For many medical device companies, getting a CE mark under the EU Medical Device Regulation (MDR, Regulation (EU) 2017/745) feels like the finish line. Under the MDR, it is closer to the starting line. The regulation places far more emphasis than the old Medical Device Directives on what happens after a device reaches the market: monitoring its performance, collecting clinical data and reporting problems.
This guide explains how post-market obligations fit into MDR compliance, then looks closely at two areas manufacturers often underestimate: post-market surveillance (PMS) and post-market clinical follow-up (PMCF). It also covers the post-market role of importers and answers common questions.
Who Do These Obligations Apply To?
The MDR applies to any medical device placed on the EU market, whether the manufacturer is based in the EU or not. That includes manufacturers in South Africa and elsewhere who want to sell into Europe.
Manufacturers carry primary responsibility for clinical evidence and post-market activities. Non-EU manufacturers must appoint an authorised representative, importers have obligations of their own, and product and regulatory teams need to keep documentation current as the device evolves.
How Post-Market Activity Fits Into the Compliance Journey
Most MDR projects move from a gap assessment through regulatory planning, technical documentation and clinical evaluation, with Notified Body involvement for higher-risk devices. Our guide to EU MDR compliance for small medical device companies walks through that roadmap in detail. What matters here is how those stages connect to life after certification:
- Clinical evaluation is an ongoing process. It must demonstrate safety, performance and a favourable benefit-risk profile, and it must be updated throughout the device’s lifecycle as new clinical and post-market data become available.
- Technical documentation must look ahead. It should account for how post-market data will be collected, evaluated and incorporated into the device’s documentation over time.
- Planning should include post-market activities from day one. Manufacturers should consider how evidence will be kept current throughout the device’s lifecycle.
PMS and PMCF are central to this ongoing process, providing the evidence manufacturers need to monitor real-world performance and keep their clinical evaluation and risk management current.
Post-Market Surveillance (PMS): What the MDR Requires
Under the MDR, every manufacturer must establish a proactive PMS system that is proportionate to the device’s risk class and appropriate for the type of device. It is not enough to wait for complaints. You are expected to actively gather and analyse data on how the device performs in real-world use.
A PMS system generally includes:
- A PMS plan, set out in the technical documentation, describing how data will be collected and analysed.
- Data sources such as complaints, service records, user feedback, vigilance data, literature and information on similar devices.
- Reporting outputs. Class I devices require a PMS report. Class IIa, IIb and III devices require a Periodic Safety Update Report (PSUR), updated at least annually for Class IIb and III and at least every two years for Class IIa.
- Vigilance. Serious incidents must be reported to the relevant authorities within strict timeframes, which are shorter where there is a serious public health threat.
- Corrective actions. Findings must feed back into risk management, design changes and, where needed, field safety corrective actions.
The key point is that PMS is a continuous cycle, not a one-off document.
Post-Market Clinical Follow-Up (PMCF)
PMCF is the part of PMS that focuses on clinical data. Its purpose is to confirm the device’s safety and performance over its lifetime, identify emerging risks and check that the benefit-risk profile remains acceptable.
A PMCF plan can draw on several methods, including:
- Registries and real-world data collection.
- PMCF studies.
- User surveys and structured feedback.
- Review of relevant scientific literature and other appropriate clinical data.
The results are summarised in a PMCF evaluation report, which feeds directly back into the clinical evaluation. If a manufacturer decides PMCF is not appropriate for a particular device, that decision must be clearly justified in the documentation. Notified Bodies expect a rationale, not silence.
A common mistake is treating PMCF as an afterthought. Building it into your clinical evaluation plan from the start saves a great deal of rework when the Notified Body asks how you will keep your evidence current.
The Importer’s Role After Market Entry
Importers carry obligations that continue well after a device is on the market. They must:
- Keep a register of complaints, non-conforming devices, recalls and withdrawals. These records can provide valuable input into the manufacturer’s PMS activities.
- Store and transport devices under suitable conditions.
- Cooperate with manufacturers and authorities on corrective actions.
If an importer believes a device does not comply, they must not place it on the market. For the checks required before a device is placed on the market, including CE marking, the declaration of conformity, labelling and the authorised representative, see our guide for small medical device companies.
Frequently Asked Questions
How long does MDR compliance take?
It depends on the device class, the quality of your existing documentation and Notified Body availability. Certification, including Notified Body review, often takes a year or more, and higher-risk devices take longer. Preparatory work such as a gap assessment and documentation review can move much faster, and starting there gives you a realistic timeline for your specific device.
What is the difference between MDR and IVDR?
The MDR (Regulation (EU) 2017/745) covers medical devices. The IVDR (Regulation (EU) 2017/746) covers in vitro diagnostic devices, such as tests used on samples taken from the human body. They share a similar philosophy of stronger clinical evidence, tighter oversight and more post-market activity, but they use different classification rules and have different transition timelines. If your product is a diagnostic test, the IVDR is the regulation that applies.
Do small companies need to comply too?
Yes. The MDR applies regardless of company size. Smaller manufacturers are subject to the same applicable regulatory requirements, although the scale and complexity of their compliance activities will depend on factors such as the device, its classification and associated risks.
Does a CE mark under the old Directives still count?
Eligible legacy devices certified under the previous Directives may continue to benefit from the MDR’s extended transitional arrangements, provided the applicable conditions are met. For certain Class III and Class IIb implantable devices, the transition period runs until 31 December 2027. For eligible other Class IIb and Class IIa devices, as well as certain Class I devices requiring Notified Body involvement under the MDR, the transition period runs until 31 December 2028.
These extensions are subject to specific conditions and earlier transition deadlines, so manufacturers should confirm the transitional status of their particular device rather than assuming an existing certificate remains sufficient.
Vesta Consulting supports manufacturers, importers and product teams with gap assessments, technical documentation review, clinical evaluation, regulatory planning and post-market compliance. If you are preparing for the EU market, or want to check that your PMS and PMCF processes will stand up to scrutiny, explore our EU MDR compliance services or get in touch to discuss your device.
Key references
– Regulation (EU) 2017/745 of the European Parliament and of the Council on medical devices
– Regulation (EU) 2023/607 amending the MDR transitional provisions
– ISO 14971:2019: Medical devices, Application of risk management
– MDCG 2020-7: Guidance on PMCF plan template
– MDCG 2020-8: Guidance on PMCF evaluation report template
– MDCG 2022-21: Guidance on periodic safety update report (PSUR) under Regulation (EU) 2017/745
– EUDAMED: ec.europa.eu/tools/eudamed
Tesha Hiralal is the founder of Vesta Consulting and a BSI-certified ISO 13485 Lead Auditor (CQI/IRCA). She holds an MSc in Regulatory Affairs and a B.Pharm (Hons), and is a former SAHPRA Medicines Control Officer and Inspector.
