The Periodic Safety Update Report Under MDR Article 86: Contents, Frequency and Who Sees It

Post-market surveillance under MDR 2017/745 generates data continuously. The periodic safety update report is the point at which that data has to become a conclusion — about the benefit-risk determination, about what post-market clinical follow-up actually found, and about how many people are using the device. Article 86 is four short paragraphs, and almost every part of it has a consequence that manufacturers discover late.

This guide sets out what has to be in the report, how often it is refreshed, which devices go through the notified body electronic route, where it is filed for custom-made devices, and what the EU authorised representative is expected to hold when a competent authority asks.

Which devices, and which document

MDR splits the reporting obligation by class. Article 85 covers class I: "Manufacturers of class I devices shall prepare a post-market surveillance report summarising the results and conclusions of the analyses of the post-market surveillance data gathered as a result of the post-market surveillance plan referred to in Article 84 together with a rationale and description of any preventive and corrective actions taken. The report shall be updated when necessary and made available to the competent authority upon request." (MDR Article 85)

That is a different document with a different name, no fixed update interval, and no notified body involvement. Calling it a PSUR is a common error, and it matters because the two documents have different mandatory contents.

Article 86(1) then covers everything above class I. "Manufacturers of class IIa, class IIb and class III devices shall prepare a periodic safety update report ('PSUR') for each device and where relevant for each category or group of devices summarising the results and conclusions of the analyses of the post-market surveillance data gathered as a result of the post-market surveillance plan referred to in Article 84 together with a rationale and description of any preventive and corrective actions taken." (MDR Article 86(1))

Two things in that sentence are worth isolating. The report is prepared for each device, and only where relevant for a category or group. Grouping is permitted, not presumed, and the manufacturer has to be able to justify why the devices grouped together share a meaningful safety profile. A grouping built around a commercial product line rather than around risk is the kind of thing a notified body challenges on review.

The second is the anchor to Article 84. The PSUR summarises data gathered as a result of the post-market surveillance plan. If the plan is thin, the PSUR has nothing to summarise, and the deficiency is in the plan rather than in the report. Article 84 requires that plan to be drawn up in accordance with Section 1 of Annex III, and adds that "For devices other than custom-made devices, the post-market surveillance plan shall be part of the technical documentation specified in Annex II." (MDR Article 84)

The three mandatory contents

Article 86(1) continues with a list that applies for as long as the device is on the market. "Throughout the lifetime of the device concerned, that PSUR shall set out: (a) the conclusions of the benefit-risk determination; (b) the main findings of the PMCF; and (c) the volume of sales of the device and an estimate evaluation of the size and other characteristics of the population using the device and, where practicable, the usage frequency of the device." (MDR Article 86(1))

Point (a) asks for conclusions, not for the analysis. The benefit-risk determination itself lives in the risk management file under Section 1 and Section 8 of Annex I and in the clinical evaluation; what the PSUR carries is the conclusion reached in this reporting period and whether it has changed since the last one. A PSUR that restates the original benefit-risk determination unchanged, period after period, with no reference to the data collected in between, is not answering point (a).

Point (b) creates a hard dependency. The PSUR has to set out the main findings of post-market clinical follow-up, which means a PMCF plan has to exist and PMCF activities have to have produced findings by the time the report is written. Annex XIV Part B requires the manufacturer to analyse the findings of the PMCF and document the results in a PMCF evaluation report; that report is the input to point (b). Our guide to the PMCF plan and report covers what the plan has to specify and what the evaluation report has to conclude.

Point (c) is the one manufacturers underestimate. It asks for three distinct things: the volume of sales; an estimate evaluation of the size and other characteristics of the population using the device; and, where practicable, the usage frequency. Sales volume is a commercial figure the company already has. Population size and characteristics is an epidemiological estimate — how many patients, of what kind — which for a device sold through distributors into multiple Member States is genuinely hard and has to be reasoned rather than asserted. Usage frequency is qualified by where practicable, which is the only softening in the paragraph; the other two are not qualified.

The reason point (c) exists is denominators. An incident count with no exposure figure cannot support a benefit-risk conclusion. A device with four serious incidents against two hundred units is a different product from a device with four serious incidents against two hundred thousand. Competent authorities read point (c) as the number that makes point (a) assessable, and a PSUR that gives incidents without exposure is treated accordingly.

The update cycle

Frequency varies by class, and the drafting differs in a way that is easy to skim past. "Manufacturers of class IIb and class III devices shall update the PSUR at least annually. That PSUR shall, except in the case of custom-made devices, be part of the technical documentation as specified in Annexes II and III." (MDR Article 86(1))

And: "Manufacturers of class IIa devices shall update the PSUR when necessary and at least every two years. That PSUR shall, except in the case of custom-made devices, be part of the technical documentation as specified in Annexes II and III." (MDR Article 86(1))

For class IIb and class III the obligation is a floor: at least annually. For class IIa there are two triggers — when necessary and at least every two years — and the first one is not a formality. A signal in the vigilance data, a field safety corrective action, a change in the state of the art, or a PMCF finding that shifts the benefit-risk picture all make an update necessary before the two-year point. A class IIa manufacturer that updates strictly on the biennial clock and can be shown to have sat on a signal in between has not complied with the first trigger.

The word update also matters. The PSUR is a living document with a version history, not a series of unrelated annual reports. A competent authority reading the current version expects to be able to see what changed and why.

Where it is filed

For devices other than custom-made devices, the PSUR is part of the technical documentation under Annexes II and III. That single clause has a cascade of consequences. It means the PSUR is inside the file that a notified body reviews at surveillance and at recertification. It means it is inside what an importer verifies has been drawn up. And it means it is inside the copy that Article 11(3)(a) requires the authorised representative to keep available. Our guide to MDR technical documentation covers the structure it sits in.

Custom-made devices are handled differently, because they have no Annex II technical documentation. "For custom-made devices, the PSUR shall be part of the documentation referred to in Section 2 of Annex XIII." (MDR Article 86(1)) The obligation is not removed; it is redirected into the Annex XIII documentation set. Our note on custom-made devices under Annex XIII explains what that set contains.

Two submission routes

Paragraph 2 creates a formal review loop for the highest-risk devices. "For class III devices or implantable devices, manufacturers shall submit PSURs by means of the electronic system referred to in Article 92 to the notified body involved in the conformity assessment in accordance with Article 52. The notified body shall review the report and add its evaluation to that electronic system with details of any action taken. Such PSURs and the evaluation by the notified body shall be made available to competent authorities through that electronic system." (MDR Article 86(2))

Read the scope carefully: class III devices or implantable devices. Implantable is a device characteristic, not a class, and implantable devices below class III are inside this paragraph. A class IIb implantable device follows the electronic submission route even though its class alone would not put it there.

The consequence of paragraph 2 is that the PSUR stops being an internal document. It is submitted, it is reviewed by the notified body, the notified body's evaluation and any action taken are recorded alongside it, and competent authorities in every Member State can read both. A weak PSUR for a class III device is not a finding that surfaces at the next audit; it is visible to regulators as soon as it is filed.

Paragraph 3 covers everything else. "For devices other than those referred to in paragraph 2, manufacturers shall make PSURs available to the notified body involved in the conformity assessment and, upon request, to competent authorities." (MDR Article 86(3)) Made available rather than submitted, and to competent authorities only on request. The document still has to exist, be current and be producible.

Where the authorised representative sits

Article 86 does not name the authorised representative. Article 11 brings it in through the technical documentation. Article 11(3)(a) requires the representative to verify that the technical documentation has been drawn up and to keep a copy available for the period referred to in Article 10(8); Article 11(3)(c) requires it to provide a competent authority, on request, with all the information and documentation necessary to demonstrate the conformity of a device. Because Article 86(1) puts the PSUR inside the technical documentation, both of those obligations reach it.

In practice that means the representative should be holding:

The current PSUR version for each device or justified device group in the portfolio, in a form that can be produced to a competent authority without a round trip to the manufacturer.

Evidence that the update cycle has actually been observed — annually for class IIb and class III, at least every two years and when necessary for class IIa — rather than a single report dated at the time of certification.

For class III and implantable devices, confirmation that the Article 92 submission was made and that the notified body's evaluation has been returned.

The post-market surveillance plan the PSUR summarises, since a competent authority reviewing the report will ask what plan generated the data.

The PMCF evaluation report that feeds point (b), or a documented justification where PMCF is not appropriate for the device.

A missing or stale PSUR is one of the more common findings in an authorised representative's own file review, because it is the one document in the technical file with a recurring deadline. Everything else is drawn up once and revised on change; the PSUR expires on a calendar. Our note on authorised representative liability covers why the representative is exposed when the file it certifies as available is out of date.

Practical points

Set the reporting period against a fixed anniversary and hold it. Drifting the data cut-off to accommodate an internal deadline produces gaps or overlaps between consecutive reports, which a notified body will find by comparing two versions.

Build point (c) before you need it. Sales volume by Member State, an estimated patient population and a usage frequency assumption should be produced by a standing process, not assembled in the week the PSUR is due. For devices sold through distributors, this needs to be in the distribution agreements.

Justify the grouping in the report itself. If one PSUR covers a category or group, the report should state the grouping rationale rather than leaving a reviewer to infer it.

Do not let the PSUR restate the clinical evaluation. It summarises post-market data and reaches conclusions; the clinical evaluation report is a different document with a different function, and a PSUR that is mostly a copy of it is not summarising anything.

Treat the when necessary trigger for class IIa as real. Document the decision each time a signal is assessed and an update is judged unnecessary, so there is a record of the judgement rather than a silence.

Track the vigilance interface. Article 87 reporting of serious incidents and field safety corrective actions runs on its own timetable and does not wait for the PSUR; the PSUR then has to reflect what was reported and what was done about it.

If your devices are on the EU market from outside the Union and you want an authorised representative that tracks PSUR cycles as a standing obligation rather than checking for the document once at onboarding, our authorised representative service covers post-market document management across MDR and IVDR portfolios.

Medex Kurumsal as your EU authorised representative

If you place medical devices or in vitro diagnostics on the European market from outside the Union, Article 11 of MDR 2017/745 — and Article 11 of IVDR 2017/746 for in vitro diagnostics — requires a single authorised representative established in a Member State before those devices reach the market. Medex Kurumsal Danismanlik acts as EU authorised representative under both Regulations, registered in EUDAMED under SRN TR-AR-000057550.

What the mandate covers: verification of the EU declaration of conformity and the technical documentation before signature rather than after; the Article 11(3)(a) copy of the file kept available for the full retention period; EUDAMED actor and device registration and the Basic UDI-DI submission; the registered EU address printed on your label and instructions for use; handling of competent authority requests, samples and information in the language of the Member State concerned; and the vigilance interface under Articles 87 to 90.

We review the file before accepting a mandate, because Article 11(5) makes the authorised representative jointly and severally liable for defective devices where the manufacturer has not complied with Article 10. A file we have not read is a liability we cannot price. Our fee structure is published on the EU authorised representative cost page, and the scope of the service is set out under EU authorised representative. Send us the declaration of conformity and the device list and we will tell you within two working days whether the file is ready for a mandate and what is missing if it is not.