Post-Market Surveillance for Medical Devices, Explained
Post-market surveillance is the systematic collection and review of experience with a device once it is on the market, and the use of that experience to act.
The word doing the work is proactive. Waiting for complaints to arrive and processing them well is complaint handling, and it is required, but it is not surveillance. Surveillance means going looking: at literature, at registries, at similar devices, at your own trend data, for signals that nobody has reported to you.
That distinction is the most common finding in this area. A PMS system that consists entirely of the complaint process is a reactive system wearing the wrong label.
What the US requires
There is no single "PMS regulation". The obligations are spread across several:
- Medical Device Reporting, 21 CFR 803. Reportable deaths, serious injuries and malfunctions, on defined timelines.
- Postmarket surveillance studies, 21 CFR 822. Studies FDA orders under section 522 for specific devices, which is a targeted order rather than a standing requirement.
- Corrections and removals, 21 CFR 806.
- Device tracking, 21 CFR 821, for certain devices.
- Complaint handling and CAPA, now via ISO 13485 under the QMSR.
Plus the requirement that sits underneath all of them: your ISO 14971 risk management process has a production and post-production stage, and it expects this information to flow back into the risk file.
What the EU requires
The EU MDR is more prescriptive and is where the vocabulary most people use comes from.
- A PMS system and a PMS plan, proportionate to risk class.
- PMCF, Post-Market Clinical Follow-up: the proactive collection of clinical data on a device already on the market, with its own plan and evaluation report, feeding the clinical evaluation.
- A PSUR for class IIa, IIb and III devices, updated on a class-dependent cycle, or a PMS report for class I.
- Vigilance reporting of serious incidents and field safety corrective actions.
PMCF is the part US-only manufacturers most often have no equivalent of, and it is not optional in the EU. A PMCF plan that says PMCF is not applicable has to justify why, and "the device is well established" is a justification FDA-side teams tend to underestimate the scrutiny of.
Proactive and reactive, and how they connect
| Reactive | Proactive | |
|---|---|---|
| Source | Complaints, incidents, returns | Literature, registries, similar-device data, trend analysis, PMCF |
| Trigger | Someone tells you | You go looking |
| Output | Investigation, MDR or vigilance report, CAPA | PMS report, PSUR, updated risk file and clinical evaluation |
Both feed the same place: the risk management file and, for the EU, the clinical evaluation. A PMS system that generates reports nobody reads back into those two documents is producing paperwork rather than surveillance.
Where PMS systems fail
- Complaint handling relabelled as PMS. The most common finding.
- No trending. Individual complaints handled correctly, with nobody asking whether the rate is rising.
- Literature review done once. For the CE mark, and never repeated.
- PMS output that does not reach the risk file. Surveillance data that never changes a risk estimate suggests either a device with no surprises or a loop that is not connected.
- Similar devices ignored. Registry and adverse event data for comparable devices is a legitimate and expected input, and it is public.
- PMCF deferred. Planned at CE marking, then not executed, which surfaces at the first surveillance audit.
Frequently asked questions
What is post-market surveillance?
The systematic, proactive collection and review of experience with a device after it is on the market, and the use of that experience to update risk management, clinical evaluation and the device itself.
Is complaint handling the same as post-market surveillance?
No. Complaint handling is reactive and required. Surveillance also means actively seeking data from literature, registries, similar devices and trend analysis that nobody has reported to you.
What is PMCF?
Post-Market Clinical Follow-up, the proactive collection of clinical data on a device already on the market under the EU MDR, with its own plan and evaluation report feeding the clinical evaluation.
What does the US require for post-market surveillance?
Obligations spread across MDR reporting under 21 CFR 803, section 522 postmarket surveillance studies under 21 CFR 822, corrections and removals under 806, tracking under 821, and complaint handling and CAPA through ISO 13485.
What is a PSUR for devices?
A periodic safety update report required under the EU MDR for class IIa, IIb and III devices, summarising PMS data and its conclusions on a class-dependent cycle.
Where should PMS data end up?
In the risk management file and, in the EU, the clinical evaluation. Data that never reaches either is not closing the loop.