Post-market surveillance: turning field data into safety decisions
Many teams experience post-market surveillance as a report to produce when the deadline approaches. It is in fact a continuous loop: complaints, incidents, literature, user feedback and performance data must be collected according to a plan, analyzed against defined thresholds, and linked to risk decisions, CAPAs and regulatory reports. Here is what the MDR and the IVDR expect, and what you need to put in place.
What do the regulations require?
The MDR and the IVDR require PMS for every device within their scope. The class does not change that obligation: it changes the type of report and how often it is produced. In parallel, vigilance imposes its own deadlines. Three notions frame the subject.
- PMS
- Post-Market Surveillance: the active and systematic process by which the manufacturer collects, records and analyzes the data generated once a device has been placed on the market. It is part of the quality system and feeds risk management, the clinical or performance evaluation, vigilance and corrective actions.
- PSUR
- Periodic Safety Update Report: a periodic report that summarizes the PMS data, the conclusions on the benefit-risk ratio and the main findings of the PMCF or PMPF. It applies to MDR devices of classes IIa, IIb and III and to IVDR devices of classes C and D. Other devices fall under the lighter PMSR.
- Vigilance
- The regulatory component that deals in particular with reporting serious incidents and field safety corrective actions (FSCA). Vigilance does not replace PMS: it is one component of it, alongside complaints, literature, user feedback and PMCF / PMPF, but it follows its own deadlines.
| Obligation | What it requires in practice |
|---|---|
| PMSR (basic surveillance) | MDR class I devices; IVDR class A and B devices. A report updated when necessary and kept available to the competent authority. |
| PSUR (periodic report) | MDR class IIa (at least every 2 years), IIb and III (at least annually); IVDR classes C and D (at least annually). Submitted to the notified body, and electronically for the highest classes once the corresponding EUDAMED system is operational. |
| Vigilance (in parallel) | Serious incident: 15 days; death or unanticipated serious deterioration: 10 days; serious public health threat: 2 days after becoming aware. Independently of the periodic report. |
Summary of Articles 85-87 of the MDR and 80-82 of the IVDR. Specific rules exist (custom-made devices, transitions). It replaces neither the texts nor the opinion of your regulatory affairs lead.
What should you do?
The report is only the visible output. The work happens before it: finding the data, making it comparable, detecting signals and deciding what to update. Here is what your organization has to keep up, whatever the tool.
- Write the PMS plan before the data comes in: sources monitored, frequencies, analysis methods, indicators, thresholds and decision rules.
- Organize active and systematic collection, not waiting for a complaint, by defining who collects what, how often and over which scope.
- Set thresholds and analysis methods in advance, to tell a normal variation from a signal that needs investigating (trend reporting).
- Handle vigilance in parallel, on its own deadlines: a serious incident is reported within the applicable deadline even if the investigation is not finished.
- Link each signal to the decisions it triggers (risk management, clinical or performance evaluation, CAPA, FSCA) and keep the justification.
- Keep exposure, incidents, actions and clinical data linked by stable identifiers, so that you can prepare the PMSR and PSUR without rebuilding them from emails.
Praeventis keeps quality signals traceable for PMS
Praeventis centralizes the incidents, deviations, CAPAs, changes and decisions that make up part of the PMS data. It replaces neither the PMS plan, nor the PMCF/PMPF, nor the reportability analysis, nor the writing of the PSUR: it keeps events, decisions and actions structured and traceable enough to remain usable during reviews.
- Quality tickets linked to a project, a category, an owner, a status and deadlines.
- CAPA with criticality analysis, actions and post-analysis; FSCAs and changes linked to the originating event.
- A history of decisions and an audit trail you can view and export.
- Exports of tickets and histories to prepare PMS, PMSR or PSUR reviews without re-entry.
The Cerebellis software related to this topic
Further reading
Producing PMS and PSUR reports without rebuilding the data by hand
A PSUR links exposure, incidents, trends and actions. Why this data lives in two systems, production and quality, and how to bring it together to produce the report without re-entry.
Computerized system validation (CSV) according to GAMP 5
Software categories, V-model, risk analysis and traceability matrix: how GAMP 5 structures a risk-proportionate computerized system validation.
ISO 13485 QMS software: what it should support
A QMS is not a piece of software: what the MDR, the IVDR and ISO 13485 ask of the quality system, and how to choose which workflows to digitize first.