Regulatory work does not end with the placing on the market. Post-market surveillance (PMS) of medical devices requires manufacturers to systematically monitor their products on the market and evaluate the data collected. Vigilance is the reactive component of this system and governs the reporting of serious incidents and Field Safety Corrective Actions (FSCAs). This is distinct from market surveillance, which is the responsibility of the authorities.
The PMS system is an integral part of the quality management system and must be established before placing the product on the market (Art. 10(9) MDR). In practice, there are sometimes PMS plans in place that do not yield data that can be analyzed. This gives rise to criticism during Audits and in responses to inquiries from regulatory authorities.
This article discusses the obligations set forth in the European Medical Device Regulation, (EU) 2017/745 (MDR), and in vitro diagnostic medical devices, (EU) 2017/746 (IVDR), which reports and notifications are due and when, and what specific requirements apply to software and AI-based medical devices.
Legal framework for post-market surveillance of medical devices
The requirements are set forth in Chapter VII of the MDR (Articles 83 through 92) and in Chapter VII of the IVDR (Articles 78 through 87). The structure is the same in both regulations.
Three levels can be distinguished:
- PMS encompasses all activities involved in proactively and systematically collecting, recording, and evaluating data on a product on the market (Art. 83 MDR).
- Vigilance refers to the handling of serious incidents and Field Safety Corrective Actions (FSCA) (Art. 87–90 MDR).
- Market surveillance refers to the activities of the competent authorities (Art. 93 et seq. MDR), which in Germany are primarily the competent state authorities.
The PMS system is part of the quality management system. The Person Responsible for Regulatory Compliance (PRRC) under Art. 15 MDR is expressly responsible for ensuring compliance with post-market surveillance obligations and reporting requirements.
For legacy medical devices under Article 120 of the MDR, the MDR requirements for post-market surveillance, vigilance, market surveillance, and the registration of economic operators and products already apply during the transition period. The same applies to legacy IVDs under Article 110 of the IVDR.
The PMS plan: data sources, indicators, and analysis
The content of the PMS plan is specified in Annex III of the MDR and Annex III of the IVDR, respectively. It is part of the technical documentation and must be prepared on a product-specific basis.
The PMS plan defines the data to be collected, the evaluation methods to be applied, and the thresholds above which a review, escalation, or action is required. These include:
- Reactive sources: Complaints, service reports, returns, reports from regulatory authorities, reports from other Manufacturers, and much more.
- Proactive sources: user surveys, literature and database searches, registries, PMCF or PMPF activities
- Indicators, statistical methods, and threshold values, particularly for trend reporting under Article 88 of the MDR
The results must be incorporated, among other things, into risk management in accordance with ISO 14971, into the clinical evaluation, and into the benefit-risk assessment. The clinical aspect is covered by Post-Market Clinical Follow-up (PMCF) activities (Annex XIV, Part B, MDR); for IVDs, it is covered by Post-Market Performance Follow-up (PMPF) activities in accordance with Annex XIII, Part B, IVDR.
For software, additional data types are included: usage and error logs, telemetry data, support tickets, or reviews in app stores. This data is often more reliable than traditional complaints but is subject to the GDPR. Purpose limitation, legal basis, and retention periods must be clarified before analysis.
Reporting requirements: PMS report and PSUR
The report to be prepared depends on the risk class.
Product class | Report and Frequency |
MDR Class I | PMS report (Art. 85), to be updated as needed and submitted upon request by the Authority |
MDR Class IIa | PSUR (Art. 86), at least every two years |
MDR Class IIb and III | PSUR (Art. 86), at least annually |
MDR Class III and implantable devices | PSUR additionally submitted via EUDAMED to the Notified Body (Art. 86(2)) |
IVDR Classes A and B | PMS report (Art. 80) |
IVDR Class C and D | PSUR (Art. 81), at least annually |
IVDR Class D | PSUR additionally submitted via EUDAMED to the Notified Body (Art. 81(2)) |
The PSUR (Periodic Safety Update Report) summarizes the analysis of PMS data and outlines the conclusions regarding the benefit-risk balance, the key findings of the PMCF/PMPF, and sales volumes. MDCG 2022-21 provides guidance on the content for the MDR. For Class IIa, IIb, and III medical devices, as well as for Class C and D IVDs under the IVDR, the PSUR is part of the technical documentation.
In practice, the timing of submission is important. Notified Bodies expect the report to be submitted promptly after the end of the respective data collection period. Delays may trigger additional requests as part of certificate surveillance.
Vigilance: reporting categories and deadlines
A serious incident occurs when an incident has directly or indirectly resulted in or could have resulted in death, a serious deterioration in health, or a serious threat to public health (Art. 2 No. 65 MDR).
The deadlines under Art. 87 MDR begin upon becoming aware of the incident:
- 2 days in the case of a serious threat to public health
- 10 days in the case of death or an unforeseen serious deterioration in health
- 15 days in all other cases
For IVDs, Article 82 of the IVDR applies with the same framework. In addition, there is the reporting of Field Safety Corrective Actions (FSCA) and the field safety notice (Field Safety Notice, FSN) pursuant to Article 89 of the MDR or Article 84 of the IVDR, as well as trend reporting pursuant to Article 88 of the MDR or Article 83 of the IVDR in the event of a statistically significant increase in non-serious incidents or expected adverse events.
The short deadlines require that the review follows a defined procedure:
- Record receipt. Document the date of awareness.
- Determine whether an incident within the meaning of the regulation has occurred.
- Review the severity and causal relationship. Perform the determination of the reporting obligation and deadline.
- Prepare and submit the report. Continue the investigation.
- Determine necessary measures. Implement FSCA and FSN, if applicable.
- Feed the results back into risk management, the PMS report, or the PSUR and CAPA process.
Decisions not to report must also be documented and justified. The justification may be assessed during audits.
EUDAMED: current status and reporting channels
Regulation (EU) 2024/1860 legally established the phased introduction of EUDAMED. Pursuant to Commission Decision (EU) 2025/2371, the modules for stakeholder registration, UDI/products, Notified Bodies and certificates, and market surveillance have been mandatory since May 28, 2026.
As things stand, the vigilance module is not yet available. Mandatory use is expected to begin in 2027, subject to further clarification by the European Commission. Until then, vigilance reports will be submitted via national channels. In Germany, this is done through the BfArM.
Reporting processes must therefore accommodate multiple channels. However, data fields should already be structured to accommodate future submissions via EUDAMED, including links to the registered UDI data.
Post-market surveillance for software and AI medical devices
The same obligations apply to software as to hardware, but there are some specific considerations to keep in mind:
Type of incident:
For software, malfunctions, incorrect or delayed outputs, and mix-ups are relevant. The situation is different for pure application errors that are not due to product characteristics. The distinction depends on the individual case. MDCG 2023-3 Rev.2 provides guidance here.
Cybersecurity:
Monitoring vulnerabilities and threats is part of the PMS plan. IEC 81001-5-1 and Guideline MDCG 2019-16 are used as the state of the art. The Cyber Resilience Act (Regulation (EU) 2024/2847) does not cover medical devices under the MDR and IVDR (Art. 2(2) CRA). However, it may apply to companion apps, cloud services, or accessories that are not medical devices themselves. This distinction should be checked on a product-by-product basis.
Software Maintenance as an Interface:
The maintenance and troubleshooting process under IEC 62304 must be integrated with the PMS, vigilance, risk management, and CAPA. Every relevant error report should therefore trigger two reviews: the technical analysis and correction of the software error, and the regulatory review of potential safety, performance, and reporting obligations.
Changes and Model Updates:
Every software change and model update must be checked with regard to safety, performance, intended purpose, risk profile, or conformity assessment. For AI systems, monitoring of potential data and concept drift is also required, as these can lead to a deterioration in performance in the field compared to validation results. The PMS plan should therefore define performance metrics, thresholds, monitoring intervals, and escalation criteria. EU law does not currently explicitly provide for a formalized procedure corresponding to the FDA’s concept of the Predetermined Change Control Plan (PCCP). However, structured, predefined change processes can be implemented within the framework of PMS, risk management, and change management.
Interaction with the AI Act.
AI-based medical devices involving a Notified Body are considered high-risk AI systems. MDCG 2025-6 explains the interaction between the MDR/IVDR and the AI Act. The post-market surveillance system under Article 72 of the AI Act can be integrated into the existing PMS system for MDR/IVDR-regulated AI systems. The additional reporting obligation under Article 73(10) of the AI Act is limited to serious incidents related to fundamental rights. Following the agreement on the EU Digital Omnibus, the MDR and IVDR remain in Annex I, Section A of the AI Act. The practical design of this provision should be monitored further.
Practical approach
- Determine which report is required for the respective product and plan data collection periods and submission deadlines working backward from the certification cycle.
- Design the PMS plan to be measurable, with defined data sources, key performance indicators, thresholds, evaluation intervals, and responsibilities.
- Link PMS, vigilance, risk management, CAPA, and change management through defined interfaces, rather than making decisions on a case-by-case basis in isolation.
- Document every decision regarding reporting, including the decision not to report, in each case with the date of awareness and the rationale.
- Prepare reporting processes for future use of EUDAMED without abandoning the currently applicable national reporting channels.
FAQ
When must the PMS system be in place?
Before the device is placed on the market. It is part of the quality management system under Article 10(9) of the MDR and is assessed during the conformity assessment.
Do I need a PSUR for Class I products?
No. For Class I devices, the PMS report under Article 85 of the MDR is required. It must be updated as needed and submitted to the authorities upon request.
When is a trend report required?
When a statistically significant increase in the frequency or severity of non-serious incidents or expected side effects is detected (Article 88 of the MDR). The thresholds are defined in advance in the PMS plan.
Do vigilance reports already need to be submitted via EUDAMED?
No. The EUDAMED Vigilance module is not yet available. Until it becomes operational, vigilance reports must continue to be submitted through the relevant national competent authority channels.
Is it necessary to maintain two PMS systems for an AI medical device?
No. The requirements of Article 72 of the AI Act can be integrated into the existing PMS system under the MDR. The reporting obligations remain regulated separately.
Conclusion
PMS and vigilance are not merely a matter of documentation, but an ongoing process with fixed deadlines and defined interfaces. If the manufacturer defines data sources, key metrics, and evaluation steps in advance, they can reliably assess reporting obligations and submit reports on time. For software and AI, telemetry data, cybersecurity, and model changes come into play, each requiring its own set of rules within the PMS plan.
If you would like to check whether your PMS and vigilance system meets the requirements of the MDR and IVDR, please contact us. During an initial consultation, we will assess your current situation and outline the next logical steps.
