Post-Market Surveillance for Medical Devices, Explained
Post-market surveillance is the systematic collection and review of experience with a device once it is on the market, and the use of that experience to act.
Surveillance is proactive. Processing complaints as they arrive is complaint handling, which is required but is not surveillance. Surveillance means searching literature, registries, similar-device data and your own trends for signals nobody has reported to you.
The most common finding in this area is a PMS system that consists entirely of the complaint process.
US requirements
There is no single "PMS regulation". The obligations are spread across several:
- Medical Device Reporting, 21 CFR 803. Reportable deaths, serious injuries and malfunctions, on defined timelines.
- Postmarket surveillance studies, 21 CFR 822. Studies FDA orders under section 522 for specific devices, which is a targeted order rather than a standing requirement.
- Corrections and removals, 21 CFR 806.
- Device tracking, 21 CFR 821, for certain devices.
- Complaint handling and CAPA, now via ISO 13485 under the QMSR.
Underneath all of them, your ISO 14971 risk management process has a production and post-production stage that expects this information to flow back into the risk file.
EU requirements
The EU MDR is more prescriptive, and most PMS vocabulary comes from it.
- A PMS system and a PMS plan, proportionate to risk class.
- PMCF, Post-Market Clinical Follow-up: the proactive collection of clinical data on a device already on the market, with its own plan and evaluation report, feeding the clinical evaluation.
- A PSUR for class IIa, IIb and III devices, updated on a class-dependent cycle, or a PMS report for class I.
- Vigilance reporting of serious incidents and field safety corrective actions.
US-only manufacturers most often have no equivalent of PMCF, and it is not optional in the EU. A PMCF plan that declares PMCF not applicable has to justify it, and "the device is well established" draws more scrutiny than FDA-side teams tend to expect.
Proactive and reactive, and how they connect
| Reactive | Proactive | |
|---|---|---|
| Source | Complaints, incidents, returns | Literature, registries, similar-device data, trend analysis, PMCF |
| Trigger | Someone tells you | You go looking |
| Output | Investigation, MDR or vigilance report, CAPA | PMS report, PSUR, updated risk file and clinical evaluation |
Both feed the risk management file and, for the EU, the clinical evaluation. A PMS report that never changes either document has not closed the loop.
Common failures
- Complaint handling relabeled as PMS. The most common finding.
- No trending. Individual complaints handled correctly, with nobody asking whether the rate is rising.
- Literature review done once. For the CE mark, and never repeated.
- PMS output that does not reach the risk file. Surveillance data that never changes a risk estimate suggests either a device with no surprises or a loop that is not connected.
- Similar devices ignored. Registry and adverse event data for comparable devices is a legitimate and expected input, and it is public.
- PMCF deferred. Planned at CE marking, then not executed, which surfaces at the first surveillance audit.
Frequently asked questions
What is post-market surveillance?
The systematic, proactive collection and review of experience with a device after it is on the market, and the use of that experience to update risk management, clinical evaluation and the device itself.
Is complaint handling the same as post-market surveillance?
No. Complaint handling is reactive and required. Surveillance also means actively seeking data from literature, registries, similar devices and trend analysis that nobody has reported to you.
What is PMCF?
Post-Market Clinical Follow-up, the proactive collection of clinical data on a device already on the market under the EU MDR, with its own plan and evaluation report feeding the clinical evaluation.
What does the US require for post-market surveillance?
Obligations spread across MDR reporting under 21 CFR 803, section 522 postmarket surveillance studies under 21 CFR 822, corrections and removals under 806, tracking under 821, and complaint handling and CAPA through ISO 13485.
What is a PSUR for devices?
A periodic safety update report required under the EU MDR for class IIa, IIb and III devices, summarizing PMS data and its conclusions on a class-dependent cycle.
Where should PMS data end up?
In the risk management file and, in the EU, the clinical evaluation. Data that never reaches either is not closing the loop.