Manufacturers of class IIa, IIb and III devices must prepare a periodic safety update report (PSUR) under Article 86 of Regulation (EU) 2017/745 (MDR). It summarises the results and conclusions of the post-market surveillance data gathered under the post-market surveillance plan, and states whether anything has changed in the device’s benefit-risk profile. Class I devices need a post-market surveillance report instead, not a PSUR.
The reference guidance is MDCG 2022-21 (December 2022), which also gives a PSUR template and templates for presenting data. It covers devices under the MDR, including custom-made and Annex XVI products, and legacy devices still sold under the transitional provisions. It does not cover IVDs. The Medical Device Coordination Group added general guidance on post-market surveillance for devices and IVDs in December 2025 (MDCG 2025-10).
What the PSUR is for
Three jobs. It reports any change to the benefit-risk profile in the light of new information. It makes post-market data visible to the notified body and, for some devices, to competent authorities. And it records the corrective and preventive actions taken. When the benefit-risk profile moves the wrong way, the PSUR is where you show that you checked the device remains safe and performs as intended, and that the clinical evaluation and risk management were updated.
How often
Class IIb and class III: at least once a year. Class IIa: when necessary and at least every two years. The PSUR is part of the technical documentation.
How long
For the whole lifetime of the device. The obligation ends only when the last device of a model has been placed on the market and its intended lifetime has passed. MDCG 2022-21 gives examples: for an implant with a three-year shelf life and a ten-year lifetime, the PSUR continues for thirteen years after the last unit is placed on the market.
Grouping devices
A PSUR can cover one device (one Basic UDI-DI) or a justified group. A group has a leading device, the one of highest risk class, which sets the schedule for the whole group. Devices can be added to or removed from a group, but the leading device cannot change without a new PSUR. Grouping is only possible across devices assessed by the same notified body.
When data collection starts
For a device certified directly under the MDR, data collection starts at the certification date and the period ends on the certificate’s anniversary, unless agreed otherwise with the notified body. For a legacy device later certified under the MDR, the first MDR PSUR includes a summary of historical data, or picks up where the legacy PSUR’s data collection ended. For a legacy device still sold under the transitional provisions, the first data collection period started on 26 May 2021.
Where it goes
The MDR expects manufacturers of class III and implantable devices to submit their PSURs to the notified body through EUDAMED. For other class IIa and IIb devices, the PSUR is kept available to the notified body and, on request, to competent authorities.
Here is the part that has changed since the original article. Four EUDAMED modules became mandatory on 28 May 2026, but the module for vigilance and post-market surveillance is not one of them. PSURs therefore still cannot be submitted through EUDAMED as a legal requirement. Until that module is declared functional, agree the submission route with your notified body and follow any national provisions.
One knock-on effect: a manufacturer that does submit a PSUR through EUDAMED for a device already on the market must also register that device in EUDAMED, unless it is a device placed on the market under the old Directives.
What it means for your product
Check three things this quarter. That every class IIa, IIb and III device has a PSUR schedule tied to its certificate date. That any grouping is justified in writing and the leading device is the right one. And that the PSUR’s conclusions actually feed back into the clinical evaluation and the risk file; a PSUR nobody reads is the finding a notified body writes up most easily.
Post-market surveillance plans, PSUR templates and PMCF are part of our post-market work, and of the outsourced PRRC role: Post-market.
Related briefing: What does an EU Authorised Representative do, and how is a PRRC different?