MDCG 2025-10: Post-market surveillance of devices and IVDs, explained
The MDCG's first dedicated guidance on the post-market surveillance system: what your PMS plan must contain, which data sources count, and how PMS feeds risk management and clinical evaluation.
MDCG 2025-10 is the MDCG's first dedicated guidance on the post-market surveillance system the MDR and IVDR require from every manufacturer. It explains what belongs in a PMS plan, what "proactive" data collection actually means, and how PMS output must flow back into your risk management, clinical evaluation, and technical documentation. It deliberately does not cover PSUR writing — that stays with MDCG 2022-21.
Who this applies to
Everyone. The PMS obligations in MDR Article 83 (and IVDR Article 78) apply to all devices and all IVDs, from class I to class III — including custom-made devices, which get their own section in the guidance. What scales with risk class is not whether you do PMS, but how much: the system must be "proportionate to the risk class and appropriate for the type of device", and the output document differs — a PMS report for class I devices (class A/B IVDs), a PSUR for everything else.
What the guidance covers
The document walks through the PMS system as an integral part of your QMS: the PMS plan (Annex III of both regulations), the main activities of the PMS cycle — determining data sources, collecting data, assessing it, and drawing conclusions — and how PMS interacts with the rest of your QMS. Its Annex 1 tabulates every PMS obligation in the MDR and IVDR side by side; Annex 2 gives worked scenarios showing how PMS data updates other processes.
Two things are explicitly out of scope: how to write a PSUR or PMS report (that remains MDCG 2022-21 territory), and PMS for in-house devices under the health institution exemption (MDCG 2023-1).
The PMS plan
Every device must be covered by a PMS plan; one plan may cover a device family sharing design, manufacturing process, and intended purpose, as long as the plan states which devices it covers. Following Annex III section 1(b), the plan must specify what is monitored, how often, and by which methods — with the rationale for choosing those methods documented and proportionate to the device's risk profile. It must include, among other elements:
The plan must define
In practice
A proactive, systematic data collection process — including data on similar products
Surveys, literature screening, registries, user feedback — deliberately planned, not just waiting for complaints
Methods and thresholds for assessing the data
Indicators and threshold values tied back to your risk management, so PMS data re-evaluates the benefit-risk determination
Methods and protocols for trend reporting
How you detect a statistically significant increase in the frequency or severity of non-serious incidents (Article 88 MDR)
Communication protocols
How you inform competent authorities, notified bodies, economic operators, and users
Criteria and procedures for corrective action
What triggers a CAPA or field safety corrective action, and who owns it
A PMCF/PMPF plan — or a justification why none is needed
The template lives in MDCG 2020-7; "not applicable" requires reasoning
"Proactive" is the concept the guidance leans on hardest: waiting for complaints to arrive is explicitly not enough. Manufacturers must actively seek out post-market information, and the guidance warns against over-reacting to unverifiable sources such as social media — data quality comes before analysis.
How PMS connects to the rest of your QMS
PMS is not a standalone reporting exercise. The guidance dedicates a full section to the feedback loops: PMS data must update your risk assessment and clinical/performance evaluation, trigger preventive and corrective actions, feed the SSCP, and land in the technical documentation. PMS effectiveness should also reach top management — the guidance names management review as the vehicle.
What this means for you, practically
Write the PMS plan during development, not after launch. The guidance is explicit that PMS planning starts before the first device ships, and the first PMS cycle begins at first placing on the market.
Name your data sources and defend the selection. For each source, know who provides it, how often you check it, and why it fits your device — "we review complaints" is one row of the table, not the whole plan.
Tie thresholds to risk management. Every indicator in the PMS plan should map to a hazard or risk-acceptability criterion, so crossing a threshold has an obvious consequence.
Close the loop in writing. When PMS data changes the risk analysis, the clinical evaluation, or the IFU, record that chain — the interactions section of this guidance is what auditors will use as their checklist.