MDR PSUR: Periodic Safety Update Report Guide 2026

An MDR PSUR, or periodic safety update report, is the document in which a manufacturer summarises the results and conclusions of its post-market surveillance for a device and states what they mean for the benefit-risk balance. Article 86 of Regulation (EU) 2017/745 requires it for higher-class devices, and the Medical Device Coordination Group has published guidance, MDCG 2022-21, that explains how to prepare one. Getting the PSUR right matters because it is the report your notified body reads to judge whether your surveillance actually works.

This guide summarises what the MDCG guidance says about who needs a PSUR, how often, what goes in it and how it is submitted. It sits alongside our overview of the EU MDR and our guide to MDR technical documentation, since the PSUR is part of the post-market file that the technical documentation refers to.

Which devices need an MDR PSUR

According to the MDCG guidance, PSURs are mandatory for Class IIa, Class IIb and Class III devices certified under the MDR. Class I manufacturers prepare a Post-Market Surveillance Report under Article 85 instead, though the guidance says its suggestions on presenting data may be useful for them. Legacy devices, that is devices that continue to be marketed after the MDR date of application under earlier directive certificates, also need PSURs based on their original classification.

Device group	Report type	Update frequency
Class III	PSUR	Annually
Class IIb implantable	PSUR	Annually
Class IIb non-implantable	PSUR	Annually
Class IIa implantable	PSUR	Every 24 months
Class IIa non-implantable	PSUR	Every 24 months
Class I	PMS Report (Article 85)	Updated when necessary

Check the frequencies against the current text of the guidance and the regulation, because they can be refined by later documents.

What an MDR PSUR must contain

Article 86 states the core content. A PSUR must include the conclusions of the benefit-risk determination, the main findings of post-market clinical follow-up, and the sales volume of the device together with an estimate of the size and other characteristics of the population using it and, where practicable, the usage frequency. The MDCG guidance adds that the report draws on Annex III point 2 of the regulation, which brings in serious and non-serious incidents, trend data, literature review and user feedback.

A working structure

1. Device description and scope. Devices, variants, classification, intended purpose and the certificate covered.
2. Reporting period. The data collection window, with dates.
3. Sales and exposure. Units sold, estimated users, regions and usage patterns.
4. Safety data. Incidents, field safety corrective actions, complaints and trends.
5. Performance and clinical data. PMCF results, literature and registries.
6. Risk file review. Whether new information changes hazards or risk estimates.
7. Benefit-risk conclusion. A clear statement of whether the balance remains acceptable, with reasoning.
8. Actions. Preventive or corrective actions and changes to instructions or design.

Link the incident section to your serious incident reporting records so numbers match across documents. An inconsistent count between the PSUR and the vigilance file is a red flag for reviewers.

Data collection period and continuity

The guidance says the first period starts on the date the device was certified under the MDR, or on the MDR date of application for legacy devices. Consecutive periods should be contiguous, with no gaps or overlaps. That means each report should state its start and end dates clearly, and the next report should begin on the following day. Keep a calendar that shows when each PSUR is due and who owns it.

Submission: EUDAMED or notified body

The MDCG guidance separates devices by route. Only Class III and implantable devices require the PSUR to be uploaded to EUDAMED, where the notified body adds its evaluation. For non-implantable Class IIa and IIb devices, the manufacturer makes the PSUR available to the notified body during surveillance activities. Legacy devices are not submitted through EUDAMED but made available to competent authorities on request. See our page on EUDAMED registration for the wider system, and confirm the current status of the relevant modules, since their availability has been phased.

Who writes and signs the MDR PSUR

Preparation is a team task: regulatory affairs, clinical, quality, risk management and post-market surveillance all contribute. The person responsible for regulatory compliance should review the report. Our guide to the person responsible for regulatory compliance explains that role. Assign a single accountable owner for each PSUR and give them a template so that the structure is the same from year to year.

Keep a PSUR file for every cycle that holds the data extracts, the approved report, the review comments and any submission receipt. When the notified body or a competent authority asks a follow-up question, this file lets you answer quickly and consistently, and it gives the next cycle a clear starting point.

How to prepare each cycle

• Three months before the due date. Freeze the data period, extract sales figures and pull complaint and vigilance data.
• Two months before. Complete trend analysis and literature review, and update PMCF results.
• One month before. Draft the benefit-risk conclusion with clinical and risk management input.
• Two weeks before. Review, approve and, where needed, submit to EUDAMED or file for the notified body.

Making the benefit-risk conclusion credible

The benefit-risk conclusion is the heart of every MDR PSUR, and it is where reviewers spend most of their time. A credible conclusion does more than say the balance is acceptable. It shows the reasoning: which data were considered, how the data compare with the previous period, whether any new hazard or higher risk estimate emerged, and how the clinical benefit stands against the state of the art. If a complaint trend or a literature finding pushes in the wrong direction, say so and describe the response. Reviewers trust reports that acknowledge problems, and distrust reports in which every year looks identical.

Keep the conclusion consistent with the clinical evaluation report and the risk management file. If the PSUR changes the assessment, update those documents in step, and record the link between them.

Feeding the MDR PSUR from your surveillance plan

A PSUR is only as good as the data behind it, so build the data flow into your post-market surveillance plan. Decide which sources feed each section: complaint handling for complaints and trends, vigilance for incidents, sales and distribution systems for volume, PMCF studies for clinical data, and a literature search protocol for published evidence. Give each source an owner, a monthly extract and a data quality check. Then the PSUR becomes an assembly task at the end of the period rather than a scramble.

Also define how you count. Agree definitions for a complaint, an incident, a unit sold and an estimated user, and use them consistently. Changes in definitions between years make trend analysis unreliable, so record any change and explain its effect.

Working with your notified body

Ask your notified body early how it expects to receive and evaluate PSURs, and what format it prefers. Some ask for specific tables or an executive summary. Include PSUR review in your surveillance audit preparation, and respond quickly to questions. Where the notified body identifies gaps, log them as corrective actions with owners and dates, and reference them in the next report.

A hypothetical example

A hypothetical manufacturer of a Class IIb non-implantable wound monitor prepares its first annual PSUR. The period runs from the certificate date, sales volume is taken from the ERP system, and the population is estimated from user registrations. Complaints about a sensor adhesive rise in the second half of the year. The PSUR records the trend, links it to a corrective action that changes the adhesive supplier, and concludes that the benefit-risk balance remains acceptable. Because the device is non-implantable, the PSUR is not uploaded to EUDAMED, and the manufacturer provides it to the notified body during the next surveillance audit. The example is invented for illustration.

Common problems with an MDR PSUR

• Reports with gaps or overlaps between periods.
• Benefit-risk conclusions that repeat earlier text without new analysis.
• Sales and population data missing or unexplained.
• Incident numbers that do not match the vigilance records.
• No link between complaint trends and the risk management file.
• Treating a Class I report as if a PSUR were required, or the reverse.

The primary source for the structure and route is MDCG 2022-21, which you should read in full. Notified body expectations, timelines and fees may vary, so see also our note on notified body fees.

Templates for your MDR PSUR

To avoid building a PSUR template, data collection plan and benefit-risk worksheet from scratch, the EU MDR Toolkit includes documents you can adapt. Have your regulatory lead check them against current guidance and your notified body’s expectations.

MDR PSUR FAQ

Do Class I devices need a PSUR?

No. According to MDCG 2022-21, Class I manufacturers prepare a Post-Market Surveillance Report under Article 85.

How often is a PSUR updated?

The guidance describes annual updates for Class III and Class IIb, and every 24 months for Class IIa.

Is every PSUR uploaded to EUDAMED?

No. The guidance limits EUDAMED submission to Class III and implantable devices. Others are made available to notified bodies during surveillance.

Do legacy devices need one?

Yes, based on their original classification, according to the guidance.

What must the conclusion cover?

The benefit-risk determination, together with the main PMCF findings and information about sales volume and the population using the device.