IVDR Post-Market Surveillance: PMS Plan, Report and PSUR 2026

IVDR post-market surveillance is the set of duties that begins the day an in vitro diagnostic device reaches the EU market, and it is where many manufacturers discover their technical file was written for approval and not for life on the market. The regulation expects a documented system, a plan, a report matched to the device’s risk class, and evidence that what you learn feeds back into your performance evaluation and risk management.

This guide sets out what Regulation (EU) 2017/746 asks for, how the reporting differs between classes A and B and classes C and D, what post-market performance follow-up adds, and how to organise the work. For the classification itself, see our IVDR classification guide.

What IVDR post-market surveillance requires

Every manufacturer must plan, establish, document, implement, maintain and update a post-market surveillance system that is proportionate to the risk class and appropriate for the type of device. The system is expected to be systematic and proactive: collecting and analysing data on the quality, performance and safety of each device across its lifetime, and using the conclusions to update the benefit-risk determination, the design and manufacturing information, the instructions for use and the performance evaluation. The post-market surveillance plan forms part of the technical documentation, which we describe in our IVDR technical documentation guide.

The plan itself has minimum contents set out in the annex on technical documentation. Practitioners summarise them as a proactive and systematic process to collect relevant information, methods to assess complaints and market data, indicators and thresholds for the continuous reassessment of benefit-risk, protocols for trend reporting, tools to trace and identify devices, procedures to communicate with competent authorities and notified bodies, and procedures to identify and start corrective actions.

PMS report or PSUR: what your class decides

The output document depends on the class of the device.

Class	Document	Article	Frequency and handling
A and B	Post-market surveillance report	80	Updated when necessary, and available to the competent authority on request
C	Periodic safety update report (PSUR)	81	Updated at least annually, available to the notified body and competent authorities on request
D	Periodic safety update report (PSUR)	81	Updated at least annually and submitted to the notified body through the electronic system, subject to system availability

The report for classes A and B summarises the results and conclusions of the analysis of the surveillance data, with the rationale and description of any preventive and corrective actions taken. The PSUR for classes C and D contains the same summary, plus the conclusions of the benefit-risk determination, the main findings of the post-market performance follow-up, and sales volume and an estimate of the population using the device. Some commentary suggests a five-year cycle for the lower-class reports, but the regulation’s wording is “when necessary,” so define your own trigger and interval in the plan and justify it.

The class D route through the notified body

For class D, the notified body evaluates the PSUR and adds its evaluation and any action taken to the electronic system. Because the electronic system’s functionality has been phased in over time, check the current position with your notified body and the Commission’s guidance before you decide how you will submit. Our EUDAMED registration guide explains the wider system, and our IVDR notified body guide covers when one is needed.

Post-market performance follow-up under IVDR post-market surveillance

Post-market performance follow-up, or PMPF, is the proactive collection and evaluation of performance data from the use of a device that is CE-marked and on the market. The regulation treats it as part of the performance evaluation process and describes it in an annex. Manufacturers are expected to have a PMPF plan and to record results in a PMPF evaluation report, unless they justify in the performance evaluation documents why PMPF is not appropriate for the device. The conclusions then feed the performance evaluation report and the risk management file. Our guide to IVDR performance evaluation explains how the pieces connect.

Typical PMPF activities include follow-up studies, registry data, structured feedback from laboratories and users, review of external quality assessment results, and literature review. Choose the methods that answer the open questions in your performance evaluation. If the initial evidence for a new assay was strong on analytical performance but thin on real-world clinical use, PMPF should target the clinical gap.

Trend reporting, complaints and vigilance

The regulation also requires manufacturers to report statistically significant increases in the frequency or severity of incidents that are not serious incidents but could have a significant impact on the benefit-risk analysis. Your plan should therefore define the methods and protocols for detecting such increases, the observation period and the threshold. That needs clean complaint data: consistent categories, a common definition of an incident and enough volume to spot a signal. Serious incidents and field safety corrective actions run on their own reporting rules, so keep the complaint process and the vigilance process connected, with clear criteria for escalation from one to the other. If you have followed our MDR serious incident reporting guide, many of the same principles apply.

Building the IVDR post-market surveillance system

1. Define the scope. List devices, classes and intended users, and set a plan for each device or family.
2. Pick data sources. Complaints, service records, laboratory feedback, external quality assessment data, literature, competitor incidents and PMPF results.
3. Set indicators and thresholds. Decide what will trigger a benefit-risk review or corrective action.
4. Assign owners. Name who collects, analyses and approves each output. The person responsible for regulatory compliance should be able to confirm that the system works.
5. Produce the report on schedule. A PMS report or PSUR, as your class requires, with a calendar for updates.
6. Close the loop. Update risk management, performance evaluation, labelling and design where the data says so.
7. Prepare for audit. Keep the data, the analyses and the decisions traceable.

What notified bodies look for in IVDR post-market surveillance

For devices that involve a notified body, surveillance is part of the ongoing assessment. Expect the auditor to ask for the plan, the last reports, the complaint data behind them and the decisions taken. They will test whether the conclusions follow from the data, whether thresholds were applied as written, and whether changes reached the technical documentation. A polished report that cannot be traced to raw complaint records will not hold up. Equally, a rich data set with no documented conclusion shows a system that collects but does not learn. Keep a simple traceability chain from the complaint to the trend, the trend to the decision and the decision to the document that changed.

Resourcing the work

Smaller manufacturers often underestimate the effort. Plan for regular review meetings, a person who owns the complaint database, access to clinical or laboratory expertise to interpret performance data, and time each year to produce the required report. Where you rely on distributors or laboratories to collect feedback, put that duty in the agreement and check that they send it. The cost of the IVDR post-market surveillance routine is small compared with the cost of an unnoticed signal reaching a regulator first.

A hypothetical example

A manufacturer of a class C immunoassay for a cardiac marker sees complaints about borderline results with one reagent lot. Its plan has a threshold for lot-related complaints, and the count crosses it. The team investigates, finds a stability issue in transport, updates the instructions on storage, notifies affected customers and records a corrective action. Both the complaint trend and the change appear in the annual PSUR, together with the PMPF finding that performance in the field matches the claim once the storage rule is followed. The performance evaluation report and risk file are revised. The example is illustrative and does not describe any real device.

Common mistakes in IVDR post-market surveillance

• A generic plan. One template copied across devices with no reference to the device’s risks.
• No thresholds. The plan describes data collection but never says what triggers action.
• Complaints and vigilance disconnected. Issues are logged but never escalated.
• PMPF skipped without justification. The regulation expects PMPF or a documented reason.
• Reports late or thin. A PSUR that lists numbers without conclusions.
• No feedback. Findings never reach the risk file or the performance evaluation.

Tools for IVDR post-market surveillance

The documents are repeatable: a surveillance procedure, a plan template, a complaint and trend log, a PMPF plan and report, and templates for the PMS report and the PSUR. The EU IVDR Toolkit includes templates that you can tailor to your devices and classes. For further reading, see the NAMSA overview of IVDR post-market surveillance, and verify details against the regulation text and current guidance from the Medical Device Coordination Group.

IVDR post-market surveillance FAQ

Which report do class A and B devices need?

A post-market surveillance report under Article 80, updated when necessary and available to the competent authority on request.

Which report do class C and D devices need?

A periodic safety update report under Article 81, updated at least annually, with class D reports submitted to the notified body through the electronic system.

Is PMPF mandatory?

PMPF is part of the performance evaluation process, and if you decide it is not appropriate for a device you must justify that in your documentation.

Who is responsible for the system?

The manufacturer is responsible, and the person responsible for regulatory compliance should be able to confirm the system operates as the regulation requires.