Post-Market Surveillance for High-Risk Devices: Class IIb and Class III Requirements Under EU MDR
Executive Summary Under EU MDR 2017/745, post-market surveillance is an active, continuous obligation for all [...]
Executive Summary
Under EU MDR 2017/745, post-market surveillance is an active, continuous obligation for all medical device manufacturers. For Class IIb and Class III devices, the requirements are more extensive and subject to greater regulatory oversight than for lower-risk device classes. Manufacturers of high-risk devices face more frequent reporting obligations, more intensive Notified Body involvement, and a higher standard of evidence for demonstrating ongoing safety and performance.
Many manufacturers underestimate the practical demands of post-market surveillance for high-risk devices. The Periodic Safety Update Report must be submitted annually. PMCF activities must be proactive and well-documented. The Clinical Evaluation Report must remain current. And all of this must connect coherently across the technical file.
This article examines the specific post-market surveillance requirements for Class IIb and Class III devices, what Notified Bodies look for, and how manufacturers can build a defensible PMS system that meets the heightened expectations for high-risk devices.
Key Takeaways
- Class IIb and Class III devices are subject to enhanced post-market surveillance requirements under EU MDR, including annual PSUR submission and proactive PMCF obligations
- The PSUR must include a genuine benefit-risk evaluation, not just a summary of surveillance data, this is one of the most common reasons PSURs are challenged during Notified Body review
- PMCF is mandatory for Class III and implantable devices; for Class IIb devices it must be justified whether PMCF activities are appropriate
- The Summary of Safety and Clinical Performance (SSCP) is required for Class III and implantable Class IIb devices and must be updated annually
- Post-market surveillance findings must feed directly into the CER, risk management file, and PMCF plan to maintain alignment across the technical file
- Serious incidents must be reported to competent authorities within defined timelines under EU MDR Article 87
- Ongoing literature surveillance is a required component of PMS for high-risk devices and must be conducted systematically
Table of Contents
- Direct Answer: What Are the PMS Requirements for Class IIb and Class III Devices?
- Why It Matters: Enhanced Obligations for High-Risk Devices
- How It Works: PMS System Requirements and Key Activities
- Common Mistakes: Where High-Risk Device PMS Fails
- Best Practices: Building a Defensible PMS System for High-Risk Devices
- Comparison Table
- Checklist
- Definitions
- Expert Perspective
- FAQ
- References
- Related Resources
- Call to Action
Direct Answer: What Are the PMS Requirements for Class IIb and Class III Devices?
Class IIb and Class III devices are subject to enhanced post-market surveillance requirements under EU MDR compared to lower-risk device classes. The key differences are:
Annual PSUR: Under Article 86, Class IIb and Class III devices require a Periodic Safety Update Report updated at least annually and submitted to the Notified Body. Class IIa devices require a PSUR updated at least every two years.
Proactive PMCF: Post-Market Clinical Follow-Up is mandatory for Class III and implantable devices. For Class IIb devices, manufacturers must justify in the PMCF plan whether PMCF activities are appropriate, and if not, provide a clear scientific justification.
SSCP requirement: Class III and implantable Class IIb devices require a Summary of Safety and Clinical Performance, which must be validated by the Notified Body and updated at least annually.
Notified Body scrutiny: Notified Bodies assess the PSUR and technical documentation for Class IIb and Class III devices as part of ongoing surveillance, with greater frequency and depth than for lower-risk classes.
Vigilance reporting: Serious incidents involving Class IIb and Class III devices must be reported to competent authorities within defined timelines under Article 87.
Why It Matters: Enhanced Obligations for High-Risk Devices
The enhanced post-market surveillance requirements for Class IIb and Class III devices reflect their higher risk profile and the greater consequences of safety failures. A Class III implantable device that develops an unexpected safety signal has significantly different patient consequences than a Class I device. The regulatory framework reflects this through more intensive oversight, more frequent reporting, and a higher evidentiary standard for demonstrating continued safety and performance.
In practice, many manufacturers underestimate the operational demands of meeting these requirements continuously. The PSUR is not a once-a-year document production exercise. It requires a functioning post-market surveillance system that generates, collects, and analyses data throughout the year. PMCF activities must be planned, executed, and their findings integrated into the CER on an ongoing basis. Literature surveillance must be continuous. And all of these activities must remain aligned and consistent across the technical file.
Manufacturers who treat post-market surveillance as a periodic documentation exercise rather than a continuous operational system consistently face the same problems: outdated PSURs that do not reflect current data, CERs that are inconsistent with post-market findings, and PMCF plans that exist as documents but are not generating meaningful evidence. These gaps are identified by Notified Bodies during surveillance audits and result in findings that require significant remediation effort.
How It Works: PMS System Requirements and Key Activities
The PMS System Foundation
Under Article 83 of EU MDR, manufacturers must establish, document, implement, and maintain a post-market surveillance system that is proportionate to the risk class and type of device. For Class IIb and Class III devices, this system must be capable of generating and analysing a comprehensive range of post-market data on a continuous basis.
The PMS system must collect and process data from complaints and adverse event reports, vigilance data and field safety corrective actions, scientific literature and post-market clinical data, PMCF study findings, registry data where available, and information from other post-market sources relevant to the device. The system must be documented in a PMS plan, which defines the data sources, collection methods, analysis processes, and thresholds for escalation.
Periodic Safety Update Report
The PSUR is the primary periodic reporting document for Class IIb and Class III devices. Under Article 86, it must be updated at least annually and made available to the Notified Body on request or as part of surveillance activities.
The PSUR must include the conclusions of a benefit-risk determination based on the findings of the PMS system, the main findings of the PMCF plan, the volume of sales of the device, and an estimate of the size of the population using the device. It must assess whether the benefit-risk balance remains acceptable given all available post-market evidence.
The benefit-risk evaluation in the PSUR is one of the most commonly challenged elements during Notified Body review. A PSUR that presents surveillance data accurately but does not critically analyse what that data means for the device’s ongoing benefit-risk profile will generate findings regardless of how thorough the underlying data collection appears. The analytical layer is not optional. It is the point of the document.
Post-Market Clinical Follow-Up
PMCF is the structured process through which manufacturers proactively collect clinical data on their device after it has reached the market. Under Annex XIV Part B, PMCF activities must be documented in a PMCF plan that defines the objectives, methods, and rationale for the chosen activities.
For Class III and implantable devices, PMCF is mandatory. PMCF activities may include post-market clinical investigations, patient registries, systematic literature reviews, user surveys, analysis of complaint and incident data, and other structured data collection methods. The findings must be documented in a PMCF evaluation report that forms part of the CER and must be updated at least annually.
For Class IIb devices, manufacturers must justify in the PMCF plan whether PMCF activities are appropriate. Where PMCF is considered unnecessary, a clear scientific justification must be provided. This justification must be well-founded and defensible, as Notified Bodies scrutinise the reasoning carefully for higher-risk devices.
Summary of Safety and Clinical Performance
Class III and implantable Class IIb devices require a Summary of Safety and Clinical Performance (SSCP) under Article 32 of EU MDR. The SSCP must be written in a way that is clear to the intended user and validated by the Notified Body. It must be updated at least annually with the findings of the PMCF evaluation report.
The SSCP is a publicly available document, making accuracy and consistency with the CER and other technical documentation particularly important. Inconsistencies between the SSCP and the technical file can raise questions during regulatory review.
Vigilance Reporting
Under Article 87, manufacturers must report serious incidents and field safety corrective actions to the relevant competent authority within defined timelines. Serious incidents must generally be reported immediately and no later than 15 days for incidents that have or could have led to serious public health threats, and 30 days for other serious incidents.
The vigilance process must be integrated with the broader PMS system. Vigilance data forms a key input to the PSUR and must be reflected in the benefit-risk evaluation. For Class IIb and Class III devices, vigilance trends are one of the primary signals through which emerging safety concerns are identified.
Ongoing Literature Surveillance
Systematic literature surveillance is a required component of the PMS system. Manufacturers must monitor published clinical and scientific literature on a continuous basis to identify new evidence relating to the device, comparable technologies, emerging risks, and changes in the state of the art. For high-risk devices, literature surveillance must be structured, documented, and conducted with sufficient frequency to ensure that new safety signals are not missed between review cycles.
The findings of literature surveillance feed into the PSUR, the CER, and the PMCF plan. Where new literature identifies previously unknown risks or changes to the accepted benefit-risk profile, these must be assessed and reflected in the relevant documentation.
Alignment Across the Technical File
For Class IIb and Class III devices, the coherence of the technical file is subject to close scrutiny during Notified Body assessment. Post-market surveillance findings must feed directly into the CER and risk management file. The PSUR benefit-risk conclusion must be consistent with the CER benefit-risk conclusion. The PMCF evaluation report must inform the CER update. And the SSCP must accurately reflect the current state of the clinical evidence.
Where these documents are developed in isolation by different teams with limited coordination, inconsistencies emerge that are difficult and time-consuming to remediate. Building alignment across the technical file from the outset is significantly more efficient than attempting to reconcile documents under Notified Body deadline pressure.
Common Mistakes: Where High-Risk Device PMS Fails
Treating PSUR preparation as a periodic document exercise
The most common failure in high-risk device PMS is treating the PSUR as an annual document production task rather than the output of a continuously operating surveillance system. A PSUR that is assembled once a year from data that has not been actively monitored throughout the year will not reflect the current state of the device’s safety and performance profile accurately. This is immediately apparent to Notified Bodies reviewing the document.
Descriptive PSURs without genuine benefit-risk analysis
A PSUR that presents complaint rates, vigilance reports, and PMCF findings accurately but does not critically evaluate what those findings mean for the device’s benefit-risk profile will generate a finding during Notified Body review regardless of how complete the data appears. The analytical layer is not optional. Notified Bodies expect to see a reasoned assessment of whether the available evidence continues to support the benefit-risk conclusion, not a data summary.
PMCF plans that exist as documents but generate no evidence
For Class III and implantable devices, a PMCF plan that defines activities but does not result in actual data collection fails to meet the intent of the requirement. PMCF activities must be executed and their findings documented in the PMCF evaluation report. A plan without execution is a compliance gap that Notified Bodies identify consistently.
Weak linkage between PMS and the CER
Post-market surveillance findings that are not reflected in CER updates create inconsistencies across the technical file. Where the PSUR identifies a new safety signal but the CER benefit-risk conclusion has not been updated to reflect it, the technical file presents conflicting accounts of the device’s safety profile. This is one of the most frequently cited findings during Notified Body surveillance audits for Class IIb and Class III devices. For a full breakdown of the most common reasons Clinical Evaluation Reports are rejected see our dedicated article on this topic.
Inadequate vigilance integration
Vigilance data that is managed separately from the broader PMS system produces fragmented documentation. Serious incidents, trends identified through complaint monitoring, and field safety corrective actions must all feed into the PSUR and be reflected in the benefit-risk evaluation. Where vigilance is treated as a standalone regulatory reporting obligation rather than a component of the evidence system, the PSUR benefit-risk analysis is incomplete.
Literature surveillance gaps between review cycles
For high-risk devices, new published evidence that emerges between annual CER or PSUR review cycles may identify safety signals or changes to the state of the art that should prompt an earlier reassessment. Manufacturers who conduct literature searches annually without continuous monitoring risk missing evidence that Notified Bodies would expect to have been incorporated. For a full breakdown of how literature review methodology gaps affect regulatory submissions, see our dedicated article on this topic.
Best Practices: Building a Defensible PMS System for High-Risk Devices
A defensible post-market surveillance system for Class IIb and Class III devices functions as a continuous evidence ecosystem, not a periodic reporting exercise. The following practices characterise the most effective high-risk device PMS systems.
Build the PMS system before it is needed
The PMS system should be established and operational before the device reaches the market, not after regulatory pressure begins to build. Data collection processes, complaint handling procedures, literature surveillance workflows, and PMCF activities should all be in place from market entry, ensuring that data is available when the first PSUR is due.
Make PMCF activities substantive
For Class III and implantable devices, PMCF must generate real evidence. The PMCF plan should define specific, achievable activities with clear timelines and measurable outcomes. Vague commitments to future data collection are not sufficient. The PMCF evaluation report must present findings, and those findings must be integrated into the CER update.
Conduct literature surveillance continuously
Rather than scheduling annual literature searches, establish a continuous literature surveillance process that monitors relevant databases and notifies the team when new evidence emerges. CiteMed’s Living Reviews functionality supports this by monitoring defined databases continuously and importing new matching articles directly into the existing review, eliminating manual re-runs between update cycles.
Ensure PSUR benefit-risk analysis is genuine
The PSUR benefit-risk evaluation should be a reasoned assessment of whether the available post-market evidence continues to support the device’s benefit-risk profile. It should address what complaint trends indicate about real-world safety, whether PMCF findings change the clinical evidence picture, whether new literature has identified emerging risks, and whether the state of the art has changed in ways that affect the benchmark for acceptable risk. Raw data without analysis is not sufficient.
Maintain alignment across the technical file
Establish clear processes for ensuring that PMS findings feed into CER updates, that PSUR conclusions are consistent with CER conclusions, and that the SSCP reflects the current clinical evidence picture. These connections should be maintained as a routine operational process rather than addressed retrospectively before each Notified Body interaction.
Comparison Table: PMS Requirements by Device Class
| Requirement | Class I | Class IIa | Class IIb | Class III |
|---|---|---|---|---|
| PMS system | Required | Required | Required | Required |
| Reporting document | PMSR | PSUR (biennial) | PSUR (annual) | PSUR (annual) |
| Notified Body review of PSUR | Not applicable | On request | On request or during surveillance | Regular surveillance |
| PMCF | Not mandatory | Justify if not conducted | Justify if not conducted | Mandatory |
| PMCF evaluation report update | Not applicable | As needed | At least annually | At least annually |
| SSCP | Not required | Not required | Required for implantables | Required |
| SSCP update | Not applicable | Not applicable | At least annually | At least annually |
| Vigilance reporting | Required | Required | Required | Required |
| Literature surveillance | Required | Required | Required, continuous | Required, continuous |
Checklist: High-Risk Device PMS Readiness Under EU MDR
PMS system foundation:
- PMS plan is documented and defines data sources, collection methods, analysis processes, and escalation thresholds
- Complaint monitoring and trend analysis processes are operational and generating data continuously
- Vigilance reporting procedures are established with defined timelines for serious incident reporting
- Literature surveillance is conducted continuously using a structured and reproducible methodology
- PMCF activities are defined, operational, and generating evidence
PSUR preparation:
- PSUR is updated at least annually
- Benefit-risk evaluation is analytically supported and addresses what post-market evidence means for the device’s safety profile
- Complaint trends are contextualised against population exposure and clinically justified
- PMCF findings are integrated into the benefit-risk assessment
- Vigilance data is reflected in the PSUR
- PSUR conclusions are consistent with CER benefit-risk conclusions
- Sales volume and population exposure data are captured and current
PMCF:
- PMCF plan defines specific activities with clear timelines and measurable outcomes
- PMCF activities are being executed and generating data
- PMCF evaluation report is updated at least annually
- PMCF findings are reflected in CER updates
SSCP (Class III and implantable Class IIb):
- SSCP is prepared and validated by the Notified Body
- SSCP is updated at least annually with PMCF findings
- SSCP is consistent with current CER and technical documentation
Technical file alignment:
- PMS findings are reflected in CER updates
- Risk management file is consistent with current post-market evidence
- CER, PSUR, PMCF evaluation report, and SSCP present a coherent and consistent account of the device’s safety and performance
Definitions
Post-Market Surveillance (PMS)
The systematic process of collecting, analysing, and evaluating data on a medical device after market entry. Under EU MDR, PMS is a continuous active obligation, not a periodic reporting exercise. For Class IIb and Class III devices, the PMS system must be capable of generating and analysing a comprehensive range of post-market data on a continuous basis.
Periodic Safety Update Report (PSUR)
A comprehensive post-market safety document required under Article 86 of EU MDR for Class IIa, IIb, and Class III devices. For Class IIb and Class III devices, the PSUR must be updated at least annually and includes a benefit-risk evaluation, PMCF findings, sales volume, and population exposure data. It is subject to Notified Body review.
Post-Market Clinical Follow-Up (PMCF)
The structured process through which manufacturers proactively collect clinical data on their device after market entry. Mandatory for Class III and implantable devices under Annex XIV Part B of EU MDR. PMCF findings must be documented in a PMCF evaluation report updated at least annually and integrated into the CER.
Summary of Safety and Clinical Performance (SSCP)
A publicly available document required for Class III and implantable Class IIb devices under Article 32 of EU MDR. It must be validated by the Notified Body and updated at least annually with PMCF findings. Accuracy and consistency with the technical file are critical given its public availability.
Vigilance reporting
The process of reporting serious incidents and field safety corrective actions to competent authorities within defined timelines under Article 87 of EU MDR. For most serious incidents, reporting must occur within 15 to 30 days. Vigilance data is a key input to the PSUR and must be reflected in the benefit-risk evaluation.
Benefit-risk evaluation
The formal assessment of whether the clinical benefits of a device outweigh its risks in the context of all available post-market evidence. In a PSUR, the benefit-risk evaluation must be analytically supported and consistent with the CER benefit-risk conclusion.
Signal detection
The process of identifying emerging safety concerns from post-market data before they become reportable events. Effective signal detection for high-risk devices requires structured analysis of complaint trends, vigilance data, literature findings, and PMCF outcomes on a continuous basis.
Expert Perspective
The manufacturers who manage Class IIb and Class III post-market surveillance most effectively treat it as an intelligence system, not a documentation system. The question they are continuously asking is not “what do I need to document?” but “what does the available data tell me about how this device is performing and whether anything has changed that affects its safety profile?” That orientation produces PSURs where the benefit-risk analysis is genuine and well-supported because the underlying system has been generating and processing evidence throughout the year. The manufacturers who struggle are the ones who collect data passively and assemble the PSUR under deadline pressure. The output reflects the process.
Frequently Asked Questions
What are the PSUR requirements for Class IIb and Class III devices?
Under Article 86 of EU MDR, manufacturers of Class IIb and Class III devices must prepare a Periodic Safety Update Report updated at least annually. The PSUR must include the conclusions of a benefit-risk determination based on PMS findings, the main findings of the PMCF evaluation report, sales volume, and an estimate of the population using the device. It is made available to the Notified Body as part of ongoing surveillance activities. For more detail on PSUR structure and common challenges see our article on PSUR vs PMSR under EU MDR.
Is PMCF mandatory for Class IIb devices?
PMCF is mandatory for Class III and implantable devices. For Class IIb devices, manufacturers must address in the PMCF plan whether PMCF activities are appropriate and, if they are considered unnecessary, provide a clear scientific justification. This justification must be well-founded and defensible, as Notified Bodies scrutinise the reasoning carefully for higher-risk devices.
What is the SSCP and which devices require it?
The Summary of Safety and Clinical Performance is a publicly available document required for Class III and implantable Class IIb devices under Article 32 of EU MDR. It must be written clearly for the intended user, validated by the Notified Body, and updated at least annually with the findings of the PMCF evaluation report. The SSCP must be consistent with the CER and other technical documentation.
How does post-market surveillance feed into the CER for high-risk devices?
Post-market surveillance findings must feed directly into CER updates for Class IIb and Class III devices. Complaint trends, vigilance data, PMCF findings, and new literature must be assessed for their impact on the existing clinical evaluation. Where they affect benefit-risk conclusions, the CER must be updated. Where the PSUR and CER present inconsistent conclusions, this is one of the most commonly identified findings during Notified Body surveillance audits.
What vigilance reporting timelines apply to Class IIb and Class III devices?
Under Article 87 of EU MDR, serious incidents must generally be reported immediately and no later than 15 days for incidents posing a serious public health threat, and 30 days for other serious incidents. Field safety corrective actions must also be reported to competent authorities. Vigilance data must be integrated with the broader PMS system and reflected in the annual PSUR.
How often should literature surveillance be conducted for high-risk devices?
For Class IIb and Class III devices, literature surveillance should be continuous rather than conducted at defined annual intervals. New evidence that emerges between review cycles may identify safety signals or changes to the state of the art that should prompt an earlier reassessment of the CER or PSUR. CiteMed’s Living Reviews functionality supports continuous monitoring by automatically tracking defined databases and notifying teams when new matching articles are published, eliminating manual re-runs between update cycles.
What are the most common PMS failures for Class IIb and Class III devices?
The most common failures are treating PSUR preparation as a periodic document exercise rather than the output of a continuously operating surveillance system, producing PSURs that present data accurately without a genuine benefit-risk analysis, PMCF plans that exist as documents but do not generate evidence, weak linkage between PMS findings and CER updates, and inadequate integration of vigilance data into the benefit-risk evaluation.
References
- Regulation (EU) 2017/745 on medical devices (EU MDR)
- EU MDR Article 83: Post-Market Surveillance System
- EU MDR Article 84: Post-Market Surveillance Plan
- EU MDR Article 85: Post-Market Surveillance Report
- EU MDR Article 86: Periodic Safety Update Report
- EU MDR Article 87: Reporting of Serious Incidents and Field Safety Corrective Actions
- EU MDR Article 61: Clinical Evaluation
- EU MDR Annex XIV: Clinical Evaluation and Post-Market Clinical Follow-Up
- MEDDEV 2.7/1 Revision 4: Clinical Evaluation Guide
Related Resources
- Post-Market Surveillance Under EU MDR — Building a proactive PMS system aligned with EU MDR expectations
- PMCF Surveys Solution — Structured PMCF activities supporting ongoing clinical evidence generation
- Medical Device Vigilance — Vigilance monitoring and reporting support
- CER Checklist for EU MDR — A practical framework for pre-submission review of Clinical Evaluation Reports
- Why Clinical Evaluation Reports Are Rejected — Common reasons CERs fail Notified Body review
- EU MDR Literature Review Services — Structured literature surveillance supporting PMS and PSUR preparation
- PSUR vs PMSR Under EU MDR — Understanding post-market surveillance reporting requirements
- EU MDR Consulting Services — Expert support for post-market surveillance strategy and high-risk device compliance
Call to Action
If you are building or reviewing your post-market surveillance system for a Class IIb or Class III device, preparing for a Notified Body surveillance audit, or want support ensuring alignment across your PSUR, CER, and PMCF documentation, Citemeds can help. Get in touch to discuss your requirements.