EU MDR Post-Market Surveillance (PMS): Why Most Systems Look Compliant Until Real-World Data Arrives

One of the most important shifts under EU MDR is that compliance no longer ends when a device receives CE marking.

In many ways, that is where the real regulatory scrutiny begins.

Under the EU MDR, Post-Market Surveillance (PMS) has evolved from a relatively passive monitoring activity into a proactive, continuous, data-driven lifecycle system intended to evaluate whether a device remains safe, effective, and performs as intended in the real world.

This has created a major challenge for many manufacturers because PMS is no longer simply about passively collecting complaints. It is about proving that the organization understands what is happening to its device after-market release. Is it acting on that information appropriately?

That distinction is becoming one of the most important drivers of Notified Body findings.

What is Post-Market Surveillance (PMS) under EU MDR?

Please see EU MDR Articles §83–86 and Annex III. Manufacturers are required to, throughout the entire lifetime of the device, [§ 83(1)] “plan, establish, document, implement, maintain, and update a post-market surveillance system in a manner that is proportionate to the risk class and appropriate for the type of device.”

The PMS system is intended to be a “living system” that is:

1. Planned
2. Actively collecting and analyzing post-market data
3. Identifying emerging risks and connecting them to device designs, risk analysis files, and labeling
4. Evaluating benefit-risk acceptability
5. Detecting trends
6. Triggering improvements when necessary

Importantly, PMS is not supposed to operate independently. It must connect directly with:

1. Design
2. Risk management
3. CAPA
4. Clinical evaluation and evidence
5. PMCF
6. Complaint handling
7. Technical documentation
8. Change control

That integration requirement is where many organizations begin to struggle.

Why do PMS systems fail Notified Body reviews or audits?

Most PMS failures are not caused by missing procedures. They are caused by weak system integration.

Common audit findings include:

• PMS data not feeding back into risk management
• Complaint trends not triggering CAPA
• Inadequate PMCF planning
• Weak trend analysis
• PSURs lacking meaningful conclusions
• PMS reports that summarize data without interpretation

In many organizations, PMS activities still operate as isolated regulatory tasks rather than as part of a coordinated quality and clinical system.

That creates a dangerous gap:

Data is being collected but not fully understood, connected to, or acted upon.

What do regulators and Notified Bodies actually expect from PMS?

Regulators increasingly expect PMS to function as an “early warning system.” Weak systems often appear reactive:

1. Complaints are processed individually
2. Trends are missed
3. CAPA activities fail to address systemic risk

This distinction matters because the EU MDR emphasizes lifecycle oversight rather than a one-time conformity assessment. Many organizations still rely heavily on reactive PMS because it is easier operationally. However, the EU MDR increasingly expects manufacturers to identify emerging risks rather than wait for complaints to arise.

Why PMS is now deeply connected to clinical evaluation

Under MDR, clinical evaluation is no longer primarily pre-market. PMS and PMCF are expected to continuously support:

1. Clinical evidence updates
2. State-of-the-art reviews
3. Benefit-risk reassessments
4. CER maintenance

When your medical device has a recall, that conclusion in your benefit-risk assessment and quoted in your CER is no longer true, right? Update those files to acknowledge the recall and state that another revision will be created following the CAPA investigation. This creates a major operational challenge because regulatory, quality, R&D, clinical, engineering, and commercial teams must now coordinate far more closely than under older regulatory models. Organizations with siloed departments often struggle to maintain this level of integration.

Why PSURs are being scrutinized

One reason is that there is an MDCG guidance document [MDCG 2022-21] that you should use. Check out this link on Periodic Safety Update Reports (PSURs):

MDCG endorsed documents and other guidance

Weak PSURs often:

1. Summarize raw data with little, if any, analysis
2. Avoid interpretation
3. Fail to identify meaningful trends
4. Contain inconsistencies with other technical documentation

Those inconsistencies are becoming increasingly visible during Notified Body and regulatory reviews.

Conclusion: PMS is now the continuous audit of your device

Under the EU MDR, PMS has become the mechanism Notified Bodies and regulators use to evaluate whether a manufacturer truly understands the device’s real-world performance when used as intended. That means your device is no longer judged only by what happened before approval, but by how effectively you monitor, interpret, and respond after commercialization.

Learn More with SGS Training

Want to know more? Visit SGS’s Training Academy:

• USA Training: SGS USA Training
• Canada Training: SGS Canada Training