How to Read a Periodic Safety Update Report

A periodic safety update report gets treated, in a lot of shops, as an annual compliance deliverable — gather the numbers, fill the template, file it before the deadline. Under EU MDR, a PSUR is also the document where a manufacturer has to say, in writing and on a schedule, whether the device’s benefit-risk balance still holds up against everything that happened since the last one. That second part is the one that gets shortchanged.

In brief

Article 86 requires manufacturers of Class IIa, IIb, and III devices to prepare a PSUR for each device — or, where it makes sense, each category or group of devices — summarizing the post-market surveillance data gathered under the PMS plan Article 84 requires, with a rationale for any preventive or corrective action taken.
A PSUR has to set out three specific things: the conclusions of the benefit-risk determination, the main findings of post-market clinical follow-up, and the device’s sales volume with an estimate of the population using it and, where practicable, how often. A report that only restates PMS data without reaching a benefit-risk conclusion hasn’t done what Article 86 asks.
Update frequency and audience both split by class. Class IIa manufacturers update the PSUR when necessary and at least every two years; Class IIb and III manufacturers update it at least annually. Class III and implantable device PSURs go to the notified body through EUDAMED, which reviews them and records its own assessment; Class IIa and non-implantable Class IIb PSURs are made available to the notified body and, on request, to competent authorities — not routinely submitted.
A PSUR isn’t the clinical evaluation report and isn’t the PMS report by itself. It’s the document that pulls data from both — plus sales and exposure numbers — into one periodic conclusion a reviewer can actually check the manufacturer’s reasoning against.

What the report has to conclude, not just contain

The part of a PSUR that gets shortchanged is the benefit-risk conclusion itself. It is tempting to treat the report as a container for data — complaint counts, PMCF findings, sales figures — and let the reader draw their own conclusion. Article 86 doesn’t ask for a container; it asks the manufacturer to state where the benefit-risk balance stands, now, given what the last reporting period added. That conclusion has to trace back to the same evidentiary base the clinical evaluation report built, which is why a PSUR written by someone who hasn’t actually read the CER tends to read like a status update instead of an argument. The PMCF findings aren’t a separate checkbox either — they're the mechanism by which the benefit-risk conclusion gets tested against real use, not just the evidence gathered before CE marking.

The class split changes who reads it, and when

Classification decides both the clock and the audience. A Class IIa PSUR only has to move when something warrants it, with two years as the outer bound; Class IIb and III PSURs are due at least annually regardless. The bigger operational difference is where the report goes: Class III and implantable devices route their PSUR to the notified body through EUDAMED for active review, consistent with the standing authority a notified body holds over a manufacturer’s file — the same authority behind its right to audit unannounced. Lower-risk classes keep the PSUR on hand and produce it on request instead. Neither path resembles FDA’s own periodic reporting mechanics — compare how an FDA postmarket surveillance order works — so a team running both systems can’t assume one calendar or one routing rule covers both.

Where this goes wrong

Treating the PSUR as a resubmission of the CER

A PSUR that restates the CER’s original benefit-risk conclusion without testing it against a reporting period’s worth of real PMS data isn’t doing what Article 86 asks for.

Assuming one routing rule covers every class

EUDAMED submission to the notified body applies to Class III and implantable devices. Class IIa and non-implantable Class IIb reports are made available on request, not routinely submitted the same way.

Letting an annual obligation run on autopilot

The interval is a floor, not a fixed schedule — a real new signal is supposed to trigger an update sooner than the calendar would, particularly for Class IIa’s “when necessary” standard.

A PSUR earns its name only when it functions as an update — synthesizing a reporting period’s worth of surveillance and clinical follow-up data into a benefit-risk conclusion that either still holds or doesn’t. A report that restates last year’s conclusion with this year’s numbers attached hasn’t done that work, whatever the notified body decides to do with it next.

Sources & further reading

EUR-Lex — Regulation (EU) 2017/745, Article 86 (periodic safety update report) eur-lex.europa.eu
Regulatory Academy — How to Read a Clinical Evaluation Report regulatoryacademy.com
Regulatory Academy — How to Work With a Notified Body Under EU MDR regulatoryacademy.com
Regulatory Academy — How to Read an FDA Postmarket Surveillance Order regulatoryacademy.com

This essay is provided for general educational purposes and reflects the regulatory landscape as of its publication date. It is not legal, regulatory, or career advice.