Post-market surveillance for SaMD: PMS Plan, PMCF, PSUR explained

Why post-market surveillance matters more under EU MDR

Under MDD, post-market surveillance was broadly defined and inconsistently enforced. Many companies maintained minimal PMS systems — a complaint log, an annual literature search, and a brief summary — and passed NB audits without difficulty. EU MDR fundamentally changed this. The regulation introduces specific, named post-market documents with defined content requirements, mandatory update frequencies, and direct linkage to the clinical evaluation that must be maintained throughout the device's lifetime.

For SaMD specifically, post-market surveillance has a dimension that hardware devices do not: the product is continuously updated, and each update creates a data point relevant to real-world performance. A SaMD company with an active user base has more post-market clinical data available than almost any hardware manufacturer — but only if the PMS system is designed to capture it.

The four documents: what they are and how they connect

EU MDR creates four distinct but interconnected post-market documents. They are not interchangeable, and the failure to understand the difference between them is itself a common audit finding.

What each document must contain for SaMD

PMS Plan

The PMS Plan must specify proactive and reactive data collection methods. For SaMD, this typically includes: complaint handling and trend analysis (classification, severity, frequency thresholds triggering escalation); adverse event and near-miss reporting per MDR Article 87; post-market literature surveillance covering the clinical domain and comparable devices; PMCF activities as specified in the PMCF Plan; and data from user feedback channels. Critically, the plan must define thresholds — specific criteria that, when met, trigger a defined response (design change, field safety notice, NB notification, CER update). A PMS Plan without thresholds is a data collection plan, not a surveillance plan.

PSUR (Class IIa/IIb — annual)

The PSUR must include: a summary of PMS data collected since the last PSUR; complaint analysis with trend conclusions; vigilance events and regulatory actions; literature surveillance findings; PMCF findings summary; conclusions of the current benefit-risk analysis (not just a statement that the benefit-risk is acceptable, but the actual analysis); and the conclusions of the current clinical evaluation. For most Class IIa SaMD, the first PSUR is due 12 months after initial certification. If the PSUR identifies a new risk or a change in the benefit-risk profile, this must trigger a CER update and — if significant — NB notification.

PMCF Plan

The PMCF Plan for SaMD should specify: the specific clinical questions or evidence gaps it is designed to address (taken directly from the CER conclusions); the data collection methods to be used and why they are appropriate; timelines and responsible parties for each activity; acceptance criteria that would confirm or refute the clinical hypotheses; and what will happen when the PMCF Report is completed (how findings feed back into the CER). For software, PMCF activities often include systematic literature surveillance (most efficient for SaMD teams with limited field study capacity), analysis of usage logs linked to clinical outcomes, and structured user feedback with clinical performance dimensions.

PMCF Report

The PMCF Report documents what was actually done per the PMCF Plan and what was found. It must conclude whether the PMCF findings confirm the clinical evaluation's benefit-risk analysis or whether a CER update is required. If findings reveal unexpected adverse effects, performance variation across patient subgroups, or new evidence about the clinical domain, the PMCF Report triggers a CER revision — which may in turn require NB notification if the revision constitutes a significant change.

The post-market lifecycle timeline for Class IIa SaMD

Connecting PMS to real-world SaMD operations

For SaMD teams, the practical challenge is that post-market regulatory obligations run in parallel with normal product development. The same engineering team managing sprint cycles and software releases is also the source of post-market performance data. Designing the PMS system to capture this data without creating separate manual processes is both possible and important.

Specifically for SaMD, operational data that can serve PMS purposes includes: support ticket classification by symptom type and clinical impact severity; error rate telemetry on algorithm outputs where clinical impact can be assessed; user-reported discrepancies between algorithm output and clinical judgement; and usage patterns that indicate the device is being used outside its validated intended use. None of this requires building a separate regulatory data collection process — it requires designing the existing operational systems to retain and classify data in a way that feeds PMS analysis.

What NBs look for in PMS surveillance audits

Based on NB audit experience, the most frequently cited PMS deficiencies for SaMD under EU MDR are:

• PSUR not produced on schedule: The single most common finding. Annual PSUR is a hard requirement for Class IIa/IIb — missing or late PSURs are major non-conformities.
• PMS Plan not being executed: Literature surveillance described in the Plan but not performed; PMCF activities listed but no evidence of execution; complaint thresholds defined but no evidence of threshold monitoring.
• Complaint data not classified by clinical severity: Logging all complaints as equivalent regardless of whether they relate to minor UI issues or potential clinical impact misses the purpose of complaint trend analysis.
• PMCF Plan and CER not connected: PMCF activities that do not address the specific evidence gaps identified in the CER do not satisfy the PMCF requirement, regardless of how much data they collect.
• PMS findings not feeding back into the QMS or risk file: A complaint analysis that concludes "no action required" every cycle — without documented analysis of whether risk controls remain adequate — is treated as evidence of a non-functioning PMS system.