Post-Market Obligations Under EU MDR: What Manufacturers Are Expected to Keep Doing

Certification opens the door — it does not close the file

A common mental model for compliance is that you work hard to get certified, then maintain the status quo. MDR does not work that way. Post-market obligations under MDR are active, systematic, and ongoing — and they feed back into your technical documentation in ways that can require you to revise it. If you treat post-market as a checkbox exercise, you will accumulate risk until it surfaces in an audit or an incident.

The post-market system under MDR consists of several interconnected obligations: a Post-Market Surveillance (PMS) plan, systematic data collection and analysis, the PMS report or Periodic Safety Update Report (PSUR), Post-Market Clinical Follow-up (PMCF), and vigilance reporting. These are not separate bureaucratic tasks — they are supposed to form a cycle where field experience feeds back into risk management, clinical evaluation, and technical documentation updates.

The PMS plan and who owns it

Every device on the market needs a PMS plan. The plan defines what data you collect, from what sources, at what frequency, and how you analyse it. Sources typically include complaints, feedback from healthcare professionals, literature surveillance, vigilance data from your own device and similar devices on the market, and (for higher-risk devices) PMCF data.

The part that catches a lot of teams off guard is the requirement that the PMS plan and its outputs are not static. If your risk analysis changes — because of a new complaint trend, a new vigilance event, or new literature — the PMS plan needs to reflect that. The same is true in reverse: if PMS data reveals a safety signal, it must flow through to your risk management file and clinical evaluation. This feedback loop is what Notified Bodies audit most closely in surveillance assessments. A PMS plan that has not been updated in two years, with a PSUR that cites no actions taken, will attract scrutiny.

PMS report vs. PSUR — which applies to you

Class I devices produce a PMS report. Class IIa, IIb, and III devices produce a Periodic Safety Update Report (PSUR). The distinction matters because PSURs have additional content requirements: a benefit-risk determination, conclusions about residual risks and overall residual risk, analysis of information from similar devices on the market, and an update of the clinical evaluation report and PMCF plan.

PSURs for Class IIb and III devices are submitted to the Notified Body and made available on EUDAMED. For Class IIa, they are made available on request. Required PSUR frequency:

• Class IIb and III: at minimum every year until the certificate is five years old, then at least every two years
• Class IIa: at least every two years

Your Notified Body may specify a more frequent interval based on your device's risk profile.

PMCF: this is where many manufacturers underinvest

Post-Market Clinical Follow-up is the active collection of clinical data from marketed devices. The purpose is to confirm the benefit-risk balance remains acceptable, identify previously unknown risks or side effects, and generate data that keeps the clinical evaluation current. PMCF is not optional for Class IIb and III devices — and for many Class IIa devices, it is expected unless you can justify why it is not needed.

Where manufacturers commonly go wrong: they treat PMCF as a theoretical appendix to the clinical evaluation rather than an active data collection activity. A PMCF plan that says "we will conduct a registry study if post-market data indicates a need" is not a PMCF plan — it is a deferred decision. Notified Bodies and auditors expect to see active PMCF activities: structured surveys of healthcare professionals, systematic analysis of complaints and outcomes, registry participation, literature reviews with defined methodology, or clinical investigations where the risk profile warrants it.

The outputs of PMCF feed your PMCF evaluation report (PMCFER), which feeds the PSUR, which feeds the clinical evaluation report. If the PMCFER has not been updated since certification, something is wrong.

Vigilance: the urgent end of post-market

Vigilance reporting sits at the urgency end of post-market obligations. Serious incidents involving your device that are linked to device malfunction, inadequacy, or labelling issues must be reported to the relevant national competent authority within defined timeframes: 15 days for serious incidents that are not immediately life-threatening, 10 days for those that could be, and immediately for incidents involving a direct risk to life.

Trend reporting adds another layer: if you identify a statistically significant increase in non-serious incidents or expected side effects that could affect the benefit-risk profile, that needs to be reported too. This requires you to have a baseline — which means your vigilance system needs defined expected rates, not just a complaints log.

Field safety corrective actions (FSCAs) — recalls, software updates issued for safety reasons, advisory notices — must be reported to national authorities and made public through Field Safety Notices. The coordination across multiple EU markets for a single FSCA is one of the more operationally complex aspects of vigilance. If your device is on multiple EU markets, you need a process that handles simultaneous notification across jurisdictions.

The EUDAMED dimension

MDR requires manufacturers to register devices and report vigilance events through EUDAMED, the EU medical device database. EUDAMED's UDI module, device registration module, and vigilance module are either live or progressively coming into force. Being late on EUDAMED registration can affect your ability to legally place devices on the EU market, independent of whether your technical documentation and certification are in order. This is an operational obligation, not just a compliance one.