Post-Market Surveillance Under EU MDR: The Complete Guide

Post-market surveillance (PMS) under EU MDR is the system every manufacturer must run to proactively collect and review real-world data on its devices once they are on the market, and to act on what that data shows. It is set out in Articles 83 to 86 and Annex III of Regulation (EU) 2017/745, must be part of the manufacturer’s quality management system, and produces a PMS plan for every device plus either a PMS Report (Class I) or a Periodic Safety Update Report (Class IIa, IIb, and III). This is CiteMed’s main PMS guide; the supporting posts linked throughout go deeper on specific parts.

Post-market surveillance (PMS) under the EU MDR (2017/745) is a systematic and proactive process through which medical device manufacturers collect, analyze, and continuously evaluate data on device safety and performance after a device has been placed on the market.

The purpose of PMS is to ensure that devices continue to perform as intended in real-world clinical use, while enabling the early identification of safety concerns, performance issues, and emerging risks. This supports ongoing benefit–risk evaluation and helps maintain compliance with regulatory requirements throughout the device lifecycle.

Central to this process is the PMS plan, which defines the methods and procedures for data collection, analysis, and ongoing monitoring. Under the EU MDR, manufacturers are required to establish, implement, document, maintain, and update a PMS system for each device, in a manner proportionate to its risk class and appropriate for its intended purpose. The PMS system forms an integral part of the manufacturer’s quality management system.

A well-designed PMS system not only supports regulatory compliance but also enables continuous improvement, informed decision-making, and the safe and effective use of medical devices in clinical practice.

The Legal Framework: MDR Articles 83 to 92

PMS sits in MDR Articles 83–86, vigilance in Articles 87–92, and Annex III sets out what the PMS technical documentation must contain; the IVDR mirrors this in Articles 78–87.

MDR Article 2(60) defines post-market surveillance as “all activities carried out by manufacturers in cooperation with other economic operators to institute and keep up to date a systematic procedure to proactively collect and review experience gained from devices they place on the market, make available on the market or put into service for the purpose of identifying any need to immediately apply any necessary corrective or preventive actions.”

The obligations that flow from that definition are spread across ten articles:

On December 19, 2025, the Medical Device Coordination Group published MDCG 2025-10, its guidance on post-market surveillance under both the MDR and IVDR. It stresses that PMS plans must be device-specific, that generic, template-driven plans are not enough, and that where a data source or activity doesn’t apply, the manufacturer must document why. MDCG 2025-10 does not cover how to draft the reports themselves; for PSURs, MDCG 2022-21 remains the reference guidance.

Adverse Event and Incident Definitions

An adverse event is a clinical investigation concept covering any untoward medical occurrence; an incident is a malfunction, deterioration, or use-related problem with a device already on the market.

Under the EU MDR, adverse events and incidents are defined as distinct concepts within the context of clinical investigation and post-market surveillance.

An adverse event is defined as any untoward medical occurrence, unintended disease or injury, or any adverse clinical sign, including abnormal laboratory findings, in subjects, users, or other persons, even if it is not related to the investigational device.

An incident is defined as any malfunction or deterioration in the characteristics or performance of a device made available on the market, including use errors due to ergonomic features, inadequacies in the information supplied by the manufacturer, or undesirable side effects.

Although these terms are sometimes used interchangeably in practice, they represent different regulatory concepts and should be distinguished within PMS and vigilance activities.

Medical Device Adverse Event Monitoring

Manufacturers must identify incidents and respond by severity, and serious incidents and FSCAs are reported to the competent authority under Article 87.

Under the EU MDR, manufacturers are required to monitor for and identify incidents associated with their devices and respond appropriately based on the severity of the event (e.g., complaint, serious injury, or death).

Where a serious incident occurs, or a Field Safety Corrective Action (FSCA) is undertaken, manufacturers must report it to the relevant competent authorities in accordance with vigilance requirements under Article 87 of the EU MDR. Until the EUDAMED vigilance module becomes mandatory, reports go through national procedures using the Manufacturer Incident Report (MIR) form, and version 7.3.1 of that form became mandatory on May 1, 2026.

Trend Reporting

Article 88 requires manufacturers to report statistically significant increases in non-serious incidents or expected side effects that could affect the benefit–risk profile.

Trend reporting refers to the systematic analysis of incident data to identify increases in frequency or severity that may impact the device’s safety or benefit–risk profile.

Under Article 88 of the EU MDR, manufacturers must report any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or of expected undesirable side effects, that could significantly affect the benefit–risk analysis. The PMS plan must specify how such increases are identified, including the methodology and the observation period.

Trend reporting is based on data collected through post-market surveillance activities, including adverse event monitoring and vigilance reporting. A structured and continuous approach to data analysis is essential to ensure that emerging risks are identified and addressed in a timely manner.

Core Components of a Post-Market Surveillance System

A PMS system rests on four ongoing activities: updating the benefit–risk determination, reviewing clinical performance data, monitoring safety signals, and documenting all of it.

A well-designed PMS system is structured around several core components that ensure continuous monitoring of device safety and performance throughout the product lifecycle.

These components include:

• Updating the benefit–risk determination

Ongoing assessment of clinical data, adverse events, and new information is required to determine whether the device’s benefit–risk profile remains acceptable over time.

• Clinical performance evaluation

Review of clinical data, including scientific literature and real-world evidence, supports the continued demonstration of device safety and performance in the intended population.

• Monitoring and summarizing safety information

Systematic collection and analysis of adverse events, incidents, and safety signals enables early identification of potential risks.

• Documentation of PMS activities and processes

All PMS activities must be clearly documented, including methodologies, data sources, analyses, and resulting conclusions, to ensure transparency and regulatory compliance.

Use Technology to Ensure Consistency

The use of digital tools can support the consistent and efficient execution of post-market surveillance activities. These tools may assist in the systematic collection, organisation, and analysis of data from multiple sources, including scientific literature and adverse event databases.

Structured use of technology can also improve traceability, reproducibility, and documentation of PMS processes, supporting compliance with EU MDR requirements and facilitating ongoing monitoring throughout the device lifecycle.

Incidence Reporting and Vigilance

Annex III of the MDR contains the technical documentation that is outlined in the preceding articles addressing Post Market Surveillance. Manufacturers must establish, document, implement, maintain, and update a post-market surveillance system for each device. This system must be proportionate to the risk class and appropriate for the type of device.

Manufacturers are also required to take appropriate measures based on surveillance data to address identified issues and ensure device safety and compliance.

Reporting Requirements and Timelines

Under Article 87 of the EU MDR, manufacturers are required to report serious incidents and field safety corrective actions (FSCAs) within defined timelines. These reporting requirements are based on the severity of the event and are critical to ensuring timely risk mitigation and regulatory oversight. The reporting timelines are as follows:

A serious public health threat refers to an event that may result in imminent risk of death, serious deterioration of health, or significant public health impact requiring rapid intervention.

Manufacturers are required to report within these timelines from the point at which they become aware of the incident. Timely identification and escalation of such events are essential components of an effective PMS system.

Field Safety Corrective Actions for Medical Devices

Under the EU MDR, manufacturers are required to report any Field Safety Corrective Actions (FSCAs) undertaken to address safety concerns associated with a device. For more information, you can refer to EU MDR Combination Products.

This includes FSCAs related to equivalent devices in third countries. Where such actions occur, manufacturers must assess their relevance and report them to the appropriate European authorities as part of their vigilance obligations.

What Goes in a Post-Market Surveillance Plan (Annex III, Section 1.1)

Annex III requires the PMS plan to name every data source, the methods for analysing it, the indicators and thresholds that trigger a benefit–risk reassessment, and the links to CAPA, trend reporting, and PMCF.

Article 84 requires a PMS plan for every device, and Annex III, Section 1.1 sets out its minimum content. The plan must address how the manufacturer will collect and use:

• information on serious incidents, including information from PSURs, and field safety corrective actions;
• records of non-serious incidents and data on any undesirable side effects;
• information from trend reporting;
• relevant specialist or technical literature, databases, and/or registers;
• feedback and complaints from users, distributors, and importers; and
• publicly available information about similar medical devices.

It must also describe:

• a proactive and systematic process for collecting that information;
• effective and appropriate methods for assessing the data collected;
• suitable indicators and threshold values for continuously reassessing the benefit–risk analysis and risk management;
• methods and tools for investigating complaints and analysing market experience in the field;
• methods and protocols for managing trend-reported events, including how a statistically significant increase is established and over what observation period;
• methods for communicating with competent authorities, notified bodies, economic operators, and users;
• procedures for identifying and initiating corrective actions, and tools to trace the devices affected; and
• a post-market clinical follow-up (PMCF) plan, or a justification for why PMCF is not applicable.

For the full list of PMS documents and when each applies, see The Post-Market Surveillance Document: Which Ones Do You Need?. For how to keep the plan proportionate rather than promising more than you can deliver, see Are You Over-Committing on Your EU MDR Post-Market Surveillance Plan?

Monitoring for and Identifying Applicable Events

Monitoring scope scales with distribution: a single-market device may only need national alert subscriptions, while a global portfolio needs structured monitoring across jurisdictions.

Monitoring processes may vary depending on the distribution and complexity of the device portfolio. For devices marketed in a limited number of regions, surveillance activities may be supported through subscription to national adverse event alert systems or vigilance databases.

For devices with broader market presence or multiple equivalent products across regions, monitoring requirements become more complex, requiring structured approaches to identify and assess reportable events across multiple jurisdictions in accordance with Article 87 of the EU MDR.

For lower-risk devices (e.g., Class I), the EU MDR imposes less stringent post-market surveillance requirements. Manufacturers of these devices are required to maintain a PMS Plan and generate a PMS Report, rather than a Periodic Safety Update Report (PSUR).

Monitoring activities may include routine review of adverse event databases, vigilance reports, and other relevant data sources. The use of centralized tools or platforms may support efficient aggregation and assessment of global incident data.

The PMS Report for lower-risk devices should summarize data analysis, conclusions, and any corrective actions taken in relation to device safety and performance throughout the device lifecycle.

Monitoring processes should be clearly defined, consistently applied, and adequately documented to ensure transparency, traceability, and regulatory compliance.

Role of Notified Body in Post-Market Surveillance

The notified body plays a pivotal role in the post market surveillance process for medical devices under the EU MDR. As an independent organization designated by EU member states, the notified body is responsible for assessing and verifying that a manufacturer’s PMS system meets all MDR requirements. This includes reviewing the manufacturer’s PMS plan, evaluating post market surveillance reports, and ensuring that the processes in place are effective and compliant.

During audits and technical documentation reviews, the notified body examines how manufacturers collect, analyze, and act on post market data. They assess whether the PMS system is capable of identifying and addressing safety or performance issues in a timely manner. If gaps or deficiencies are found, the notified body provides feedback and guidance, helping manufacturers refine their PMS processes and maintain regulatory compliance.

Ongoing interaction with the notified body is essential for manufacturers, as it ensures that their PMS activities remain aligned with the latest regulatory expectations. By working closely with the notified body, manufacturers can strengthen their market surveillance efforts, respond proactively to emerging risks, and demonstrate their commitment to patient safety and product quality.

Periodic Safety Update Report

The live section says the PSUR applies “particularly” to Class III and “certain Class IIb” devices, and that it is submitted “typically annually for Class III and implantable devices, and at least every two years for other specified devices.” Both points are inaccurate under Article 86. Corrected first two paragraphs:

The Periodic Safety Update Report (PSUR) is a cornerstone of the post-market surveillance system for all Class IIa, Class IIb, and Class III medical devices. The PSUR provides a structured, comprehensive overview of the device’s safety and clinical performance over a defined period, consolidating all relevant data collected through the PMS system.

Within the PSUR, manufacturers must summarise the results and conclusions of their PMS data analysis, including any new or emerging safety concerns, trend analysis, benefit-risk determination updates, the main findings of PMCF, sales volumes and an estimate of the population using the device, and the effectiveness of preventive and corrective actions taken. Class IIb and Class III PSURs must be updated at least annually; Class IIa PSURs must be updated when necessary and at least every two years. For Class III and implantable devices, the PSUR is submitted to the notified body, which adds its evaluation; for other classes, it is made available to the notified body and, on request, to competent authorities.

By maintaining up-to-date PSURs, manufacturers demonstrate their commitment to continuous monitoring and improvement of their medical devices. The PSUR not only supports regulatory compliance but also provides valuable insights for risk management, clinical evaluation, and the overall safety profile of devices on the EU market. Regular submission and review of the PSUR ensure that both manufacturers and regulators remain vigilant in protecting patient safety and maintaining high standards of device performance.

PMS Report vs PSUR: What Each Device Class Needs

Class I devices need a PMS Report; Class IIa, IIb, and III devices need a PSUR, updated every two years for IIa and annually for IIb and III.

Every class, MDR or IVDR, also needs a PMS plan and a PMCF (or, for IVDs, PMPF) plan or a justification for not having one. For how the MDR and IVDR versions compare line by line, see Post-Market Surveillance and Vigilance: MDR vs IVDR.

PMS vs Market Surveillance: What Competent Authorities Do

PMS is the manufacturer’s job; market surveillance is what national competent authorities do under MDR Article 93 (IVDR Article 88) to check that devices on the market comply.

The term market surveillance covers the activities carried out by national regulatory authorities to ensure the safety and efficiency of products placed on the market. In these activities, the national regulatory authorities put measures in place to verify and guarantee the regulatory compliance of products and to establish processes and appropriate measures for diminishing the risk of non-compliant products.

Medical devices in the European Union market must comply with article 93 of the Medical Device Regulation (MDR; 2017/745) and article 88 of the In Vitro Diagnostic Regulation (IVDR; 2017/746).

Market surveillance is defined in the MDR as “…the activities carried out and measures taken by regulatory authorities to check and ensure that devices comply with the requirements set out in the relevant European Union harmonization legislation and do not endanger health, safety or any other aspect of public interest protection;” Article 93 of the MDR further outlines the market surveillance responsibilities of each regulatory authority.

Conformity and performance assessment

Every competent authority, i.e., every designated government department for an EU member state, must check the conformity characteristics and performance of the devices manufactured or available in their market. They should mainly consider risk assessment and management, vigilance data, and complaints when doing so.

This means making sure the economic operators of the products gather the documentation and information necessary to confirm the product’s conformity and make it available to the authorities. It also means that economic operators, such as manufacturers or importers, must provide the necessary medical device samples for testing, free of charge if required by the authorities.

The competent authority must perform announced and, if required, unannounced inspections of production lines, warehouses, and other facilities used by the economic operators to produce and distribute their medical devices. The inspections must be documented in reports summarizing the findings of the inspection and set out any corrective actions if needed. This report is made available to the economic operator subject to the inspection, and before finalizing and adopting the report, the economic operator has the opportunity to submit comments. Once finalized, the report is uploaded to EUDAMED.

Annual surveillance activities

Just as manufacturers must run a PMS system and report on it, competent authorities are required to draw up surveillance plans and report on their activities.

Each regulatory authority is obligated to establish and maintain annual surveillance activity plans under the MDR. The surveillance activities carried out must also be summarized yearly and be made accessible to other competent/regulatory authorities through EUDAMED.

Likewise, the regulatory authority must allocate materials and human resources to carry out these activities.

Non-compliant medical devices

Even though medical device manufacturers do everything to ensure the safety of their devices, adverse events and malfunctions are bound to happen. Off-label use, unexpected errors, and faulty servicing or training happen to even the most tested medical devices.

The main job of the competent authority is to protect public health. Therefore, they must confiscate, destroy, or otherwise render inoperable devices that pose an unacceptable risk to the patient or user. Likewise, they are obligated to confiscate and destroy any falsified medical devices or in vitro diagnostic devices they come across in their market.

Sharing information across borders in the European Union

The European Union market consists of many different cultures and countries. Therefore, in order to ensure the protection of public health in each country, an effort to communicate and coordinate activities across borders is necessary.

After reviewing and assessing the functioning of their market surveillance activities, the MDR requires each Member State to make a summary of its results and make it available to the other Member States through EUDAMED.

Likewise, each regulatory authority must coordinate its market surveillance activities with other Member States to “provide for a harmonized and high level of market surveillance in all Member States” (article 93.9). The authorities must also share their work, join their market surveillance activities and specializations, and share information where appropriate.

Lastly, the member states are also responsible for cooperation with competent authorities in countries or markets outside the European Union, exchanging information and technical support whenever needed.

EUDAMED

EUDAMED is the European Database on Medical Devices, the central IT system the MDR and IVDR use for transparency, traceability, and information-sharing between manufacturers, notified bodies, competent authorities, and the European Commission. Much of its data, including registered actors, devices, and certificates, is publicly accessible. Commission Decision (EU) 2025/2371, published in the Official Journal on November 27, 2025, declared the first four modules (Actor Registration, UDI/Device Registration, Notified Bodies and Certificates, and Market Surveillance) functional, and their use became mandatory on May 28, 2026. The vigilance and clinical investigation modules are not yet mandatory.

Depending on the classification of a medical device and which regulations and provisions it falls under, EUDAMED contains the following relevant data, where applicable:

• Quality Management System certificates
• Labeling and instructions for use
• Declarations of conformity
• Vigilance and traceability systems
• Registration of manufacturer, authorized representative, and device data lists
• Classification justification
• Clinical investigation data
• Any other information required for the device

For a deeper look at how PMS, vigilance, and market surveillance differ, see PMS vs Market Surveillance vs Vigilance.

Related PMS Guides

These supporting guides each cover one part of PMS in depth and link back here for the fundamentals.

• The Post-Market Surveillance Document: Which Ones Do You Need? Every PMS document, which classes need it, and how often.
• Are You Over-Committing on Your EU MDR Post-Market Surveillance Plan? How to scope a PMS plan you can actually deliver.
• Post-Market Surveillance and Vigilance: MDR vs IVDR: side-by-side comparison of the two regulations.
• PMS vs Market Surveillance vs Vigilance: the three terms and who is responsible for each.
• CiteMed Vigilance: software for adverse event monitoring, literature surveillance, and PMS reporting.

Conclusion

PMS is a lifecycle obligation, and done well, it drives benefit–risk updates, clinical evaluation, and product improvement rather than just satisfying an auditor.

Post-market surveillance is a fundamental component of the EU MDR framework, ensuring that medical devices continue to meet safety and performance requirements throughout their lifecycle.

A well-structured PMS system enables the continuous collection and evaluation of real-world data, supporting timely identification of risks, informed benefit–risk assessment, and effective regulatory compliance.

Beyond fulfilling regulatory obligations, PMS plays a critical role in maintaining device quality, guiding ongoing clinical evaluation, and supporting improvements in patient outcomes.

Ultimately, a robust PMS system reinforces a proactive, evidence-based approach to medical device safety and contributes to the safe and effective use of devices in clinical practice.

FAQ

What is post market surveillance under EU MDR?

It is the manufacturer’s legal obligation, under Articles 83 to 86 of Regulation (EU) 2017/745, to run a planned, proactive system that collects and reviews real-world experience with its devices and acts on it. The system must be proportionate to the device’s risk class, form part of the quality management system, and feed back into risk management, clinical evaluation, and corrective actions.

What are the EU MDR PMS requirements for each device class?

Every device needs a PMS system and a device-specific PMS plan. Class I devices then need a PMS Report, updated when necessary and available to competent authorities on request. Class IIa devices need a PSUR updated at least every two years, and Class IIb and III devices need a PSUR updated at least annually.

What must a post market surveillance plan include?

Annex III, Section 1.1 requires the plan to cover every relevant data source (serious and non-serious incidents, trend data, literature and registries, complaints and user feedback, and information on similar devices) and to describe how that data will be analysed. It must also define indicators and thresholds for reassessing benefit–risk, link to CAPA and trend reporting, and include a PMCF plan or a justification for why PMCF isn’t needed.

What does the PMS process for medical devices look like in practice?

It runs as a loop: plan the data sources and methods, collect data proactively and reactively, analyse it against the thresholds in the plan, act on the findings, and report. Actions can include CAPA, updates to the risk file, clinical evaluation report, instructions for use, or SSCP, and vigilance reports where a serious incident or FSCA is involved.

What is the difference between PMS and market surveillance of medical devices?

PMS is carried out by the manufacturer on its own devices. Market surveillance is carried out by national competent authorities across the whole market, under MDR Article 93 and IVDR Article 88, to check that devices comply and don’t endanger health.

What are the EU MDR market surveillance requirements for competent authorities?

Each competent authority must check the conformity and performance of devices on its market, carry out announced and, where needed, unannounced inspections, and act on devices that pose an unacceptable risk or are falsified. It must also draw up annual surveillance plans, summarise its activities each year, and share results with other Member States through EUDAMED.

What medical device market surveillance requirements apply to manufacturers?

Manufacturers and other economic operators must cooperate with authority checks. That means making the documentation needed to demonstrate conformity available, providing device samples free of charge where requested, and allowing inspections of manufacturing and distribution facilities.

Is there official guidance on PMS under EU MDR?

Yes. MDCG 2025-10, published December 19, 2025, is the main guidance on PMS systems and plans under both the MDR and IVDR. MDCG 2022-21 covers PSURs, and ISO/TR 20416:2020 gives manufacturers a standards-based approach to PMS.

How quickly must serious incidents be reported under EU MDR?

Immediately, and no later than 2 days for a serious public health threat, 10 days for a death or unanticipated serious deterioration in health, and 15 days for any other serious incident, counted from when the manufacturer becomes aware. See CiteMed Vigilance for how these deadlines are tracked in practice.