Understanding the Periodic Safety Update Report (PSUR) under IVDR 2017/746

Contents

A lot of PSUR writing stops at a paraphrase of Article 86 and a list of headings from guidance. That does not help once you already run post-market surveillance and need a report a Notified Body can follow without reconstructing your logic from complaint exports.

The legal baseline is Regulation (EU) 2017/745 (MDR), especially Articles 84 to 86 on the PMS plan, the class I PMS report, and the PSUR. The practical template and schedule logic sit in MDCG 2022-21, published by the Medical Device Coordination Group on the European Commission’s public health site. Legacy-device applicability is confirmed in MDCG 2021-25 Rev.1

1. Start with the decision, not the template

Article 86 requires manufacturers of class IIa, IIb, and III devices to prepare a Periodic Safety Update Report that summarises the results and conclusions of the analyses of post-market surveillance data gathered under the Article 84 PMS plan, together with a rationale and description of any preventive and corrective actions taken. Class I devices are outside PSUR scope; they use a post-market surveillance report under Article 85.

Before you open a template, fix four decisions. First, class: class IIb and III update at least annually; class IIa at least every two years, and whenever necessary. Second, implantable status or class III: Article 86(2) routes those PSURs to the Notified Body through the electronic system referred to in Article 92, while other class IIa and non-implantable IIb PSURs stay in the technical documentation and are made available on request. Third, single Basic UDI-DI versus a group: grouping is allowed only where relevant and only with a written justification and a leading device. Fourth, MDR-certified versus legacy under Article 120: the data-collection start date and first-PSUR timing differ, as set out in MDCG 2022-21.

Problems that usually attract findings

Reviewers still see the same failure modes. A PSUR that reprints complaint lists without a benefit–risk conclusion fails Article 86’s demand for results and conclusions. Sales or exposure missing means rates cannot be interpreted. PMCF findings omitted, or copied from an old clinical evaluation report with no link to the cycle, leave Article 86(1) incomplete where PMCF applies. One PSUR for an entire portfolio with no grouping rationale looks like avoidance. Schedule gaps or overlaps between consecutive data-collection periods break trend integrity. Treating legacy devices as exempt contradicts MDCG 2021-25 Rev.1 and MDCG 2022-21. Planning only to a Commission proposal that is not yet applicable law is another common process error.

Build the cycle questions first

Write the PSUR around a short set of questions, not around empty headings. Has benefit–risk changed since the last cycle, and what in the risk file, clinical evaluation, and prior PSUR supports that answer? Are serious incidents or field safety corrective actions rising once you express them as rates against units sold or estimated users? Do open PMCF questions still hold, and what are the main findings for this period? Is state of the art still acceptable based on a time-bounded literature and peer-signal check? Did any CAPA have safety or performance impact, and what is the residual risk status?

2. EUDAMED status that actually affects PSUR work

Article 86(2) still says that for class III devices or implantable devices, manufacturers shall submit PSURs by means of the electronic system referred to in Article 92 to the Notified Body involved in conformity assessment. That legal destination has not changed. What has changed in 2025–2026 is which EUDAMED modules are mandatory for day-to-day use.

Commission Decision (EU) 2025/2371 of 26 November 2025 declared the first four EUDAMED electronic systems functional. Under the transitional mechanism in Regulation (EU) 2024/1860, that notice started a six-month period. The Commission’s own announcement confirms that from 28 May 2026 the following modules are mandatory: Actor registration, UDI/Devices registration, Notified Bodies and Certificates, and Market Surveillance. See the Commission notice “The EUDAMED four first modules will be mandatory to use as from 28 May 2026” and the live status page EUDAMED overview.

For PSUR authors, the practical split is important. Actor registration gives the Single Registration Number that should appear consistently on PSURs, serious incident reports, and FSCAs. UDI/Device registration must align with the Basic UDI-DIs and models listed in the PSUR scope. Devices already on the market before mandatory use generally need registration within the transitional window described in Commission communications (commonly cited as 28 November 2026 for devices that continue to be placed on the market). None of that replaces the PSUR analysis itself.

The Commission’s published module timeline (November 2025) anticipates a later notice for the Vigilance module and mandatory use after a further six-month period. Treat that timeline as planning information from the Commission, and always re-check the official overview before changing your submission SOP.

3. What evidence is actually needed in practice

Article 86(1) is short and specific. Throughout the lifetime of the device, the PSUR must set out the conclusions of the benefit–risk determination; the main findings of the PMCF; and the volume of sales of the device and an estimate evaluation of the size and other characteristics of the population using the device and, where practicable, the usage frequency of the device. It must also summarise PMS analyses and explain preventive and corrective actions.

In review, device-specific vigilance and FSCA data with exposure denominators carry the most weight for benefit–risk shifts. PMCF outputs tied to open clinical questions are expected whenever a PMCF plan exists. Complaint trends only help when coded by safety or performance impact and expressed as rates. Sales and usage estimates are mandatory framing data, not optional context. Literature, state-of-the-art checks, and similar-device signals support whether the risk picture is still current. CAPA and design or labelling changes matter only where they have safety or performance impact. Raw complaint dumps and certificate copies do not substitute for analysis.

MDCG 2022-21 is explicit that the PSUR should be a stand-alone document that can be assessed independently from supporting documentation. It should provide a general overview of PMS activities and the data collected and analysed under the PMS plan. The aim is not to duplicate every PMS report, but to summarise results and conclusions. That is the difference between a decision record and a file dump.

4. When reduced analytical scope is defensible

You cannot waive Article 86 for class IIa to III. You can keep the analytical burden proportional if the report still answers the statutory questions.

Grouping several models in one PSUR is usually acceptable when they share intended purpose, technology, and risk profile, sit under the same Notified Body, and have a written grouping rationale with a clear leading device. It is usually rejected when the whole catalogue is forced into one file with no common risk profile. A short first data-collection period is acceptable because MDCG 2022-21 allows the first PSUR after certification to cover less than a full twelve or twenty-four months, provided later periods are contiguous. Permanent partial periods with gaps are not. “No additional dedicated PMCF study this cycle” can work when the PMCF plan already relies on general methods and the PSUR still records main findings. A blank PMCF section when a plan exists does not. “No change to benefit–risk” is acceptable only when supported by rates, PMCF, CAPA evaluation, and a state-of-the-art statement.

5. Legacy devices, existing data, and transition deadlines

MDCG 2022-21 applies to MDR-certified devices and to devices certified under the MDD or AIMDD, except devices that stopped being placed on the EU market before the MDR date of application. MDCG 2021-25 Rev.1 states that manufacturers of class IIa, IIb, and III legacy devices shall draw up and update PSURs, make them available outside EUDAMED to competent authorities on request, and make them available to Notified Bodies for surveillance.

For a new MDR-certified device, the data-collection period starts at the MDR certificate date. The first PSUR should be prepared within one year for class IIb and III, or within two years for class IIa. For a legacy device not yet MDR-certified, data collection starts at the MDR date of application, 26 May 2021. MDCG 2022-21 explains that “annually” and “every two years” for first legacy PSURs are understood in calendar-year terms after that date. When a legacy device becomes MDR-certified mid-cycle, follow the continuity rules in section 5 of MDCG 2022-21: align to the certificate anniversary or an agreed Notified Body schedule, and avoid gaps or overlaps.

Legacy transition deadlines for placing devices on the market are separate from PSUR frequency. Regulation (EU) 2023/607 extended Article 120 transitional provisions, subject to conditions including an MDR-compliant quality management system and a formal Notified Body application and written agreement by the dates set in that regulation. In broad terms, class III and certain class IIb implantable devices may be placed on the market under valid legacy certificates until 31 December 2027, and other class IIb, class IIa, and certain class I devices until 31 December 2028, if the statutory conditions are met. Those dates do not pause PSUR obligations. A legacy class IIb implantable still needs an annual PSUR while it remains on the market under the transition.

Use existing MDD PMS reports, complaint databases, PMCF and clinical evaluation updates, sales data, CAPA and FSCA files, and prior PSURs as inputs to appraise. Do not paste an MDD PMS report and call it an Article 86 PSUR. Re-analyse under MDR benefit–risk framing, code complaints by safety impact, compute rates, and extract only main PMCF findings for the cycle.

6. What the PSUR must look like to clear review

Process flow: Scope → Schedule → Sales / exposure → PMS analysis → PMCF → B/R conclusion → TD impact

Follow MDCG 2022-21 in substance even if your internal numbering differs. The report should read as a decision record for the cycle. Start with administrative identity: manufacturer, Single Registration Number where available, device identification including Basic UDI-DI and models, Notified Body, and the exact data-collection period. Add an executive summary that states the benefit–risk conclusion, critical PMCF findings, and significant actions. Describe devices in scope and any grouping justification with the leading device. Present sales volume, estimated user population, and usage frequency where practicable. Summarise PMS findings, serious incidents, FSCAs, and safety-relevant CAPA. Close with an explicit benefit–risk determination and a technical documentation impact line: change or no change to IFU, risk file, clinical evaluation, SSCP, and PMCF plan, with owners if updates are needed.

For class III and implantable MDR devices, submit to the Notified Body through the currently agreed electronic or portal channel until the Vigilance and PMS module is mandatory, then use EUDAMED as Article 86(2) intends. For class IIa and non-implantable IIb devices, keep the PSUR in the technical documentation under Annexes II and III and make it available to the Notified Body and competent authorities on request and during surveillance.

7. Grouping devices in one PSUR

Article 86 allows a PSUR for each device and, where relevant, for a category or group of devices. MDCG 2022-21 treats “device” as a device model associated with one Basic UDI-DI for MDR devices, including variants or sizes under that DI. Multiple Basic UDI-DIs may sit in one PSUR only if the manufacturer demonstrates relevance of the grouping.

Nominate a leading device. It determines the data-collection period, PSUR frequency, issuance timeline, and whether the EUDAMED submission path applies to the group. The leading device cannot be changed later; other devices may be added or removed with justification. Grouping is only possible for devices whose conformity assessment activities were carried out by the same Notified Body. When the Vigilance module is used, capture Basic UDI-DIs of class III or implantable members through the interface; list non-EUDAMED members in the body of the report as part of scope, as MDCG 2022-21 describes for mixed groups and legacy implantables.

8. Worked scenarios

9. Common review problems and fixes

A complaint list without analysis is not a summary of PMS conclusions; replace it with trends, rates, and a benefit–risk statement. Missing sales or population estimates leave Article 86(1) incomplete; report units sold and a user estimate for the same period. A missing PMCF section fails when PMCF applies; record main findings or a justified “not applicable this cycle” with a plan reference. Grouping without rationale looks like portfolio dumping; name the leading device and explain similarity. Overlapping or gapped periods break trend integrity; make periods contiguous end-to-start. “Safe and effective” alone is not a decision trail; state change or no change with evidence pointers. CAPA dumps add noise; keep only safety or performance-impact actions. When the PSUR, clinical evaluation, and SSCP tell different stories, add an explicit technical documentation impact line. Wrong submission path is a process finding: class III and implantables go to the Notified Body on the Article 86(2) route; other class IIa and non-implantable IIb stay in the technical documentation. Do not file solely to a future proposal such as COM(2025) 1023; use current Article 86 frequencies until any amendment is adopted and applicable.

10. Working approach

11. FAQ

12. Official sources

Primary texts and Commission-published guidance used in this article:

1. Regulation (EU) 2017/745 (MDR) — Articles 84–86, 92, 120; Annexes II and III

2. MDCG 2022-21 — Guidance on Periodic Safety Update Report (PSUR)

3. MDCG 2021-25 Rev.1 — Application of MDR requirements to legacy devices

4. Regulation (EU) 2023/607 — transitional provisions for certain devices

5. Regulation (EU) 2024/1860 — EUDAMED transitional mechanism and related amendments

6. Commission Decision (EU) 2025/2371 — functionality of the first four EUDAMED modules

7. Commission notice: EUDAMED four first modules mandatory from 28 May 2026

8. European Commission — EUDAMED overview and module status

9. MDCG 2025-10 — PMS context; points back to MDCG 2022-21 for PSUR detail