Reviewed by Andreas Oberleitner, Regulatory Affairs, Platomics

If your laboratory makes and uses its own tests within a health institution, Article 5(5) of the IVDR exempts them, under conditions, from most of the Regulation. It does not exempt them from the relevant general safety and performance requirements (GSPRs) in Annex I. The GSPRs are the heart of the IVDR: every device has to meet the ones that apply to it, whether it carries a CE mark or is made in-house. For each in-house test, your public declaration has to say that it meets them, and name any requirement that is not fully met and why.

An IVDR GSPR checklist is how you work through that, one test at a time. Ours is a free Excel file with the 20 GSPRs of Annex I in plain words, one answer column that follows the logic of the declaration, and three rows filled in for a fictitious in-house PCR test.

How many GSPRs are there in the IVDR?

Annex I of Regulation (EU) 2017/746 has 20 GSPRs, numbered 1 to 20, in three chapters: general requirements (GSPR 1 to 8), requirements regarding performance, design and manufacture (GSPR 9 to 19), and requirements regarding the information supplied with the device (GSPR 20). Each GSPR is split into points and sub-points. Depending on how finely you count them, that makes around 200 requirements, and GSPR 20, on the label and instructions for use, holds a large share of them.

The 20 GSPRs as text

GSPR	Chapter	Topic
1	I	Performance and safety
2	I	Risk reduction
3	I	Risk management system
4	I	Risk control measures
5	I	Use error
6	I	Performance over the lifetime
7	I	Transport and storage
8	I	Known risks against the benefit
9	II	Performance characteristics
10	II	Chemical, physical and biological properties
11	II	Infection and microbial contamination
12	II	Materials of biological origin
13	II	Construction and environment
14	II	Measuring function
15	II	Radiation
16	II	Software and IT security
17	II	Energy source
18	II	Mechanical and thermal risks
19	II	Self-testing and near-patient testing
20	III	Label and instructions for use

GSPR 1 to 8 have no headings in the Regulation, and some headings in chapter II are long, so the graphic names each GSPR by its topic.

Why an in-house test needs one

Article 5(5) lifts the requirements of the IVDR from devices made and used only within health institutions, under conditions (a) to (i), “with the exception of the relevant general safety and performance requirements set out in Annex I”. Point (f) adds a public declaration that the devices meet Annex I and, where applicable, information on which requirements are not fully met, with a reasoned justification.

That last option exists only for in-house devices. A CE-marked device has to meet every requirement of Annex I that applies to it (Article 5(2)). A health institution may declare that an applicable requirement is not fully met, as long as it names the requirement and gives a reasoned justification. The model declaration in Annex A of MDCG 2023-1, the guidance on this exemption endorsed by the Medical Device Coordination Group, has a column headed “Applicable GSPR fully met? (Y/N)” next to one for “Information on and justification for applicable GSPR that are not fully met”.

The same guidance says that health institutions have to make sure their in-house devices meet the relevant requirements of Annex I (section 3.3), and document this for each device (section 3.5.2).

How the GSPRs are worked through

Every GSPR goes through the same steps, for every test.

1. Is it applicable? Decide for each requirement whether it applies to the test. If it does not, write a justification that refers to the test, not a general one.
2. How is it met? Name the solution you used: a harmonised standard, a common specification, or another solution that reflects the state of the art, such as a CLSI guideline, a standard that is not on the harmonised list, or your own validated method. Give the standard and its version.
3. Where is the evidence? Name the controlled documents that show it, with their version and where they are kept: the validation report, the risk management file, the instructions for use.
4. Is it fully met? If an applicable requirement is not fully met, write the reasoned justification that will go into the declaration.
5. Declare. The answers for each requirement lead to the single “Applicable GSPR fully met? (Y/N)” per test in the MDCG model, and the justifications go into its last column. Name each requirement that is not fully met by its Annex I number, for example GSPR 16.4.

A word on standards. For CE-marked devices, conformity with a harmonised standard whose reference is published in the Official Journal gives a presumption of conformity with the requirements that standard covers (Article 8). Examples on the IVDR list are EN ISO 14971 for risk management and EN ISO 15223-1 for the symbols used on the label (Commission list of harmonised standards for IVDs). Article 5(5) does not refer to Article 8. MDCG 2023-1, in its section on the quality management system, says that ISO standards on manufacturing and risk management can be used, especially if they are harmonised with the IVDR (section 3.5.2), and it counts the standards, common specifications and guidelines applied among the documentation (section 3.9). Common specifications have been adopted for certain class D devices (Implementing Regulation (EU) 2022/1107).

These steps are the same ones Annex II, point 4 asks of manufacturers for their technical documentation: the requirements that apply, the method used to show conformity, the standards or other solutions applied, and the controlled documents that offer the evidence. Describing how each requirement is fulfilled and linking the evidence, requirement by requirement, is the recognised way to demonstrate the assessment. For an in-house test, that is what a GSPR checklist is.

Want to see the GSPR checklist in PlatoX® with one of your own tests?

What is in the free IVDR GSPR checklist

• One row for each of the 20 GSPRs of Annex I, grouped by chapter and described in plain words.
• One answer per GSPR: “Y” (fully met), “N” (not fully met) or “N/A” (not applicable). It follows the model declaration in MDCG 2023-1, which asks for each test whether the applicable GSPRs are fully met.
• Columns for the justification, for how the requirement is met (method and standards applied) and for the evidence (a document or a link).
• Three rows filled in for a fictitious in-house real-time PCR test: GSPR 9 fully met, GSPR 16 not fully met (point 16.4), and GSPR 19 not applicable.
• A “Read me” sheet: what the file is for, how to fill it in and where it stops.

The file works at the level of the GSPR. Each GSPR holds several requirements, and to declare that a test meets Annex I, or to name what it does not fully meet, someone has to go through every requirement in every applicable GSPR. Use the file for the first pass: what applies, who knows the answer and where the evidence sits.

How to use it

1. Use one copy per test. Fill in the header: the test, its intended purpose, the version and date, who prepared the file and who reviewed it.
2. For each GSPR, choose one answer: “Y”, “N” or “N/A”. An “N/A” needs a reason that refers to this test.
3. For “N”, write the justification as it would appear in the declaration, and name the requirement by its number, for example GSPR 16.4.
4. For each GSPR that applies, note how it is met (method, standards applied with their version) and name the evidence documents.
5. Read the requirements inside each applicable GSPR in the text of Annex I, and review the file whenever the test, a reagent, an instrument or the software changes.

Six common pitfalls

• Starting from a checklist built for the MDR. The Medical Device Regulation has 23 GSPRs in its Annex I, and they do not map one to one onto the 20 of the IVDR. Some requirements have no counterpart.
• “Not applicable” without a reason. The reason is part of the record, and the next person who reads the file needs it.
• General answers. “Complies”, “see SOP” or a justification copied from another test says nothing about this test. Each answer has to refer to the test in front of you.
• No evidence, or evidence nobody can find. A requirement marked as met needs a named, controlled document behind it, in the version that is valid today.
• A checklist that disagrees with the declaration. If a row says an applicable requirement is not fully met, the declaration has to say so too, with the justification.
• Filling it in once. Annex I describes risk management as “a continuous iterative process throughout the entire lifecycle of a device, requiring regular systematic updating”, and the checklist has to keep up with the test.

But a spreadsheet is the wrong place for GSPR work

Up to here, everything points to a checklist. The declaration covers every relevant requirement of Annex I, the guidance asks for documentation per device, and one row per requirement is the obvious shape for that. As a method, it is right.

As a tool, a spreadsheet is the wrong place for it. The free file is a good way to see the structure and to make a first pass on one test. Running the GSPR work of real tests in spreadsheets, test after test and year after year, is where the problems start.

Every answer is typed by hand

Annex I holds around 200 requirements, and each one that applies needs an answer for each test, kept current for as long as the test is in use. A blank spreadsheet does not know what the test is, so every decision starts from an empty cell.

The evidence column holds a file name

A cell can name a validation report or hold a link to it. When the report is revised, renamed or moved, the cell can end up pointing to a superseded or missing file, and nothing flags it. Later, it can be hard to say which version an answer was based on.

Nobody can tell which file is current

GSPR_checklist_PCR_v7_final(2).xlsx sits next to a copy sent by email and another on someone’s desktop. Version history, where it is switched on, covers one copy at best, and it rarely records why a row changed.

Review is a column, not a record

“Reviewed by” is filled in once. When a row changes afterwards, the review stays where it was, and the file looks approved when it is not.

Similar tests drift apart

Tests that share a platform, a reagent or a software tool share many answers, so the rows get copied from one file to the next. When the instructions for use of the shared reagent change, every copy has to be found and corrected by hand, and a missed copy keeps the old answer.

It is cut off from the rest of the file

The GSPR answers depend on the intended purpose, the risk management file, the performance evaluation and the label. When a new risk is added or the intended purpose changes, no row in the spreadsheet reopens.

The declaration is written somewhere else

The public declaration is a separate document, and two documents kept apart can end up saying different things.

Every change in the rules lands in every copy

Guidance is revised, harmonised standards are amended (the Commission list for IVDs has been amended several times since 2022) and the IVDR itself may change. Each spreadsheet has to be checked by hand, one test at a time.

It depends on the person who built it

Colour codes, abbreviations and the logic of the file live in one person’s head. When that person moves on, the next one starts by reverse-engineering the file.

More on this in The IVDR is not a static checklist.

What changes with PlatoX®

PlatoX® guides laboratories through IVDR in-house IVD documentation step by step, and includes a checklist of the general safety and performance requirements (GSPR) for this.

	In a spreadsheet	In PlatoX®
Requirements	Rows you type and keep current yourself	Each requirement has its own row with your laboratory’s answer, its documents and its standards
Evidence	A file name or a link in a cell	The typical evidence documents for each GSPR are shown on the list, so you do not link them by hand
Reagents and components	Copied from the manufacturer’s documents by hand	When a manufacturer has registered a component on PlatoX®, the laboratory that adds it inherits its documentation, such as instructions for use and safety data sheets
Where you start	An empty row	PlatoX® guides you step by step; your laboratory decides

Your laboratory decides what applies, whether a requirement is fully met and what the declaration says.

Questions laboratories ask

Is a GSPR checklist mandatory for in-house tests?

Not as a form. The IVDR asks for compliance with the relevant requirements of Annex I and for a public declaration, not for a checklist. Compliance has to be documented for each device (MDCG 2023-1, section 3.5.2), and class D devices need the documentation described in Article 5(5)(g). Describing how each requirement is fulfilled and linking the evidence is the recognised way to demonstrate it, the same way manufacturers do in their technical documentation (Annex II, point 4), and a checklist is the common form it takes for an in-house test.

Does every GSPR apply to an in-house test?

No. It depends on the test. For example, GSPR 19 only concerns tests for self-testing or near-patient testing, and GSPR 15 and 17 only matter if the test involves radiation or an energy source. Whatever you decide, write down why.

Can an in-house test be declared if a requirement is not fully met?

Yes, if the declaration names the requirement and gives a reasoned justification (Article 5(5)(f)). This is specific to in-house devices; a CE-marked device has to meet every requirement that applies to it.

Is ISO 15189 accreditation enough to cover Annex I?

No. MDCG 2023-1 says that compliance with EN ISO 15189 alone does not constitute an appropriate quality management system for making in-house devices, because the manufacturing process and the relevant requirements of Annex I are not in the scope of the standard. The standard does not cover the other IVDR requirements for in-house devices either. An ad hoc commission of the AWMF, the association of scientific medical societies in Germany, came to a similar picture: its Annex I checklist has a tab that compares each point of Annex I with ISO 15189, and it marks only 7 points as having a comparable requirement in the standard, 51 as partly comparable and 29 as not comparable. The file dates from early 2022, before the current edition of ISO 15189 was published, and it is their reading, not an official mapping. Compliance with EN ISO 15189, or with national provisions where they apply, is still one of the Article 5(5) conditions. More in Is ISO 15189 accreditation enough under IVDR?

What goes in the public declaration?

Article 5(5)(f) asks for three things: the name and address of the health institution, the details needed to identify the devices, and a declaration that they meet Annex I, with information on any requirement not fully met and a reasoned justification. MDCG 2023-1 proposes a format in its Annex A. Check national rules on language and on where to publish it.

Will the proposed changes to the IVDR remove this work?

The Commission’s proposal of December 2025, COM(2025) 1023, would change parts of Article 5(5), including what the public declaration has to state: as tabled, a health institution accredited to EN ISO 15189 could state its accreditation instead of declaring that its devices meet Annex I. It is a proposal, not law: in early November 2026 it was still being discussed by the European Parliament and the Council. Until a change is adopted and applies, Article 5(5) and Annex I apply as they stand.

A question we did not answer here? Bring it to a demo, together with one of your tests.

Sources

• Regulation (EU) 2017/746, consolidated text of 10 January 2025: Article 5(2), Article 5(5), Article 8, Annex I, Annex II
• MDCG 2023-1, guidance on the health institution exemption under Article 5(5), January 2023
• European Commission, harmonised standards for in vitro diagnostic medical devices
• Commission Implementing Regulation (EU) 2022/1107, common specifications for certain class D devices
• AWMF ad hoc commission, useful documents for the IVDR requirements, including the Annex I checklist with an ISO 15189 tab (Biomedical Alliance in Europe, January 2022)
• Proposal COM(2025) 1023, Council copy
• Procedure 2025/0404(COD), European Parliament Legislative Observatory