# EU MDR post-market surveillance and vigilance What EU MDR asks you to monitor once a device is on the market, the PSUR cadence by class, and the 15, 10 and 2 day deadlines for serious incidents. Source: https://sted.digital/docs/standards/eu-mdr/post-market-surveillance-and-vigilance · Last reviewed 17 October 2026 · Strand Standards and regulations EU MDR Articles 83 to 86 require surveillance of every device on the market, with a report for Class I and a periodic safety update report above it. Articles 87 to 89 set vigilance: report a serious incident within 15 days of awareness, 10 days for a death or unanticipated serious deterioration, 2 days for a serious public health threat. ## The requirement in plain English **A system for every device (EU MDR Article 83).** Each device needs a surveillance system proportionate to its risk, built into the quality management system of EU MDR Article 10(9). It must gather and analyse data on quality, performance and safety actively and systematically, not only wait for complaints (EU MDR Article 83(2)). What it finds updates the risk management, the clinical evaluation, the labelling and the technical documentation, and identifies preventive, corrective and field safety corrective actions. **A plan (EU MDR Article 84).** The system rests on a plan whose content EU MDR Annex III sets out; it is part of the technical documentation. **Reports by class.** Class I devices have a post-market surveillance report, updated when necessary and given to the competent authority on request (EU MDR Article 85). Class IIa, IIb and III devices have a periodic safety update report (PSUR) covering the benefit-risk conclusions, the main post-market clinical follow-up findings and the sales volume and user population (EU MDR Article 86(1)). Class IIb and III PSURs are updated at least annually; Class IIa PSURs when necessary and at least every two years. For Class III and implantable devices the notified body reviews each PSUR (EU MDR Article 86(2)). **Serious incidents (EU MDR Article 87).** A serious incident is any incident that "directly or indirectly led, might have led or might lead to" a death, a serious deterioration in health or a serious public health threat ([EU MDR Article 2(65)](https://eur-lex.europa.eu/eli/reg/2017/745)). You report it once a causal link with your device is established or reasonably possible: | Event | Report no later than | Where it is set | |---|---|---| | Serious incident | 15 days after awareness | EU MDR Article 87(3) | | Death or unanticipated serious deterioration in health | 10 days after awareness | EU MDR Article 87(5) | | Serious public health threat | 2 days after awareness | EU MDR Article 87(4) | An incomplete first report may come before the complete one (EU MDR Article 87(6)), and if you are unsure whether an incident is reportable you still report on time (EU MDR Article 87(7)). Expected side-effects that are documented and quantified in the technical documentation go to trend reporting instead. **Field safety corrective actions.** You report one before you take it, unless it is urgent (EU MDR Article 87(8)), and tell users through a field safety notice whose draft the competent authority sees first, except in urgent cases (EU MDR Article 89(8)). **Trends (EU MDR Article 88).** A statistically significant rise in the frequency or severity of non-serious incidents or expected side-effects is reported. Your plan must say how you detect one. **Investigation (EU MDR Article 89(1)).** You investigate without delay, without altering the device or batch in a way that could affect later analysis before telling the authority, and you file a final report (EU MDR Article 89(5)). **Supply interruption.** Under EU MDR Article 10a you warn your competent authority and direct customers at least six months before an interruption or discontinuation that could cause serious harm, barring exceptional circumstances. A vigilance deadline runs from the manufacturer's awareness, so treat the first person in your organisation to hear of an incident as the start of the clock, and decide in advance who can file a report on a public holiday. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 40-person company makes a Class IIa wearable heart-rate monitor and its app. Its post-market surveillance plan names every data source: complaints, service returns, app-store reviews, user surveys, literature searches, safety notices on similar devices, and the post-market clinical follow-up study. Each source has an owner and a frequency. The plan defines trend reporting statistically: complaints per 1,000 devices in use, by failure mode, against a 12-month baseline, with a threshold that triggers an Article 88 assessment. A monthly surveillance review looks at the numbers and records decisions. The vigilance procedure opens with a decision tree: incident or not, serious or not, causal link established or reasonably possible, which deadline applies. Every complaint that touches safety gets a documented reportability decision, including the ones judged not reportable. Two trained people can file a report, so the 2-day clock works at weekends, and the team runs a timed drill once a year. The company updates its PSUR every year rather than every two, because its notified body asked for annual data during certification. Each PSUR states the benefit-risk conclusion and links to the corrective actions it raised. ## Evidence an auditor expects - **Post-market surveillance plan** (required, in the technical documentation): the notified body checks it covers the Annex III content, including the trend method. - **PSUR or surveillance report** (required): checked for cadence by class and for conclusions that match the data. - **Complaint and reportability records**: the notified body samples complaints and asks why each one was or was not reported. - **Vigilance reports and acknowledgements**: the competent authority checks dates against awareness. - **Field safety corrective action files**: the advance notice, the field safety notice and evidence it reached users. - **Investigation and final reports**: closed, with root cause and corrective action linked. - **Updates downstream**: risk file, clinical evaluation and labelling changes traced to surveillance findings. ## Common mistakes ### Starting the clock at the wrong moment Teams date awareness from when the regulatory lead reads the ticket. The clock starts when the manufacturer becomes aware, so log the first contact and route safety complaints straight to the people who decide reportability. ### Waiting for certainty before reporting Article 87(7) says an uncertain incident is still reported on time. File an initial report and complete it later. ### Surveillance that only listens A complaints inbox is not a system. Article 83(2) wants active, systematic collection; plan literature searches, user feedback and data on similar devices, and record what each found, even when it found nothing. ### Trend reporting with no method A plan that says "trends will be monitored" fails the Article 88 test. State the measure, the baseline, the observation period and the threshold. ### A PSUR that changes nothing A PSUR whose conclusions never reach the risk file, the clinical evaluation or a corrective action shows surveillance in name only. Trace each finding to where it landed. ## How Sted helps Under the Post-Market Surveillance and Vigilance Procedure (PRC-PMSV) Sted's knowledge base carries a Post-Market Surveillance (PMS) Plan (REC-PMS) for each device, setting out what is gathered, from where, by whom and how often, a Post-Market Surveillance (PMS) Review Record (REC-PMSR) and a Periodic Safety Update Report (PSUR) (REC-PSUR) covering the benefit-risk balance, clinical follow-up, sales and use, and serious incidents for each reporting period. Records are part of the Full Management System plan. Sted's knowledge base includes a Medical Device Incident Record (REC-MDI) under the Incident Management Procedure (PRC-IMP), which records what happened, the device and version involved, what it meant for patients and users, who had to be told and by when, and what was done to make it safe again. Records are part of the Full Management System plan. For EU MDR Sted's knowledge base carries five procedures, the Clinical Evaluation and PMCF Procedure (PRC-CEP), Post-Market Surveillance and Vigilance Procedure (PRC-PMSV), Enhanced Summative Evaluation Procedure (PRC-ESE), Risk Management Procedure (PRC-RMP) and Incident Management Procedure (PRC-IMP), and eight record templates: the Post-Market Surveillance Plan (REC-PMS), Post-Market Surveillance Review Record (REC-PMSR), Periodic Safety Update Report (REC-PSUR), Medical Device Incident Record (REC-MDI), Medical Device Risk Management File (REC-MDRM), Human Factors Engineering Report (REC-HFE), Enhanced Summative Evaluation Requirement Review (REC-ESER) and Problem Report (REC-MDPR), with six seeded requirement rows and no control catalogue. You can set a record type to repeat (weekly to every two years) and Sted raises a task when it falls due. Nothing is scheduled until an owner picks a first due date. Sted's knowledge base includes a Corrective and Preventive Actions record template, under its Corrective and Preventive Action Procedure. Records are part of the Full Management System plan. Sted does not decide whether an incident is reportable or file reports with a competent authority. The manufacturer decides and reports, and Sted keeps the record. ## Related guides and terms - [EU MDR](/docs/standards/eu-mdr): where surveillance sits in the regulation's loop. - [EU MDR clinical evaluation](/docs/standards/eu-mdr/clinical-evaluation): the evaluation surveillance data keeps current. - [ISO 13485 measurement and analysis](/docs/standards/iso-13485/measurement-and-analysis): feedback, complaint handling and reporting to regulators in the quality system. - [UK MDR 2002 and UKCA marking](/docs/standards/uk-mdr-2002): Great Britain's own reporting to the MHRA. - [Root-cause analysis for a CAPA](/docs/guides/capa-root-cause-analysis): investigating an incident to its cause. - [Repeating records](/docs/product/repeating-records): how a PSUR or surveillance review can fall due on a schedule. - [EU MDR device classification](/docs/standards/eu-mdr/classification): the class that sets your PSUR cadence and whether the notified body reviews it. ## Frequently asked questions Q: When does the 15-day vigilance clock start under EU MDR? A: When the manufacturer becomes aware of the serious incident, not when its investigation finishes. You report as soon as you have established a causal link with your device, or that one is reasonably possible, and no later than 15 days after awareness. Shorter limits of 10 days and 2 days apply to deaths, unanticipated serious deteriorations and serious public health threats. Q: How often must I update a PSUR? A: At least once a year for Class IIb and Class III devices, and when necessary but at least every two years for Class IIa. Class I devices have a post-market surveillance report instead, updated when necessary. Great Britain sets its own cadence under UK MDR 2002, so check both if you sell in both. Q: Do I report through Eudamed yet? A: Not for vigilance as of 17 October 2026. The first four Eudamed modules, including actor and device registration, became mandatory on 28 May 2026, but the vigilance module had not. Until it is, serious incidents go to the national competent authorities by the routes they set, under EU MDR's deadlines.