Post-Market Surveillance Under the MDR: Which Document, Which Interval, and Who Files It
Updated: Aug 15
Post-market surveillance generates more correspondence between a manufacturer and its authorised representative than any other part of the MDR, and more confusion about who owes what. The regulation is not ambiguous. It is spread across five articles and one annex whose numbering was changed by corrigendum, which is a different problem.
The system Article 83 actually requires
Article 83(1) requires a post-market surveillance system for each device, planned, established, documented, implemented, maintained and updated in a manner proportionate to the risk class and appropriate for the type of device. It is an integral part of the quality management system referred to in Article 10(9), not a parallel process alongside it.
Article 83(2) sets the standard of operation: actively and systematically gathering, recording and analysing data on the quality, performance and safety of a device throughout its entire lifetime.
Article 83(3) lists what that data must be used for. Updating the benefit-risk determination and risk management. Updating the design and manufacturing information, the instructions for use and the labelling. Updating the clinical evaluation and the summary of safety and clinical performance. Identifying the need for preventive, corrective or field safety corrective action. Identifying options to improve usability, performance and safety. Contributing, when relevant, to the surveillance of other devices. Detecting and reporting trends under Article 88.
The paragraph closes with a sentence that is routinely skipped: the technical documentation shall be updated accordingly. A surveillance system that produces reports but never changes the technical file does not satisfy Article 83(3).
The plan is in Annex III Section 1, not Section 1.1
Article 84 requires the system to be based on a post-market surveillance plan, the requirements for which are set out in Section 1 of Annex III.
If your procedure cites Annex III Section 1.1, it is citing the 2017 Official Journal text rather than the law in force. The corrigendum published in OJ L 334 of 27 December 2019 renumbered Annex III: Section 1.1 became Section 1 and Section 1.2 became Section 2, and Article 84 was corrected to match. The same corrigendum replaced the word events with incidents in the fifth indent of point 1(b), aligning the trend-reporting methodology with the wording of Article 88.
Annex III point 1(b) sets ten minimum contents for the plan. The tenth is the one that most often fails review: a post-market clinical follow-up plan as referred to in Part B of Annex XIV, or a justification as to why PMCF is not applicable. A justification is permitted. An omission is not.
Article 85 and Article 86 are different documents
Article 85 applies to class I devices only. It requires a post-market surveillance report summarising the results and conclusions of the analyses of the data gathered under the plan, with a rationale and description of any preventive and corrective actions taken. It is updated when necessary and made available to the competent authority upon request. There is no fixed interval and no notified body in the loop.
Article 86 applies to class IIa, class IIb and class III devices and requires a periodic safety update report. Throughout the lifetime of the device, the PSUR must set out the conclusions of the benefit-risk determination, the main findings of the post-market clinical follow-up, and the volume of sales together with an estimate of the size and other characteristics of the population using the device and, where practicable, its usage frequency.
The intervals differ by class. Class IIb and class III devices: update at least annually. Class IIa devices: update when necessary and at least every two years. Class IIa is the only class carrying both a discretionary trigger and a fixed outer limit, which is why nothing to report is not by itself an answer for a class IIa device in month twenty-five.
Where the PSUR goes, and where it cannot go yet
Article 86(2) covers class III devices or implantable devices. Manufacturers submit the PSUR through the electronic system referred to in Article 92 to the notified body involved in the conformity assessment; the notified body reviews the report and adds its evaluation to that system, and both are made available to competent authorities through it. Article 86(3) covers everything else: the PSUR is made available to the notified body and, upon request, to competent authorities.
Note the disjunction. An implantable class IIb device keeps the annual interval of its class but takes the class III route, because the trigger is class III or implantable.
There is a practical qualification worth stating plainly. Commission Decision (EU) 2025/2371 of 26 November 2025 declared four EUDAMED modules functional, and those four became mandatory on 28 May 2026: actor registration, UDI and device registration, notified bodies and certificates, and market surveillance. The Article 92 vigilance and post-market surveillance module is not one of them. The Commission's EUDAMED overview still lists it as in development, with no mandatory date. Market surveillance under Article 100 and vigilance under Article 92 are separate systems, and it is the first that went live. Until the second does, PSURs and incident reports travel by national routes.
The three vigilance clocks
Article 87 sets three deadlines, and they are drafted differently on purpose.
Fifteen days under Article 87(3): report immediately after establishing that a causal relationship exists between the incident and the device, or that such a relationship is reasonably possible, and not later than fifteen days after becoming aware of the incident.
Ten days under Article 87(5), for death or an unanticipated serious deterioration in a person's state of health: immediately after the manufacturer has established, or as soon as it suspects, a causal relationship. That is a lower threshold on a shorter clock.
Two days under Article 87(4), for a serious public health threat. That paragraph contains no causality language at all.
All three run from awareness, never from the completion of an assessment.
What the authorised representative actually owes here
None of Articles 83 to 89 addresses the authorised representative. They address manufacturers. Article 11(3) contains no obligation to operate a surveillance system, write a plan, prepare or review a PSUR, or file an incident report.
Four points of Article 11(3) touch this chain. Point (d): in response to a request from a competent authority, provide all the information and documentation necessary to demonstrate the conformity of a device, in an official Union language determined by the Member State concerned. Point (e): forward requests for samples or access to a device, and verify the authority receives them. Point (f): cooperate with competent authorities on any preventive or corrective action taken to eliminate or mitigate risk. Point (g): immediately inform the manufacturer about complaints and reports from healthcare professionals, patients and users about suspected incidents.
Article 11(4) then ring-fences Article 10(1), (2), (3), (4), (6), (7), (9), (10), (11) and (12) as non-delegable, and 10(10) is the obligation to implement and keep up to date the post-market surveillance system in accordance with Article 83. MDCG 2022-16 states the boundary precisely: the manufacturer cannot delegate its responsibility for these tasks, but the authorised representative is not prevented from assisting in their performance.
One consequence is easy to miss. Article 11(7) reads references to the Member State of the manufacturer's registered place of business as references to the representative's. Article 89(9) makes the coordinating competent authority, by default, the authority of the Member State where the manufacturer has its registered place of business. For a manufacturer outside the Union, that resolves through 11(7) to the representative's Member State. Your representative's address decides which national authority coordinates a multi-state assessment of your device, and under Article 87(9) which authority you would have to agree periodic summary reporting with.
Sources
Regulation (EU) 2017/745, Articles 10, 11, 83, 84, 85, 86, 87, 88 and 89, and Annex III
Corrigendum to Regulation (EU) 2017/745, OJ L 334, 27 December 2019, renumbering of Annex III and correction of Article 84
Commission Decision (EU) 2025/2371 of 26 November 2025 on the functionality of certain EUDAMED electronic systems
MDCG 2022-21, Guidance on Periodic Safety Update Report (PSUR) according to Regulation (EU) 2017/745, December 2022
MDCG 2025-10, Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025
MDCG 2022-16, Guidance on Authorised Representatives, Regulation (EU) 2017/745 and Regulation (EU) 2017/746, October 2022
European Commission, EUDAMED overview, module status
Who wrote this
Medex is a medical device manufacturer established in Ankara and a registered authorised representative in EUDAMED under SRN TR-AR-000057550. We maintain post-market surveillance documentation for our own devices before we hold it for anyone else's. We are not a law firm and do not provide legal advice.
Comments