EU post-market obligations for medical devices

A manufacturer whose device is on the Union market operates a post-market surveillance system for that device under Article 83 of Regulation (EU) 2017/745, reports serious incidents and field safety corrective actions to competent authorities under Article 87 and produces periodic reports whose frequency depends on the risk class. The data gathered feeds back into the technical documentation, the clinical evaluation and the benefit-risk determination, which are updated accordingly.¹ The reporting clocks are short: 15 days for a serious incident, 10 days where a death or an unanticipated serious deterioration in health is involved and 2 days in the event of a serious public health threat.¹

The post-market surveillance system

Article 83(1) requires manufacturers to plan, establish and document a post-market surveillance system for each device. They must also implement, maintain and update it. The system must be proportionate to the risk class and appropriate for the type of device. It forms an integral part of the quality management system referred to in Article 10(9). Under Article 83(2) the system must be suited to actively and systematically gathering, recording and analysing relevant data on the quality, performance and safety of the device throughout its entire lifetime.¹

Article 83(3) specifies the uses to which the gathered data must be put. The manufacturer uses the data for the following purposes.

• Updating the benefit-risk determination and improving risk management as referred to in Chapter I of Annex I.
• Updating the design and manufacturing information, the instructions for use and the labelling.
• Updating the clinical evaluation.
• Updating the summary of safety and clinical performance referred to in Article 32.
• Identifying needs for preventive, corrective or field safety corrective action.
• Identifying options to improve the usability, performance and safety of the device.
• Contributing, where relevant, to the post-market surveillance of other devices.
• Detecting and reporting trends in accordance with Article 88.

The technical documentation is updated accordingly.¹ Where surveillance identifies a need for preventive or corrective action, Article 83(4) requires the manufacturer to implement the appropriate measures. The manufacturer must also inform the competent authorities concerned and, where applicable, the notified body. A serious incident or an implemented field safety corrective action is reported under Article 87.¹

The post-market surveillance plan

Article 84 requires the surveillance system to be based on a post-market surveillance plan. The requirements for that plan are set out in Section 1 of Annex III. For devices other than custom-made devices, the plan forms part of the technical documentation specified in Annex II.¹ The plan also carries the trend methodology: Article 88(1) requires the manufacturer to specify in the plan how the relevant incidents are managed, the methodology used to determine a statistically significant increase in their frequency or severity and the observation period.¹

Periodic reporting by risk class

Class I manufacturers prepare a post-market surveillance report under Article 85. It summarises the results and conclusions of the analyses of the data gathered under the surveillance plan, together with a rationale and description of any preventive and corrective actions taken. The report is updated when necessary and made available to the competent authority upon request.¹ There is no routine submission of the class I report.

Manufacturers of class IIa, class IIb and class III devices prepare a periodic safety update report under Article 86(1), for each device and where relevant for each category or group of devices. Throughout the lifetime of the device the PSUR sets out the conclusions of the benefit-risk determination, the main findings of the post-market clinical follow-up and the volume of sales of the device. It also gives an estimate of the size and other characteristics of the population using the device and, where practicable, the usage frequency.¹

The update intervals differ by class. Manufacturers of class IIb and class III devices update the PSUR at least annually. Manufacturers of class IIa devices update it when necessary and at least every two years. Except for custom-made devices, the PSUR forms part of the technical documentation specified in Annexes II and III. For custom-made devices it forms part of the documentation referred to in Section 2 of Annex XIII.¹

Routing of the PSUR also depends on the device. Under Article 86(2), manufacturers of class III devices and implantable devices submit PSURs through the electronic system referred to in Article 92 to the notified body involved in the conformity assessment under Article 52. The notified body reviews the report and adds its evaluation to that system with details of any action taken. Both the PSUR and the evaluation are made available to competent authorities through that system. For all other devices, Article 86(3) requires the manufacturer to make the PSUR available to the notified body involved in the conformity assessment. It must also be made available to competent authorities upon request.¹

Vigilance reporting and its deadlines

Article 87(1) requires manufacturers of devices made available on the Union market, other than investigational devices, to report serious incidents involving those devices and any field safety corrective action in respect of them. A field safety corrective action undertaken in a third country is reportable where the device is also legally made available on the Union market and the reason for the action is not limited to the third-country device. Expected side-effects are excluded from serious incident reporting where they are clearly documented in the product information, quantified in the technical documentation and subject to trend reporting under Article 88. Reports are submitted through the electronic system referred to in Article 92.¹

Three deadlines apply. The general rule in Article 87(3) is a report immediately after the manufacturer establishes a causal relationship between the incident and the device, or that such a relationship is reasonably possible, and no later than 15 days after becoming aware of the incident. Article 87(5) shortens this to 10 days from awareness where a death or an unanticipated serious deterioration in a person’s state of health is involved. Article 87(4) requires a report within 2 days of the manufacturer becoming aware of a serious public health threat.¹

Two practical allowances sit alongside the deadlines. Article 87(6) permits an initial incomplete report followed by a complete report where this is needed to ensure timely reporting. Article 87(7) requires a manufacturer that is uncertain whether an incident is reportable to submit a report anyway, within the applicable timeframe.¹ Field safety corrective actions are reported in advance of being undertaken, without undue delay, except in cases of urgency where the action must be taken immediately.¹

Article 87(9) allows periodic summary reports in place of individual serious incident reports for similar serious incidents with the same device or device type, where the root cause has been identified, a field safety corrective action has been implemented or the incidents are common and well documented. This requires prior agreement with the coordinating competent authority on format, content and frequency.¹ Where a competent authority receives a suspected serious incident report from a healthcare professional, user or patient, Article 87(11) requires it to ensure the manufacturer is informed without delay. A manufacturer that considers the incident is not serious, or is an expected undesirable side-effect covered by trend reporting, provides an explanatory statement.¹

Trend reporting

Article 88(1) requires manufacturers to report, through the electronic system referred to in Article 92, any statistically significant increase in the frequency or severity of incidents that are not serious incidents or that are expected undesirable side-effects. The reporting trigger is a potential significant impact on the benefit-risk analysis referred to in Sections 1 and 8 of Annex I, where the increase has led or may lead to unacceptable risks when weighed against the intended benefits. The increase is measured against the foreseeable frequency or severity specified in the technical documentation and product information for a specific period.¹ Competent authorities may conduct their own assessments of trend reports and require appropriate measures under Article 88(2).¹

Investigation and field safety notices

Article 89(1) requires the manufacturer to perform the necessary investigations without delay following a serious incident report. Those investigations include a risk assessment of the incident and of the field safety corrective action. The manufacturer cooperates with competent authorities and, where relevant, the notified body. It must not perform any investigation that alters the device or a sample of the batch in a way that may affect subsequent evaluation of the causes, before informing the competent authorities of that action.¹ A final report setting out the findings, the conclusions and any corrective actions to be taken is provided to the competent authority through the electronic system referred to in Article 92.¹

Article 89(8) governs the field safety notice. The manufacturer ensures that information about the field safety corrective action reaches users of the device without delay by means of such a notice. The notice is edited in an official Union language or languages determined by the Member State in which the field safety corrective action is taken. Except in cases of urgency, the draft is submitted to the evaluating or coordinating competent authority for comment. The content must be consistent across Member States unless the situation of an individual Member State justifies otherwise. The notice must allow correct identification of the devices through the relevant UDIs and of the manufacturer through its SRN, where already issued. It must explain the reasons for the action with reference to the device malfunction and associated risks, without understating the level of risk, and indicate all actions to be taken by users. The manufacturer enters the notice in the electronic system referred to in Article 92, through which it is accessible to the public.¹

Where a serious incident or cluster of incidents relating to the same device of the same manufacturer raises concern in more than one Member State, or where the appropriateness of a proposed field safety corrective action in more than one Member State is in question, Article 89(9) requires competent authorities to coordinate their assessments. Unless otherwise agreed, the coordinating competent authority is that of the Member State where the manufacturer has its registered place of business.¹

Legacy devices and the electronic system dates

Devices still covered by a certificate issued under Directive 90/385/EEC or Directive 93/42/EEC may be placed on the market or put into service until 31 December 2027 for class III devices and class IIb implantable devices other than the listed items, and until 31 December 2028 for other class IIb devices, class IIa devices and class I devices placed on the market in sterile condition or having a measuring function. These extensions apply only where the conditions in Article 120(3c) are met, including continued compliance with the applicable directive and the absence of significant changes in design and intended purpose. Article 120(3c) also requires the quality management system and the formal application to a notified body no later than 26 May 2024 and the signed written agreement no later than 26 September 2024.¹ Article 120(3d) provides that the requirements of the Regulation on post-market surveillance, market surveillance, vigilance and registration of economic operators and devices apply to those devices in place of the corresponding requirements in the directives.¹

Several of the obligations described above are tied to the availability of the electronic systems. Article 123(3)(d) provides that the obligations and requirements relating to the electronic systems referred to in Article 33(2) apply from six months after publication of the notice under Article 34(3) confirming that the relevant system is functional. The provisions listed there include Article 86(2), Articles 87 and 88, Article 89(5) and (7), the third subparagraph of Article 89(8) and Article 120(3d). Until the applicable date, the corresponding provisions of Directives 90/385/EEC and 93/42/EEC on vigilance reporting continue to apply.¹ Article 123(3)(ec) adds that a manufacturer submitting a PSUR under Article 86(2), reporting under Article 87 or submitting a trend report under Article 88 through the vigilance module must also register the device in the electronic systems referred to in Article 33(2), points (a) and (b). That registration requirement does not apply where the device was placed on the market under Directive 90/385/EEC or Directive 93/42/EEC.¹

Questions people also ask

How often must a periodic safety update report be updated under the MDR?

Article 86(1) sets two intervals. Manufacturers of class IIb and class III devices update the PSUR at least annually. Manufacturers of class IIa devices update it when necessary and at least every two years. Manufacturers of class I devices prepare a post-market surveillance report under Article 85 instead, updated when necessary.¹

What is the deadline for reporting a serious incident in the European Union?

The general deadline in Article 87(3) is no later than 15 days after the manufacturer becomes aware of the incident, reported immediately once a causal relationship is established or is reasonably possible. Where a death or an unanticipated serious deterioration in a person’s state of health is involved, Article 87(5) sets 10 days from awareness. A serious public health threat is reported immediately and no later than 2 days after the manufacturer becomes aware of it.¹

Who receives the periodic safety update report?

For class III devices and implantable devices, Article 86(2) requires submission through the electronic system referred to in Article 92 to the notified body involved in the conformity assessment. That notified body reviews the report and adds its evaluation, and competent authorities access both through the system. For other devices, Article 86(3) requires the manufacturer to make the PSUR available to the notified body. It must also be made available to competent authorities upon request.¹

Do the MDR post-market rules apply to devices still certified under the old directives?

Article 120(3d) provides that the Regulation’s requirements on post-market surveillance, market surveillance, vigilance and registration of economic operators and devices apply to devices placed on the market under the transitional provisions in Article 120(3a) and (3b), in place of the corresponding requirements in Directives 90/385/EEC and 93/42/EEC. Article 123(3)(d) lists Article 120(3d) among the provisions whose application is linked to the electronic system notice under Article 34(3).¹

What must a field safety notice contain?

Under Article 89(8) it must allow correct identification of the devices involved, in particular through the relevant UDIs, and of the manufacturer that undertook the action, in particular through the SRN where already issued. It must explain the reasons for the field safety corrective action with reference to the device malfunction and the associated risks for patients, users or other persons. It must clearly indicate all actions to be taken by users and must not understate the level of risk. The manufacturer enters the notice in the electronic system referred to in Article 92, where it is accessible to the public.¹

Can a manufacturer report groups of similar incidents together?

Article 87(9) permits periodic summary reports in place of individual serious incident reports for similar serious incidents with the same device or device type, where the root cause has been identified, a field safety corrective action has been implemented or the incidents are common and well documented. The format, content and frequency must first be agreed with the coordinating competent authority referred to in Article 89(9), in consultation with the competent authorities referred to in Article 92(8)(a).¹

Footnotes

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC. Consolidated version of 2026-07-19. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02017R0745-20260719 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²² ↩²³ ↩²⁴ ↩²⁵ ↩²⁶ ↩²⁷ ↩²⁸ ↩²⁹ ↩³⁰ ↩³¹ ↩³² ↩³³