Post-Market Surveillance, Vigilance and Post-Market Clinical Follow-Up
Post-market obligations are examined at pre-registration because a device cannot be certified without a functioning PMS system already described. The exam tests timelines and the difference between the PMS plan, the PMS report, the PSUR and the vigilance report.
PMS architecture (Articles 83 to 86)
Article 83 requires a PMS system proportionate to the risk class. Article 84 requires a PMS plan as part of the technical documentation under Annex III, defining data sources, methods, indicators and thresholds for trend analysis. Class I manufacturers produce a post-market surveillance report; Class IIa and above produce a periodic safety update report, every two years for Class IIa and IIb and at least annually for Class III and implantable devices, submitted to the notified body. The IVDR mirrors this: PSUR annually for Class D, every two years for Class C, and on request for Classes A and B.
Vigilance (Articles 87 to 89)
Serious incident reporting goes through EUDAMED: 15 days after awareness, shortened to 10 days for death or unanticipated serious deterioration in health, and 2 days for a serious public health threat. Article 88 covers trend reporting of non-serious incidents. Field safety corrective actions are reported and accompanied by a field safety notice, even where no serious incident occurred.
PMCF
Annex XIV Part B requires a PMCF plan and a PMCF evaluation report as part of the clinical evaluation, feeding back into the clinical evaluation report.
Worked example
A manufacturer records a software defect that produced incorrect INR results in 200 devices, none of which caused harm. Reporting is still required: the event meets the trend-reporting threshold in Article 88, and the correction is a field safety corrective action needing a field safety notice, regardless of the absence of injury.
Traps
Reporting under Article 87 what belongs under Article 88; treating a complaint log as a PMS system; treating PMCF as optional when it is the default; and applying PSUR frequency by certificate cycle instead of by risk class.
Quality Management System: Article 10(9), Annex IX and EN ISO 13485
The quality management system is assessed in every Annex IX certificate and is where notified bodies find systemic failures that undermine an otherwise strong technical file. The exam tests the MDR-specific layers on top of EN ISO 13485:2016.
The legal basis
Article 10(9) requires manufacturers to establish, document, implement, maintain, keep up to date and continually improve a quality management system proportionate to the class and type of device. Annex IX Chapter I, point 2, lists what it must cover: a regulatory compliance strategy, general safety and performance requirements, management responsibility, resource management, product realisation, and measurement, analysis and improvement - mirroring ISO 13485 while adding device-specific items.
MDR additions to ISO 13485
EN ISO 13485:2016 is harmonised and gives presumption of conformity, but the Regulation adds requirements the standard does not contain: the person responsible for regulatory compliance under Article 15, UDI assignment and maintenance, PMS and vigilance procedures, written agreements with authorised representatives, importers and distributors, and obligations to keep technical documentation and certificates available. An ISO 13485 certificate is not a substitute for an Annex IX certificate.
Surveillance and unannounced audits
Certificates are subject to surveillance at least annually, and notified bodies conduct unannounced audits, including at critical subcontractors and suppliers such as sterilisation facilities.
Worked example
A manufacturer's quality manual is certified to ISO 13485:2016 and its audit reports are clean. The notified body still raises a non-conformity because no person responsible for regulatory compliance is documented, there is no procedure for maintaining UDI data in EUDAMED, and the contract steriliser is outside supplier control. The certification simply does not cover those MDR obligations.
Traps
Equating a 13485 certificate with MDR compliance; leaving critical suppliers outside the audit scope; treating the PRRC as a job title rather than a qualified, documented role; and assuming remote audits permanently replace on-site surveillance.
Risk Management (ISO 14971) and Supplier Controls
Risk management is assessed twice: as a document set within the technical documentation and as a process inside the quality management system. It is also where supplier failures become systemic non-conformities.
The ISO 14971:2019 process
The standard requires a risk management plan defining scope, responsibilities and acceptability criteria; identification of hazards and hazardous situations from the intended use and reasonably foreseeable misuse; risk estimation of severity and probability of occurrence; risk evaluation against the plan's criteria; risk control following the hierarchy of inherently safe design, protective measures and information for safety; residual risk evaluation; benefit-risk analysis where residual risk is not acceptable; and a risk management report. Production and post-production activities feed incidents and complaints back into the file.
The MDR overlay
Annex I requirements 1 to 3 make risk management a legal obligation across the whole lifecycle and require risk control to be applied as far as possible without economic considerations. Annex I also requires residual risk to be disclosed in the information supplied with the device. EN ISO 14971:2019 is harmonised, but where its text diverges from the Regulation, the Regulation prevails.
Supplier and subcontractor control
ISO 13485 clause 7.4 requires purchasing controls and supplier evaluation. In pre-registration assessment the notified body expects a supplier list distinguishing critical from non-critical suppliers, quality agreements, audit evidence for critical suppliers, and traceability from the bill of materials into the technical documentation. Sterilisation, contract manufacturing, calibration and software development are typical critical suppliers.
Worked example
A risk file lists infection with a severity of 5 and a probability of 1 and concludes acceptability. The notified body notes the device is supplied non-sterile and that no control measure addresses reprocessing instructions. The hierarchy was not applied: the file needs validated reprocessing instructions or a design change, and the residual risk must be communicated in the information supplied.
Traps
Treating the risk management file as a one-off document rather than a living process; accepting training as a risk control where design change was feasible; and omitting single-source critical components from the device risk assessment.
Unique Device Identification, EUDAMED Registration and Data Governance
UDI and EUDAMED questions are largely factual, but they are increasingly checked at pre-registration because the basic UDI-DI must exist before the certificate is issued.
UDI structure
Article 27 and Annex VI introduce the unique device identification system. The basic UDI-DI identifies a device group and is the key in EUDAMED and on certificates; the UDI-DI identifies a specific device or model; the UDI-PI identifies production data such as lot, serial number or expiry. Issuing entities designated by the Commission are GS1, HIBCC, ICCBBA and, for IVDs, IFA. UDI carriers must appear on the label and, for reusable devices, on the device itself. Deadlines were staggered: Class III and implantables from 26 May 2021, Class IIa and IIb from 26 May 2023, Class I from 26 May 2025. Implantable devices must also be accompanied by an implant card under Article 18.
EUDAMED
Article 33 establishes the European database on medical devices with six modules: actor registration, UDI and device registration, certificates and notified bodies, clinical investigations and performance studies, vigilance and post-market surveillance, and market surveillance. Actors register to obtain a single registration number, which is required for the manufacturer's application and appears in the declaration of conformity. Use of EUDAMED becomes mandatory six months after the Commission publishes notice that the system is fully functional under Article 123.
Data governance
Registration does not replace the technical documentation. Public access is given to identified device data, confidentiality is governed by Article 109 and personal data by the GDPR, and the Commission and competent authorities have wider access than the public.
Worked example
A manufacturer of a Class IIb device submits a basic UDI-DI that changes with every lot. It is rejected: lot variation belongs in the UDI-PI, while the basic UDI-DI must remain stable for the device group across the certificate lifetime.
Traps
Confusing the three UDI levels; assuming EUDAMED registration is equivalent to certification; treating allocation of a single registration number as optional for the authorised representative; and forgetting that certificates and their scope are published in the certificates module.
MDCG Guidance Documents, Position Papers and Their Application in Assessment
This domain tests judgement: which MDCG document governs a question, what weight it carries, and how to deploy it in an assessment argument without overstating it.
Status and structure
The Medical Device Coordination Group is established by Article 103 MDR and Article 98 IVDR, chaired by the Commission with one representative per Member State. It issues guidance documents numbered by year (for example MDCG 2021-24), position papers, questions and answers, and templates. None is legally binding; each states that it represents the views of the MDCG and should be read together with the Regulation. In practice notified bodies and competent authorities expect compliance, so a departure must be reasoned in the technical documentation.
Documents worth knowing
MDCG 2021-24 addresses classification under Annex VIII. MDCG 2020-5 addresses clinical evaluation and equivalence. MDCG 2020-6 covers clinical evidence for legacy devices previously certified under the directives. MDCG 2020-7 and 2020-8 provide the PMCF plan and PMCF evaluation report templates. MDCG 2022-21 covers the PSUR. MDCG 2019-9 covers the summary of safety and clinical performance, MDCG 2019-16 covers cybersecurity, and MDCG 2023-3 defines vigilance terms.
Using guidance correctly
A sound argument quotes the article or annex first and then uses the guidance as the agreed interpretation. A weak one cites only the guidance. Where guidance conflicts with the Regulation the Regulation prevails; where guidance post-dates a certificate it does not retroactively invalidate it, though it informs surveillance findings.
Worked example
An assessor objects that a clinical evaluation report merges the plan into the report. The correct route is to cite Annex XIV Part A, which requires a plan, and then MDCG 2020-5 for the expected equivalence content and appraisal structure. Citing guidance alone would leave the non-conformity unsupported in law and vulnerable on appeal.
Traps
Treating guidance as a harmonised standard giving presumption of conformity; citing a superseded revision; applying IVD guidance to an MDR device; and assuming position papers carry the same standing as guidance documents, when they normally express an interim and narrower view.