Post-market surveillance for medical devices: EU requirements

An EU device’s market entry is only one part of its regulatory lifecycle; surveillance must continue after placement. Under the EU Medical Device Regulation, post-market surveillance applies to every device on the EU market, with requirements set out in Articles 83 to 86.

The practical challenge is to build these obligations into one coherent system, rather than treating the plan, clinical follow-up and safety reporting as separate tasks. Manufacturers collect and assess experience with a device to determine whether action is needed.

This guide explains what the EU plan needs to cover, how post-market clinical follow-up fits into the process, and how FDA-requested surveillance under Section 522 differs from routine EU requirements. It shows how these activities connect within a post-market surveillance system.

What is post-market surveillance?

Post-market surveillance is the structured collection and evaluation of experience with devices after market placement. Its purpose is to detect safety or performance concerns and inform whether action is needed.

Requirements differ between the EU and the United States. Manufacturers therefore need to distinguish routine monitoring from regulator-ordered surveillance and reporting.

FDA Surveillance Requirements and Criteria

FDA post-market surveillance is active, systematic, scientifically valid collection, analysis, and interpretation of information about a marketed device. Under 21 CFR Part 822, FDA may order surveillance for certain class II and class III devices when failure could reasonably cause serious adverse health consequences. Criteria also include devices implanted for more than one year or likely to be used significantly by children. Class I devices are normally exempt from these orders.

A surveillance plan should define its questions, data sources, methods and analysis before collection begins. This helps ensure the evidence is relevant to the device’s risks and intended use.

EU MDR Surveillance Requirements

EU MDR surveillance is the manufacturer’s ongoing system for monitoring every device placed on the EU market. Articles 83 to 86 require a system proportionate to the device’s risks, while Regulation (EU) 2017/745 requires a surveillance strategy in the technical documentation. Annex III sets out topics for the plan, and Class I devices must submit Post Market Surveillance Reports.

In practice, manufacturers connect complaints, field experience and safety information to the device’s risk profile. The plan should explain how information will be reviewed and used to identify trends or determine whether corrective action is needed.

Reporting, Complaints, and Device Issues

FDA reporting covers qualifying adverse events, while complaint management records and assesses issues received after launch. Under 21 CFR Part 803, U.S. medical device manufacturers must submit Medical Device Reports electronically. A controlled complaint process captures the report, identifies the device, evaluates the event, and documents whether further reporting or corrective action is appropriate.

For recalls, corrections, and removals, manufacturers assess the issue, document the action, and follow applicable FDA reporting processes. Under 21 CFR Part 822, a manufacturer must notify FDA within 30 days of a change in company ownership, according to the U.S. Food and Drug Administration.

Failure to maintain an approved Section 522 plan or conduct surveillance under it violates Section 522 of the Federal Food, Drug, and Cosmetic Act and can make a device misbranded under Section 502(t)(3). Surveillance costs and timelines depend on study design, device risks, data sources, and the evidence needed.

FDA Safety Information and Device Data

FDA safety information supports manufacturers’ review of emerging device issues. Search FDA safety communications, recall notices, and adverse event data using identifiers such as device name, manufacturer, and unique device identifier. Under 21 CFR Part 822, a unique device identifier must meet § 830.20.

Record search terms, the review date, relevant findings and their assessment. This repeatable process helps connect external signals with complaints and other device-specific evidence.

EU post-market surveillance plan contents

An EU post-market surveillance plan translates the manufacturer’s strategy into defined data collection, review and follow-up activities. Its content should reflect the device, its intended purpose and the risks the monitoring needs to detect.

PMS Plan Contents and Submissions

A PMS plan documents how experience with a device will be collected and evaluated after it enters the EU market. Annex III of the EU MDR lists the topics the plan must cover. Use these topics as a structure, then specify how each activity applies to the device and its risk profile.

For example, identify the device and its intended use, the information sources to monitor, and how to assess adverse events or emerging trends. Explain how findings will be recorded, evaluated and translated into action. The plan should connect surveillance results to decisions, such as further investigation or a review of risk controls.

The requirements do not describe one submission workflow that applies to every plan. Keep the current plan in the device’s technical documentation, with controlled versions and supporting records. During a conformity assessment or regulatory interaction, the responsible team can provide the applicable version and show how it relates to the evidence collected.

Creating and Maintaining a PMS Plan

Creating a PMS plan means translating the device’s risks and intended use into repeatable monitoring tasks. First identify information that could signal a change in safety or performance. Then assign a source, review method, owner and documented output to each task.

To carry out a surveillance plan or study, define its objective and the question the evidence needs to answer. Choose suitable data sources and collection methods, establish how information will be assessed, and document responsibilities before implementation. Review results against the device’s risk profile and record decisions, including whether further action is warranted.

Regular maintenance keeps the plan aligned with the device and the evidence gathered after launch. Review it when new adverse information, a change in intended use or recurring complaints alter monitoring needs. Record the rationale for revisions, identify the effective version and keep collected records traceable to the plan used to review them.

Operational discipline matters: a plan that names data sources but leaves ownership unclear can produce gaps between collection and assessment. Assign responsibility for each source, define how findings reach the evaluation team, and retain records of conclusions and resulting actions. An established ISO 13485 medical devices certification framework can support documented processes and controlled records alongside the device-specific plan.

European Union post-market clinical follow-up

Post-market clinical follow-up (PMCF) is the ongoing clinical evaluation of a device after it reaches the EU market. Under EU requirements, manufacturers must conduct PMCF or justify why they did not. EU 2017/745 increased the focus on post-market surveillance, making clinical follow-up an important part of the wider evidence process.

PMCF addresses questions that pre-market evidence alone may not resolve. It assesses whether clinical experience in real-world use continues to support the device’s safety and performance for its intended purpose. Its scope should reflect the device, its risks and any evidence gaps that remain after market placement.

Start by identifying those evidence gaps. For example, the manufacturer may need more information about performance in routine use or users’ experience with a device over time. It can then define a focused clinical question, choose a suitable method and explain how the resulting evidence will be assessed. These are planning considerations, not a universal study template.

PMCF studies are structured investigations that collect clinical information after a device is marketed. They address specific questions that routine surveillance data may not answer adequately. A study protocol should state its objective, describe the population and device use being examined, and specify how observations will be recorded and evaluated.

The study design should match the question. If the concern is clinical performance in a defined use context, the protocol should collect evidence relevant to that context. If it concerns experience across routine use, explain how the selected data can inform the issue. Document why the method was chosen and how the findings will inform the clinical evaluation.

Feedback from users and healthcare professionals can contribute to PMCF when it provides relevant clinical information. Capture it consistently, link it to the device and its intended use, and assess whether it answers the defined question. A complaint may flag an issue; clinical follow-up evaluates whether broader evidence supports a conclusion.

Keep the evidence trail connected. Record the PMCF objective, method, findings, analysis and any resulting action. If the evidence changes the assessment of safety or performance, document how that conclusion affects the device’s clinical evaluation and surveillance activities. This traceability makes the reasoning reviewable without treating every item of feedback as proof of a clinical trend.

U.S. 21 CFR Part 822 concerns FDA-ordered post-market surveillance, not the EU PMCF requirement. Manufacturers marketing in both markets should manage these obligations as distinct regulatory activities, while coordinating shared evidence where it supports each activity’s purpose. The EU PMCF rationale, study question, and clinical findings should remain clearly identifiable in the manufacturer’s records.

FDA-requested surveillance plans and reports

An FDA-requested surveillance plan sets out how a manufacturer will meet a Section 522 order. It is distinct from routine EU post-market reporting, so manufacturers serving both markets should track each obligation separately. The plan, its evidence, and resulting reports should remain traceable to the relevant device and regulatory requirement.

After an FDA order, the manufacturer must submit its surveillance plan within 30 days of receiving the order, according to the U.S. Food and Drug Administration. The plan should describe the proposed method, data collection, analysis, and reporting. It should also explain how the approach answers the surveillance question and produces scientifically valid information about the marketed device.

Timing continues after submission. The manufacturer must begin FDA-ordered surveillance no later than 15 months after the order is issued, according to the U.S. Food and Drug Administration. Under 21 CFR Part 822, a change affecting the nature or validity of collected data requires FDA’s written approval before the approved plan is changed. This makes change control part of study execution, not merely document maintenance.

The FDA’s Section 522 guidance supports manufacturers subject to these orders in fulfilling their obligations. FDA finalized its current guidance in October 2022, intending it to update and replace guidance issued in May 2016. Manufacturers should align their plan and reports with the order and approved protocol, then document study progress, results, and any changes through controlled records.

EU post-market reports document surveillance under EU rules; they are distinct from responses to an FDA order. Under the EU MDR, Class I devices require Post Market Surveillance Reports, while Class IIa, IIb and III devices require Periodic Safety Update Reports. Under the IVDR, class A and B in-vitro devices require Post Market Surveillance Reports, while class C and D devices require Periodic Safety Update Reports.

Periodic Safety Update Reporting should be considered within the manufacturer’s EU MDR or IVDR surveillance process. Keep each report linked to its device classification and the evidence reviewed. For example, records can connect collected post-market information with the manufacturer’s evaluation, conclusions, and any resulting action. This supports a clear update trail as new evidence changes the assessment.

Do not treat an FDA 522 study report as a substitute for an EU report. The regulatory purpose and device classification determine which reporting route applies. For a device sold in both markets, maintain a reporting matrix that identifies the applicable FDA order, EU regulation, device class, report type, evidence owner, and submission status. That practical control helps teams distinguish overlapping evidence from separate reporting duties.

Building a post-market surveillance system

A post-market surveillance system is the connected process for gathering, assessing and acting on device experience after launch. Design it around the device’s intended purpose and risks, and make each signal traceable from its source to the resulting decision.

Start with governance. Assign responsibility for receiving information, assessing potential signals, approving actions and maintaining records. For example, a complaint received by customer support should reach the team responsible for safety evaluation, rather than remaining only in a service database. Define escalation routes so relevant findings are reviewed and documented consistently.

Next, map evidence sources to the questions they can answer. A monitoring framework can include complaints, adverse event information, user feedback, service records and clinical follow-up outputs. For each source, state what is collected, who reviews it, and how findings are linked to the device and its intended use. A source list without clear ownership can leave gaps in routine review.

Make assessments repeatable. Define how reviewers distinguish an isolated observation from a pattern that warrants investigation. Consider the reported issue, its possible effect on safety or performance, and whether similar information appears across sources. Record the rationale for each conclusion, including why a signal requires action or continued monitoring.

Connect assessments to decisions. Show how a finding can lead to further investigation, a review of risk controls, an update to technical documentation or corrective action. Keep each decision with its supporting evidence. If a complaint prompts an investigation, link records of the issue, review steps, conclusion and any resulting action.

Use controlled records to preserve traceability. Maintain current procedures, assigned responsibilities, source logs, assessments and decision histories. When a process changes, document the updated version and communicate the change to teams handling device feedback. This helps prevent inconsistent application across complaint intake, analysis and reporting.

Check system performance, including whether assigned teams complete reviews and decisions link back to evidence. Use the findings to identify process gaps, not merely to close records. For example, repeated delays in routing complaints may indicate unclear ownership or an ineffective handoff between customer support and safety reviewers.

Keep regulatory outputs connected but distinct. EU surveillance records, clinical follow-up evidence and any FDA-ordered study information may inform broader product decisions, but each still needs a clear purpose and traceable assessment. A device-level index can connect evidence sources, applicable plans, evaluations and actions without merging separate obligations.

Organisations strengthening documented quality processes can consider ISO 9001 Quality Management System Certification as a way to assess their quality management system. Keep device-specific surveillance decisions grounded in the applicable medical-device requirements and evidence.

International Associates Limited: Social Accountability Audits

International Associates Limited provides Social Accountability Audits and ISO 13485 Medical Devices Certification for organisations addressing different assurance needs. A Social Accountability Audit focuses on social accountability, while ISO 13485 certification is relevant when a medical device manufacturer is seeking independent assessment of its quality management system against that standard.

For organisations building a robust post-market process, ISO 13485 certification can provide a structured assessment of the broader quality management system. It does not replace device-specific surveillance plans, clinical follow-up, or regulatory reporting. Those activities must remain aligned with the applicable EU MDR or FDA requirements.

Choose the relevant route based on your organisation’s objective: social accountability assessment or medical-device quality management system certification. Contact International Associates Limited to discuss the appropriate certification or audit.

Make post-market surveillance part of ongoing improvement

A mature system treats post-market surveillance for medical devices as an ongoing management responsibility, not a document to complete once. Keep ownership clear, connect evidence to decisions and ensure relevant teams can apply the process consistently as products and operational priorities evolve.

For broader organisational assurance, International Associates Limited offers Social Accountability Audits, ISO 9001 Quality Management System Certification, and ISO 14001 Environmental Management System Certification. These offerings address distinct assessment needs and do not replace device-specific regulatory surveillance or reporting. Consider them where independent assessment of social accountability, quality management, or environmental management aligns with your organisation’s objectives.

To discuss an appropriate audit or certification pathway, contact International Associates Limited. A well-governed next step can help your organisation strengthen its assurance approach with clarity and confidence.

Frequently Asked Questions

What Are The PMS Requirements For The European Market?

EU manufacturers need a documented process for turning device experience into review and appropriate action. For practical implementation, maintain a device-level record linking each signal to its source, assessment and disposition. For example, a complaint about a specific model should remain traceable through its evaluation and any resulting decision. This creates a clear evidence trail across surveillance activities.

What Is PMCF in the MDR?

PMCF, or post-market clinical follow-up, is the clinical evidence-gathering activity carried out after a device is marketed. It focuses on clinical information, rather than simply collecting every operational or service issue. Start by identifying the remaining clinical question about the device, then choose follow-up activities that can address it. The resulting evidence can inform the manufacturer’s clinical evaluation.

§ 822.1 What does this part cover?

21 CFR Part 822 covers FDA procedures and requirements for post-market surveillance under Section 522 of the Federal Food, Drug, and Cosmetic Act. It applies to certain Class II and Class III devices subject to that statutory surveillance framework. For manufacturers, the practical distinction is between routine post-launch monitoring and the specific surveillance obligations established through an FDA order under this part.

§ 822.2 What is the purpose of this part?

Section 822.2 sets out the purpose of Part 822: establishing procedures and requirements for surveillance under Section 522. In practice, manufacturers use the applicable order and regulatory requirements to identify the device, study expectations, and records involved. This helps keep the response tied to the FDA-directed surveillance activity instead of treating general quality monitoring as a substitute.

§ 822.31 What records am I required to keep?

Section 822.31 addresses records manufacturers must keep under Part 822. Organise required information so it can be retrieved by device and surveillance activity, with clear links between source records, analysis, and decisions. This structure helps staff locate the relevant material during an inspection or internal review. Keep responsibility for maintaining and retrieving these records assigned within the surveillance process.

What is post-market surveillance for medical devices?

Post-market surveillance is the manufacturer’s ongoing process for reviewing information about a marketed device and determining whether it calls for action. It is broader than a single study or complaint file. For example, teams can assess whether separate reports point to a common device issue, then document their reasoning. This decision-making process distinguishes surveillance from simple data storage.

What are FDA post-market surveillance requirements for medical devices in the United States?

FDA requirements include responding to applicable surveillance orders and meeting separate reporting duties. Under 21 CFR Part 822, manufacturers must continue complying with surveillance requirements unless FDA grants an exemption. In practice, track the order’s status and any exemption decision alongside study records. This prevents an active obligation from being treated as closed merely because data collection or a reporting milestone has been completed.

Which medical devices require FDA post-market surveillance studies under Section 522?

Section 522 studies apply to devices for which FDA issues a post-market surveillance order. The order identifies the manufacturer’s surveillance obligation; manufacturers should therefore match the named device and order conditions to their records before planning study activity. This order-based trigger is distinct from a manufacturer choosing routine monitoring as part of its broader quality processes.