Usually, within a quality system, Notified Bodies will require documented procedures so they can clearly establish compliance against the requirements of the specific regulation or directive being audited.
However, EU legislation must be proportional. This means companies of all sizes can participate, including startups and micro-enterprises. While key procedures must always be documented for Module D/D1, the legislation does leave room for different ways of demonstrating compliance—especially for very small companies.
For small companies, Notified Bodies may occasionally accept procedures that are present in the company but not formally written down. This flexibility does not extend to larger companies. To determine this, you should begin with the EU definition of an SME. Any company categorised as a micro-enterprise may be able to rely on informal or unwritten procedures in limited cases.
Companies that are not classified as small or micro (i.e., headcount above 50) cannot rely on unwritten procedures for major operational requirements such as training, competence, or production controls. Even companies with 10–50 employees will generally be expected to have such procedures documented.
An example of an “informal” procedure might be the quality policy required under Module D. Larger companies must document this formally, often as part of the QMS. For a very small company, however, the equivalent might be a mission statement on the website or an internal but informal agreement.
In all cases, the auditor will make a written record of what the procedure is and what it covers. During future audits, the auditor may request follow-up evidence to demonstrate continued compliance or may recommend that certain informal practices be documented more formally. If you have questions about this, feel free to reach out.