Under the EU Medical Device Regulation (MDR) 2017/745, most medical device manufacturers placing devices on the European market must produce a Periodic Safety Update Report (PSUR). The PSUR is a structured post-market document that summarizes safety and performance data collected since the last report, assesses whether the benefit-risk profile of the device remains acceptable, and documents any corrective actions taken. Class IIa devices require a PSUR every two years. Class IIb and Class III devices require one annually. The PSUR does not replace Post-Market Clinical Follow-Up (PMCF) or the Post-Market Surveillance (PMS) plan, but it integrates their outputs into a single regulatory-facing document.

What is a Periodic Safety Update Report?

A Periodic Safety Update Report is a mandatory post-market document required under EU MDR Article 86 for Class IIa, IIb, and III medical devices. It compiles and analyzes post-market surveillance data to confirm that the device’s benefit-risk profile remains acceptable, that the residual risks identified in the clinical evaluation are still justified, and that no new risks have emerged in the market.

The PSUR concept originated in pharmaceuticals, where similar periodic safety reports have been required for decades under the EMA’s Pharmacovigilance regulations. EU MDR adapted this approach for medical devices, making the PSUR one of the more demanding new documentation requirements introduced by the regulation that replaced the older MDD (93/42/EEC) and AIMDD (90/385/EEC) directives.

For Class IIa devices, the PSUR feeds into the Summary of Safety and Clinical Performance (SSCP) for implantable devices. For Class IIb and Class III devices, the PSUR must be made available to the Notified Body as part of the technical documentation review cycle.

Which devices require a PSUR under EU MDR?

EU MDR Article 86 applies to:

• Class IIa devices: PSUR required every two years
• Class IIb devices: PSUR required annually
• Class III devices: PSUR required annually

Class I devices are not subject to the PSUR requirement under Article 86, but manufacturers of Class I devices still have post-market surveillance obligations under Article 83 and must maintain a PMS plan and PMS report. The PMS report for Class I devices is a lighter document than a PSUR.

Manufacturers who received CE marking under the old MDD and are operating under transitional arrangements still need to comply with EU MDR Article 86 PSUR requirements if their device falls into Class IIa, IIb, or III. The transition deadline does not exempt companies from new post-market documentation obligations.

What must a PSUR contain?

EU MDR Annex III specifies the minimum content requirements for a PSUR. A complete and compliant PSUR includes:

Post-market surveillance data summary

This section brings together all data collected since the previous PSUR (or since market introduction for the first PSUR). Data sources include complaints, adverse events, field safety corrective actions, literature reviews, registry data, clinical studies, and any feedback from the PMCF program. The summary must cover both the EU market and, where relevant, other markets where the device is sold.

Conclusions from the benefit-risk assessment

The PSUR must explicitly state whether the device’s benefit-risk ratio remains acceptable. This assessment draws on the clinical evaluation report and incorporates any new data collected during the surveillance period. If new risks emerged during the period, the PSUR must document how they were assessed and whether the residual risk remains within acceptable limits defined in the risk management file.

Main findings from PMCF

The PSUR must summarize the conclusions of the Post-Market Clinical Follow-Up program, including any new clinical data collected, any changes to the PMCF plan in response to findings, and whether the PMCF findings support or contradict the benefit-risk conclusions in the clinical evaluation.

Complaint analysis and trend review

A structured complaint analysis covering the reporting period must document the number and nature of complaints received, the categories of failure mode identified, the serious incidents and FSCAs reported to competent authorities, and any trends identified through statistical or qualitative analysis.

Conclusions from vigilance reporting

All serious incidents and FSCAs reported during the period must be listed and summarized. The PSUR must confirm that all mandatory reporting obligations to competent authorities were met within the required timeframes.

Volume of devices sold and market data

The PSUR must include an estimate of the number of devices placed on the market during the reporting period. This is used to normalize adverse event rates and complaint frequencies against device exposure.

PSUR vs. PMS report: what is the difference?

EU MDR distinguishes between two post-market documents based on device class:

• A PMS Report is required for Class I devices under Article 85. It is a simpler document that summarizes post-market surveillance conclusions and is updated when necessary, without a fixed annual or biennial schedule.
• A PSUR is required for Class IIa, IIb, and III devices under Article 86. It follows a fixed reporting cycle and must be submitted to the Notified Body as part of the conformity assessment.

Both documents draw from the same underlying data in the PMS plan. The PSUR goes further by requiring an explicit benefit-risk conclusion and integration of PMCF findings into the safety assessment.

How the PSUR connects to other technical documentation

The PSUR does not exist in isolation. It feeds into and draws from several other required documents:

Clinical Evaluation Report (CER): The PSUR references the CER and must confirm whether the PMCF data and complaint data collected since the last CER update require the CER to be revised. In most cases, the annual PSUR update triggers at least a review of the CER for Class IIb and III devices.

Risk Management File: The PSUR benefit-risk assessment references the risk management file and must document any changes to residual risk estimates based on real-world performance data. If a new hazard is identified through post-market data, it must be added to the risk management file, and the PSUR documents that update.

PMCF Plan and Report: The PMCF plan defines the ongoing clinical data collection activities for the device. The PMCF report summarizes the results. The PSUR integrates both documents into its benefit-risk conclusion section.

Summary of Safety and Clinical Performance (SSCP): For implantable devices and certain Class III devices, the SSCP is a public-facing document published on EUDAMED. The PSUR informs the SSCP by confirming whether the safety and performance data in the SSCP remain accurate. When the PSUR identifies new findings, the SSCP may need to be updated.

Common problems in PSUR preparation

Notified bodies reviewing PSURs under EU MDR have flagged recurring problems that lead to non-conformities during technical documentation audits:

Disconnected data sources. Many manufacturers collect complaint data in one system, literature monitoring in a spreadsheet, and adverse event reports in another database. When the PSUR author has to manually pull from multiple disconnected sources, the risk of data gaps is high and the process takes far longer than it should.

Benefit-risk conclusions without supporting analysis. A PSUR that simply states “the benefit-risk profile remains acceptable” without demonstrating the analysis that supports that conclusion is not compliant. The conclusion must follow from the data, and the data must be in the report.

No integration of PMCF findings. Some manufacturers treat the PMCF report as a separate document that runs on a different schedule from the PSUR. EU MDR requires PMCF conclusions to be integrated into the PSUR. If the PMCF report is not available at the time of the PSUR, the manufacturer must document why and when it will be available.

Complaint rates presented without context. A raw complaint count without denominator data (units sold, device-years of use) is not an analyzable trend. Notified bodies expect normalized complaint rates and comparison to the rates assumed in the risk management file.

Late or missing PSURs. The two-year cycle for Class IIa and the annual cycle for Class IIb and III are mandatory. Missing a cycle or submitting significantly late creates a compliance gap that the Notified Body must assess during the next audit.

Building a PSUR-ready post-market surveillance system

The difference between a smooth PSUR preparation cycle and a frantic last-minute scramble comes down to whether the underlying data infrastructure exists. Companies that prepare well maintain:

• A complaint management system that captures and categorizes all feedback in a structured format, with root cause and corrective action outcomes tracked to closure
• A literature monitoring program running on a defined schedule, with search results and article assessments documented
• An adverse event tracking system that links each event to the corresponding vigilance report submitted to competent authorities
• A PMCF program that runs on a schedule aligned with the PSUR cycle, so PMCF outputs are available when the PSUR is drafted
• A risk management file that is updated whenever new information is incorporated into the benefit-risk assessment

When all of these data sources are managed in a single quality management system, the PSUR becomes a reporting exercise rather than a data recovery project. The author pulls structured data from the complaint module, the adverse event module, and the PMCF records, rather than searching across email threads and disconnected spreadsheets.

How Cloudtheapp supports PSUR preparation

Cloudtheapp’s QMS platform gives medical device manufacturers the data infrastructure that makes periodic reporting manageable. Complaint records, adverse events, CAPA records, and supplier feedback are all managed within the same system, tagged to products and device configurations, and tracked through closure. When it is time to prepare the PSUR, the quality or regulatory team can pull a structured dataset for the reporting period rather than assembling records manually.

The platform supports the full post-market surveillance cycle: from complaint intake and investigation through CAPA closure, literature monitoring records, and PMCF activity tracking. Every record includes a complete audit trail showing who created it, who reviewed it, and what actions were taken. That audit trail is available for Notified Body review without additional preparation.

Companies managing multiple device families across Class IIa, IIb, and III can configure separate reporting schedules per product, with automated reminders triggered at defined intervals before each PSUR is due. This keeps the two-year and annual cycles on track without relying on manual calendar management.

If your post-market surveillance data is currently spread across multiple systems and your PSUR preparation takes weeks of manual consolidation, there is a simpler path. See how Cloudtheapp structures PMS data for regulatory reporting at cloudtheapp.com/demo.

Conclusion

The PSUR is one of the more demanding documentation requirements introduced by EU MDR for Class IIa, IIb, and III medical device manufacturers. A compliant PSUR requires structured data from multiple post-market surveillance activities, an explicit benefit-risk conclusion supported by that data, and integration of PMCF findings into the safety assessment. Companies that build their post-market surveillance infrastructure correctly spend relatively little time on PSUR preparation. Those that collect data in disconnected systems find each reporting cycle to be a significant resource drain. The investment in a unified QMS pays for itself in the quality and efficiency of post-market reporting.

This post created by and appeared first on Cloudtheapp