second subparagraph of each), as covered under drug-device combinations.
• Products without a medical purpose: Implementing Regulation (EU) 2022/2346, applying from 22 June 2023, sets common specifications for the second sentence of Section 1 and Sections 2 to 5, 8 and 9 of MDR Annex I (its Article 1(2)) for the products of Annex XVI MDR.

How MDR Annex I Is Structured: Three Chapters and 23 Sections

MDR Annex I has 23 sections in three chapters: Chapter I sets the general requirements (Sections 1 to 9), Chapter II the requirements regarding design and manufacture (Sections 10 to 22) and Chapter III the requirements for the label and instructions for use (Section 23). The chapter order runs from general risk principles to product-specific design and then to the information supplied, as the annex reads in the consolidated MDR on EUR-Lex.

Chapter I: General Requirements on Safety, Performance and Risk (Sections 1 to 9)

MDR Annex I Section 2 requires risks to be reduced as far as possible without adversely affecting the benefit-risk ratio. Section 3 turns that duty into six risk-management steps, from (a) a risk-management plan for each device, through the identification of hazards and the estimation of risks including reasonably foreseeable misuse, to (f) amending the control measures.

Section 4 sets the order in which risks are controlled, and the three priorities below follow its points.

1. Eliminate or reduce risks through safe design and manufacture (point (a)).
2. Take protection measures, including alarms (point (b)).
3. Provide information for safety and training to users (point (c)), and inform users of any residual risks.

Section 5 addresses use error. It requires the risks linked to ergonomic features and the use environment to be reduced as far as possible, and the design to take account of the technical knowledge, experience, education and training of the intended users, whether lay, professional, disabled or other users.

Chapter II: Requirements Regarding Design and Manufacture (Sections 10 to 22)

Chapter II turns the general principles into product-specific requirements, from chemical, physical and biological properties in Section 10 to devices for lay persons in Section 22. MDR Annex I Section 10.1(a) and (b) require particular attention to the choice of materials, with regard to toxicity and flammability, and to the compatibility between materials and biological tissues, cells and body fluids. Section 18 covers active devices: single fault condition, power supply and power-failure alarms, alarms for monitoring devices, electromagnetic interference and immunity, accidental electric shock and protection against unauthorised access. Section 22.1 requires devices for lay persons to perform appropriately given the skills and means available to lay persons.

Software sits in Section 17. MDR Annex I Section 17.2 requires software to be developed and manufactured according to the state of the art, taking into account the development life cycle, risk management including information security, verification and validation. Section 17.4 requires manufacturers to set out minimum requirements concerning hardware, IT network characteristics and IT security measures, including protection against unauthorised access. IVDR Annex I Sections 16.2 and 16.4 carry the same requirements, explained in detail under medical device cybersecurity under the MDR and IVDR.

Section 10.4: CMR and Endocrine-Disrupting Substances after Regulation (EU) 2025/2457

MDR Annex I Section 10.4.1 sets a concentration threshold of 0.1 % weight by weight for substances that are carcinogenic, mutagenic or toxic to reproduction of category 1A or 1B and for endocrine-disrupting substances. Regulation (EU) 2025/2457, signed on 26 November 2025 and published in OJ L, 2025/2457 of 12 December 2025, replaced Sections 10.4.1(b), 10.4.2(d), 10.4.3 and 10.4.4 with effect from 1 January 2026 (text on EUR-Lex as Regulation (EU) 2025/2457). Since that date, Section 10.4.1(b) also covers substances classified as endocrine disruptors for human health of Category 1 under Part 3 of Annex VI to the CLP Regulation, alongside the substances identified under REACH Article 59 and under the Biocides Regulation.

The guidelines under Section 10.4.3 changed hands as well. The European Chemicals Agency (ECHA), no longer the scientific committee SCHEER, now prepares the guidelines on the benefit-risk assessment of phthalates and updates them at least every 5 years. The SCHEER phthalates guidelines remain listed on the Commission's guidance page under "Other guidance documents".

Chapter III: The Label and Instructions for Use (Section 23)

MDR Annex I Section 23 governs the information supplied with the device in four parts: general requirements (23.1), the label (23.2), the sterile packaging (23.3) and the instructions for use (23.4). Under Section 23.1(h), any symbol or identification colour used must conform to harmonised standards or common specifications; where none exist, the symbols and colours are described in the documentation supplied with the device. IVDR Annex I places the same information requirements in Section 20, with the symbols rule in Section 20.1(h). The particulars of the label and the instructions for use, and the language rules, are covered under medical device labelling under the MDR and IVDR.

How IVDR Annex I Differs: 20 Sections and the Performance Characteristics of Section 9

IVDR Annex I has 20 sections in the same three chapters, and its distinctive part is Section 9 on performance characteristics: Chapter I runs from Section 1 to 8, Chapter II from Section 9 to 19 and Chapter III is Section 20. The section numbers therefore differ between the two annexes, as the consolidated IVDR on EUR-Lex shows: software, for example, is Section 17 in the MDR and Section 16 in the IVDR.

IVDR Annex I Section 9.1(b) lists the clinical performance characteristics: diagnostic sensitivity, diagnostic specificity, positive predictive value, negative predictive value, likelihood ratio, and expected values in normal and affected populations. The analytical performance characteristics sit in Section 9.1(a). For certain class D devices, Implementing Regulation (EU) 2022/1107, applying from 25 July 2024, sets common specifications for IVDR Annex I Sections 9.1(a), 9.1(b), 9.3 and 9.4(a). The table compares the two annexes point by point.

Sections 9.4(a), 19 and 20 carry the extra requirements for devices used for self-testing and near-patient testing: performance obtained by lay persons, protection against the risks of that use and further particulars in the information supplied. Software for IVDs is governed by Section 16. The evidence for the Section 9 characteristics comes from the IVDR performance evaluation.

How Conformity with Each GSPR Is Demonstrated

Annex II Section 4 of both regulations requires the technical documentation to contain the information that demonstrates conformity with the GSPR: the requirements that apply and why the others do not, the methods used, the harmonised standards, common specifications or other solutions applied, and the precise identity of the controlled documents that offer the evidence, with a cross-reference.

The evidence itself sits in the controlled documents, such as the verification and validation reports, the risk-management file or the clinical evaluation report. The GSPR checklist only points to that evidence, so every applicable row needs a document reference.

Two presumption routes support the demonstration. A device that conforms to a harmonised standard whose reference is published in the Official Journal is presumed to conform to the requirements covered by that standard (MDR and IVDR Article 8(1)), and only to the requirements listed in the standard's Annex ZA (MDR) or ZB (IVDR), as MDCG 2021-5 rev.1 (July 2024) explains in section 2.3. A device that conforms to common specifications is presumed to conform to the requirements they cover (MDR and IVDR Article 9(2)), and manufacturers comply with them unless they duly justify solutions of at least equivalent safety and performance (MDR and IVDR Article 9(3)). The lists of references are explained under harmonised standards under the MDR and IVDR.

The table below links five standards to the MDR Annex I sections they address; the harmonisation status of each is given on its own page.

How to Build the GSPR Checklist

Build the GSPR checklist as one table row per Annex I requirement of the applicable regulation, with the four pieces of information that MDR and IVDR Annex II Section 4 ask for in every row.

The six steps below build the checklist and keep it linked to the evidence.

1. List every section and point of MDR Annex I (23 sections) or IVDR Annex I (20 sections) as a separate row.
2. Decide for each row whether the requirement applies, and record why where it does not (MDR and IVDR Annex II Section 4).
3. Record the method used to demonstrate conformity with the requirement.
4. Name the harmonised standard as cited in the Official Journal, the common specification or the other solution applied (MDR and IVDR Articles 8 and 9).
5. Cross-reference the precise identity of the controlled document that holds the evidence.
6. Feed production and post-market information back into the rows (MDR Annex I Section 3(e) and (f)), and check the obligations outside Annex I against the EU MDR compliance checklist.

The Four Columns of a GSPR Checklist Row

Each checklist row carries four columns, one per element of Annex II Section 4: applicability, method, solution applied and evidence reference. The table gives the content and legal basis of each column.

Two MDCG documents contain official checklists of this type, both listed on the Commission's MDCG guidance page. MDCG 2021-8 (May 2021) contains the "Checklist of general safety and performance requirements, Standards, common specifications and scientific advice" for investigational devices. MDCG 2022-19 (December 2022) includes a GSPR, standards and common-specifications checklist among its templates for IVDR performance studies. Neither is legally binding (MDR Articles 103 and 105, IVDR Articles 98 and 99), but notified bodies take MDCG guidance into consideration (MDR Annex VII Section 1.6.2).

How the MDCG 2021-8 checklist is used for investigational devices is covered under clinical investigations under the MDR.

Justifying a Requirement as Not Applicable

A requirement marked not applicable needs a written reason in the technical documentation, because Annex II Section 4 asks for the requirements that apply and the explanation why the others do not.

The reason refers to the characteristics of the device. A device that is not an active device states that in the Section 18 rows; a device without software states it in the rows for Sections 17.2 to 17.4. In the Section 10.4 rows, the reason refers to the substances the device actually contains.

When the Checklist Has to Be Updated

The checklist is updated whenever the device, its evidence or the solutions cited change, because MDR Article 10(4) requires manufacturers to keep the technical documentation up to date. MDR Annex I Section 3(e) and (f) add a standing trigger: production and post-market information is evaluated, and the control measures are amended.

Changes to the law trigger updates too. The Section 10.4 rows changed on 1 January 2026 with Regulation (EU) 2025/2457. A new or withdrawn harmonised-standard reference changes the Solution applied column; the references are listed in Implementing Decisions (EU) 2021/1182 (MDR) and (EU) 2021/1195 (IVDR), whose latest amendments as of 6 November 2026 are Implementing Decisions (EU) 2026/1231 and (EU) 2026/1313.

Are Changes to Annex I Pending?

Changes to Annex I are proposed, not law: the Commission's proposal for a targeted revision, COM(2025) 1023 of 16 December 2025 (procedure 2025/0404(COD)), would add "cybersecurity" to the minimum requirements of MDR Annex I Section 17.4 and IVDR Annex I Section 16.4, and as of 6 November 2026 the European Parliament lists it at the stage "Awaiting committee decision" in its health committee (SANT). The stage and the past procedural events are recorded in the legislative observatory file.

The proposal would also let labels be provided in digital form, to the extent and under the conditions set in implementing rules (MDR Annex I Section 23.1(c)), and would delete Section 23.2(o), the indication for reprocessed single-use devices. The past procedural events include the committee's draft report of 30 June 2026. Until an amending regulation is adopted and published, the current Annex I applies; the proposal and every adopted act are tracked under MDR and IVDR amendments.

GSPR Questions

Five questions come up about Annex I.

What does GSPR stand for?

GSPR stands for general safety and performance requirements, the title of Annex I of both the MDR and the IVDR. The directives used the term essential requirements instead.

How many general safety and performance requirements are there?

MDR Annex I has 23 sections (nine in Chapter I, 13 in Chapter II, one in Chapter III) and IVDR Annex I has 20 sections (eight, 11 and one). Sections such as Section 3 (points (a) to (f)) and Section 23 (Sections 23.1 to 23.4) are divided further, so a checklist has more rows than sections.

Is there an official GSPR checklist template?

No: no official MDR or IVDR compliance checklist exists; the official checklist-type documents are the GSPR checklist in MDCG 2021-8 for investigational devices and the GSPR, standards and common-specifications checklist among the MDCG 2022-19 templates for IVDR performance studies.

Is using a standard mandatory to meet the GSPR?

No: using standards is voluntary (MDCG 2021-5 rev.1, section 2.2), with one exception, symbols and identification colours, which must conform to harmonised standards or common specifications (MDR Annex I Section 23.1(h), IVDR Annex I Section 20.1(h)).

When did the GSPR start to apply?

On 26 May 2021 under the MDR and on 26 May 2022 under the IVDR, the dates of application of the two regulations. The requirements of the repealed IVD directive are compared under IVDD vs IVDR.