Post-Market Surveillance Plan: What to Include Under EU MDR

Executive Summary

The Post-Market Surveillance Plan (PMSP) is the document that defines how a medical device manufacturer collects, analyses, and acts on post-market data throughout the device lifecycle. Under EU MDR 2017/745, every medical device must have a PMSP, and that plan must be proportionate to the device’s risk class and type.

Many manufacturers underestimate what a PMSP must contain. A plan that lists data sources without defining collection methods, analysis processes, or escalation thresholds is a compliance gap that Notified Bodies identify consistently. A plan that is not actively implemented is a more significant compliance gap still.

This article examines what the PMSP must contain under EU MDR, how it connects to the PSUR, CER, and PMCF, the most common mistakes manufacturers make, and what a defensible PMSP looks like in practice.

Key Takeaways

• Every medical device must have a Post-Market Surveillance Plan under EU MDR Article 84
• The PMSP must define specific data sources, collection methods, analysis processes, and escalation thresholds, not just list categories of data
• Literature surveillance is a required component of the PMSP and must be conducted systematically and continuously
• The PMSP feeds directly into the PMSR (Class I) or PSUR (Class IIa, IIb, III) and must remain consistent with the CER and risk management file
• A PMSP that exists as a document but is not implemented is a compliance failure that Notified Bodies identify during surveillance audits
• The PMSP and PMCF plan are distinct documents that serve different purposes and must not be combined or treated as interchangeable
• Post-market surveillance software supports PMSP implementation by integrating literature surveillance, complaint tracking, and evidence management in a single connected system

Table of Contents

1. 1. 1. Direct Answer: What Is a Post-Market Surveillance Plan?
      2. Why It Matters: PMSP Obligations Under EU MDR
      3. How It Works: PMSP Structure and Required Elements
      4. Frequency and Timing
      5. Connection to the CER and Risk Management File
      6. PMSP vs PMCF Plan
      7. Common Mistakes: PMSP Problems That Affect Regulatory Review
      8. Best Practices: How to Build a Defensible PMSP
      9. Comparison Table
      10. Checklist
      11. Definitions
      12. Expert Perspective
      13. FAQ
      14. References
      15. Related Resources
      16. Call to Action

Direct Answer: What Is a Post-Market Surveillance Plan?

A Post-Market Surveillance Plan is the document that defines the manufacturer’s systematic process for collecting, recording, and analysing data on the quality, performance, and safety of a medical device after it has been placed on the market. Under EU MDR Article 84, every device must have a PMSP, and the plan must be proportionate to the device’s risk class and type.

The PMSP is not a statement of intent. It is a structured operational document that defines what data will be collected, from what sources, using what methods, at what frequency, and what analysis and escalation processes will be applied. Notified Bodies assess the plan against this standard. A plan that does not meet it generates findings.

The PMSP is distinct from the PMCF plan, which defines proactive clinical data collection activities. The PMSP covers the broader surveillance system including all post-market data sources, not just clinical follow-up.

Why It Matters: PMSP Obligations Under EU MDR

Under EU MDR Article 83, manufacturers must establish, document, implement, and maintain a post-market surveillance system that is proportionate to the risk class and type of the device. The PMSP is the document that defines this system.

The PMSP obligation applies to every device class. For Class I devices, the findings of the PMSP feed into the Post-Market Surveillance Report (PMSR) under Article 85. For Class IIa, IIb, and Class III devices, they feed into the Periodic Safety Update Report (PSUR) under Article 86, which is updated at least every two years for Class IIa and at least annually for Class IIb and Class III.

The consequences of an inadequate PMSP are significant. A plan that lists data sources without defining how they will be monitored, analysed, or escalated will generate findings during Notified Body assessment. A plan that has not been implemented will generate more serious findings still, as the absence of actual post-market data generation is immediately apparent when the PSUR or PMSR is reviewed. For a full breakdown of the most common reasons post-market surveillance documentation fails see our dedicated article on this topic.

How It Works: PMSP Structure and Required Elements

What EU MDR Article 84 Requires

Article 84 of EU MDR defines the elements that the PMSP must address. These are not optional. The plan must cover:

A proactive and systematic process to collect information generated during the post-market phase. The process must be proportionate to the risk class and type of the device and cover the post-market phase of the device’s lifetime.

The methods and processes to be used to collect and process the data generated by the PMS system, including the sources of data to be collected and processed.

A reference to the general safety and performance requirements of Annex I of EU MDR that are relevant to the device and the PMCF plan required under Annex XIV Part B.

The methods and procedures used for analysing data and the analysis outputs, including what the data means for device safety, performance, and benefit-risk.

The specific methods and procedures used to investigate complaints and analyse the significance of field safety corrective actions and trends in adverse events.

The methods and procedures used to manage any post-market obligations including those relating to reporting requirements under the vigilance provisions of EU MDR.

Data Sources the PMSP Must Address

The PMSP must define all sources of post-market data that will feed into the surveillance system. These typically include:

Complaint data: Structured collection and analysis of complaints from healthcare professionals, patients, and users, including trending of complaint types and identification of potential safety signals.

Vigilance data: Serious incident reports, field safety corrective actions, and safety-related feedback from competent authorities and Notified Bodies.

Literature surveillance: Systematic and continuous monitoring of published clinical and scientific literature relating to the device, comparable technologies, and related clinical areas. This is a mandatory component of the PMSP and must be conducted with a structured methodology.

PMCF findings: Data generated through proactive post-market clinical follow-up activities including registries, surveys, post-market clinical investigations, and literature reviews conducted as PMCF methods.

Registry data: Data from national or international device registries where available and applicable to the device.

Regulatory intelligence: New or updated standards, guidance documents, and regulatory decisions relevant to the device or its technology.

User feedback: Structured collection of feedback from healthcare professionals and patients regarding device performance and usability in clinical practice.

Analysis Processes and Escalation Thresholds

Defining data sources is only the first part of the PMSP. The plan must also define how collected data will be analysed and what thresholds will trigger escalation or corrective action.

Analysis processes should address how complaint trends will be assessed against expected rates and population exposure, how literature findings will be evaluated for their impact on the existing benefit-risk conclusion, how vigilance data will be reviewed for emerging safety signals, and how PMCF findings will be assessed for their impact on the CER.

Escalation thresholds define at what point a finding requires a specific response, whether that is a vigilance report, a CER update, a risk management review, or a field safety corrective action. Thresholds should be defined in objective terms where possible, using complaint rates, severity classifications, or specific event types as triggers.

Frequency and Timing

The PMSP must define how frequently each data source will be monitored and at what intervals findings will be analysed and documented. For higher-risk devices, continuous monitoring is expected rather than periodic reviews.

Literature surveillance should be conducted continuously rather than at defined annual intervals. For Class IIb and Class III devices in particular, new published evidence that emerges between annual PSUR review cycles may identify safety signals or changes to the state of the art that should prompt an earlier reassessment. CiteMed’s Living Reviews functionality supports continuous literature surveillance by monitoring defined databases and automatically identifying new matching publications without manual re-runs.

Connection to the CER and Risk Management File

The PMSP must be consistent with and connected to the CER and risk management file. Post-market surveillance findings must feed into CER updates, and CER conclusions must reflect the current state of post-market evidence. Where PMS findings identify new risks or changes to the benefit-risk profile, the risk management file must also be updated.

This alignment across the technical file is one of the most commonly assessed aspects of post-market surveillance during Notified Body conformity assessment. Where the PMSP, PSUR, CER, and risk management file present inconsistent conclusions, the technical file does not tell a coherent safety story..

PMSP vs PMCF Plan

The PMSP and PMCF plan are distinct documents that serve different purposes and must not be combined.

Common Mistakes: PMSP Problems That Affect Regulatory Review

Listing data sources without defining collection methods

The most common PMSP deficiency is a plan that identifies the categories of data to be collected — complaints, literature, vigilance — without defining the specific methods and processes by which each will be collected, recorded, and analysed. A list of data sources is not a surveillance plan. It is the starting point for one.

No defined escalation thresholds

A PMSP that collects and analyses data without defining what findings require a specific response leaves the manufacturer without a clear basis for decision-making when a signal emerges. Notified Bodies expect to see defined thresholds that trigger specific actions, whether that is a vigilance report, a CER update, or a risk management review.

Literature surveillance conducted without a structured methodology

Where literature surveillance is listed as a PMSP data source but is conducted without predefined search strategies, documented inclusion and exclusion criteria, structured screening, and PRISMA-aligned reporting, it does not meet the standard expected for a systematic surveillance method under EU MDR. For more detail on the methodology required see our article on common literature review challenges.

Combining the PMSP and PMCF plan

Combining these two documents into one creates confusion about the distinct obligations each is designed to address. Notified Bodies assess each document separately against different regulatory bases. A combined document typically meets neither requirement adequately.

A PMSP that exists as a document but is not implemented

A PMSP that has been written but has not resulted in actual data collection processes being established and operated is a compliance failure that becomes immediately apparent when the PSUR or PMSR is reviewed. If the PSUR benefit-risk analysis cannot be supported by the data the PMSP committed to collecting, the gap is visible.

Inconsistency between the PMSP and the CER

Where the data sources and analysis methods defined in the PMSP are not reflected in CER updates, or where the PSUR benefit-risk conclusion is inconsistent with the CER benefit-risk conclusion, the technical file presents conflicting accounts of the device’s safety profile. For a full breakdown of how documentation inconsistencies affect regulatory submissions see our article on reasons Clinical Evaluation Reports are rejected.

Best Practices: How to Build a Defensible PMSP

A defensible PMSP functions as an operational document, not a compliance checkbox. It defines a surveillance system that is actively generating and analysing data, with findings feeding coherently into the PSUR, CER, and risk management file.

Define data sources, methods, and analysis processes together

For each data source identified in the PMSP, define the specific collection method, the responsible function, the monitoring frequency, the analysis process, and the escalation thresholds. A data source without these elements is not defined; it is mentioned.

Make literature surveillance genuinely systematic

Literature surveillance must be conducted with the same rigour as a systematic review. Predefined search strategies, documented inclusion and exclusion criteria, structured screening, and PRISMA-aligned reporting are required. Continuous monitoring rather than annual searches is expected for higher-risk devices. CiteMed’s Living Reviews functionality supports this directly by monitoring defined databases continuously and alerting the team when new matching publications are available.

Establish escalation thresholds before they are needed

Escalation thresholds defined reactively, after a signal has emerged, are less defensible than those defined prospectively in the PMSP. Define what complaint rates, event types, or literature findings will trigger a vigilance report, a CER review, or a risk management assessment before those situations arise.

Maintain alignment across the technical file

Build processes into the PMSP that ensure post-market findings feed into CER updates and risk management file reviews on a defined timeline. The PMSP, PSUR, CER, and risk management file must tell a consistent and coherent safety story across the technical file.

Use post-market surveillance software to support implementation

Post-market surveillance software that integrates literature surveillance, complaint tracking, vigilance management, and evidence documentation in a single connected system makes PMSP implementation significantly more manageable than coordinating these activities across separate tools. CiteMed’s Evidence Cloud supports this integrated approach, combining continuous literature surveillance through Living Reviews with clinical evidence management and audit-ready documentation across the full post-market surveillance lifecycle.

Comparison Table: PMSP Requirements by Device Class

Checklist: PMSP Readiness Under EU MDR

Data sources and collection:

• All required data sources are identified including complaints, vigilance, literature, PMCF, registry data, and user feedback
• Specific collection methods and responsible functions are defined for each data source
• Monitoring frequency is defined for each data source and proportionate to device risk
• Literature surveillance is conducted using a structured methodology with predefined search strategies and documented inclusion and exclusion criteria

Analysis and escalation:

• Analysis processes are defined for each data source
• Escalation thresholds are defined in objective terms for complaint rates, event types, and literature findings
• Actions required at each escalation threshold are clearly specified
• Responsibility for analysis and escalation decisions is assigned

Integration and alignment:

• PMSP is consistent with and connected to the CER and risk management file
• Processes are defined for how PMS findings feed into CER updates and risk management reviews
• PMSP is distinct from and consistent with the PMCF plan
• PSUR or PMSR update frequency is defined and aligned with device classification

Implementation:

• Data collection processes defined in the PMSP are operational and generating data
• Literature surveillance is continuous rather than conducted at infrequent intervals
• Post-market surveillance software is in place to support continuous data collection and analysis
• Escalation processes have been tested and are understood by relevant team members

Definitions

Post-Market Surveillance Plan (PMSP)
The document that defines the manufacturer’s systematic process for collecting, recording, and analysing post-market data throughout the device lifecycle. Required under Article 84 of EU MDR for every medical device.

Post-Market Surveillance System
The broader operational system established under Article 83 of EU MDR for collecting and processing post-market data. The PMSP is the document that defines this system.

Post-Market Surveillance Report (PMSR)
The reporting document required for Class I devices under Article 85 of EU MDR. Updated when necessary and available for competent authority inspection.

Periodic Safety Update Report (PSUR)
The reporting document required for Class IIa, IIb, and Class III devices under Article 86 of EU MDR. Updated at least every two years for Class IIa and at least annually for Class IIb and Class III.

Escalation threshold
A defined trigger in the PMSP that requires a specific response when reached. Escalation thresholds may be based on complaint rates, event types, severity classifications, or specific literature findings. Defined prospectively in the PMSP rather than reactively when a signal emerges.

Literature surveillance
The systematic and continuous monitoring of published scientific and clinical literature for new evidence relating to the device, comparable technologies, and related clinical areas. A required component of the PMSP that must be conducted with a structured methodology and documented process.

Signal detection
The process of identifying emerging safety concerns from post-market data before they become reportable events. Effective signal detection requires structured analysis of complaint trends, vigilance data, literature findings, and PMCF outcomes on a continuous basis.

Post-market surveillance software
Platforms that support the ongoing collection, analysis, and reporting of post-market data including literature surveillance, complaint trending, vigilance reporting, and PMCF monitoring. Under EU MDR, PMS must be active and continuous, making dedicated software support essential for manufacturers of higher-risk devices.

Expert Perspective

The PMSPs that generate findings during Notified Body review are almost always the ones that were written to satisfy a documentation requirement rather than to define an operational system. They identify the right data sources. They use the right language. And then they stop, without defining how any of those data sources will actually be monitored, at what frequency, by whom, or what will happen when something significant is found. A PMSP that does not define escalation thresholds is not a surveillance plan. It is a data collection aspiration. The test of a PMSP is not whether it covers the right categories. It is whether a new team member joining the organisation could read it and know exactly what to do on Monday morning to keep the surveillance system running.

Frequently Asked Questions

What must a Post-Market Surveillance Plan contain under EU MDR?
Under Article 84 of EU MDR, the PMSP must define a proactive and systematic process to collect post-market data, the methods and processes for collecting and processing that data, the specific data sources to be monitored, analysis and escalation processes for identified findings, methods for investigating complaints and analysing field safety corrective action trends, and methods for managing post-market reporting obligations. The plan must be proportionate to the device’s risk class and type and must be actively implemented.

Is a Post-Market Surveillance Plan required for all device classes?
Yes. Under Article 84 of EU MDR, every medical device must have a Post-Market Surveillance Plan regardless of classification. The scope and depth of the plan should be proportionate to the device’s risk class. For Class IIb and Class III devices, the PMSP must support continuous data generation and analysis feeding into annual PSURs and regular Notified Body surveillance.

What is the difference between a PMSP and a PMCF plan?
The PMSP defines the full post-market surveillance system, covering all data sources including complaints, vigilance, literature surveillance, registry data, and PMCF findings. The PMCF plan defines the specific proactive clinical data collection activities conducted as part of post-market follow-up. The two documents have different regulatory bases, different purposes, and are assessed separately by Notified Bodies. They must not be combined or treated as interchangeable.

How often should literature surveillance be conducted as part of the PMSP?
For higher-risk devices, literature surveillance should be continuous rather than conducted at defined annual intervals. New published evidence that emerges between review cycles may identify safety signals or changes to the state of the art that should prompt an earlier reassessment of the CER or PSUR. CiteMed’s Living Reviews functionality supports continuous literature surveillance by monitoring defined databases and automatically identifying new matching publications without manual re-runs.

How does the PMSP connect to the CER?
Post-market surveillance findings must feed directly into CER updates. The PMSP should define the process by which PMS data is assessed for its impact on the existing clinical evaluation and how that assessment is reflected in CER updates. Where PMS findings identify new risks or changes to the benefit-risk profile, both the CER and the risk management file must be updated to reflect them. Inconsistency between the PMSP, PSUR, and CER is one of the most commonly cited findings during Notified Body conformity assessment.

What post-market surveillance software supports PMSP implementation?
Post-market surveillance software that supports PMSP implementation should integrate literature surveillance without manual re-runs, complaint and vigilance data management, structured evidence documentation, and a complete audit trail connecting post-market findings to CER updates and the PSUR benefit-risk assessment. CiteMed’s Evidence Cloud is designed specifically for this purpose, combining continuous literature surveillance through Living Reviews with clinical evidence management and audit-ready documentation across the full post-market surveillance lifecycle. Book a demo to see Evidence Cloud in action.

What are the most common PMSP mistakes?
The most common mistakes are listing data sources without defining collection methods and analysis processes, failing to define escalation thresholds, conducting literature surveillance without a structured methodology, combining the PMSP with the PMCF plan, writing a plan that is not implemented, and failing to maintain alignment between the PMSP findings and the CER and risk management file.

References

• Regulation (EU) 2017/745 on medical devices (EU MDR)
• EU MDR Article 83: Post-Market Surveillance System
• EU MDR Article 84: Post-Market Surveillance Plan
• EU MDR Article 85: Post-Market Surveillance Report
• EU MDR Article 86: Periodic Safety Update Report
• EU MDR Annex XIV: Clinical Evaluation and Post-Market Clinical Follow-Up
• MEDDEV 2.7/1 Revision 4: Clinical Evaluation Guide
• PRISMA 2020 Statement

Related Resources

• Post-Market Surveillance Under EU MDR — Building a proactive PMS system aligned with EU MDR expectations
• PMCF Surveys Solution — Structured PMCF activities supporting ongoing clinical evidence generation
• Medical Device Vigilance — Vigilance monitoring and reporting support
• EU MDR Literature Review Services — Structured literature surveillance supporting PMSP and PSUR preparation
• CER Checklist for EU MDR — A practical framework for pre-submission review of Clinical Evaluation Reports
• Why Clinical Evaluation Reports Are Rejected — Common reasons CERs fail Notified Body review
• PSUR vs PMSR Under EU MDR — Understanding post-market surveillance reporting requirements
• PRISMA and EU MDR Literature Review — Structured literature review methodology supporting PMS literature surveillance
• EU MDR Consulting Services — Expert support for post-market surveillance strategy and PMSP development

Call to Action

If you are developing a Post-Market Surveillance Plan, reviewing an existing plan before Notified Body assessment, or building a more structured approach to post-market surveillance and literature surveillance under EU MDR, Citemeds can help. Get in touch to discuss your requirements.