How to Set Up a Post-Market Surveillance System

Post-Market Surveillance is one of the most important elements of compliance with the EU Regulations for medical devices and is oftentimes an overlooked section which comes back with a vengeance during the audit period. A good system for post-market surveillance allows the manufacturer to keep track of the safety and performance of the device being placed on the market as well as highlight any previously unknown risks related to its use.

This article intends to provide an overview of what a good Post-Market Surveillance system entails.

Post-Market Surveillance

Relevant Legislation

Although Post-Market Surveillance (PMS) has always been an important requirement in the regulation of both medical devices and IVDs, the requirement for a robust PMS system is stressed in EU Regulations 2017/745 (MDR) and 2017/746 (IVDR) on medical devices and IVDs, respectively. As evidence of this, the EU Medical Device Directive 93/42/EEC (MDD) mentions “post-market surveillance” twice, whilst the EU MDR mentions it 62 times defining it as follows:

‘post-market surveillance’ means all activities carried out by manufacturers in cooperation with other economic operators to institute and keep up to date a systematic procedure to proactively collect and review experience gained from devices they place on the market, make available on the market or put into service for the purpose of identifying any need to immediately apply any necessary corrective or preventive actions.

EU MDR Article 2(60)

The obligation for manufacturers to develop a robust system for PMS is rooted in Article 10 of the EU Regulations ‘General obligations of manufacturers’ which requires the manufacturer’s Quality Management System (QMS) to cover aspects of “setting-up, implementation and maintenance of a post-market surveillance system, in accordance with Article 83 and is reiterated a few paragraphs down whereby it asks manufacturers of devices to “implement and keep up to date the post-market surveillance system in accordance with Article 83. [Article 78 for IVDR]

Section 1 of Chapter VII in both the EU Regulations is dedicated to providing an overview of the PMS system required by every manufacturer (for each device they manufacture) and covers:

  • Post-market surveillance system of the manufacturer [Article 83 MDR / 78 IVDR].
  • Post-market surveillance plan [Article 84 / 79].
  • Post-market surveillance report [Article 85 / 80].
  • Periodic safety update report [Article 86 / 81].

Furthermore, Annex III of the Regulations spells out in further detail, what is expected to form part of the technical documentation for PMS, providing specific areas to be included within the PMS Plan.

In addition, Annex XIV Part B (MDR) and Annex XIII Part B (IVDR) give some level of detail on the Post-Market Clinical Follow-up and Post-Market Performance Follow-up requirements, respectively. But more on that later.

Post-Market Surveillance System

The post-market surveillance system must be well-integrated into the manufacturer’s QMS and must allow for a continuous and systematic collection of data relevant to the device throughout its lifetime. Although all medical devices will require it, the extent of the PMS system in place will depend on the risk classification and type of device. Therefore, conformity assessment bodies will expect to see a more robust and far-reaching system for higher-risk and novel devices, and at more frequent intervals.

Data which is gathered and assessed through the PMS system shall be used to:

  • Update:
    • Benefit-risk determination & improve risk management.
    • Design & manufacturing information, IFU, labelling.
    • Clinical / performance evaluation.
    • Summary of safety and (clinical) performance.
    • Technical documentation, as required.
  • Identify:
    • Needs for preventive, corrective, or FSCA.
    • Options to improve usability, performance, and safety of the device.
    • And report trends.
  • Contribute to PMS of other devices, if relevant.

Post-market Surveillance Procedure

The PMS system employed should be described at QMS-level, within a designated PMS Procedure. The procedure should preferably highlight the following:

  • The documentation required as part of the PMS.
  • Responsibilities.
  • The frequency at which PMS shall be performed and at which data shall be reviewed.
  • The interaction of post-market surveillance with the technical documentation and other areas of the QMS, such as vigilance or CAPA.
  • Potential sources of data for post-market activities.
  • General instructions on how post-market surveillance shall be carried out. Further detail can be saved for the PMS Plan itself.
  • The minimum content of the PMS Plan, PMS Report or PSUR, and the PMCF or PMPF. It could also provide a reference to a template or form to be completed.

Keep in mind that this procedure will need to be followed for each device type. Therefore, whilst it should have sufficient detail on what elements to include in the PMS system, device-specific details should be left out.

PMS Plan

The elements of a PMS Plan are generally laid out very well in Annex III of the Regulations. Within the plan, the manufacturer shall indicate how they collect and use available data from the following sources:

  • Information from vigilance, non-serious incidents and undesirable side-effects.
  • Relevant specialist or technical literature, databases or registers.
  • Feedback and complaints received on the device and data on other similar devices on the market.

The PMS Plan should then lay down the processes to be carried out in order to collect and analyse the information above. We recommend that for each activity indicated the manufacturer shall provide clear instructions for how to carry them out, as well as a rationale to justify the use of such data.

It is also important for the manufacturer to indicate “suitable indicators and threshold values” which will be used for the continuous reassessment of the benefit-risk analysis. These indicators should be defined such that if they are exceeded, an investigation is triggered to determine whether the device benefits still outweigh the risks. We have found that defining these “indicators and threshold values” in line with the risk assessment documentation has been adequate. Take, for example, a particular risk whose probability of occurrence was previously indicated as 1 in 1000 within the risk management documentation. If post-market data indicates that this is actually 1 in 100, then this should trigger some level of investigation.

If a suitable feedback and complaints procedure has been defined by the manufacturer within their existing QMS, then the PMS Plan can provide reference to such procedures which can be used to investigate complaints and analyse market-related experiences.

The PMS Plan shall also indicate the appropriate processes to carry out in the event of vigilance or trend reporting. With respect to the latter, we would recommend providing a statistically significant value of the increase in the frequency or severity of incidents within a particular observation period which would trigger an investigation and potential trend report. This may also be linked to the risk management documentation.

Furthermore, the PMS Plan must identify the methods in which the manufacturer shall communicate effectively with any relevant competent authorities, notified bodies, economic operators (EC-REP, importer, distributor), as well as users. This may be linked to your vigilance procedure.

The Plan shall identify the PMS procedure and any other procedures which may detail how the manufacturer fulfils their obligations with respect to the PMS procedure, PMS Plan, and PSUR. It should also include a reference to the CAPA procedure which shall identify the correct route for identifying and handling the problematic device.

Finally, the PMS Plan should also include information on the PMCF / PMPF Plan which can either be included as part of the PMS Plan or be separated into an individual document.

Post-Market Surveillance Report

The PMS Report is a document which summarises the results and conclusions of the analyses of the post-market data collected by following the PMS Plan. Putting together the PMS Report is specifically a requirement of Class I medical devices and Class A and B IVDs.

Although an official structure of the PMS Report is not provided, it should be generally formed around the PMS Plan activities and should be completed at a frequency defined within the Plan. For each post-market activity conducted, the Report should provide a summary of the results obtained and an analysis of these results and how they translate to building upon the known clinical safety and performance of the device.

If relevant, the PMS Report shall also identify any preventive or corrective actions to be taken, giving an adequate rationale and description of such actions. It would also be helpful to identify the sections of the technical documentation, such as risk management or clinical evaluation, which will require an update (or not) based on the results obtained and analyses conducted.

The PMS Report is to be updated in accordance with the PMS Plan, or whenever necessary, and shall be made available to the Competent Authority upon their request.

Periodic Safety Update Report

Manufacturers of Class IIa, IIb, and III devices, as well as Class C and D IVDs, are required to prepare a Periodic Safety Update Report (PSUR) for each device, category, or group. Similar to the PMS Report, the aim of the PSUR is to summarise the results and conclusions of the post-market activities conducted in accordance with the PMS Plan whilst giving a rationale and description of any corrective or preventive actions taken.

As the name suggests, this document intends to give a regular update on the safety of the device concerned. Therefore, it summarises the activities and results conducted in the post-market phase, as well as reiterates the benefit-risk of the device. Throughout the lifetime of the device, the PSUR shall set out:

a) Conclusions of benefit-risk determination: Based on the data collected from the post-market phase, the manufacturer shall indicate the effect on the overall benefit-risk of the product. This shall take into consideration any new or emerging risks related to the device which have been identified through the post-market activities conducted. Any adverse changes to the benefit-risk profile shall then be evaluated in the risk management and clinical evaluation for the device concerned.

b) The main findings of the PMCF or PMPF: The PSUR shall include a summary of the findings from PMCF/PMPF activities. This indicates what the manufacturer has learned from proactive post-market activities.

c) Sales and user population: The PSUR shall also give an update on the total sales of the device and an estimate of the user population. This estimate can be tricky to determine and will depend on the nature of the product. For single-use devices, an estimate of the user population may be equal to total sales. However, for reusable equipment, e.g. infusion pumps, further investigation may be required to identify the use cycles and determine how many patients, on average, will use a single pump.

The PSUR shall be prepared, at least, on an annual basis for Class IIb and III medical devices, and Class C and D IVDs. Manufacturers of Class IIa devices shall update the PSUR whenever necessary, but at least every 2 years. The PSUR shall form part of the technical documentation identified in Annexes II and III of the Regulations. The PSUR shall also be required for custom-made medical devices, and shall be part of the documentation required in Annex XIII of the EU MDR.

Class III and Class D manufacturers shall submit their PSUR to their Notified Body (NB) via Eudamed. The NB shall then review this document and add an evaluation through Eudamed with further details of any actions taken. Both the PSUR and the NB evaluation are made available to the requesting Competent Authority through Eudamed.

For Class IIa, IIb, and Class C devices, the PSUR shall be made available to the NB during their conformity assessment, and to any requesting Competent Authority in the EU.

Although the Regulations do not give much information on the structure of the PSUR, a very helpful document was released by the Medical Device Coordination Group (MDCG) in 2022, MDCG 2022-21 “Guidance on Periodic Safety Update Report (PSUR) according to Regulation (EU) 2017/745 (MDR)”. This guidance document provides a lot of detail into what should be considered and reported within a PSUR. It also includes useful templates for presenting data on sections such as volume of sales, user population size, and total serious incidents related to the device. We strongly recommend that you model your PSUR structure around this document, as it will become a guidance document on which NBs may base their assessments.


The Regulations require all devices to conduct Post-Market Clinical Follow-up (PMCF) or Post-Market Performance Follow-up (PMPF) activities to continually assess and verify the device’s clinical safety and performance. That’s right, all device classifications will need to provide evidence that they will be proactively collecting clinical data on their devices, the extent of which shall depend on the type of device, its novelty, the overall risk posed, as well as the extent of existing clinical data.

The content and structure of the PMCF for medical devices are indicated in Part B of Annex XIV of the MDR, whilst those for the PMPF are laid down in Part B of Annex XIII of the IVDR. Furthermore, the MDCG provides templates for the PMCF Plan and PMCF Evaluation Report, in MDCG 2020-7 and MDCG 2020-8, respectively. Again, although the guidance is non-binding, we strongly suggest that you incorporate these elements into your templates as your NB will be looking for such compliance.

The concept of PMCF in the EU Regulations differs from that in the previous Directives where it was understood to be a clinical study. In fact, manufacturers still use the points found in MEDDEV 2.12/2 rev.2 to justify not conducting a PMCF, which is incorrect.

PMCF activities are categorised into “General Methods” and “Specific Methods”:

  • General Methods of PMCF: Data from clinical experience and user feedback, screening of scientific literature.
  • Specific Methods of PMCF: Clinical studies, suitable registers.

For each activity chosen, one must provide an adequate rationale as to why they deem it appropriate to collect that data, as well as sufficient detail on how and when that activity shall be carried out. Therefore, whilst we agree that Section 5 of MEDDEV 2.12/2 rev.2 can be used to rationalise not performing Specific Methods of PMCF, there is no getting away from General Methods. An excellent resource on the different types of activities which may be conducted can be found in Appendix III of MDCG 2020-6.

PMS Requirements for Legacy Devices

The requirements laid down in the EU Regulations will also apply to legacy devices i.e. those devices currently benefitting from the transitional provisions laid out in Article 120 and Article 110 of the EU MDR and IVDR, respectively. Therefore, from the date of application of the Regulations, manufacturers of products which qualify as legacy devices are expected to use a system complying with the new requirements. Surveillance audits from Notified Bodies will pick on this, and therefore we suggest that the appropriate amendments are made to existing systems.

Furthermore, we strongly recommend utilising your PMS data to its maximum potential and collecting as much clinical data as possible which can be used for your MDR/IVDR assessment in the near future.

How Can We Help?

Our team is experienced in setting up robust post-market surveillance systems for all types of devices. Based on your product, we can evaluate the most appropriate post-market activities required to ensure you continually monitor your device’s safety and performance whilst on the market and ensure that you meet all the Regulation’s requirements to pass your NB assessments.

Get in touch today to discuss how we can help you comply with your requirements.