Post-Market Surveillance for Medical Devices: EU MDR and FDA Requirements

Post-market surveillance (PMS) is the systematic collection and analysis of real-world data on a device after it is on the market. It protects patients, keeps your risk and clinical files honest, and is now one of the most heavily audited areas under the EU MDR. This guide compares the EU and US approaches and shows how to build a PMS system that works in practice.

What PMS covers

PMS is broader than complaint handling. It includes complaints, vigilance and adverse event reporting, trend analysis, literature and registry review, user feedback, service records, field safety corrective actions and, where needed, proactive studies. The output feeds back into risk management, clinical evaluation, design changes and labeling. A device with no feedback loop is a compliance gap in both regions.

PMS under the EU MDR

MDR Articles 83 to 86 and Annex III require every manufacturer to run a PMS system proportionate to the risk class and appropriate for the device, as part of the quality management system. The main documents are:

Document	Applies to	Purpose
PMS plan (Annex III)	All devices	Defines data sources, methods, indicators, thresholds, responsibilities and links to PMCF
PMS report (Art. 85)	Class I devices	Summarises PMS data and conclusions, updated when necessary and made available on request
Periodic Safety Update Report, PSUR (Art. 86)	Classes IIa, IIb and III	Summarises benefit-risk conclusions, PMS and PMCF findings, sales volume and population. Class IIb and III are updated at least annually; Class IIa when necessary and at least every two years

For Class III and implantable devices the PSUR is submitted via EUDAMED for notified body evaluation; for other classes it is available to the notified body and authorities on request. Post-market clinical follow-up is part of the system; read our guide to PMCF under EU MDR.

Vigilance and trend reporting

Serious incidents must be reported to the competent authority. The general limit is 15 days after becoming aware; the limit is shortened for a serious public health threat and for death or unanticipated serious deterioration in health. Field safety corrective actions require a field safety notice to users. Manufacturers must also report statistically significant increases in the frequency or severity of non-serious incidents or expected side effects under Article 88. ISO/TR 20416 gives guidance on designing PMS for manufacturers.

PMS in the United States

FDA has no single “PMS plan” document, but the expectations come from several regulations:

• Complaint handling: required under the quality system. Since the QMSR took effect on 2 February 2026, this is addressed through ISO 13485 clause 8.2.2 and the record requirements FDA retained.
• Medical Device Reporting, 21 CFR Part 803: manufacturers report deaths, serious injuries and certain malfunctions within 30 calendar days of becoming aware, and within 5 work days for events requiring remedial action to prevent unreasonable risk of substantial harm.
• Corrections and removals, 21 CFR Part 806: report recalls and corrections made to reduce a health risk or remedy a violation.
• Section 522 postmarket surveillance orders: FDA can require studies for certain devices.
• Unique Device Identification and registration and listing: support traceability.

Verify the current reporting timelines on FDA’s website before you write them into a procedure.

Building a PMS system that works

1. Define sources. Complaints, service, sales and field data, literature, registries, social and online sources where relevant, similar-device and competitor safety information, and customer feedback.
2. Set indicators and thresholds. For example complaint rate per 1,000 units, serious incident rate and trend limits that trigger action. Without thresholds, trends are noticed too late.
3. Process each input. Triage, assess reportability (see CAPA and complaint handling), investigate and decide on action.
4. Feed the results back. Update the risk management file under ISO 14971, the clinical evaluation and the instructions for use.
5. Review on a schedule. Include PMS results in management review.
6. Keep the technical file current. The PMS plan, reports and conclusions belong in the technical documentation; see EU MDR technical documentation.

Common PMS gaps

• A generic PMS plan copied across all products with no device-specific indicators.
• Literature review done only once at launch.
• Complaints counted but not trended against units sold.
• PSURs that repeat last year’s text with no new benefit-risk conclusion.
• Distributor and importer feedback not captured.
• No link between PMS findings and the risk file.

Frequently asked questions

What is the difference between a PMS report and a PSUR?

A PMS report is for Class I devices and summarises PMS data and conclusions. A PSUR is for Classes IIa, IIb and III and also covers benefit-risk conclusions, PMCF findings, sales volumes and the user population.

Is PMCF the same as PMS?

No. PMCF is one proactive element of PMS, focused on collecting clinical data on a device to confirm safety and performance throughout its lifetime.

How fast must a serious incident be reported in the EU?

The general limit is 15 days after the manufacturer becomes aware. It is shorter for a serious public health threat and for death or unanticipated serious deterioration. Check the MDR text and current MDCG guidance for exact limits.

Do US manufacturers need a PMS plan?

FDA does not use that term for most devices, but you need complaint handling, adverse event reporting, correction and removal reporting and trend analysis. Many companies run a single global PMS system covering both markets.

Timelines and document requirements are updated by regulators and guidance. Confirm against the MDR text, MDCG guidance and FDA regulations before publishing procedures.

Talk to the AptSkill team

Need help with a PMS plan, PSUR or vigilance procedure? Contact us.