After launch, what must a manufacturer monitor, report and correct?

Introduction#

A device that carries the CE marking still has legal duties once it is on the market, and they last for its whole lifetime. The manufacturer watches how the device performs in use, reports serious incidents within fixed time limits, and corrects problems in devices already in the field. These duties decide how fast a company must act on a complaint and which reports it owes, so they shape budgets long after launch.

This chapter answers those questions for medical devices and for in vitro diagnostic medical devices (IVDs), the tests run on samples such as blood, including software. It applies the Medical Device Regulation, Regulation (EU) 2017/745 (MDR), and the In Vitro Diagnostic Medical Device Regulation, Regulation (EU) 2017/746 (IVDR).

It applies them to four illustrative products, each placed in a risk class, which runs from I to III for medical devices and from A to D for IVDs. A wearable cardiac monitor from a US company has class IIa hardware, on our reading (a label for the authors' own interpretation). Its application is planned as class IIa. Triage software using artificial intelligence (AI) from a Union company is planned as class IIb. A spinal implant system certified under one of the earlier directives, with a class III cage, is seeking its first MDR certificate. A near-patient cardiac troponin test from a Swiss company is a legacy device, one already sold under the earlier IVD directive, and is planned as class C.

The law is stated as consolidated on 19 July 2026 for the MDR and on 10 January 2025 for the IVDR. The sources were checked on 30 September 2026.

1. Which post-market duties apply, and who answers for them?#

The manufacturer's person responsible for regulatory compliance has to ensure that the surveillance obligations and the reporting obligations are met. (MDR Art. 15(3)(c), (d); IVDR Art. 15(3)(c), (d))

Other parties take part:

(MDR Art. 2(32) to (34), 2(42), 101)

What the coordination group's guidance is worth#

The Medical Device Coordination Group (MDCG) is established by Article 103 of the MDR, composed of representatives of all Member States and chaired by a representative of the Commission. Each MDCG document cited in this chapter states that its views are not legally binding. Each adds that only the Court of Justice of the European Union can give binding interpretations of Union law. The guidance therefore shows how the Member States' representatives read the regulations. (MDCG 2025-10, cover page; MDCG 2023-3 Rev.2, cover page)

Our reading is that a manufacturer may depart from the guidance's interpretation, provided it sets out in writing its argument against that interpretation.

The post-market surveillance and vigilance (PMSV) section of the Commission's guidance list, as read on 29 September 2026, holds five device specific vigilance guidances. MDCG 2024-1 says such a guidance is read with the regulations and does not replace or extend any of their requirements. The Commission's list gives the current versions. (MDCG guidance page, PMSV section; MDCG 2024-1, s. 1, 2, p. 3)

2. What does the surveillance system do?#

Post-market surveillance is all the activities a manufacturer carries out, with other economic operators, to collect and review experience with its devices on the market. Their purpose is to identify any need for corrective or preventive action. (MDR Art. 2(60); IVDR Art. 2(63))

For each device, the manufacturer plans, establishes, documents, implements, maintains and updates the system, in proportion to the risk class, appropriate for the type of device, and as part of the quality management system. It gathers, records and analyses data on quality, performance and safety actively and systematically, throughout the device's lifetime. (MDR Art. 10(9), 83(1), (2); IVDR Art. 78(1), (2))

MDCG 2025-10 interprets "proactive" as a duty to seek information out, without waiting for complaints to arrive. (MDCG 2025-10, s. 1, 2, 4, 5.2, pp. 3, 4, 7, 13)

The MDR names eight uses of the surveillance data, and the manufacturer updates the technical documentation accordingly. In place of the clinical evaluation and the summary of safety and clinical performance, the IVDR list names the performance evaluation and the summary of safety and performance.

(MDR Art. 83(3), 88; IVDR Art. 78(3))

If surveillance identifies a need for preventive or corrective action, the manufacturer implements it. It informs the competent authorities concerned and, where applicable, the notified body. A serious incident or a field safety corrective action is also reported under the vigilance article. (MDR Art. 83(4); IVDR Art. 78(4))

3. What does the surveillance plan contain?#

The surveillance system is based on a post-market surveillance plan that meets Annex III, Section 1. Under the MDR, the plan is part of the Annex II technical documentation for devices other than custom-made devices. The corresponding IVDR provision has no exception for custom-made devices. (MDR Art. 84; IVDR Art. 79)

(MDR Annex III, s. 1(a), (b); IVDR Annex III, s. 1(a), (b))

The threshold values are where the manufacturer itself sets the level at which it must act, and trend reporting under section 7 depends on them. Our observation, a label for the authors' practical judgement, is that a plan that sets no numbers cannot show whether a trend is reportable.

For class III and implantable devices, the PMCF evaluation report is updated at least annually. For class C and D IVDs, the performance evaluation report is too. (MDR Art. 61(11); IVDR Art. 56(6)) Chapter 6, on clinical and performance evidence, covers the follow-up plans, and chapter 7, on technical documentation, shows where the plan sits in that documentation.

4. Which report does each class write, and where does it go?#

The device's class determines which report the manufacturer writes and how often it is updated. Under the MDR, whether the device is class III or implantable determines where a PSUR is sent. In the table, "electronic system" means the PSUR is submitted through that system to the notified body, which reviews it and adds its evaluation. "Available" means to the notified body and, on request, to competent authorities.

(MDR Art. 85, 86(1) to (3); IVDR Art. 80, 81)

The surveillance report summarises the analyses and any preventive and corrective action. A PSUR sets out, throughout the device's lifetime, the benefit-risk conclusions, the main PMCF findings, the volume of sales, and an estimate of the population using the device. Except for custom-made devices, it is part of the technical documentation. An IVD PSUR carries PMPF findings in place of PMCF. (MDR Art. 85, 86(1); IVDR Art. 81(1))

Our computation, a label for the authors' working from the cited text, applies Article 86(1) and (2). A class IIb device that is not implantable needs a PSUR at least annually, which is not submitted through the electronic system. A class IIa implant needs one at least every two years, which is submitted through it. A schedule that sorts devices only by class therefore sends both PSURs by the wrong route.

MDCG 2022-21 does not apply to IVDs and says a specific IVD guidance is intended. The Commission's list, as read on 29 September 2026, holds no PSUR guidance for IVDs. The content of an IVD PSUR is therefore set by Article 81, and a manufacturer that applies MDCG 2022-21 by analogy has to justify doing so. (MDCG 2022-21, s. 1.3, 2.1.2, 2.2.1, pp. 5 to 7; MDCG guidance page, PMSV section)

When does the PSUR period start and end?#

Under MDCG 2022-21, the data collection period starts at the device's MDR certification date. For a device without MDR certification, it starts at 26 May 2021, the MDR's date of application. Periods are contiguous, so a first PSUR may cover something other than exactly 12 or 24 months. (MDCG 2022-21, s. 5.1, p. 13)

For a new MDR device, the guidance aligns the end of each period to the certificate anniversary, or to a schedule agreed with the notified body. Depending on class, the manufacturer either submits the PSUR to the notified body through EUDAMED, the European database on medical devices, or makes it available to that body. (MDCG 2022-21, s. 5.1, 5.2.1, pp. 13 to 15)

Devices assessed by the same notified body can share one PSUR. The guidance asks the manufacturer to assign a leading device of the highest risk class, or one of the highest. That device sets the schedule for the whole group, including whether the shared PSUR is submitted through EUDAMED. Our computation is that a class IIa accessory in a group led by a class IIb device moves to an annual cycle. (MDCG 2022-21, s. 4.1, p. 12)

A PSUR is required throughout the device's lifetime, which the guidance defines as the period the manufacturer specifies. Where the record retention period is shorter than the lifetime, the shorter period applies. Updates stop once the last device of the model has been placed on the market and its intended lifetime has passed. (MDCG 2022-21, s. 3.2.1, 3.2.2, pp. 9, 10)

How are legacy devices treated?#

MDCG 2022-21 calls a device a legacy device when it is still placed on the market under Article 120(3). Such a device holds a valid directive certificate or, for some former class I devices, a directive declaration of conformity. For such devices, the MDR's requirements on surveillance and vigilance apply in place of the directive's, and the IVDR's for IVDs. Article 120(3d) is one of the provisions listed in Article 123(3)(d), so the date from which it applies depends on the reading in section 10. (MDCG 2022-21, s. 2, pp. 4, 5; MDR Art. 120(3d), 123(3)(d); IVDR Art. 110(3d))

The guidance applies Article 86 to a legacy device according to its class under the directive. It says a change of class under the MDR should not be taken into account during the transition period. The legacy device's PSUR is not submitted through EUDAMED and is available on request to the competent authorities and the notified body. (MDCG 2022-21, s. 5.2.2, p. 15)

When such a device becomes MDR certified without significant change, the initial schedule may continue unless otherwise agreed with the notified body. A significant change makes it a new device with a new schedule. (MDCG 2022-21, s. 5.1, p. 14)

5. When is an incident reportable?#

An incident is any malfunction or deterioration in a device's characteristics or performance, including use error due to ergonomic features. It also covers any inadequacy in the manufacturer's information, and any undesirable side-effect. The IVDR replaces side-effects with harm resulting from a medical decision, or action taken or not taken, on the basis of the device's information or results. (MDR Art. 2(64); IVDR Art. 2(67))

A serious incident is one that directly or indirectly led, might have led or might lead to a listed outcome. The outcomes are the death of a patient, user or other person, a temporary or permanent serious deterioration of their state of health, or a serious public health threat. (MDR Art. 2(65); IVDR Art. 2(68))

A serious public health threat is an event which could result in imminent risk of death, serious deterioration in health, or serious illness, and may require prompt remedial action. It may also cause significant morbidity or mortality, or be unusual or unexpected for the place and time. (MDR Art. 2(66); IVDR Art. 2(69))

MDCG 2023-3 Rev.2 interprets the term as including the possibility of multiple deaths at short intervals, or events of a significant and unexpected nature that become alarming as a potential public health hazard. One of its examples is a failing blood-bank test. (MDCG 2023-3 Rev.2, Q2, p. 10)

The same guidance breaks the definitions down into three criteria, all of which have to be met:

(MDCG 2023-3 Rev.2, Q1, Q2, pp. 7, 9 to 11)

The regulation says the same about doubt: a manufacturer uncertain whether an incident is reportable still reports within the time limit. Our reading is that a complaint procedure whose decision step reads "if reportable, report" starts from the wrong default, because it reports only once reportability is shown. The step should ask whether the device can reasonably be excluded as a cause, and lead to a report unless it can. (MDR Art. 87(7); IVDR Art. 82(7))

Guidance names misdiagnosis, delayed diagnosis or treatment, inappropriate or absent treatment and transfusion of inappropriate materials as sources of indirect harm. Such harm is reported where it meets, or could meet, a serious outcome. (MDCG 2023-3 Rev.2, Q7, p. 14)

The duty to report serious incidents individually does not cover expected side-effects that are clearly documented in the product information, quantified in the technical documentation, and subject to trend reporting. The IVDR applies the same exclusion, on the same conditions, to expected erroneous results. Guidance adds that if the manufacturer cannot show within the reporting deadline that the event was expected in that sense, it reports. (MDR Art. 87(1)(a); IVDR Art. 82(1)(a); MDCG 2023-3 Rev.2, Q9, Q10, pp. 15, 16)

6. Which time limit applies, and when does it start?#

Each time limit is the latest date for the report, and the report becomes due immediately, if earlier, once a stated condition is met.

(MDR Art. 87(2) to (5); IVDR Art. 82(2) to (5))

Guidance calls a deterioration unanticipated if the condition leading to it was not considered in the manufacturer's risk assessment. For an anticipated deterioration, it expects documented evidence of risk reduction, or that the risk appears in the information supplied to the user. On our reading, whether the 10-day or the 15-day limit applies therefore depends on the risk management file, whatever word a clinician uses to describe the deterioration. (MDCG 2023-3 Rev.2, Q12, pp. 16, 17)

The guidance counts the time limit in calendar days, starting on the day after awareness, and takes both rules from Regulation (EEC, Euratom) No 1182/71 on periods and time limits. That Regulation counts weekends and public holidays in a period. (MDCG 2023-3 Rev.2, Q14, fn. 25, 26, p. 17; Regulation 1182/71, Art. 3(1), (3))

A period whose last day falls on a public holiday, Saturday or Sunday ends with the following working day, and the guidance applies this to Article 87. Incomplete information from a hospital or user does not justify a late initial report. (Regulation 1182/71, Art. 3(4); MDCG 2023-3 Rev.2, Q14, fn. 29, p. 18)

The Regulation also provides that any period of two days or more includes at least two working days. Because Article 87(4) also requires a report on a serious public health threat immediately, on our reading the manufacturer should meet the 2-day limit by calendar date and not rely on that extension. (Regulation 1182/71, Art. 3(5); MDR Art. 87(4))

Whose awareness starts the clock?#

The awareness date is when the manufacturer is first made aware of the potentially serious incident, and not a later date after investigation. Guidance treats it as the date the first employee or representative of the manufacturer receives the information. Where an authorised representative or a subcontractor handles complaints, the date on which it receives the information counts as the manufacturer's awareness date. (MDCG 2023-3 Rev.2, Q14, Q15, pp. 17, 19)

Where new information turns a closed complaint into a reportable one, fields 1.2.c and 1.2.d of the manufacturer incident report (MIR) give the first awareness date and the date of the new information. (MDCG 2023-3 Rev.2, Q15, p. 19)

What eases the deadlines without moving them?#

A manufacturer may send an incomplete initial report in time, followed by a complete one. The MIR form's help text describes initial, follow-up and combined initial and final reports. (MDR Art. 87(6); IVDR Art. 82(6); MIR 7.3.1 helptext, s. 1.2(e), pp. 2, 3)

For similar serious incidents with a known root cause, an implemented corrective action, or a common and well documented pattern, periodic summary reports may replace individual ones. The coordinating competent authority agrees their format, content and frequency first, and guidance expects an incident described as common to be covered in the risk analysis already. (MDR Art. 87(9); IVDR Art. 82(9); MDCG 2023-3 Rev.2, Q23, Q24, p. 24)

7. When must a trend be reported?#

Manufacturers report any statistically significant increase in the frequency or severity of non-serious incidents or expected side-effects. The increase has to be one that could significantly affect the benefit-risk analysis and has led, or may lead, to unacceptable risks. (MDR Art. 88(1))

The increase is measured against the foreseeable frequency or severity for the device, over a period set in the technical documentation and product information. The plan states how such incidents are managed, the method for finding a significant increase, and the observation period. The IVDR adds any significant increase in expected erroneous results, measured against the device's stated performance. (MDR Art. 88(1); IVDR Art. 83(1))

Our reading is that where the plan sets no method and no threshold, the Article 88 duty to report trends still applies, and the manufacturer has no means of telling when it is triggered.

8. What happens when a device needs correcting in the field?#

(MDR Art. 2(62), (63), (67) to (69); IVDR Art. 2(70) to (72))

A manufacturer that believes a device it has placed on the market does not conform takes the necessary corrective action immediately. It brings the device into conformity, withdraws it or recalls it, and informs its distributors, representative and importers. (MDR Art. 10(12))

MDCG 2023-3 Rev.2 gives as examples of field safety corrective actions a recall, an exchange, a modification, a retrofit, advice on use, safety-related software or firmware changes, and labelling corrections. Removals for purely commercial reasons unrelated to safety are excluded. (MDCG 2023-3 Rev.2, Q17, fn. 31, pp. 20, 21)

The action is reported without undue delay and, except in urgency, before it is taken. An action in a third country is reported too, if the device is also legally on the Union market and the reason is not limited to the third country. (MDR Art. 87(1)(b), (8); IVDR Art. 82(8))

What the field safety notice says, and who sees it first#

The notice reaches users without delay, in the official Union language or languages set by each Member State where the action is taken. Its content is consistent across Member States unless one Member State's situation justifies a difference. (MDR Art. 89(8); IVDR Art. 84(8); MDCG 2023-3 Rev.2, Q17, p. 21)

Each notice identifies the devices, in particular by their unique device identifiers (UDIs), and the manufacturer, in particular by its single registration number if already issued. It explains the reasons and risks clearly, without understating the risk, and states what users must do. (MDR Art. 89(8))

A UDI is a series of characters that allows unambiguous identification of specific devices on the market. The single registration number is the one the competent authority obtains from the electronic system, after verifying the registration data. It issues that number to the manufacturer, the authorised representative or the importer. Chapter 9 covers both identifiers. (MDR Art. 2(15), 31(2))

Except in urgency, the manufacturer first sends the draft notice for comment to the evaluating competent authority, or the coordinating one in coordinated cases. Guidance names the evaluating authority as that of the Member State where a serious incident occurred, or each one where a field action is taken. The authority where the manufacturer or its representative is registered is always informed. Guidance asks the manufacturer to allow 48 hours, equal to two weekdays, for comment, unless the action needs a shorter timescale. (MDR Art. 89(8); MDCG 2023-3 Rev.2, Q20, fn. 34, pp. 22, 23)

Investigation, coordination and action the authorities start#

After a serious incident report, the manufacturer investigates without delay. It may not alter the device or a sample of the batch in a way that could affect later evaluation of the cause without first informing the authorities. (MDR Art. 89(1), (5); IVDR Art. 84(1), (5))

Where serious incidents with a device raise concern in more than one Member State, or the appropriateness of a field safety corrective action proposed in more than one Member State is in question, the competent authorities coordinate their assessment. Unless they agree otherwise, the authority where the manufacturer has its registered place of business coordinates. In the consolidations cited, neither article says which authority coordinates for a manufacturer outside the Union, such as the US maker of the monitor or the Swiss maker of the test. (MDR Art. 89(9); IVDR Art. 84(9))

Once the electronic system applies, the Commission and the Member States monitor its data. Where a previously unknown risk is found, or the frequency of an anticipated risk significantly and adversely changes the benefit-risk determination, the competent authority informs the manufacturer, which takes the necessary corrective action. Article 90 is one of the provisions listed in Article 123(3)(d), which section 10 discusses. For a device presenting an unacceptable risk, the authority requires correction, restriction, withdrawal or recall within a set period. (MDR Art. 90, 95(1), 123(3)(d); IVDR Art. 85)

9. What do the representative, importers and distributors pass back?#

(MDR Art. 11(3)(g), 13(6) to (8), 14(4), (5); IVDR Art. 11(3)(g), 13(6), (8), 14(5))

Guidance interprets serious risk as a situation likely to cause serious harm, including where the effects are not immediate. It interprets "immediately", in the reporting time limits, as meaning without any delay that the manufacturer causes intentionally or negligently. The authorised representative's mandate does not transfer to it the manufacturer's own surveillance and corrective action duties. (MDCG 2023-3 Rev.2, Q13, Q22, pp. 17, 24; MDR Art. 11(4))

Our reading is that "immediately" has the same meaning in the mandate, so a mandate that allows the representative a forwarding time measured in working days is hard to reconcile with it. Under the awareness rule in section 6, the manufacturer's time limit starts when the representative receives the complaint, so days spent forwarding it use up that limit.

A manufacturer may anticipate interrupting or discontinuing supply where it is reasonably foreseeable that this could result in serious harm, or a risk of serious harm, to patients or public health in one or more Member States. It then informs the competent authority where it or its authorised representative is established, and those it supplies directly. Other than in exceptional circumstances, it does so at least 6 months ahead. The MDR duty excludes custom-made devices, and the IVDR text has no such exclusion. MDCG 2024-16 provides a form for the notice. (MDR Art. 10a(1); IVDR Art. 10a(1); MDCG 2024-16, p. 1)

10. Where do reports go before the EUDAMED vigilance module applies?#

The regulations route reports, PSURs and field safety notices through one electronic system, which sends each incident report to the authority where it occurred. The obligations relating to that system, including the PSUR route and incident and trend reporting, apply 6 months after the Commission publishes a notice that it is functional. Until then, the directives' provisions on information on vigilance reporting continue to apply. (MDR Art. 92(1), (5), 123(3)(d); IVDR Art. 87(5), 113(3)(f))

MDCG 2021-1 Rev.1 says the directives' provisions continue to apply for the exchange of information. Its interim practices do not affect the general obligation to comply with the MDR, including the provisions Article 123(3)(d) lists. MDCG 2023-3 Rev.2 says national processes are used "for compliance with the vigilance provisions outlined in the Regulations". (MDCG 2021-1 Rev.1, pp. 3, 4; MDCG 2023-3 Rev.2, Q21, p. 23)

Our reading is that the criteria and time limits in MDR Articles 87 and 88, and IVDR Articles 82 and 83, govern the content and timing of reports now. Only the channel through which reports are sent is interim. The same reading covers MDR Article 120(3d) on legacy devices, which is also among the provisions listed in Article 123(3)(d).

Decision (EU) 2025/2371 confirmed four EUDAMED systems as functional, and vigilance is not among them. The Commission's overview page, as read on 29 September 2026, shows the vigilance module as in development, to be released only when its use becomes mandatory, with no voluntary period. That page gives its current status. (Decision (EU) 2025/2371, Art. 1; EUDAMED overview page)

The interim route#

(MDCG 2021-1 Rev.1, pp. 23 to 26; MDCG 2022-21, s. 5.4, p. 20; MDCG 2022-12, pp. 25 to 28)

The Commission's forms page, read on 30 September 2026, states that MIR form 7.3.1 is mandatory from 1 May 2026. Versions from the December 2025 publication onward are acceptable until further notice if necessary, and earlier versions can no longer be used. (PMSV forms page)

National channels#

Each Member State runs its own channel, and each authority's own page gives the current route. The Commission publishes a list of national vigilance contact points, dated September 2026 on its face. (Vigilance contact points)

11. What does the Artificial Intelligence Act add?#

The Artificial Intelligence Act (AI Act), Regulation (EU) 2024/1689, requires a post-market monitoring system for a high-risk AI system, collecting and analysing performance data over its lifetime. The monitoring system is based on a post-market monitoring plan, which forms part of the technical documentation under Annex IV. The Commission has to adopt guidance with a template for that plan by 2 September 2027. (AI Act Art. 72(1) to (3); Regulation (EU) 2026/1744, Art. 1, point (30))

Where a system and plan already exist under legislation listed in Section A of Annex I, the provider may integrate the AI Act elements into them. It uses the template, and the result has to achieve an equivalent level of protection. (AI Act Art. 72(4))

For high-risk AI systems that are devices, or safety components of devices, serious incident notification under the AI Act is limited to the outcome in its definition that concerns fundamental rights. The Commission's draft guidance on Article 73 takes the same reading, although it is still a draft. Harm to health that meets the serious incident definition is reported under device vigilance. (AI Act Art. 3(49), 73(10); Draft Article 73 guidance, para. (65); MDR Art. 87(1); IVDR Art. 82(1))

For AI systems classified as high-risk under Article 6(1) and Annex I, the AI Act's Chapter III, Sections 1 to 3, other than Article 6(5), apply from 2 August 2028. Chapter 10, on AI and cybersecurity obligations, gives our reading of when Articles 72 and 73 start to apply to a device. The dates in this section were checked on 30 September 2026, and the consolidated text on the Publications Office gives the current ones. (AI Act Art. 113)

12. What would the Commission's proposal change?#

Proposal COM(2025) 1023 of 16 December 2025 would amend both regulations. It is a proposal and is not law.

(COM(2025) 1023, Art. 1, points (2)(e), (65), (67) to (70); Art. 2, points (53) to (55); MDR Art. 88(1))

On 29 September 2026 the procedure file showed "Awaiting committee decision", and that file gives the current stage. Our reading is that none of the proposed changes removes the duty to keep a surveillance system and plan. (Legislative Observatory, 2025/0404(COD))

13. How the answer is reached#

The post-market answers depend on one another, in this order:

1. Class and implant status come first. Class determines the report and its frequency, and whether the device is class III or implantable determines the PSUR route. (MDR Art. 85, 86; IVDR Art. 80, 81)
2. The plan follows Annex III, including the indicators and thresholds that trend reporting depends on. (MDR Annex III, s. 1; Art. 88(1); IVDR Annex III, s. 1; Art. 83(1))
3. The PSUR schedule follows the certificate date, and where several devices share one PSUR, the leading device sets the schedule for the group. (MDCG 2022-21, s. 4.1, 5.1, 5.2.1)
4. Each complaint is tested against criteria A to C, and doubt leads to a report. (MDCG 2023-3 Rev.2, Q1, Q2, Q9, Q10; MDR Art. 87(7))
5. The outcome of the incident decides the time limit. The risk management file decides whether a deterioration was "unanticipated", and on the guidance the count starts on the day after anyone in the organisation first receives the information. (MDR Art. 87(3) to (5); MDCG 2023-3 Rev.2, Q12, Q14, Q15)
6. A safety-driven correction that meets Article 2(68) is a field safety corrective action, reported in advance except in urgency. (MDR Art. 2(68), 87(8), 89(8))
7. Reports go through national channels until the EUDAMED vigilance module applies. (MDCG 2021-1 Rev.1, pp. 23 to 26; PMSV forms page)

14. The four running cases#

The monitor: a wearable cardiac monitor from a US company#

The monitor records heart rhythm continuously for later review by a clinician, and a companion application displays the recording. Chapter 1 puts the hardware in class IIa under Rule 10, on our reading. It classifies the application separately: class IIa if it only records, class IIb if it analyses the rhythm to guide a physician's diagnosis. The planning assumption is that it only records.

The US company has a sole authorised representative, and Union distributors buying from it act as importers.

Suppose, as an illustrative assumption, that the risk file lists skin irritation from the adhesive as a known side-effect. Irritation falls outside individual reporting only if it is clearly documented in the product information, quantified in the technical documentation and covered by trend reporting, so the plan needs an irritation rate, a threshold and an observation period. (MDR Art. 87(1)(a), 88(1))

The triage tool: AI-enabled software from a Union company#

The triage tool suggests how soon each patient should be seen, for patients a triage nurse has already assessed as having no life-threatening condition. Classes IIa to III are all arguable under Rule 11, and it is planned as class IIb. Its maker is established in the Union, and the tool is a high-risk AI system through Annex I of the AI Act.

Our reading is that where the model's performance drifts in one subgroup of patients, with no single output shown to be wrong, it is unclear whether this is an incident to report individually or a trend to report under Article 88. None of the guidance cited here settles which.

The implant: a spinal implant system from a Union company with a directive certificate#

The implant is an interbody cage with screws, plates, hooks and rods. Chapter 1 classes it by component: the cage class III, screws and plates class IIb, and hooks class IIb on MDCG 2021-24 rev.1's reading. Rods, wires and pins stay open, because Rule 8 does not name them.

As an illustrative assumption of this book, the system is CE marked under Directive 93/42/EEC, the Medical Devices Directive. The company is seeking its first MDR certificate. The further illustrative assumptions are that the certificate qualifies under Article 120(2), the Article 120(3c) conditions were met, and each component was class IIb or III under the directive.

A notice identifies the affected devices, in particular by UDI. On our reading, knowing which lots of cages, screws and rods went to which hospitals is one way to provide the tracing tools the plan requires. (MDR Art. 89(8); Annex III, s. 1(b))

The near-patient test: a cardiac troponin test from a Swiss company#

The near-patient test measures cardiac troponin in hospital emergency departments. Chapter 1 gives it two intended purposes: serial measurement, class C under Rule 3(j), and single measurement, class B under Rule 6 on the guidance's reading, which is contested. Both are planned as class C until a notified body confirms otherwise, and this chapter works on the serial purpose.

As an illustrative assumption of this book, the test is a legacy device. Its declaration of conformity was drawn up under Directive 98/79/EC before 26 May 2022, with no notified body, and it is already sold through distributors in Germany, the Netherlands, Belgium and Austria. That places it under Article 110(3b) of the IVDR. The Swiss company has a sole authorised representative, and Union distributors buying from it act as importers. (IVDR Art. 110(3), (3b))

15. When specialist help is worth paying for#

• A serious incident may have occurred and the answer is unclear. The time limit keeps running while advice is taken, and the regulation requires a report where the manufacturer is uncertain. (MDR Art. 87(7))
• A field safety corrective action reaches several Member States, in which case the competent authorities may coordinate their assessment. (MDR Art. 89(8), (9))
• A legacy device is moving to its first MDR certificate, since the PSUR schedule and route change with the certificate. (MDR Art. 120(3d); MDCG 2022-21, s. 5.2.2, p. 15)
• The device includes a high-risk AI system, where integrating AI Act monitoring into the device plan under Article 72(4) needs an argument that the result achieves an equivalent level of protection. (AI Act Art. 72(4))

Conclusion#

The device's risk class decides which periodic report the company owes and how often it is updated. For medical devices, class III or implant status decides where the periodic safety update report (PSUR), the regular safety summary, goes. It is either submitted for review to the notified body, the organisation that certifies the device, or only kept available to it.

The surveillance plan sets threshold values, the levels at which the company itself must act, and the duty to report a statistically significant rise in non-serious incidents or expected side-effects (trend reporting) depends on them.

Three criteria in MDCG 2023-3 Rev.2, guidance from the Member States' expert group, decide whether a complaint is a reportable serious incident, and all three must be met. An incident has occurred. It directly or indirectly led, might have led, or might lead to a serious outcome. A causal link with the device is established, suspected, or reasonably possible, that is, the device cannot reasonably be ruled out as a contributing cause. A manufacturer in doubt reports.

For a serious incident, the outcome decides whether the time limit is 2, 10 or 15 days. On the guidance, the count runs from the first receipt of the information anywhere in the organisation, including by a representative that handles complaints for it. On our reading, days spent forwarding a complaint therefore use up the limit.

A correction made for safety reasons to devices already sold is a field safety corrective action where it meets the Article 2(68) definition, reported before it is taken except in urgency. On our reading the time limits already apply, and only the channel differs: reports go through national systems until the vigilance module of EUDAMED, the European database on medical devices, applies.

For the wearable heart monitor from a US company, the hardware, class IIa on our reading, and its recording application, planned as class IIa, owe a PSUR at least every two years. An algorithm that analysed the rhythm would move the application to class IIb and make that PSUR annual. On the guidance, the reporting clock starts when the monitor's authorised representative, its agent in the Union, receives a complaint, and the representative's mandate requires it to forward complaints immediately.

The AI triage tool from a Union company, planned as class IIb, owes a PSUR at least annually, which is made available to the notified body and not submitted to it for review. A model update made for safety reasons is such an action where it meets the Article 2(68) definition, reported before release except in urgency.

On the guidance and our computation, the spinal implant system seeking its first MDR certificate owes an annual PSUR now, based on its class under the directive. On our reading, it still does after MDR certification.

The near-patient cardiac troponin test from a Swiss company is a legacy device, already sold under the earlier IVD directive, planned as class C, and it owes a PSUR at least annually. Harm caused by a medical decision taken on its result counts as an incident.

Chapter 6 covers clinical and performance follow-up, chapter 7 technical documentation, chapter 9 registration identifiers, and chapter 10 AI and cybersecurity duties.