Are You Over-Committing on Your EU MDR Post-Market Surveillance Plan?

Yes, most manufacturers do. They write PMCF studies, surveys, and monitoring frequencies into their PMS plan and CER that they don’t have the staff or budget to deliver, and every unmet commitment becomes a potential audit finding. EU MDR Article 83 asks for a PMS system proportionate to the device’s risk class and type, so the better approach is to commit only to what you can resource, justify in writing any data source you leave out, and build in triggers that scale activity up when the data calls for it. For the baseline requirements, see our main guide to post-market surveillance under EU MDR.

All MedTech companies face increased post-market surveillance (PMS) requirements under the EU MDR and IVDR. A PMS plan will incorporate a Post-Market Clinical Follow-up (PMCF) plan or justification for why it is unnecessary.

Class IIa, IIb, and III medical devices, and Class C and D IVDs, require a Periodic Safety Update Report (PSUR). Class I medical devices and Class A and B IVDs require a Post-Market Surveillance Report (PMSR) instead.

This future landscape requires MedTech companies to maximize their Post Market Surveillance by using real-world data to detect defects before recalls are necessary by using real-world data.

Some MedTech companies optimize their PMS approach by creating their evidence platforms, while others are still figuring it out. Unfortunately, most companies overcommit to PMCF, vigilance, event monitoring, and PSURs as part of their PMS plan. However, they need more time, resources, and money to follow their CER promises.

Understanding what’s actually required for post-market surveillance under EU MDR helps avoid over-engineering your plan.

The key challenges with PMS:

• Identifying the data that can aid their PMS efforts
• Generating new data promptly to support PMS
• Dedicating time and resources to PMS documentation
• Monitoring how devices perform in everyday clinical use
• Updating the benefit–risk determination as new data arrives
• Keeping the CER, risk management file, and instructions for use aligned with what PMS finds

Post Market Surveillance And Its Role in Design

PMS isn’t just complaint handling; clinical, commercial, and technical inputs should combine to drive one of three design outcomes: a new product, a design modification, or no change.

As discussed above, all medical companies should have an active PMS system in place. Unfortunately, many companies still assume this system exists only to capture complaints, but it does not.

Post Market Surveillance captures information about the device when placed in the market, whether good, bad, or ineffective.

It is, therefore, better to have three different roles in managing the whole PMS system.

These three roles are defined below:

The first position is for the CER writers who will look into your clinical writings and knowledge base for any device.

The second person is your marketing manager, who will collect all the information from the marketing staff, sales, and current market literature.

The third person responsible is your technical director, who will collect all quality-related information and material from the technical knowledge base.

So the design of any product depends on the above three strands to come out with one of the following design outcomes:

• New product
• Design modification
• No Change

This can only happen if you will discuss all three inputs related to your device.

MDR Vigilance – An Added Challenge

MDR cut the general serious incident deadline from 30 to 15 days, with 10 days for deaths or unanticipated serious deterioration and 2 days for serious public health threats.

With the new vigilance reporting timelines under the MDR and IVDR, manufacturers must report incidents within 15 days rather than 30 days, which will worsen the aforementioned challenges.

For the most critical events, the window is much shorter: a death or unanticipated serious deterioration in health must be reported no later than 10 days after awareness, and a serious public health threat no later than 2 days. With an automated system, it is easier to detect and escalate these events quickly and efficiently.

Companies have access to vast amounts of real-world data collected through their devices or through registries they’ve implemented; this data is rarely put to good use!

Within a large number of MedTech companies today, PMS is spread out. Siloed departments manage product safety and patient vigilance data, including Quality Assurance or Regulatory Affairs.

However, some precious and useful information is available with departments outside QA/RA systems. For example, there might be issues in capturing, assessing, and trending information from user meetings, brand surveys, and social media.

Annex III of the MDR lists the following points for a successful PMS plan:

• First, a thorough examination of all activities implemented around the organization will, in turn, help identify the types and value of data. This data is taken from those activities concerning PMS.
• An ideal PMS system would take in both reactive data and combine it with proactive data. So manufacturers can submit all of the available data as one set. The reactive data covers vigilance reports, audits, complaints, and out-of-specification reports. The proactive data will cover service reports, literature, social media, real-world evidence, and customer surveys.
• A set of processes, such as prioritization algorithms, to quickly and efficiently handle incoming data and events will help decide on necessary actions.
• Practical tools to trace and identify medical gadgets for which corrective measures might be required.
• Technologies and frameworks for executing corrective actions when required.
• Reference for methods to satisfy manufacturer’s commitments for PMS system, PMS plan, and PSUR.

Implementing a centralized approach and system that pulls PMS data from all available sources; for reporting and signal detection will enable Med-tech companies to stay ahead of safety trends and signals, thus, ensuring that their devices in the field are highly safe and effective for their customers.

Structure Of New MDR

The MDR has 123 articles in 10 chapters and 17 annexes, compared with 23 articles and 12 annexes in the MDD, and it replaced both the MDD and the AIMD Directive.

The new MDR document is 174 pages long and more detailed than the MDD. In addition, there are 42 implementing acts and 12 delegating acts to modify/amend it.

The Active Implantable Medical Devices Directive (AIMD) is also integrated into the MDR. AIMD also has a lot of content that did not exist previously; besides that, a lot more content still needs to exist.

The MDR is far longer and more detailed than the directives it replaced. It contains 123 articles in 10 chapters and 17 annexes, compared with 23 articles and 12 annexes in the Medical Device Directive (93/42/EEC). It repealed both the MDD and the Active Implantable Medical Devices Directive (90/385/EEC), bringing active implantables under the same regulation as all other medical devices. Much of the added length is in post-market requirements: the PMS, PSUR, and vigilance obligations in Articles 83 to 92 and Annex III had no real equivalent in the MDD.

Section 522 Post Market Surveillance Requirements

Section 522 is a US FDA authority, separate from EU MDR, that lets FDA order post-market surveillance for certain Class II and Class III devices.

FDA has established an automated tracking system that efficiently identifies the reporting status of active 522 Post Market Surveillance studies. The FDA says it’s trying to ensure those commitments are fulfilled promptly.

Under Section 522 of the Federal Food, Drug, and Cosmetic Act, FDA can order the manufacturer of a Class II or Class III device to conduct postmarket surveillance if the device meets at least one of these criteria: its failure would be reasonably likely to have serious adverse health consequences; it is expected to have significant use in pediatric populations; it is intended to be implanted in the body for more than one year; or it is intended to be a life-sustaining or life-supporting device used outside a device user facility. Section 522 is a US requirement and has no direct equivalent in the EU, where PMS is a standing obligation for every device rather than something a regulator orders case by case.

What is a Post-Market Clinical Follow-up (PMCF)?

The post-market section of the Clinical Evaluation Report (CER) must include Post-market surveillance data and information.

The PMCF is the systematic collection of clinical data to answer important questions about the safety or performance of the medical device and update its clinical evaluation.

In addition, documentation of the findings of PMCF is a must in a PMCF evaluation report, which is a part of the Clinical Evaluation Report.

The PMCF evaluation report must discuss any regulatory action (such as recalls and notifications), incidents must be displayed in a table, and (serious) adverse events must be mentioned in detail (with a focus on the evaluation of whether an incident is device-related or not). The conclusions may also lead to an update of the risk management documents.

Why PMS Matters Under the MDR

Some risks only show up once a device is in routine use and storage, which is why the MDR puts so much weight on collecting data after CE marking.

Post-market surveillance (PMS) is an important part of the regulatory framework for medical devices in Europe.

The Medical Device Regulation (MDR) emphasizes gathering clinical and safety-related data after the approval/CE certification process and market access.

Monitoring CE-marked products are crucial to identifying risks identified in the practical use of the product.

Through continuous and systematic post-market surveillance, manufacturers can ensure that medical devices are safe and have no uncontrolled risks, such as defects or undetected security problems.

Manufacturers must ensure they are safe when using medical devices, as some risks only become apparent when used and stored.

What are the PMS requirements imposed by applicable QMS and risk management standards?

ISO 13485:2016 and ISO 14971:2019 aren’t legally mandatory, but both expect PMS data to feed the QMS feedback process and risk management.

EN ISO 13485:2016 and EN ISO 14971:2019 are both harmonised under the MDR. Neither is legally mandatory, but compliance with them is the standard way to demonstrate that your quality and risk management processes, including how they use PMS data, meet the regulation. ISO/TR 20416:2020 adds dedicated guidance on post-market surveillance for manufacturers.

The PMS requirements in the post-market phase do not focus on reporting obligations. Instead, they require PMS data to be used to re-estimate the probability and severity of harms, so that the manufacturer can confirm whether all risks have been identified, whether they still meet the risk acceptance criteria, and whether the benefit–risk ratio remains acceptable.

Collecting information through the feedback process needs to consider as input for risk management.

Minimum requirements for a PMS Plan according to Annex III (MDR 2017/745)

• Information from PSUR’s
• Serious incidents
• Field safety corrective actions
• Data on undesirable side-effects
• Trend reporting
• Inputs referring to non-serious incidents
• Literature, registers, and or databases
• Feedbacks and complaints sources from users, distributors, and importers
• Publicly available resources on similar devices

How to Right-Size Your PMS Plan

TL;DR: Scope the plan to the device’s risk class, cover every Annex III data source but justify exclusions, match update frequencies to what the regulation requires, and let data thresholds decide when to do more.

1. Start from risk class and device type. Article 83 requires the PMS system to be proportionate to the risk class and appropriate for the type of device. A Class I reusable instrument and a Class III implant should not have the same plan.
2. Address every Annex III data source, then justify what you exclude. MDCG 2025-10 expects a device-specific plan, and where a source or activity doesn’t apply, a documented reason is enough. Committing to a source you’ll never use is worse than a clear justification.
3. Match frequencies to the regulation, not your ambitions. PSURs are due at least annually for Class IIb and III and every two years for Class IIa. Promising quarterly literature reviews or monthly trend meetings is fine if you’ll staff them, but each promise becomes something a notified body can check.
4. Keep the CER, PMCF plan, and PMS plan consistent. Every post-market commitment in the clinical evaluation should appear in the PMS plan, and vice versa. Auditors compare what was promised against what was delivered.
5. Use thresholds to scale up. Annex III requires indicators and threshold values for reassessing benefit–risk. Set them so that a signal triggers additional activity, rather than committing to maximum activity from day one.

For the full list of what the plan must contain, see the PMS plan section of our main PMS guide. For tooling that keeps literature and adverse event monitoring on schedule, see CiteMed Vigilance.

FAQ

What does an EU MDR post-market surveillance plan need to include?

Annex III, Section 1.1 sets the minimum: the data sources you’ll use, how you’ll collect and assess them, indicators and thresholds for reassessing benefit–risk, complaint and trend-reporting methods, links to corrective actions, and a PMCF plan or justification. Our main PMS guide [link: /post-market-surveillance-under-eu-mdr/] lists each element in full.

How do I decide the right PMS plan scope for my device?

Start from the device’s risk class, intended purpose, and how long it has been on the market. Higher-risk, novel, or implantable devices justify more proactive data collection and PMCF; well-established lower-risk devices can often rely more on complaints, literature, and vigilance databases, with the reasoning written down.

Can I leave a data source out of my PMS plan?

Yes, if it genuinely doesn’t apply to your device and you document why. MDCG 2025-10 expects the justification to be in the plan, so an unexplained gap is the problem, not the exclusion itself.

What happens if I don’t deliver what my PMS plan promised?

Notified bodies review the PMS plan against the PMS outputs and the CER during audits and technical documentation reviews. Commitments that weren’t carried out are likely to be raised as nonconformities, which is why over-committing is a real risk rather than a harmless extra.

Is right sizing a PMS plan the same as doing the minimum?

No. Right sizing means committing to what the risk profile actually needs and what you can resource consistently, with thresholds that escalate activity when the data warrants it. For some devices, that is more than the minimum.

Does every device need a PMCF plan?

Every device needs either a PMCF plan or a documented justification for why PMCF isn’t necessary, and the justification must hold up to notified body review.