Post-Market Surveillance (PMS) Plan: Structure, Data Sources, and How It Differs From PMCF

A post-market surveillance (PMS) plan is the document that describes how a medical device manufacturer will actively and systematically collect and evaluate data about its device once it is on the market — it is not the same document as a PMCF plan, a PSUR, or an FDA 522 order response, though all four are connected. Under EU MDR (Regulation (EU) 2017/745), every manufacturer of every device class must have a PMS system, described in a PMS plan, whose structure is fixed by Annex III. In the United States, there is no equivalent universal requirement — instead, FDA holds a narrower, device-specific power under Section 522 of the Federal Food, Drug, and Cosmetic Act to order enhanced postmarket surveillance on individual devices that meet defined risk criteria. This page walks through the PMS plan’s required structure under MDR Article 83 and Annex III, the data sources that actually feed it, how a 522 order differs from that baseline EU obligation, and exactly where PMS ends and PMCF begins.

The PMS system, under MDR Article 83

Article 83 of the MDR requires every manufacturer to establish, document, implement, maintain, keep up to date, and continually improve a PMS system, proportionate to the risk class and appropriate for the type of device. This is a system-level, ongoing obligation attached to the device’s entire lifecycle — it does not end at CE marking. The PMS system’s output is meant to feed directly back into the risk management file (see our ISO 14971 guide), the clinical evaluation, and the technical documentation, closing the loop between what the manufacturer claimed about the device before market and what actually happens to it afterward.

The PMS system’s central document is the PMS plan, required by Article 84, which must be part of the technical documentation described in Annex III. The plan is not free-form — Annex III specifies the elements it has to cover.

What the PMS plan must contain (Annex III, Part A)

Annex III, Part A sets out the required content of the PMS plan. In substance, it must address:

• The method and process for gathering and evaluating data — both proactive collection (the manufacturer goes looking for data) and reactive collection (data arrives via complaints, incident reports, and similar channels).
• Effective methods to evaluate device-related data against similar devices already on the market, including relevant developments in the state of the art.
• Methods and protocols to manage the PMCF-related activities, referencing the PMCF plan (Annex XIV, Part B) and the PMCF evaluation report, or a documented justification if PMCF is not considered necessary for the device.
• Effective and appropriate methods and protocols to assess collected data to establish trends, applicable to the trend-reporting obligation in Article 88.
• The methods and protocols for communicating effectively with competent authorities, notified bodies, economic operators, and users where corrective action or a preventive measure results.
• Reference to procedures for fulfilling the manufacturer’s vigilance obligations under Articles 87-91 (serious incidents, field safety corrective actions).
• Reference to standardised methods for identifying and reporting patterns, and for benchmarking against the state of the art.
• Identification of the responsible persons and reporting lines that connect PMS findings to Article 15’s person responsible for regulatory compliance and to the quality management system required by ISO 13485.

Proportionality is deliberate: a class I bandage’s PMS plan is a fraction of the length and depth of a class III implant’s, but every device class needs one covering these same elements — there is no size-based exemption from having a plan, only from its depth.

What actually feeds a PMS plan: the real data sources

A PMS plan is only as good as what actually populates it. In practice, the data sources are a mix of channels the manufacturer already generates and channels that arrive from outside:

• Complaint and customer-feedback data, logged through the complaint-handling procedure required by ISO 13485 and by 21 CFR Part 820 (in the US, Subpart M) for the same device sold there.
• Vigilance data the manufacturer itself files — serious incident reports and FSCAs (see our field safety corrective action guide) generate their own downstream trend data.
• PMCF data, where a PMCF plan exists — registries, targeted follow-up studies, structured user surveys, and post-market clinical investigations.
• Servicing, maintenance, and repair records, which surface failure modes complaints alone often miss.
• Literature and database surveillance — scientific literature, and, where relevant, adverse-event databases and registries covering similar devices, not just the manufacturer’s own.
• UDI-linked traceability data from EUDAMED, once the vigilance and market surveillance modules are mandatory, plus the manufacturer’s own device-tracking records tied to the UDI.
• Sales, distribution, and usage-volume data, needed as the denominator for any trend or rate calculation — a raw increase in complaint counts means little without knowing whether units sold grew faster.
• Usability and human-factors feedback, cross-referenced against the use-related risk analysis performed under IEC 62366-1.

The plan has to specify not just that these sources exist, but the method for evaluating them — frequency of review, who reviews, and what threshold triggers escalation into the risk file or a vigilance report.

PMS report vs. PSUR: the class-based split

The PMS plan feeds two different downstream documents, and which one applies depends on device class:

• PMS report (Article 85) — for class I devices. Summarises the results and conclusions of the PMS data analysis, with the rationale and description of any preventive and corrective actions taken. Updated when relevant, and made available to the competent authority on request.
• Periodic Safety Update Report, PSUR (Article 86) — for class IIa, IIb, and III devices. A more structured document, updated at a defined cadence set by risk class (at least every two years for class IIa; at least annually for class IIb and III), that must include the conclusions of the benefit-risk determination, the main findings of the PMCF, and the volume of sales together with an estimate of the population using the device and its frequency of use where feasible. For class IIb and III devices, the PSUR is submitted to the notified body as part of the technical documentation assessment, not merely held on file.

Both documents draw directly on the PMS plan’s data-collection machinery; neither replaces it. A common mistake is treating the PSUR as the PMS activity itself — it is the periodic summary of an ongoing activity that has to be running continuously between report dates.

Trend reporting: Article 88

Article 88 creates a separate, standing obligation to report to the relevant competent authorities any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or expected undesirable side-effects, that could have a significant impact on the benefit-risk analysis and that has led or may lead to unacceptable risks. The manufacturer’s PMS plan has to define, in advance, the method for detecting that kind of statistically significant increase — a defined baseline rate and a defined statistical trigger, not a subjective judgment call made after the fact.

FDA’s side: Section 522 postmarket surveillance orders

The US regulatory structure does not impose a universal, MDR-Article-83-style PMS system requirement on every device. Every manufacturer still has baseline postmarket obligations — adverse-event reporting under 21 CFR Part 803 (Medical Device Reporting) and a complaint-handling system under 21 CFR Part 820 — but those are passive-collection and reactive obligations, not an active, systematically planned surveillance program.

What FDA has instead is a targeted power: under Section 522 of the FD&C Act, FDA can order a specific manufacturer to conduct postmarket surveillance on a specific class II or class III device when the device meets at least one of several statutory triggers — among them, that its failure would be reasonably likely to have serious adverse health consequences, that it is intended to be implanted in the human body for more than one year, that it is a life-sustaining or life-supporting device used outside a device user facility, or that it is expected to have significant use in a pediatric population. A 522 order is device- and manufacturer-specific, not a general industry rule, and the implementing regulations sit in 21 CFR Part 822. Once ordered, the manufacturer submits a surveillance plan for FDA review and, once approved, executes it and files periodic status reports until FDA determines the surveillance objective has been met or terminates the order.

The practical contrast with the EU: under MDR, PMS is a universal, self-initiated, risk-proportionate obligation that starts the moment a device is placed on the market, described in a plan the manufacturer writes for every device it sells. Under the FDA framework, active, structured postmarket surveillance of the 522 kind is the exception, imposed by the agency on specific higher-concern devices, layered on top of (not a replacement for) the passive MDR/complaint baseline every device already carries. A manufacturer selling the same device on both markets typically ends up maintaining a single, more comprehensive PMS data-collection process to satisfy the EU obligation, and treats a 522 order, if one is issued, as an additional, FDA-specific surveillance study layered on top.

How PMS differs from PMCF, specifically

PMS and PMCF are frequently used interchangeably, and they should not be:

• PMS is the whole system — every data source above, for every device, mandatory regardless of device class or clinical-data status.
• PMCF (Annex XIV, Part B) is one specific input into that system — a proactive activity to confirm the safety and performance of the device throughout its expected lifetime, to identify previously unknown side-effects, to monitor identified side-effects and contraindications, and to identify and analyse emergent risks, based on factual evidence from the actual clinical use of the CE-marked device.
• PMCF has its own plan and its own evaluation report, distinct documents from the PMS plan and PMS report/PSUR — but the PMS plan is required to reference how PMCF activities are managed (Annex III explicitly lists this as one of the PMS plan’s required elements), and PMCF findings feed into both the PMS report/PSUR and the clinical evaluation report.
• PMCF is not universally mandatory in the same absolute sense PMS is. A manufacturer can conclude PMCF is not applicable to a given device, but that conclusion has to be justified and documented, not simply omitted — it is a decision the PMS plan has to record, not a default.
• Scope of evidence differs. PMS pulls in complaint data, vigilance data, sales data, literature, and clinical data together. PMCF is specifically about generating and evaluating new clinical evidence from real-world use of the specific device — it is a subset of PMS’s evidence base, not a synonym for it.

A useful shorthand: every PMCF activity is a PMS input, but not every PMS input is a PMCF activity. Complaint trending, sales-volume denominators, and literature surveillance are PMS work that has nothing to do with PMCF.

Frequently asked questions

Is a PMS plan required for every device class, including class I?

Yes. Article 83’s PMS system obligation and Article 84’s PMS plan requirement apply to every device regardless of class. What scales with class is the depth of the plan and which downstream report applies — a PMS report for class I, a PSUR for class IIa/IIb/III — not whether a plan is required at all.

Does a 522 order replace a manufacturer’s normal FDA postmarket obligations?

No. A 522 order is additional to, not a substitute for, the baseline adverse-event reporting duty under 21 CFR Part 803 and the complaint-handling system required under 21 CFR Part 820. It applies only to the specific device FDA names in the order, for the surveillance question FDA specifies.

Can a PMS plan simply say PMCF is not applicable and stop there?

No. Annex III requires that where PMCF is not considered necessary, the justification has to be adequately substantiated and documented within the PMS plan itself, not asserted without support.

How often does the PSUR need updating?

At least every two years for class IIa devices, and at least annually for class IIb and class III devices. For class IIb and III devices, the notified body assesses the PSUR as part of its ongoing technical documentation review.