Post-Market Surveillance Plan Template for Medical Devices (FDA + EU MDR)

Why Post-Market Surveillance Is Now a Core Regulatory Obligation

Post-market surveillance was once treated as a box-checking exercise — a complaint log and a few annual reports filed away in a binder. That era is over. Both FDA and the EU regulatory frameworks now treat PMS as an active, lifecycle-spanning system that must generate usable data and feed directly back into risk management, clinical evaluation, and product design.

ISO 13485:2016 §8.2.1 requires that manufacturers plan and implement monitoring and measurement processes to demonstrate device conformity and ensure QMS effectiveness. EU MDR Article 83 goes further: it mandates a proactive PMS system that continuously gathers and evaluates experience from devices already on the market. For Class IIa, IIb, and III devices, that data must flow into a Periodic Safety Update Report (PSUR). For all device classes, it must support a living clinical evaluation.

FDA, while less prescriptive in structure, expects equivalent rigor through complaint handling, MDR reporting, and post-market studies where ordered under 522 authority. Manufacturers who treat PMS as paperwork rather than as a real surveillance system consistently receive 483 observations and Notified Body nonconformities that are both expensive and avoidable.

A well-designed post-market surveillance plan is the difference between a reactive quality system that chases problems and a proactive one that detects them early.

What a PMS Plan Must Include Under ISO 13485 §8.2 and EU MDR Article 83

The two frameworks share common ground but differ in specificity. Here is what a compliant PMS plan must address under both:

Scope and objectives. Define which devices are covered, what surveillance activities will be performed, and what the system is designed to detect. Objectives should be measurable — not vague commitments to "monitor complaints" but specific thresholds and review frequencies.

Data sources. A complete PMS plan identifies all relevant data sources: your own complaint files, service and repair records, literature surveillance (PubMed, adverse event databases), competitor device incident reports, regulatory authority databases (FDA MAUDE, EUDAMED vigilance module), and sales and field data. EU MDR Article 83 explicitly requires proactive data collection — you cannot rely solely on inbound complaints.

Evaluation criteria and thresholds. Define what signal levels trigger action. Complaint rates above a defined threshold, unexpected failure modes, or literature suggesting new risks should all have documented response triggers.

Roles and responsibilities. Identify who owns each data source, who reviews and evaluates the data, who makes reportability decisions, and who escalates to management when thresholds are crossed.

Reporting outputs. Under EU MDR, the PMS plan must specify whether the device requires a PSUR (Class IIa, IIb, III) or a PMS Report (Class I). For FDA, outputs include MDR reports, complaint files, and field safety corrective action documentation as applicable.

Integration with risk management and clinical evaluation. This is where most manufacturers fall short. The PMS plan must explicitly describe how surveillance findings feed into risk management file updates and clinical evaluation refreshes. Regulators want to see a closed loop — not data collection that stops at a report.

PMCF Obligations: When Clinical Follow-Up Is Required

Post-Market Clinical Follow-up is an EU MDR-specific requirement that has no direct FDA equivalent — but it is one of the most common gaps Notified Bodies cite during technical file reviews.

PMCF is required when the pre-market clinical evaluation was based primarily on literature rather than device-specific clinical investigations; when the device incorporates new materials or technologies with limited long-term safety data; when the device is used in vulnerable populations; or when the device has a long intended service life and long-term performance data is still accumulating.

A PMCF plan must describe the specific questions the follow-up is designed to answer, the methods to be used such as PMCF studies, surveys, registries, and literature monitoring, the timeline, and the criteria for determining when activities are complete.

A PMCF evaluation report, summarizing the results of these activities, must be produced and used to update the clinical evaluation. The frequency of PMCF evaluation reports is tied to device classification — typically annually for implantables and higher-risk devices.

Notified Bodies consistently flag PMCF plans that are vague with no specific clinical questions, disproportionate in claiming PMCF is not needed for a device with limited pre-market clinical data, or disconnected from the clinical evaluation where PMCF data is collected but not used to update the clinical evaluation report.

PSUR Requirements: What Goes In and How Often

The Periodic Safety Update Report is EU MDR's primary mechanism for ongoing benefit-risk surveillance for Class IIa, IIb, and Class III devices. If you are placing these devices on the EU market, PSUR production is non-negotiable.

A compliant PSUR must include device identification, a summary of PMS data covering consolidated analysis of complaint data, serious incidents, field safety corrective actions, and trends, a PMCF evaluation report summary, conclusions on the benefit-risk profile, and main findings and actions taken.

PSUR frequency requirements under EU MDR: Class III and implantable Class IIb devices require reports at least annually. Other Class IIb and Class IIa devices require reports at least every two years. Notified Bodies may require more frequent PSURs for specific devices, and manufacturers should expect annual requests during the first few years after CE certification.

Common PSUR failures include treating the PSUR as a narrative summary rather than a data-driven analysis, failing to include signal detection results beyond simple complaint counts, and disconnecting the PSUR from the clinical evaluation update cycle.

Common Gaps FDA and Notified Bodies Flag in PMS Documentation

Across FDA inspections and Notified Body audits, certain PMS deficiencies appear with enough frequency that they should be treated as predictable risks:

No documented literature surveillance methodology. Both FDA and EU MDR expect systematic literature monitoring. Your PMS plan should define the databases searched, the search terms used, the search frequency, and the criteria for acting on literature findings.

Complaint files that stop at closure without trend analysis. Individual complaints are filed and closed, but no one is looking at aggregate trends. Complaint rate by device family, failure mode, and market should all be tracked and reviewed at defined frequencies.

MDR and vigilance reportability decisions are undocumented. FDA expects documented rationale for every complaint evaluated for MDR reportability, including non-reportable determinations. Undocumented decisions are indistinguishable from no decision at all during an inspection.

PMS data does not flow back to risk management. Complaint trends that identify new hazards or higher-than-expected occurrence rates must trigger risk management file updates. Auditors check for this linkage by tracing specific complaint trends to the risk management file and clinical evaluation.

FSCA documentation is incomplete. Field safety corrective actions must be documented with decision rationale, scope, effectiveness verification, and regulatory authority notification records.

The PMS plan has not been updated since initial device certification. A PMS plan written years ago that has not been reviewed as the device complaint profile evolves is a consistent red flag. PMS plans should be reviewed at least annually.

Build Your PMS System on the Right Foundation

A compliant post-market surveillance system is not just a regulatory obligation — it is your earliest warning system for product performance issues that, left undetected, lead to patient harm, recalls, and regulatory enforcement.

Building it correctly requires the right documentation framework: a PMS plan that defines your surveillance scope and methods, PMCF plans and evaluation reports for devices that need them, a PSUR cycle for EU-marketed devices, structured complaint handling integrated with MDR and vigilance reporting, and FSCA documentation that covers the full lifecycle of any field action.

The Post-Market Surveillance Toolkit at post-market-surveillance-kit.vercel.app provides practitioner-grade templates for all six core PMS documents: PMS Plan, PMCF, PSUR, Complaint Handling procedure, FSCA documentation, and Post-Market Summary Report. Each template is built to satisfy both ISO 13485 §8.2 and EU MDR Article 83 requirements, with FDA complaint handling and MDR reporting requirements embedded in the relevant procedures.

If your current PMS documentation would not survive a Notified Body audit or an FDA inspection, now is the time to build a system that would. Get the complete toolkit at post-market-surveillance-kit.vercel.app.