Post market surveillance (PMS) for medical devices is the system a manufacturer uses to collect and analyse data on its devices once they are on the market, and to act on what it finds. Under the EU MDR it has been a lifecycle obligation since 26 May 2021. In December 2025 the MDCG published MDCG 2025-10, its guidance on post-market surveillance of medical devices and IVDs. In Great Britain, new PMS requirements took effect on 16 June 2025 (MHRA), and in the US, FDA can order postmarket surveillance under section 522 of the FD&C Act.
The documents differ by jurisdiction, but the test is the same everywhere: field data has to change decisions. This article covers the EU requirements in detail, then compares them with Great Britain and the US, with attention to software and AI-enabled devices.
The EU MDR framework
Article 83 of the MDR requires every manufacturer to plan, establish, document, implement, maintain and update a PMS system that is proportionate to the risk class and appropriate for the type of device. The PMS system is part of the quality management system under Article 10(9).
Under Article 83(3), PMS data must be used to, among other things:
update the benefit-risk determination and risk management;
update design and manufacturing information, the instructions for use and the labelling;
update the clinical evaluation and, where applicable, the summary of safety and clinical performance;
identify the need for preventive, corrective or field safety corrective action;
identify options to improve usability, performance and safety; and
detect and report trends under Article 88.
That list is the real purpose of PMS. A process that collects data but never changes one of these outputs is not meeting Article 83.
The PMS plan
Article 84 requires a PMS plan, with its content set out in Section 1 of Annex III. The plan should define what data is collected, from which sources, how it is analysed, which indicators and thresholds trigger an investigation, and who is responsible. Under Annex III, the plan must also include a post-market clinical follow-up (PMCF) plan, or a justification for why PMCF is not applicable.
In our view, the PMS plan should be versioned like a design document. When the device, its software, its labelling or its intended use changes, the plan should be reviewed at the same time, so that the data being collected still matches the device on the market.
PMS outputs by class
| Class (MDR) | Output | Update frequency | Who receives it |
|---|---|---|---|
| Class I | PMS report (Article 85) | When necessary | Competent authority on request |
| Class IIa | Periodic safety update report (PSUR, Article 86) | When necessary and at least every two years | Made available to the notified body, and to the competent authority on request |
| Class IIb | PSUR | At least annually | Made available to the notified body, and to the competent authority on request |
| Class III and implantable devices | PSUR | At least annually | Submitted to the notified body through EUDAMED |
Sources: MDR Articles 85 and 86; MDCG 2022-21; MDCG 2025-10.
The Commission's December 2025 proposal to revise the MDR would change some of these frequencies. Until it is adopted, the current rules apply.
Collecting data: active and passive sources
Passive sources are data that reach the manufacturer without being requested: complaints, service reports, user feedback, published literature and regulatory databases. Active sources are data the manufacturer sets out to collect: PMCF studies, registries, surveys and, for software, usage and performance data from the device itself.
Complaints alone are a weak signal. Reporting is incomplete and depends on users noticing a problem. In our view, each significant risk in the risk management file should be linked to at least one data source that can show whether the risk is behaving as estimated. Where that link is missing, the PMS plan has a gap.
Signal detection for software and AI devices
Counting complaints is not trend analysis. A rate needs a denominator, such as events per active installation, per thousand uses or per thousand analyses, and a baseline to compare against.
For software and AI-enabled devices, the data should also be split by software version, configuration and site. A global average can look stable while one version or one deployment is failing. Silent failures, such as gradual loss of accuracy or a rise in false positives, may never produce a complaint, so they need performance monitoring with thresholds defined in advance.
Article 88 requires manufacturers to report any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or of expected side-effects, that could affect the benefit-risk analysis. The PMS plan should state how "statistically significant" is determined for each device.
For AI-enabled devices, the AI Act adds its own post-market monitoring obligation for high-risk AI systems (Article 72). Where a device already has a PMS system and plan under the MDR or IVDR, Article 72(4) allows the provider to integrate the AI Act elements into them, provided this achieves an equivalent level of protection. The Commission is due to adopt guidance, including a template for the plan, by 2 September 2027. Our article on EU AI Act requirements for medical devices covers the detail.
Closing the loop: vigilance, CAPA and risk management
A PMS finding has to go somewhere. Depending on what it shows, it should lead to:
Vigilance: serious incidents must be reported no later than 15 days after the manufacturer becomes aware of them, 2 days for a serious public health threat, and 10 days for a death or unanticipated serious deterioration in health (MDR Article 87).
CAPA: investigation, root cause, correction and an effectiveness check.
Risk management: an update of the risk estimates and the benefit-risk conclusion.
Clinical evaluation: an update where the data affects clinical performance or safety.
Each entry in a PSUR or PMS report should end in one of these, or in a documented decision that no action is needed. That traceability is what an auditor will look for.
Great Britain and the United States
The same device can trigger different obligations in each market.
| Market | Legal basis | Main obligations |
|---|---|---|
| EU | MDR Articles 83 to 92 | PMS plan, PMS report or PSUR, PMCF, vigilance and trend reporting |
| Great Britain | UK MDR 2002 as amended by SI 2024/1368, in effect from 16 June 2025 | PMS system, plan and reports, incident reporting to the MHRA |
| United States | 21 CFR Part 803; section 522 and 21 CFR Part 822 | Medical Device Reporting; postmarket surveillance when FDA issues a 522 order |
Sources: MDR; MHRA; 21 CFR Parts 803 and 822.
Under 21 CFR Part 822, FDA can order section 522 surveillance for class II or III devices that meet certain criteria, for example where failure would be reasonably likely to have serious adverse health consequences, or the device is implanted for more than a year. The manufacturer must submit a surveillance plan within 30 days of receiving the order and start surveillance no later than 15 months after the order was issued. US adverse event reporting is covered in our article on FDA adverse event reporting.
In our view, the practical risk is classification at intake. If the complaint form does not capture enough information, such as the device identifier, software version, market and outcome, the team cannot decide which reporting obligations apply in each jurisdiction.
A hypothetical example
Hypothetical example: a manufacturer markets a class IIa AI triage software in the EU. Its PMS plan tracks complaints, in-app performance data split by software version, and clinician feedback.
After a release, the false-positive rate at two hospitals rises above the threshold set in the plan, while the overall rate stays within limits. Because the data is split by version and site, the signal is visible. The team opens a CAPA, checks whether any event meets the serious incident criteria under Article 87, updates the risk management file, and records the analysis for the next PSUR. If the increase is statistically significant and could affect the benefit-risk analysis, it is also assessed for trend reporting under Article 88.
Conclusion
Post market surveillance is only useful if it changes something: the risk file, the design, the labelling, the clinical evaluation or a field action. The MDR sets out what the system must cover and which reports each class produces, MDCG 2025-10 explains how to apply it, and the UK and US rules add their own reporting routes.
For software and AI-enabled devices, the key design choices are data split by version, rates with denominators, and thresholds set in advance. Our article on post-market regulatory complexities under the MDR and IVDR covers related challenges. If you need help building or improving your PMS system, our postmarket follow-up team can help, or contact MedQAIR.
Frequently asked questions
Is post market surveillance required for class I devices?
Yes. Every device needs a PMS system and plan. Class I devices produce a PMS report under Article 85, updated when necessary and made available to the competent authority on request.
How often must a PSUR be updated?
For class IIa devices, when necessary and at least every two years. For class IIb and class III devices, at least annually.
What is the difference between PMS and vigilance?
PMS is the overall system for collecting and analysing post-market data. Vigilance is the reporting of serious incidents and field safety corrective actions to authorities, which is one of the outputs of that system.
Does a PMS plan always need PMCF?
The plan must include a PMCF plan or a justification for why PMCF is not applicable (MDR Annex III).
What is a section 522 order?
An FDA order requiring postmarket surveillance of certain class II or III devices. The manufacturer must submit a plan within 30 days and begin surveillance within 15 months of the order.
Can AI Act post-market monitoring be combined with MDR PMS?
Yes. Article 72(4) of the AI Act allows providers of devices already covered by MDR or IVDR post-market surveillance to integrate the AI Act post-market monitoring elements into their existing system and plan.
