Is translation considered a critical activity under the MDR?

Imagine that the instructions for use state that a medical device must not be reused. A negation is inadvertently omitted during translation, resulting in an instruction that permits the user to reuse the device. The device itself has not changed, but the information the user needs to use it safely has.

This example raises an important question for medical device manufacturers: is translation considered a critical activity under the MDR?

The answer is not entirely straightforward. Regulation (EU) 2017/745 on medical devices (MDR) does not explicitly classify all translation activities as critical. However, the information supplied with the device (labelling and instructions for use) forms part of the general safety and performance requirements set out in Annex I, and Article 10(11) requires this information to be provided in the languages determined by each Member State. Translation of this information is therefore critical from a compliance perspective, although its impact on safety depends on the content in question.

The question, therefore, is not simply whether translation is considered critical, but what consequences an error could have and what controls should be put in place to prevent or detect it.

When can translation be considered critical?

Before answering, it is worth clarifying what ‘critical’ means in this context. Neither the MDR nor ISO 13485 provides a general definition of a ‘critical activity’ or ‘critical process’. The concept stems mainly from the practices of notified bodies and guidance documents on supplier control.

The MDR provides for notified bodies to audit certain suppliers and subcontractors of the manufacturer, including unannounced audits (Annex IX, Section 3.4). Commission Recommendation 2013/473/EU clarifies these concepts: it refers to those responsible for processes essential to ensuring compliance with legal requirements as ‘critical subcontractors’, and to those supplying crucial components or the complete device as ‘crucial suppliers’.

Along the same lines, document NBOG BPG 2010-1, published in 2010 by the Notified Body Operations Group (NBOG), considers a supplier of materials, components or services to be critical if its failure to meet the specified requirements could pose an unacceptable risk to the patient, user or other persons, or significantly impair performance. This document explicitly includes services required to meet regulatory or quality management system requirements.

ISO 13485, meanwhile, does not use the formal category of ‘critical process’, but instead adopts a risk-based approach. It requires this approach to be applied to the control of quality management system processes (Clause 4.1.2), to ensure that controls for outsourced processes and suppliers are proportionate to the associated risk (Clauses 4.1.5 and 7.4.1), and to validate processes whose outputs cannot be verified subsequently (Clause 7.5.6).

In practice, therefore, an activity or process is considered critical when a failure could significantly affect the safety, performance or regulatory compliance of the device.

In this context, translation can be considered a critical process or activity from a regulatory compliance perspective. With very few exceptions, a medical device will not be compliant if it is placed on the market in a country without the accompanying documentation being translated into the relevant language.

From a safety perspective, the criticality of a translation depends primarily on the foreseeable consequences of an error. Not all translations relating to medical devices necessarily carry the same level of risk.

For example, a stylistic error in a corporate news article may affect the manufacturer’s image without directly compromising patient safety. By contrast, an error in a contraindication, a concentration or a sterilisation instruction can have far more serious consequences.

Translation can be considered a critical activity when an error in the translated content could significantly compromise the device’s safety, performance, intended purpose or regulatory compliance.

In these cases, the linguistic error does not necessarily cause harm directly, but it can contribute to a sequence of events that ultimately results in harm.

It is also worth remembering that the device’s risk class does not, in itself, determine the criticality of the translation. For example, a reusable surgical instrument, such as detachable laparoscopic forceps, is a class I device. If the translation of its reprocessing instructions omits the requirement to disassemble the instrument before cleaning, organic residues may remain inside it, potentially compromising sterilisation and exposing the next patient to a risk of infection. In fact, the MDR requires the involvement of a notified body in aspects relating to the reuse of these instruments, including the corresponding instructions for use (Article 52(7)(c)).

The assessment should focus on the specific content, its function and the consequences of a potential failure.

The importance of ISO 14971 in translation risk assessment

ISO 14971:2019, the standard for medical device risk management, provides a useful framework for analysing the potential consequences of a translation error.

According to this standard, risk is determined by the probability of occurrence of harm and the severity of that harm. Therefore, it is not enough to assess the likelihood of a translator making an error. It is also necessary to analyse whether that error could reach the user, the circumstances in which it could cause harm and the potential severity of that harm.

Consider the above example of reusing a single-use device. The sequence of events could begin with a negation being omitted during translation, continue with the publication of incorrect instructions, and culminate in reuse that exposes the patient to contamination.

This distinction is fundamental: the probability of a translation error occurring is not the same as the probability of that error causing harm.

Furthermore, ISO 14971 distinguishes between implementing risk control measures and verifying their effectiveness. In certain cases, checking the linguistic accuracy of a warning may not be sufficient to demonstrate that the intended users understand it correctly.

Therefore, where justified by the risk analysis, bilingual revision can be supplemented with comprehension or usability assessments. These activities pursue related objectives, but are not equivalent.

What requirements does ISO 13485 set for the control of an outsourced translation process?

ISO 13485:2016 sets out quality management system requirements for medical devices. Although it does not prescribe a universal translation procedure, it does provide a framework for controlling activities that may affect medical device quality.

This is particularly important when a manufacturer outsources translation to an external company.

Clause 4.1.5 of ISO 13485 sets out requirements for controlling outsourced processes that affect conformity with requirements. These controls must take into account the associated risk and the supplier’s capability. Written quality agreements are also provided for.

This means that outsourcing an activity does not relieve the manufacturer of its responsibility. It must maintain appropriate control over the process and ensure that the output meets the specified requirements.

Supplier selection and control

Clause 7.4.1 requires criteria to be established for evaluating and selecting suppliers, as well as for monitoring and re-evaluating them. These controls should take into account the importance of the purchased service and the associated risks.

For a translation company, this may involve evaluating its experience with medical devices, the qualifications of its professionals, its review procedures, its history of non-conformities and its ability to manage versions and changes.

Clause 7.4.2, in turn, requires purchasing requirements to be adequately defined. For a translation project, it is advisable to specify the languages, reference documents, approved terminology, expected checks and acceptance criteria.

However, evaluating the supplier is only part of the requirement. The output of the outsourced work must also be checked.

Is the manufacturer required to verify the translations it receives?

This is one of the key aspects of ISO 13485 and also one of the areas that can cause the most uncertainty.

Clause 7.4.3, ‘Verification of purchased product’, states that the organisation must carry out the inspections or other activities necessary to ensure that purchased products meet the specified requirements. The extent of these checks should be proportionate to the supplier evaluation and the associated risk.

Since the concept of a product under ISO 13485 also encompasses services, these requirements apply when purchasing translation services.

However, this does not necessarily mean that the manufacturer must have employees who are proficient in every language or personally review every translated word.

It can rely on evidence provided by its supplier and on checks that do not require proficiency in the target language, such as verifying figures, units, content completeness and final layout. The involvement of independent external professionals can be reserved for higher-risk sections, such as warnings or contraindications.

Furthermore, the more robust the supplier evaluation, the less extensive the verification of each delivery needs to be. What matters is that the chosen method is proportionate to the risk, clearly defined and provides evidence that the requirements have been met.

Verifying the translation is not the same as evaluating the supplier

It is important to distinguish between two levels of control.

The first concerns the supplier and its processes, including professional qualifications, working methods, responsibilities, incident management and document traceability.

The second concerns the specific output, including fidelity to the source text, content completeness, terminology, figures, units, consistency between versions and final presentation.

An example illustrates why both levels are necessary: an IFU translation may have been produced by a qualified supplier and passed its bilingual review, thus meeting the first-level controls, yet still contain an accidental omission introduced during layout.

This type of error can only be identified through second-level verification of the final document intended for the user. The quality of the supplier’s process is therefore no substitute for checking the final output.

The manufacturer must be able to demonstrate that the planned acceptance checks have been applied. Supplier certification alone does not demonstrate that a particular translation is error-free.

Should the translation process be validated according to ISO 13485?

This leads us to a key distinction: the fact that an activity is critical does not automatically mean that its process must be validated in accordance with clause 7.5.6 of ISO 13485.

This clause applies to production and service provision processes where the resulting output cannot be, or is not, verified through subsequent monitoring or measurement, meaning that any deficiencies only become apparent once the product has been used or the service has been provided.

In these circumstances, process validation is required to demonstrate that the process can consistently deliver the expected results.

The question, therefore, is not just how serious the consequences of an error might be, but also whether defects can be identified and verified before the result is used.

The difference between verification and validation

Verification: the process of providing evidence that specified requirements have been met. For example, using a competent bilingual review to verify that a translation correctly reflects the instructions, warnings and parameters in the source text.

Process validation: seeks to demonstrate that a process can consistently produce the intended results under defined conditions when the relevant applicability criteria are met.

These concepts should not be used interchangeably.

In simple terms, if the translation is verified before use and that verification covers all relevant output requirements, clause 7.5.6 does not require the translation process to be validated, however important it may be for safety. In such cases, confidence in the translation is based on the documented verification of each delivery rather than on validation of the process.

By contrast, if certain relevant characteristics of the output cannot be verified, or are not verified, and any associated deficiencies only become apparent when the product is used or the service provided, the applicability of this clause must be assessed.

How can ISO 17100 and ISO 18587 help control critical translations?

Although ISO 13485 provides the quality management framework, it does not define every technical step to be followed in a translation project.

ISO 17100 sets out requirements for the processes, resources and competencies of professionals providing translation services. A key requirement is that the translation must be revised by a suitably qualified person other than the translator.

This makes it possible to establish appropriate linguistic checks and generate useful evidence for the manufacturer’s quality management system. Where required by the level of risk, these controls can be supplemented by technical checks or assessments of the final document.

For processes involving machine translation and full human post-editing, ISO 18587 provides specific requirements for this service.

However, neither of these standards independently determines whether a translation is critical based on the risks associated with the device. Nor do they eliminate the need to assess whether the controls are sufficient for the content, language combination and intended purpose.

For this reason, the choice of a linguistic process should be based on the risks and characteristics of the assignment, rather than solely on the name of the certification associated with the service.

How to implement risk-based translation controls

Once the importance of the information to be translated has been determined, the manufacturer needs to define which controls are appropriate and what evidence will be retained.

A practical approach can be structured around five stages:

1. Assess the criticality of the content. Identify its function, intended users and the potential consequences of an error. Do not rely solely on the device class as the sole criterion.
2. Select and evaluate the supplier. Check its competencies, processes, relevant certifications, performance and experience in handling similar content.
3. Define the requirements of the assignment. Identify the source versions, terminology, target languages, responsibilities and acceptance criteria.
4. Carry out and document verification checks. Implement linguistic, technical and final presentation checks in line with the identified risks.
5. Manage changes and incidents. Maintain traceability between source documents and translations, record significant errors and evaluate the effectiveness of corrective actions.

These steps represent a practical organisational framework rather than a procedure explicitly mandated by ISO 13485.

Their value lies in enabling the manufacturer to demonstrate how risks have been identified and why the controls applied are considered appropriate.

For example, a translation certificate can provide useful information about the documents, versions and participants involved in a project. However, its value as evidence depends on the checks actually carried out and the records supporting them.

Likewise, working with a specialist agency that provides medical device translation services can facilitate the implementation of specialised procedures.

Conclusion: is translation considered a critical activity under the MDR?

The translation of labelling and instructions for use is critical to medical device compliance because this information is required under Annex I. From a safety perspective, however, criticality is not automatic: it depends on the information conveyed by each piece of content and the foreseeable consequences of an error.

The assessment should therefore focus on the actual content rather than the device class or document type. When translation involves safety information, instructions for use, warnings or risk control measures, the manufacturer should pay particular attention to the translation process and its outputs.

ISO 13485 provides a framework for controlling outsourced processes, evaluating suppliers and verifying purchased services. Where applicable, process validation should be considered separately in accordance with the specific criteria in clause 7.5.6.

The most useful question for a manufacturer is therefore not simply whether translation is critical, but what could happen if it is translated incorrectly and what evidence can demonstrate that the associated risks are under control.

If you need to integrate translation into your company’s quality management system, choosing a medical translation agency familiar with industry requirements can help you define linguistic processes suited to your documentation needs.

The key is to apply controls proportionate to the risk, maintain traceability and have evidence to support quality decisions.