PSUR Under EU MDR Article 86: Complete Periodic Safety Update Report Guide with 2026 EUDAMED Requirements

The PSUR Is the Single Most Important Post-Market Document You Will Write

The Periodic Safety Update Report (PSUR) is the cornerstone of post-market compliance for every Class IIa, IIb, and III medical device sold in the European Union. Mandated by Article 86 of Regulation (EU) 2017/745 (MDR), the PSUR is not a formality or a box-ticking exercise — it is a living document that your Notified Body will scrutinize, that Competent Authorities can request at any time, and that must accurately reflect the real-world safety and performance of your device throughout its entire market lifetime.

Get the PSUR wrong, and you face certificate suspension. BSI has publicly stated that failure to submit a PSUR within 90 days of the data collection period end-date will trigger a reminder, followed by a further 30-day window, after which the certificate will be suspended and eventually cancelled. This is not theoretical — it is operational practice at major Notified Bodies as of 2026.

This guide covers every element of a compliant PSUR: the legal basis, frequency requirements by device class, the MDCG 2022-21 template structure, EUDAMED submission obligations (the four core modules become mandatory on 28 May 2026, with the Vigilance & PMS module — which is where PSURs are filed — expected to follow around Q2 2027), benefit-risk analysis methodology, PMS data integration, PMCF findings, legacy device considerations, and the European Commission's December 2025 simplification proposal that may reduce reporting frequency for certain classes.

PSUR vs. PMS Report: Which One Do You Need?

The MDR establishes two distinct post-market reporting obligations. Understanding the difference is fundamental:

If you manufacture Class I devices exclusively, you do not write a PSUR — you write a PMS Report. Everyone else reads on.

Legal Basis: Article 86 and Annex III

Article 86 — Key Provisions

Article 86 of the MDR establishes the PSUR obligation in four paragraphs:

1. Paragraph 1: Manufacturers of Class IIa, IIb, and III devices shall prepare a PSUR for each device (or category/group of devices) summarizing the results and conclusions of PMS data analyses, together with a rationale and description of any preventive and corrective actions taken. The PSUR must include:

   • (a) The conclusions of the benefit-risk determination
   • (b) The main findings of the PMCF
   • (c) The volume of sales of the device, an estimate of the size and characteristics of the population using the device, and where practicable, the usage frequency

2. Paragraph 2: Manufacturers of Class IIb and Class III devices shall update the PSUR at least annually. The PSUR shall be part of the technical documentation per Annexes II and III.

3. Paragraph 3: Manufacturers of Class IIa devices shall update the PSUR when necessary and at least every two years.

4. Paragraph 4: For Class III devices and Class IIb implantable devices, the PSUR shall be submitted to the Notified Body involved in the conformity assessment. For Class III devices and implantable devices, the PSUR shall be submitted via EUDAMED to the Notified Body. The Notified Body shall review the PSUR and provide its evaluation to the Competent Authority.

Annex III — Supporting Requirements

Annex III of the MDR specifies the technical documentation on post-market surveillance that feeds into the PSUR. It requires:

• A PMS plan proportionate to the risk class and appropriate for the type of device
• Proactive and systematic data collection from multiple sources
• Analysis of the collected data to identify needs for preventive, corrective, or FSCA actions
• Documentation of all actions taken and their outcomes

PSUR Frequency by Device Class

The update frequency is legally defined and varies by risk class:

When Does the Clock Start?

Per MDCG 2022-21, data collection for the PSUR should commence from the first Statement of Conformity (for MDR-certified devices) or the date of first placing on the market. For legacy devices under Regulation (EU) 2023/607, the first PSUR should cover the period from the Date of Application (May 26, 2021) and be issued within one year (Class IIb/III) or two years (Class IIa) following the first MDR conformity assessment statement.

MDCG 2022-21: The PSUR Template Walkthrough

The Medical Device Coordination Group published MDCG 2022-21 in December 2022, providing the definitive guidance on PSUR structure and content. It includes five annexes: a PSUR template, a template for presentation of data, guidance on presentation and assessment of collected PMS data, summary tables for PSUR requirements, and a PSUR web form for EUDAMED submission.

Recommended PSUR Structure

Following the MDCG 2022-21 template, a compliant PSUR should contain these sections:

Section 1: Identification and Administrative Data

• Device identification: product name, Basic UDI-DI, risk class, classification rule(s) applied
• Manufacturer name, SRN, and contact details
• Notified Body name and identification number
• PSUR reference number, version, and date
• Data collection period (start and end dates)
• Grouping rationale (if multiple devices are covered)

Section 2: Sales Volume and User Population

Per Article 86(1)(c), this section must include:

• Volume of sales by EU Member State and globally over time
• Estimated size of the patient/user population
• Characteristics of the population (age, sex, clinical condition where relevant)
• Usage frequency where practicable
• Method used for estimation (must be consistent across PSUR versions)

The sales data must cover all devices placed on the market — units sold, shipped, implanted, or any other suitable indicator. Accurate information is essential, and the methodology must remain consistent throughout the PSUR lifecycle.

Section 3: Post-Market Surveillance Data Analysis

This is the core analytical section. It must cover:

• Summary of serious incidents and FSCAs reported during the period (with cross-reference to vigilance reports)
• Analysis of non-serious incidents and complaints
• Trend reporting data (Article 88)
• Analysis of literature and published data
• Results from registries and databases (if applicable)
• Feedback from users, patients, and healthcare professionals
• Information from similar devices on the market (comparative analysis)

Section 4: Benefit-Risk Determination

Per Article 86(1)(a), the PSUR must include conclusions on the benefit-risk determination:

• Confirmation that the benefit-risk profile remains favorable, OR
• Updated benefit-risk assessment with justification for any changes
• Reference to clinical evaluation data and PMCF findings supporting the conclusion
• Comparison with the benefit-risk assessment in the original clinical evaluation

Section 5: PMCF Findings

Per Article 86(1)(b), the main findings of PMCF must be presented:

• Summary of PMCF activities conducted during the period (studies, surveys, registry data analyses, literature reviews)
• Key findings from each PMCF activity
• Conclusions from the PMCF Evaluation Report (when available)
• Whether PMCF findings confirm the clinical evidence or identify new risks
• Any updates to the PMCF plan as a result

Section 6: Preventive and Corrective Actions

• Description of all CAPAs initiated during the period
• Rationale for each action
• Status of implementation
• Effectiveness of previously implemented CAPAs
• Link to the CAPA log and risk management file

Section 7: Conclusions and Overall Assessment

• Summary statement on device safety and performance
• Confirmation that the device continues to meet the GSPR (Annex I)
• Whether any updates are needed to the IFU, labeling, or SSCP
• Whether any field safety corrective actions are warranted
• Recommendations for the next PSUR period

EUDAMED Submission: What Changes on May 28, 2026 — and What Does Not

Decision (EU) 2025/2371, published on 27 November 2025, confirmed the full functionality of four EUDAMED modules: Actor registration, UDI/Device registration, Notified Bodies & Certificates, and Market Surveillance. Under Regulation (EU) 2024/1860, this triggers a six-month countdown — mandatory use of those four modules begins on 28 May 2026.

Critically, the Vigilance & Post-Market Surveillance module (through which PSURs are submitted) is NOT among the four modules going mandatory on that date. According to the Commission's current roadmap, the full-functionality notice for the Vigilance & PMS module is expected in Q4 2026, with mandatory use approximately six months later (around Q2 2027). Until then, PSURs continue to be submitted directly to the Notified Body using each NB's own portal or procedure.

What IS Mandatory from 28 May 2026

• Actor Registration (SRN): Manufacturers, authorised representatives, and importers must be registered. Without an SRN, no EUDAMED activity is possible — including future PSUR submission once the Vigilance module goes live.
• UDI/Device Registration: New MDR/IVDR devices placed on the market from 28 May 2026 must be registered before first placement. Legacy and pre-existing MDR/IVDR devices must be registered by 28 November 2026 (six-month derogation).
• Notified Bodies & Certificates: NBs register new certificates from 28 May 2026; existing certificates must be loaded by 27 May 2027.

What is NOT Yet Mandatory

• PSUR submission via EUDAMED: Remains voluntary/early-adopter until the Vigilance & PMS module's mandatory date (expected Q2 2027). Some NBs (including BSI) already accept PSURs through EUDAMED as an option, but direct submission to the NB is still the standard route.
• Vigilance reports (MIRs, trend reports, FSCAs): Submitted via existing national systems or NB channels until the module goes mandatory.

The 90-Day PSUR Submission Discipline

Independently of the EUDAMED timeline, Notified Bodies already enforce operational PSUR submission deadlines. BSI's published practice requires:

1. Day 0: Data collection period ends
2. Day 90: PSUR submission deadline to the Notified Body
3. Day 91-120: Reminder issued; 30-day grace period
4. Day 121+: Certificate suspension proceedings initiated

This 90-day discipline applies whether you submit via EUDAMED or directly to the NB, and it is enforced now — manufacturers should not wait for the Vigilance module to become mandatory before embedding these timelines into their PMS SOPs.

Exceptions Where EUDAMED Activity Is Already Required

Even within the transitional derogations for UDI/Device registration (November 2026) and NB certificate upload (May 2027), vigilance activities trigger immediate EUDAMED registration. If a legacy device is subject to a serious incident, FSCA, trend report, or PSUR-related activity, the manufacturer cannot wait for the standard derogation window — registration must be completed at the time of the activity.

PSUR Data Sources and PMS Integration

The PSUR is only as good as the data feeding into it. Article 84 requires manufacturers to establish a PMS plan that proactively and systematically collects data from the following sources:

PSUR for Legacy Devices

Legacy devices — those certified under the MDD/AIMDD and still on the market under transitional provisions per Regulation (EU) 2023/607 — have specific PSUR requirements:

Per MDCG 2022-21, manufacturers of legacy devices should NOT submit MDD/AIMDD-era PSURs to their Notified Body unless specifically requested. The PSUR must follow the MDCG 2022-21 template structure.

The 2025 Simplification Proposal: What May Change

On December 16, 2025, the European Commission published COM(2025)1023, a 170-page proposal for targeted amendments to the MDR and IVDR. This proposal is currently under legislative review by the European Parliament and Council, with full adoption expected no earlier than 2027-2028.

Proposed PSUR Changes

If adopted as proposed, the PSUR update frequency would change:

The proposal would also expand the serious incident reporting timeline from 15 days to 30 days for incidents not related to public health threats, death, or serious deterioration of health.

Important: These changes have NOT been adopted. Current PSUR frequencies under Article 86 remain in force. Manufacturers should monitor this proposal closely but continue complying with existing requirements.

Grouping Devices in a Single PSUR

MDCG 2022-21 allows manufacturers to group multiple devices in a single PSUR under certain conditions:

• Same Basic UDI-DI family: Devices sharing a Basic UDI-DI can be grouped
• Same risk class: All devices in the group must be in the same risk class
• Same conformity assessment: Conformity assessment activities must have been carried out by the same Notified Body
• Justification required: The manufacturer must provide a rationale for the grouping
• Custom-made devices: May cover entire groups or families (e.g., hips, knees, shoulders)

When a device or leading device is on the market with subsequent certificates from different Notified Bodies, the revision history must reference previous PSUR versions and indicate actions required or taken by former Notified Bodies.

Common PSUR Mistakes and How to Avoid Them

Comparison: PSUR Under MDR vs. IVDR

PSUR and the Broader PMS Ecosystem

The PSUR does not exist in isolation. It connects to multiple regulatory processes:

PMS Plan (Art. 84)
    |
    ├── Data Collection (complaints, vigilance, literature, PMCF, registries)
    |
    ├── Data Analysis
    |       |
    |       ├── Trend Reporting (Art. 88)
    |       ├── Vigilance Reporting (Arts. 87-89)
    |       └── CAPA Process
    |
    ├── PMS Report (Art. 85) — Class I only
    |
    └── PSUR (Art. 86) — Class IIa, IIb, III
            |
            ├── Benefit-Risk Determination → Clinical Evaluation Update
            ├── PMCF Findings → PMCF Plan Update
            └── SSCP Update (if Class III or implantable) → EUDAMED

Frequently Asked Questions

What is the difference between a PMS Report and a PSUR?

A PMS Report (Article 85) is required for Class I devices and summarizes PMS data and actions. A PSUR (Article 86) is required for Class IIa, IIb, and III devices and additionally includes benefit-risk analysis, sales volume data, user population estimates, and PMCF findings. PSURs for Class IIb and III must be submitted to the Notified Body, while PMS Reports are available to competent authorities on request.

How often must I update the PSUR?

Class IIa devices require PSUR updates when necessary and at least every two years. Class IIb and Class III devices require annual updates at minimum. Class III and implantable devices must be submitted via EUDAMED to the Notified Body. The data collection period should be contiguous — if one period ends on June 30, the next begins on July 1.

Can I group multiple devices in one PSUR?

Yes, provided the devices share the same Basic UDI-DI, are in the same risk class, were assessed by the same Notified Body, and you provide a documented justification for the grouping. Custom-made devices may cover entire groups or families (e.g., all hip implant variants).

What happens if I miss the PSUR submission deadline to my Notified Body?

Notified Bodies enforce a 90-day submission window after the data collection period ends. If you miss this, you receive a reminder with a further 30-day grace period. After Day 120, certificate suspension proceedings begin. This is operational practice at BSI and other major Notified Bodies as of 2026, and it applies whether you submit through EUDAMED (where available) or directly to the NB. Note that mandatory EUDAMED-based PSUR submission is not yet in force — the Vigilance & PMS module is expected to go mandatory around Q2 2027.

Do legacy devices under MDD certificates need a PSUR?

Yes. All legacy devices covered by Regulation (EU) 2023/607 transitional provisions must have PSURs in accordance with Article 86. The first PSUR should have been issued within one year (Class IIb/III) or two years (Class IIa) of the MDR Date of Application. Do not submit MDD-era PSURs to your Notified Body — follow the MDCG 2022-21 template.

Will the proposed MDR simplification reduce PSUR frequency?

The December 2025 proposal (COM(2025)1023) suggests reducing Class IIb and III PSUR frequency to once in the first year after certification, then every two years. However, this has NOT been adopted yet. The proposal is under legislative review with adoption expected no earlier than 2027-2028. Current Article 86 frequencies remain in force.

What PMCF information must be in the PSUR?

The PSUR must include a summary of all specific PMCF activities performed during the period, not limited to formal PMCF studies. This includes literature reviews, surveys, registry analyses, and any other PMCF data collection. When available, reference the conclusions documented in the PMCF Evaluation Report.

Does the PSUR need to be translated?

The PSUR is part of the technical documentation and is submitted to the Notified Body, typically in English. However, if a Competent Authority requests the PSUR, it may need to be provided in the official language of that Member State. Check your Notified Body's specific language requirements.

What is the relationship between the PSUR and the SSCP?

For Class III and implantable devices, the PSUR feeds directly into the Summary of Safety and Clinical Performance (SSCP, Article 32). If PSUR data reveals new safety information, changes to the benefit-risk profile, or updated clinical evidence, the SSCP must be revised accordingly and resubmitted via EUDAMED for Notified Body validation.

When should data collection for the first PSUR start?

For MDR-certified devices, data collection starts from the date of the first Statement of Conformity or the date the device is first placed on the EU market. For legacy devices, data collection is from the MDR Date of Application (May 26, 2021). The data collection start date may be adjusted by agreement between the manufacturer and Notified Body, with justification in the first PSUR.