The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024: guidance on implementation
Published 15 January 2025
Applies to England, Scotland and Wales
A. Introduction and scope (Regulation 44ZD)
The new set of regulations The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024 amends the UK Medical Devices Regulations (MDR) 2002 by inserting a new Part 4A on post-market surveillance (PMS) requirements for medical devices, including in vitro diagnostic (IVD) devices and active implantable medical devices which apply within Great Britain (GB). It includes notification requirements for incidents, and preventive and corrective actions taking place after the device is first approved for the GB market.
This document provides guidance on the interpretation of certain requirements in this Statutory Instrument (SI) 2024 No. 1368. It is not intended to address every requirement. This document is meant for guidance only, you should refer to the SI for the authoritative position, seeking professional advice where required.
This table sets out the important changes introduced upon commencement of the SI.
Medical devices may currently be placed on the market or put into service subject to Parts II (general medical devices), III (active implantable medical devices) or IV (in vitro diagnostic (IVD) devices) of the UK MDR 2002. The MHRA has published guidance for manufacturers on the different options for conformity assessment.
The PMS requirements differ dependent upon the basis for the chosen conformity assessment. Only certain requirements apply to custom-made devices in GB. The table of PMS obligations by medical device type provides an illustration of which requirements apply.
These requirements do not apply to devices subject to clinical investigation, performance evaluation or exceptional use authorisation in GB. They also do not apply to medical devices manufactured in house by healthcare establishments (regardless whether custom-made). These should follow the existing guidance for healthcare establishments that manufacture medical devices in-house on the MHRA website.
These requirements do not apply if a manufacturer no longer places any further individual devices of a device model on the GB market or puts them into service after 16 June 2025, the date on which this SI comes into force (that is, they are discontinued prior to commencement).
Discontinued devices remain subject to the prior PMS requirements set out in the relevant legislation, and detailed in these MEDDEV Vigilance Guidance documents, under 2.12 Post Market Surveillance. However, if any individual devices are placed on the GB market after 16 June 2025, all applicable requirements must be fulfilled. Manufacturers may find it more straightforward to operate a single PMS system for all their devices. As the new PMS requirements are generally more stringent than before, meeting these is expected to fulfil prior requirements, although each manufacturer should check this is the case for their medical devices.
Different requirements apply to the European Union (EU) defined ‘legacy devices’ placed on the market or put into service in Northern Ireland.
Northern Ireland
The Regulations apply to Great Britain (England, Wales and Scotland). Medical devices placed on the market or put into service in Northern Ireland (NI) must follow the post market surveillance rules set out in EU MDR 2017/745 and EU IVDR 2017/746 as explained by guidance documents issues by the Medical Device Coordination Group (MDCG).
B. Clarification of important terms (Regulation 44ZC)
The terms lifetime and PMS period have been defined to ensure post market surveillance (PMS) feedback continues to be gathered by the manufacturer until the end of the period during which the manufacturer has validated that the device will continue to perform as intended.
a) Lifetime of a device
The device lifetime runs from the time of manufacture/production date to the end of the period the manufacturer has validated the device will perform as intended, sometimes referred to as the expected service life (validated use duration - see Figure 1). This includes the device shelf life, if it has one.
b) Post market surveillance period
The regulation defines this as:
-
beginning with the day on which the first device of a device model is put into service by the manufacturer or placed on the market, whichever is sooner, and
-
ending with the end of the lifetime of the last device of that device model that is put into service by the manufacturer or placed on the market, whichever is later
It is important to recognise that many medical devices continue to be used beyond the device lifetime. The MHRA encourages manufacturers to continue to gather PMS data beyond the device lifetime, throughout the device’s potential lifespan when it is reasonable and realistic to expect it may remain in use. Manufacturers should use their real-world experience of the types of devices they manufacture to determine the longest reasonably foreseeable period of use.
Examples include:
-
An implant may reasonably be tested and validated to continue to perform as intended for 10 years, whereas management of clinical risks supports leaving the implant in place until it begins to show signs of failure. Gathering PMS information throughout the time the implant remains in use helps develop understanding of the implant’s long-term clinical functionality and ensures any unexpected late risks are picked up as quickly as possible
-
Large imaging systems installed in healthcare settings may in practice continue to be used for economic and practical reasons beyond the period of use for which they have been validated. Furthermore, maintenance and replacement of components can extend the life of the device. If safety or performance issues come to light from extended usage of such a system, information would need to be shared with other users to help avoid serious impact on patient care
-
A wheelchair or mobility scooter is typically used until it can no longer function or be repaired, especially in home setting. They may also be sold on second hand a number of times
-
Laboratory analytical instrumentation (for use as IVD) is often used beyond its lifetime provided it is properly maintained and regularly calibrated
This means the window of opportunity during which a manufacturer should ensure PMS data is gathered for any one device type or model runs from when the first is available for use, to the end of the lifespan when the last of these devices could reasonably remain in use.
Figure 1. Lifetime of a device
c) Serious incident and serious public health threat
A serious incident is one that must be reported to the MHRA under the vigilance system.
Assessment or reportability therefore requires an understanding both of what constitutes an incident with a medical device, and when it becomes serious.
Incident
An incident has occurred with a medical device in any one or more of the following circumstances:
-
the device malfunctions or deteriorates in characteristics or performance in any way (when used as intended)
-
if used for diagnosis, the device provides incorrect or inaccurate results that then support a clinical decision (including by the patient for self-testing devices)
-
identification of any shortcomings related to the device design or difficulty in using the device safely, which may give rise to use errors - this includes any inadequacies in information or instructions provided, as these are considered an integral part of the device
-
use of the device gives rise to a side effect that has a negative impact on the health of the patient, or their care, or on wider public health
Examples of incorrect, inaccurate or inadequate results include false positive or false negative results, erroneous results, and inadequate quality controls or calibration.
Side effects which are known and may be documented in the device’s technical information are still reportable if they meet the criteria for being serious as defined below.
Serious incident
An incident is serious if it directly, or indirectly, for example for diagnostic devices (see Guidance on In vitro diagnostic (IVD) devices, and DSVG blood glucose meters or guidance on software as a medical device) led to, or could have led under different circumstances to:
-
death (of anyone), or
-
serious deterioration in state of health for anyone
Serious deterioration in health
There are a number of circumstances which are covered by this term:
-
life-threatening illness or injury
-
permanent impairment of a body structure or a body function
-
hospitalisation or prolongation of hospitalisation
-
medical treatment, including surgical intervention and self-administered treatment, is required to prevent a or b
-
chronic disease
-
foetal distress, foetal death or a congenital physical or mental impairment or birth defect
Serious public health threat
If the risk of death or serious deterioration in health could affect a large number of people and needs urgent action to address the risks, this is known as a serious public health threat.
Other incidents
Incidents which are not considered serious are not reportable individually to MHRA. However, they must be assessed and documented within the manufacturer’s PMS system, reported to MHRA in accordance with the Trend reporting requirements, and reviewed within the Post Market Surveillance Report (PMSR) or Periodic Safety Update Report (PSUR).
Important changes introduced with implementation of SI:
-
definition of the post-market surveillance period
-
definition of the reportable side effects
-
clarification that interventions to prevent serious deterioration in health include self-administered treatment
C. Requirements of the manufacturers PMS system (Regulations 44ZE, 44ZF, 44ZG, 44ZL, 44ZM and 44ZQ)
These new regulations require manufacturers to have a process in place for gathering and analysing feedback and complaints, and to ensure their devices continue to meet appropriate standards of safety and performance.
Manufacturers must use PMS data as one of many sources of input to their risk management process, and to update the technical documentation for UKCA marked devices. Similarly, the output from the device technical documentation, including risk management, provides input to develop the PMS plan. The MHRA expects manufacturers to apply the same principles to update technical documentation for CE-marked devices placed on the GB market, although this cannot be mandated under regulation 44ZE(5).
This regulation requires manufacturers to continually gather information on the performance and safety of their device throughout the PMS period. The manufacturer must determine the device lifetime in order to specify the PMS period in their PMS plan
Manufacturers should not stop undertaking PMS at the end of the PMS period because new safety or performance issues can continue to arise at any point the device potentially remains in use. Knowledge of these issues provides real-world data that can help protect future device users by enabling manufacturers or regulators to provide advice or take actions to reduce these device-related risks. As the MHRA develop the future medical devices regime, we will consider further consultation on the expansion of these requirements commensurate with device risk.
The MHRA recognises that that the manufacturer can only validate the performance and safety of their device for the specified device lifetime. The purpose of extending post market surveillance is to gain important insight into device performance beyond the known and characterised period, which could be used to enhance patient safety.
The manufacturer must define their PMS system within a PMS plan, and the plan should be proportionate to the risk posed by the device. Information is available in the section on PSUR on the broad range of activities and data sources from which a manufacturer can obtain feedback on their medical devices.
As a minimum the plan must specify the manufacturer’s:
-
objectives of the PMS system
-
processes to gather information (ensuring comprehensive real-world data obtained)
-
methods of data analysis
-
fulfilment of their vigilance reporting obligations
-
links to preventive and corrective action as part of a risk management process
In the case of system or procedure packs, the manufacturer placing these on the market or putting them into service should ensure they focus on gathering and analysing PMS information relating to the safety and performance of the combined use of the devices in the pack. All PMS requirements apply to those manufacturers assembling the packs with the exception of PMSR or PSUR obligations under certain circumstances. See Reporting against the PMS Plan (Regulation 44ZL or 44ZM) for further information.
The manufacturer must review action taken according to the PMS plan at regular intervals. They must document the review within a PMSR or PSUR as appropriate.
The UK responsible person (UKRP) must ensure they immediately inform the manufacturer of any complaints or reports they receive relating to medical device for which they have been appointed.
See Figure 2 for PMS System and notification requirements.
Refer to the latest version of PD CEN ISO/TR 20416:2020 ‘Medical Devices. Post-market surveillance for manufacturers’ for further guidance on the PMS process. for further guidance on the PMS process.
Although the minimum document retention period is 15 years for implantable devices, and 10 years for all other devices, all documentation relating to PMS must be retained to the end of the entire PMS period if this exceeds these times (44ZQ).
Important changes introduced with implementation of SI:
- requirement for a PMS plan is now mandatory in the regulations
Figure2. Manufacturer’s PMS system
a). PMS plan (Regulation 44ZF)
Full details of what must be covered in the PMS plan are set out in regulation 44ZF of the Regulations. Clarification of certain aspects only is provided below.
i. Feedback from users including patient and public engagement (Regulation 44ZF(3)(a)(v))
Manufacturers should seek feedback from different user groups, including healthcare professionals and patients where relevant. It’s very important to gain information on device safety and performance directly from patients and the public where appropriate to ensure their views and experiences are captured.
This includes obtaining feedback on usability of the device, and adequacy of the instructions for use which are provided. Manufacturers need to assess and document the extent to which this is relevant and achievable dependent upon the particular device type. Although not limited to these devices, this is particularly important for devices used by patients or members of the public with limited or no involvement from healthcare professionals. The manufacturer should consider the most suitable and achievable ways to capture this information and the necessary frequency of this activity, facilitating feedback in the least burdensome way for users, dependent upon the type of device and its circumstances of use (for example, over the counter devices, devices used at home and/or by vulnerable populations).
For further information and advice on undertaking patient and public engagement, see the documents listed below which share ideas on transferable concepts to support these activities:
ii. Safety information on similar devices (Regulation 44ZF(3)(a)(vi))
Timely and effective signal detection relies on manufacturers reviewing global data on device performance and safety. Safety issues arising with one type or model of device may have serious implications for the safety of similar devices.
Similar devices
The regulation explains that similar devices are those based on the same or similar technology and with the same or similar intended purpose.
The manufacturer’s PMS system must therefore include the collection of data on the performance of their device across all markets, and of publicly available information on the safety of competitors’ devices which may have an impact on their own.
Where there are many similar devices on the market, the manufacturer’s device should be compared to devices that not only have the same intended purpose but also the same intended use environment. For example, pregnancy tests are used both within and outside healthcare settings and those for professional use should also be considered relative to their intended purpose and context (for example, emergency department, pre-operative assessments).
Important changes introduced with implementation of SI:
- clarification that feedback should include patient and public engagement
b). Preventive and corrective action (Regulation 44ZG)
One important objective of the PMS process is to ensure that the manufacturer identifies the need for and undertakes timely preventive and corrective action whenever necessary to protect the safety of those affected by the use of their medical devices. The findings from the PMS of one type or model of device may have implications for the safety and performance of other device types or models which share common characteristics.
Manufacturers must perform effective and continuous risk management for their devices, which may be through adherence to the latest version of the Risk Management Standard, ISO 14971: Medical devices — Application of risk management to medical devices. Risk management includes the requirement to identify and reduce safety risks as far as possible, and covers all safety risks, not only those which present a risk of a serious incident.
Before completion of the manufacturing process, manufacturers must:
-
take preventive action to reduce risks that could arise when the device is used, or
-
remove the cause of any non-conformities with the essential requirements
This includes a vast range of measures including, but not limited to, device manufacturing process corrections, improvements, or design changes.
Similarly, manufacturers must undertake corrective action to mitigate these safety or conformity issues among devices after they have been manufactured. This applies to devices stored within the manufacturer’s control (for example, in a warehouse) as well as those which have already been distributed outside the manufacturer’s control.
Corrective action to address a risk of a serious incident affecting devices outside the manufacturer’s control (that is, within the field) is known as field safety corrective action (FSCA). The section on FSCA explains that these can include a wide range of actions, in addition to device recall or withdrawal from the market.
If all the following criteria apply, then the corrective action constitutes FSCA:
-
field: devices have already been made available for use (for example, entered the distribution chain to a separate distributor, importer, retailer, hospital, or provided directly to the end user
-
safety: there is a risk of death or serious deterioration in health
-
corrective action: any action taken to reduce or mitigate this risk for the devices
The UK-based manufacturer or the UKRP must co-operate with the MHRA on any preventive or corrective action taken to reduce risks posed by medical devices.
Manufacturer’s notification requirements
To UK responsible persons (UKRP) and UK approved bodies (UKAB)
Manufacturers must inform their UKRP and/or their UKAB (where they have them) of all preventive and corrective actions taken after device certification for the GB market to address a risk or non-conformity compromising the performance or safety of the device, regardless of how the risk was identified (regulation 44ZG(2)). This enables the UKAB to assess whether there is an impact of the device certification they have issued (regulation 44ZG(3)).
The process for provision of this information should be agreed between the manufacturer and their UKAB (as part of the ongoing UKAB surveillance process), or with their UKRP as applicable. There is flexibility to determine the most effective and practical way to do so, and the PMSR or PSUR may provide a useful tool for this purpose. The MHRA recommends that the manufacturer informs their UKRP immediately if their AB cancels or suspends their device certification.
Where a manufacturer undertakes FSCA they should ensure both the UKAB and UKRP are aware in advance of initiating the action (44ZJ)
To the MHRA
Manufacturers must inform the MHRA of FSCA undertaken as part of their corrective action (see section D).
Important changes introduced with implementation of SI:
-
requirement to inform the UKRP and UKAB (where you have one) of all preventive and corrective actions taken to address a risk or non-conformity compromising the performance or safety of the device
-
UKAB to review CAPA for impact on certification
c). Reporting against the PMS plan (Regulation 44ZL or 44ZM)
The manufacturer must produce:
-
post market surveillance reports (PMSR) for:
-
devices falling under Class I
-
in vitro diagnostic devices falling under class A or B, or non-Annex II (that is, not list A or B per IVD)
-
-
periodic safety update reports (PSUR) for:
-
medical devices falling under Class II or III or
-
in vitro diagnostic devices falling under class C or D, or Annex II list A or B
-
The requirement to do so applies from the date of certification for the GB market, or date of declaration of conformity, throughout the PMS period, even in circumstances where the device certification has expired, or the device has been discontinued.
Regulation 44ZD - these reports are not required for custom-made devices. They are also not required for system or procedure packs which are not to be UKCA or CE-marked when placed on the GB market or made available for use.
The PMSR or PSUR requirements (Regulations 44ZL and 44ZM) apply to system or procedure packs which contain a medical device which does not bear a UKCA or CE-mark or where the chosen combination of medical devices is not compatible with their approved intended use. These system or procedure packs shall be classified in line with accepted classification guidance, and the PMSR/PSUR requirements apply accordingly. Specifically, this should be determined by the intended use of the pack, but if in doubt it should align with the highest classified device in the pack where applicable, taking into account the new intended use of the device.
The report should provide a comprehensive and critical analysis of the risk-benefit balance of the device, in the context of cumulative information. It should be a standalone and searchable document in the technical documentation on PMS drawn up by the manufacturer, but which can be assessed independently.
As a minimum, these reports must include a summary of the analysis and conclusions from review of the PMS data gathered since the last report, in accordance with the PMS plan. Manufacturers must provide details of any preventive or corrective action taken since the last report, with potential impact on devices safety, performance and quality, including any FSCA, and why such action was taken. If the first individual device was placed on the market or put into service after the DOA, the first report should include any action taken since device certification or the declaration of conformity.
The main objective of this review is to enable identification of any changes to the benefit-risk profile of the medical devices, considering new or emerging information, enabling transparency on post-market data for MHRA. If the manufacturer identifies concerns, this information should be used to re-evaluate whether the device continues to meet the state of the art for the medical device(s) and what risk reduction action could be taken. Hence the review allows for re-evaluation at defined time-points after market approval as to whether the medical device remains safe and effective.
Notification requirements to the MHRA:
The manufacturer must make the most up-to-date report available to the MHRA on request within 3 working days. There is no requirement to routinely submit copies of PMSRs or PSURs to the MHRA unless requested to do so.
PMSR and PSUR preparation and review requirements
*May change when future GB medical device regulations are introduced
Device Classification | Special subgroups | PSUR or PMSR | UKAB or NB involved in Conformity Assessment? | Involvement of UKAB in PMSR /PSUR | Method of Provision to MHRA | Minimum frequency of update |
---|---|---|---|---|---|---|
Class 1 | General (exclude those in Class I below) | PMSR | No | Not applicable | On request | Every 3 years |
General IVD (not Annex II list A&B) | General | PMSR | No | Not applicable | On request | Every 3 years |
IVD Class A | General (exclude those in IVD Class A below) | PMSR | Yes | None required | On request | Every 3 years |
Class I & IVD Class A | Sterile, measuring function, reusable surgical instrument | PMSR | Yes | None required | On request | Every 3 years |
IVD Class B | Not applicable | PMSR | Yes | None required | On request | Every 3 years |
Class IIa | Non-implantable | PSUR | Yes | Review | On request | Every 2 years |
Class IIa | Implants (Oral or nasal cavity, ear canal) | PSUR | Yes | Review and complete report | On request | Every 2 years |
Class IIb | Non- implantable | PSUR | Yes | Review | On request | Every (1) year |
Class IIb | Implants | PSUR | Yes | Review and complete report | On request | Every (1) year |
Class III | N/A | PSUR | Yes | Review and complete report | On request | Every (1) year |
IVD Annex II (List A&B) | N/A | PSUR | Yes | Review and complete report | On request | Every (1) year |
IVD Class C | N/A | PSUR | Yes | N/A no UKAB (NB review with/without report). May change when future GB medical device regulations are introduced. | On request | Every (1) year |
IVD Class D | N/A | PSUR | Yes | N/A no UKAB (NB review with/without report). May change when future GB medical device regulations are introduced. | On request | Every (1) year |
i. The post-market surveillance report (PMSR)
The manufacturer must prepare a PMSR within 3 years of the first device being placed on the market or put into service (whichever is sooner), or if already on the market/put into service, within 3 years of this regulation coming into force. This is because the saving provision of the regulations (Amendment to Schedule 2A paragraph 6) mean that the requirements can come into force only from the date of commencement of the SI.
The manufacturer should update the report when required but at least every 3 years. This provides flexibility for the manufacturer to align updates to the PMSR with similar requirements within other regulatory jurisdictions within this 3-year period or to spread the requirement across the year as needed.
Providing the above requirements are met, the format and presentation of the PMSR may be determined by the manufacturer. The presentation and methodology used, however, should be consistent from one PMSR to the next, to enable comparison across reporting periods. The detailed guidance on preparation of a PSUR provides some useful suggestions on how to present information.
ii. The periodic safety update report (PSUR)
The PSUR should not duplicate all data and reports generated by the PMS plan, but provide an overview of the PMS activities, data collection, analysis results and summary of conclusions.
The manufacturer should prepare the PSUR according to a standardised format to enable a consistent method for reporting from one manufacturer to another for these higher-risk devices. Further advice is available on the format and presentation of data which should be followed as far as possible for all device classes. If a manufacturer decides that specific sections or datasets are not required, they should document the justification in the PSUR.
As an overview the PSUR should include:
-
a summary of the results and conclusions of the benefit-risk determination based upon review of the risk analysis
-
the supporting risk analysis
-
the findings and conclusions of post-market clinical follow-up (PMCF)
-
a description of any preventive or corrective action since device certification/declaration of conformity including FSCA and the rationale for doing so
-
the volume of sales/supply in the UK
-
an estimate of the size of the population using the device inside and outside the UK and the usage frequency, where practical
-
the characteristics of the population using the device including details of any higher-risk sub-populations
To prepare the above summary, the manufacturer should consider the following elements:
-
information concerning serious incidents, including those arising from side effects having a negative impact on the health of the patient, their care or on wider public health
-
information from trend reporting
-
information relating to non-serious incidents
-
relevant specialist or technical literature, databases and/or registries
-
information, including feedback and complaints, provided by users including patients and the public, distributors and importers
-
publicly available information about similar medical devices inside or outside GB
Timescales for provision of PSURs by device risk classifications
See PMSR and PSUR preparation and review requirements above
Class IIa
The manufacturer must produce the first PSUR within 2 years of the device being placed on the market/put into service or if already on the market within 2 years of this regulation coming into force (see saving provision referenced above).
Update the PSUR every 2 years throughout the PMS period.
Class IIb and Class III medical devices and Class C and D, and Annex II (list A and B) IVDs
The manufacturer must produce the first PSUR within 1 year of the device being placed on the market/put into service or if already on the market within 1 year of this regulation coming into force (see Saving Provision referenced above).
Update the PSUR every year throughout the PMS period.
Involvement of the approved body (UKAB)
See PMSR and PSUR preparation and review requirements
The manufacturer must submit their PSUR (and updated PSUR) to their UKAB if they have one, according to pre-agreed arrangements.
For class C or D IVDs, for which there would be no UKAB, the EU requirements to submit the PSUR to the notified body should be followed. This aspect cannot be covered by this GB regulation.
The UKAB must take the PSUR into account as part of its assessment of the ongoing validity of certification they have issued for the device(s).
The PSUR should form part of the documentation which the UKAB reviews within surveillance activities relating to conformity assessment. This may include a sampling-based approach, depending on the device classification and assessment route chosen for the device.
For class III, all implantable devices and Annex II list A and B IVDs, the UKAB must prepare a report on its conclusions from its review of the PSUR. The report should determine whether there is any impact on the validity of the device certification it has issued, and if so, provide details of any action that is needed. The time required to complete this report may vary depending upon the complexity of the PSUR, but it should be finalised as soon as reasonably practical. The MHRA has published further guidance on the UKAB report.
Notified bodies should follow EU requirements for review of PSURs, as this aspect cannot be covered by this regulation.
Grouping of devices
For PSUR guidance, the term ‘device’ relates to a device model and not to an individual device, as individual devices are placed on the market at different moments during the period covered by the device certificate. A device should be associated with one basic UDI-DI when UDI is used (or one device for legacy devices) and may include different variants or sizes.
The manufacturer may prepare a single PSUR for a category/group of devices if they are covered by a single clinical evaluation or performance evaluation report and/or are considered similar devices. Where devices are grouped together, the manufacturer should justify the combination, and the data should be presented in a clear, organised manner so that it is easy to determine how each device and/or device variant performs independently.
The grouping of devices in one PSUR is only possible for devices for which the conformity assessment activities have been conducted by the same UKAB. This is to facilitate the review and evaluation process by the UKAB. UK CA-marked and CE-marked devices may be grouped together providing other grouping requirements are met, and they are within the remit of the same conformity assessment body.
For devices, including the leading device, which have been on the market with subsequent certificates of different UKABs, the revision history provided should make a reference to the previous PSUR versions where the former UKAB(s) were involved and, when applicable, indicates the actions they required or undertook.
The ‘leading’ device
For devices grouped together in the same PSUR, the manufacturer should assign a ‘leading device’ which needs to be the highest risk class or one of the highest risk classes. The PSUR reference number is attached to the leading device and should remain unchanged for the PSUR updates, provided the leading device in the grouped devices has remained the same.
The leading device determines the schedule for the data collection period and PSUR update/ frequency applicable to the whole group of devices irrespective of the device class or certification date for the other devices.
When a device grouping has been established, it could be amended for the PSUR update(s) by removing or adding devices except for the leading device, which cannot be changed.
The manufacturer should provide justification for the change, together with the PSUR reference number of the PSUR where the data of the removed device(s) are reported.
In case of a change related to the leading device (new device model /change of the basic UDI DI), a new PSUR should then be issued.
PSUR updates for the group of devices which includes the former leading device should continue independently for the PMS period of the former leading device.
Important changes introduced with implementation of SI:
-
provision of PMSR or PSUR to MHRA on request within 3 UK working days
-
deadline for preparation of first PMSR and update at least every 3 years
-
preparation of a PSUR to a standardised format, updated at set intervals
-
submission of PSUR to approved body
-
UKAB to review PSUR for any impact on device certification
-
UKAB to prepare a report on review of PSUR for certain device classifications
D. Reporting under the Medical Devices Vigilance System (Regulations 44ZC, 44ZH, 44ZI, 44ZJ, 44ZK, 44ZN, 44ZO and 44ZP)
a) Overview
The Medicines and Healthcare products Regulatory Agency (MHRA) is the regulatory authority for the UK medical device market. Once a medical device has been placed on the UK market, the manufacturer must submit reports to the MHRA when incidents that involve their device occur in the UK and meet the criteria detailed below. It is also good practice for manufacturers to notify their approved body (if they have one) of reportable incidents, dependent upon their contractual arrangements.
The manufacturer must also take appropriate action to address safety risks when required. This includes addressing risk relating to devices which they have already sold or made available for use. These actions are known as field safety corrective actions (FSCAs).
The notification and evaluation of adverse incidents and FSCAs involving medical devices is known as the medical device vigilance system.
The manufacturer is responsible for ensuring that all vigilance-related activities are conducted in accordance with the requirements. They may choose to delegate responsibility for individual tasks to a UKRP or an authorised representative (AR) based in Northern Ireland (NI). If so, there must be a documented agreement on responsibilities between all parties involved. The manufacturer still remains legally responsible for meeting these duties.
Where responsibility for the reporting of incidents has been deputised to a third party, the manufacturer must ensure that all parties involved are familiar with this guidance document and are informed of all relevant post market surveillance data concerning the devices. This will enable their UKRP or AR to fulfil their obligations.
The following guidance for medical device manufacturers covers what, how and when to report adverse incidents involving medical devices on the UK market. Manufacturers should read it in conjunction with the relevant regulations of the SI.
b) Who must report to the MHRA
The manufacturer, UKRP or AR shall notify the MHRA about incidents and FSCAs which meet the reporting criteria; this includes periodic summary reports (PSR) and trend reports.
Where an incident occurs from the combined use of two or more separate devices (and/or accessories) that are made by different manufacturers, each manufacturer (or their UKRP or AR) should submit a report to the MHRA.
c) What you must report to the MHRA (44ZC)
Manufacturers must report serious incidents, FSCAs, and adverse trends. The reporting templates for each are available in the MORE portal.
Regardless of how the manufacturer came to be aware of it, any incident considered to be serious must be reported to the MHRA. This includes incidents received from the MHRA as industry notifications of a public report (INPRs).
Serious incidents (that is, those which must be reported) meet all three criteria:
-
An event has occurred, or an issue has been identified. This includes situations where testing performed on the device, examination of the information supplied with the device, or any scientific information indicates some factor that could lead, or has led, to an event.
-
The manufacturer’s device is suspected to be a contributory cause of the event, including as a side effect.
-
The problem directly or indirectly resulted, or might have resulted, in death or a serious deterioration in state of health of a patient, user or other person.
The event becomes an incident when the second criteria apply, and becomes serious and therefore reportable when the third criteria apply.
This includes serious public health threat where the above affects a large number of people and needs urgent action to address the risks.
Examples of indirect harm where the problem indirectly affected the patient or user include:
-
misdiagnosis or delayed diagnosis
-
delayed, inappropriate or absence of treatment
-
transfusion of inappropriate materials
Not all adverse incidents result in death or a serious deterioration in health. These may have been avoided because of the particular circumstances, or due to medical or surgical intervention, including self-administered treatment. Such treatment could be in the form of medication, first aid or other form of self help. It is sufficient that if the incident were to occur again, it could have resulted in a serious deterioration in health if the patient, the healthcare professional or other individuals had not taken the same action. Manufacturers should report cases where a patient required revision of an implant to prevent a death or serious deterioration in health.
Therefore, manufacturers must still submit a report to the MHRA if:
-
an incident associated with a device happened, and
-
if it occurred again, it might lead to death or serious deterioration in health
If in doubt about whether to report an incident, report it.
The MHRA has provided examples of reportable incidents under vigilance.
Manufacturers should also check the list of device-specific vigilance guidance (DSVG) documents to see if any apply – see Medical devices: guidance for manufacturers on vigilance. These provide reporting advice on incidents relating to different types of medical device, including as individual serious incidents, as part of an agreed periodic summary report and if the manufacturer identifies an adverse trend.
In addition to fulfilling their vigilance reporting obligations as a manufacturer, assemblers of system or procedure packs should notify the manufacturer of any component in their pack of any serious incidents associated with their devices, of which they are aware. This is to enable the manufacturer of the component to fulfil their PMS obligations. As the MHRA develops the future medical devices regime, we will consider further consultation on including this notification requirement.
Use errors
The manufacturer must report incidents occurring because of use error if they conclude that they meet the criteria in section c, “What must be reported to the MHRA (44ZC)”, regardless of whether the incident has resulted in a serious deterioration in health. The report should include consideration of whether improvements in the device design including usability (ergonomic features), or clearer instructions/training could reduce the risk of reoccurrence of the use error and may be impacted by the number of use errors occurring. Trend reporting requirements may also apply if a significant increase is identified. Manufacturers should also consider whether FSCA could be undertaken to try to reduce this risk.
Guidance on usability and ergonomic features is available in these documents:
-
EN 62366-1 2015 medical devices application of usability engineering to medical devices
-
MHRA guidance on applying human factors and usability engineering to medical devices. January 2021
Important changes introduced with implementation of SI:
-
definition for reportable side-effects
-
clarification that interventions to prevent serious deterioration in health include self-administered treatment
-
serious deterioration in health need not have occurred for a use error to be reportable, just the risk it could occur
d) Timescale to report an adverse incident to the MHRA (Regulation 44ZH)
The manufacturer must notify the MHRA immediately upon becoming aware that one of its devices may have caused or contributed to an event meeting the criteria of what must be reported to the MHRA.
The maximum permitted time between the manufacturer first becoming aware of the incident and notifying the MHRA are:
-
serious public health threat: no later than 2 calendar days after the manufacturer becomes aware
-
death or unanticipated serious deterioration in state of health: no later than 10 calendar days after the manufacturer becomes aware
- if the situation which can result in the serious deterioration in state of health is not covered in the manufacturer’s existing risk analysis documentation, it is considered to be unanticipated
-
anticipated serious deterioration in state of health: no later than 15 calendar days after the manufacturer became aware
If, after becoming aware of a potentially reportable incident, it is unclear whether the event meets the reporting criteria above, the manufacturer must still submit a report within the relevant timeframe. Do not delay reporting because of incomplete information. Further details can be provided in a follow up report.
Important changes introduced with implementation of SI:
- 15 days to report anticipated serious deterioration in health (was 30)
e) How to report to the MHRA
Manufacturers should submit reports to the MHRA relating to adverse incidents for devices occurring in GB or NI via the MORE portal. The MHRA will not accept any reports received via other routes.
See the MORE Submissions Guide for guidance about how to use the portal.
To use the MORE portal, you must register for a MORE account. See the MORE registration guide for details on how to register.
If you are reporting as a UKRP, you must select ‘Other, please specify’ in Section 1.3.1. ‘Submitter of report’ of the MIR (manufacturer’s incident report) form. Enter ‘UKRP’ and complete the contact details in Section 1.3.4. ‘Submitters details’. For more details on how to submit reports, refer to the guidance document in the Resources tile on your account in the MORE portal.
Send reports using the MIR or FSCA schema.
If you are interested in setting up an API (application programming interface) to submit your reports directly from your internal IT systems to ours, contact us for further information. See the MORE production API guidance document for more information about how to set up your API.
A recording is available of the webinar on how to submit reports involving medical devices presented by the MHRA in 2022. More information is available in these slides on changes to submitting adverse incidents to medical devices to the MHRA.
f) What should you include in the initial incident report to the MHRA (Regulation 44ZH)
Initial incident reports must include all mandatory information. Required information is defined in the relevant schemas for MIR forms or through validations in the MORE web forms. Manufacturers should complete reports with all relevant information known to them. Following submission of an initial incident report, the manufacturer must submit a final report on completion of their investigation, unless the report type is combined initial and final.
Full details of what must be included are set out in regulation 44ZH of the SI. Clarification of certain aspects only is available below.
Details of the initial reporter
a) If the report has come from a healthcare professional, provide their name, profession, and professional contact details (including email address and telephone number). In the rare circumstances where this detail is not known, enter ‘not known’ in this field. Make all reasonable efforts to obtain this information during the investigation. Contact the medical devices safety officer (MDSO) for the trust or medical equipment management team for the health board to obtain this information if required.
b) If the initial reporter is a member of the public, the manufacturer should verify with them whether they are content for their details to be shared with the MHRA. If not, the non-mandatory fields can be left blank.
c) If the source of the incident is a journal article, a registry, social media or similar, the manufacturer should provide details of this. Where the source is a journal article, provide a copy of the article where possible, or unique digital object identified (DOI) number if not. Where the source is social media, adhere to data protection rules when submitting a report.
UDI information
Devices may be labelled with a unique device identifier (UDI), which is a unique number used to identify specific devices. Manufacturers should use UDI derived from a standardised issuing authority where possible, for example GS1, HIBCC. See unique device identifier (UDI) for further information. Use of this number ensures that a device can be correctly identified even if some of the other identifying information is missing, and facilitates traceability in the event of FSCA being required. Where the device has a UDI, this must be provided. If the device does not have a UDI, enter ’Unknown’.
Information on similar serious incidents relating to the same device model or model variant
The same model includes devices of available sizes, colours, naming variants or manufacturer sites associated with that model.
Manufacturers should provide this in the final incident report. The manufacturer should provide this in the initial report if they feel able to sufficiently characterise the incident to provide confirmation of the number of similar incidents they are aware of, involving this device or devices from the same model variant/family, they place on the market. These data can then be updated, if necessary, in the final incident report, following the manufacturer’s full investigation.
Important changes introduced with implementation of SI:
- inclusion of UDI (where available) in the incident report
g) Investigation of incidents (Regulations 44ZI, 44ZO and 44ZP)
The manufacturer has the responsibility for investigating incidents, regardless of how they came to be aware of them. They are also responsible for taking any corrective action which becomes necessary as a result of the investigation.
The manufacturer must provide any information requested by the MHRA relating to an ongoing investigation within 3 UK working days (regulation 44ZI(3)(b)). The MHRA may apply discretion in granting a longer period if requesting information not expected to be readily available.
The responsible UKAB (if there is one) must provide the MHRA on request with information and assessments relevant to the incident(s) under investigation (regulation 44ZI(2)(c)).
There is no statutory timescale for provision of the final incident report to the MHRA, which should instead be provided as soon as possible. This is because the MHRA recognises that investigations will vary significantly in their complexity and therefore take different time to complete. Where the manufacturer is aware that completion of the investigation will take many months, they should keep the MHRA updated by submitting interim follow-up reports via the MORE portal.
Incident investigation may require device examination and destructive testing on the device involved. Manufacturers must inform the MHRA before performing any investigation which involves altering the device or a sample of the batch concerned in a way which may affect any subsequent evaluation of the causes of the incident (regulation 44ZI(3)(c)).
Manufacturers should identify which of the following apply before taking action:
-
if the incident resulted in a death, the manufacturer should try to determine whether there is coroner or police interest before undertaking any action which may alter the evidence available
-
if there is coroner interest or police involvement for any incident regardless of outcome, the manufacturer should seek advice from the MHRA and the coroner/police before beginning any destructive testing
-
in all other cases the manufacturer should assume it is appropriate to progress with any required investigation without delay unless specifically asked not to do so by the MHRA or any other interested party
There will be some incidents which are reported to the MHRA before or instead of being reported to the manufacturer, or circumstances where the MHRA has identified a risk or safety concern.
If the MHRA informs the manufacturer of an incident, risk, or safety concern they must investigate and submit a report to the MHRA:
-
within the standard timescales for the incident type (regulation 44ZO)), or
-
as soon as possible for any other risks or safety concerns (regulation 44ZP(2))
If the manufacturer does not consider the incident to be reportable, they can either submit an initial report followed by a final (non-reportable) report or just submit a final (non-reportable) report (even if there is no initial report) (regulation 44ZO(3)).
If the MHRA reaches a conclusion that an incident meets reporting criteria, the manufacturer must report to the MHRA and investigate the case as a serious incident, regardless of whether their own assessment concurs (regulation 44ZO(4)).
Important changes introduced with implementation of SI:
-
provide the MHRA any information requested relating to an ongoing incident investigation or FSCA within 3 UK working days
-
detailed guidance on commencement of destructive device testing following notification to the MHRA of intention to do so
-
detailed guidance on action in response to notification of an incident by the MHRA
-
investigation and reporting in response to risk or safety concern the MHRA brings to the manufacturer’s attention
h) Periodic summary reports (Regulation 44ZH)
The manufacturer can submit a request to report via periodic summary reports (PSR) similar serious incidents with the same device or device type in a consolidated way, where the root cause is known or following an FSCA. This is an alternative way for a manufacturer to fulfil incident reporting requirements by submitting single line entries in a spreadsheet for individual events, rather than individual initial and final MIR reports. This option includes the need to provide an overview analysis of the incident data, as set out below.
Manufacturers must submit an application to the MHRA if they wish to submit reports under PSR. Guidance for doing so can be found on page 21 of the user guide to MORE incident submissions. If no agreement is in place, manufacturers must report incidents individually.
Before submitting any associated PSRs, the manufacturer must have received MHRA agreement, including confirmation of the format, periodicity, and detail to be included (see bullet points below).
All ongoing PSRs agreed before December 2022 have been stopped, and no submissions under the historic agreement will be accepted. Manufacturers wishing to continue reporting under PSR must submit a new application to do so and await MHRA response.
Once the MHRA has agreed to PSR, each subsequent report must include:
-
copy of the original completed PSR application form
-
completed MORE PSR report for the new submission
-
completed spreadsheet of incidents being reported under the PSR - the template spreadsheet is available in the MORE portal
-
you must use the template provided by the MHRA and not alter the format
-
the MHRA will not accept spreadsheets where alterations have been made to the template
-
mark any fields which are not applicable N/A
-
-
an additional document detailing the manufacturer’s analysis of the data for the period
-
there is no specific format for this document, but manufacturers must demonstrate that the assessment undertaken is appropriate and illustrate how trends have been reviewed
-
the document should also include the conclusions reached based on the data available and outline action undertaken in response
-
specific requirements for information to be included in PSR submissions will be included in the approval email from MHRA on a case-by-case basis
-
i) Trend reports (44ZN)
Manufacturers must have systems in place to detect trends throughout the PMS period of the device (regulation 44ZN(4)).
They must submit a trend report to the MHRA when they have identified a significant increase in the number or severity of incidents, compared to pre-determined thresholds based upon expected incidents, and therefore having the potential to adversely impact the required risk analysis.
Guidance on methods to establish whether an increase is statistically significant is available in PD CEN ISO/TR 20416 Medical devices — Post-market surveillance for manufacturers and in this historical Global Harmonisation Task Force (GHTF) document. However, manufacturers should select the statistical techniques which best suits the data they are analysing, and be prepared to provide justification for the method chosen if required to the MHRA and/or the UKAB.
Guidance for submitting trend reports via MORE is available in the MORE incident submissions guide (page 20). Each initial trend report must lead to a final report.
Manufacturers should submit trend reports for trends in incidents which meet the reporting criteria (serious incidents) as well as incidents which do not meet the criteria for individual reporting. Trend reports may include information derived from analysis of incidents which have already been individually reported to the MHRA.
The following information, which is part of what is required in the trend report, should be included once the trend form/schema has been updated to add the relevant fields (44ZN 5):
-
UDI information for the devices involved (where available)
-
the number of devices placed on the market or put into service in Great Britain (provide UK-wide data if GB data is not available)
-
the estimated number of users affected
Note: trend reports to the MHRA are not required for custom-made devices, although the requirement to identify adverse trends still applies. However, the manufacturer must have appropriate systems, tailored for the particular type of device, to enable any adverse trends to be detected.
Examples of reportable trends include:
-
a significant increase in number of expected false positive or false negative results from a diagnostic test in comparison to the stated performance of the device in the instructions for use
-
a number of complaints are received involving devices supplied cracked and unusable due to damage caused in transit
-
a higher-than-expected number of complaints are received concerning over-infusion from an infusion pump with the same root cause
-
a significant number of complaints are received concerning failure of an implant, despite these occurring beyond the manufacturer’s specified lifetime of the device
-
a significant increase in the rate of strokes among patients implanted with a particular kind of carotid stent
Important changes introduced with implementation of SI:
-
manufacturers should submit trend reports for incidents which are reportable individually, as well as those which do not meet the criteria for individual reporting
-
detailed requirements for information to be included in a trend report, including UDI (DN not yet visible in MORE)
-
trend reports are not required for custom-made devices
j) Field safety corrective actions (Regulations 44ZJ and Regulation 44ZK)
(i) Field safety corrective actions (FSCAs)
Once a medical device is on the market, if the manufacturer identifies a problem which could result in death or serious deterioration in state of health in patients, users or others, they must take action to reduce the risk. If this affects devices which have entered the distribution chain outside the control of the legal manufacturer, this is known as field safety corrective action (FSCA).
Examples of FSCA include (but are not limited to):
-
the return of a medical device to the supplier (recall)
-
device inspection
-
device modification or software update
-
calibration updates for IVDs
-
updated guidance in instructions for use, or drawing attention to existing guidance
-
giving advice about the follow-up of patients, users, or others
Manufacturers should notify the MHRA of FSCAs using the FSCA report form (FSCARF) which they must submit via the MORE system. Use this reporting process for FSCAs which affect devices in GB or in NI. A single submission can be made for FSCAs which affect both countries.
If you are reporting an FSCA as a UKRP, you must provide details by selecting ‘Other, identify the role’ in Section 2 of the FSCA form, ‘Status of submitter’. Enter ‘UKRP’ and add the UKRP details in the ‘National contact point information’ Section 5.
In the initial FSCA report form, manufacturers:
-
should include manufacturer specific FSCA reference numbers (for example, including the manufacturer’s name in the title).
-
must include UDI information where available
-
should include details of the communication strategy for ensuring the message contained within their FSN reaches as many affected users as possible.
Each initial FSCARF must lead to a final FSCARF. If the FSCA has been completed in the UK but is ongoing in other territories, the manufacturer should submit a UK final report to the MHRA.
In the final FSCARF the manufacturer should provide evidence of the effectiveness of the FSCA. This should include, where possible, details of the number and proportion of affected GB/NI users receiving the FSN who have confirmed they have read and understood it. Further information should also be included on the extent of completion of all planned actions to mitigate the risk for which the FSCA was initiated.
The manufacturer must provide any information requested by MHRA relating to an ongoing FSCA within 3 UK working days (regulation 44ZJ(8)).
The MHRA recommends that manufacturers also provide copies of their FSCARF and field safety notice to their UKAB where they have one, at the time or in advance of initiating FSCA. This can be included in the contractual obligations between the two parties.
(ii) Field safety notices (FSNs)
Manufacturers should communicate all FSCAs to affected customers using a Field Safety Notice (FSN), regardless of the type of medical device involved. If the MHRA become aware that a manufacturer has failed to implement FSCA appropriately, we will require a retrospective FSN to be produced and communicated to affected customers to detail the action carried out and why it was undertaken. The manufacturer will also need to provide a detailed and robust rationale for the decision not to undertake formal FSCA in line with the requirements. This is to ensure there is a clear and consistent record available to all explaining the action taken, and the reason for it.
The manufacturer should submit the proposed FSN with the initial FSCARF to MHRA before sharing with their customers so that we can provide advice on the FSCA implementation strategy or comments on the proposed FSN.
If you receive no response within 5 days of submitting the draft, you should circulate the FSN to your customers.
If the action required to protect patient safety is urgent, you can circulate the FSN to your customers without waiting the 5 days for a response from the MHRA.
The FSN must be sent in a format that enables customers to search for UDI information (wherever available), catalogue numbers, model numbers and LOT numbers. It is important that the manufacturer does not understate the risk within the FSN. The MHRA has published guidance on effective field safety notices.
We encourage manufacturers to use the following templates and guidance for writing FSNs:
The manufacturer must take reasonable steps to reach all end users affected by the FSCA.
They must monitor the effectiveness of the communication to ensure that users have taken the action required to reduce the risk
A read receipt, automated response or proof of delivery is not a suitable method to demonstrate that the required action has been taken. Wherever possible, use the FSN customer reply and distributor/importer reply templates, or adapt them for use if necessary.
When one form of communication has proved unsuccessful, the manufacturer should try an alternative method, for example, contact the customer by telephone or make an on-site visit).
The guidance on effective field safety notices draws attention to use of the Medical Device Safety Offices (MDSO) network to help with reconciliation. For heath institutions with large numbers of end users, consider including specific points of contact to ensure a coordinated approach.
Where devices are supplied via distributors and third-party organisations, the manufacturer must include traceability and information sharing in their contracts to ensure that they can fulfil this requirement.
It is good practice for manufacturers to host a copy of the FSN on their website (if they have one) and cooperate with any relevant distributors to enable them to do the same. This is not as a method to target the FSN to those affected, which should be managed proactively as detailed above. The purpose of publication in this way is to provide an accurate and transparent historical record for all interested parties of relevant actions, available along with other device information such as promotional material. The information in the FSN is already in the public domain and should be available where members of the public with an interest in the device would be expected to look. It should remain on the manufacturer’s website for the entire PMS period, or for 15 years for implantable devices/10 years for other devices, whichever is longer. As the MHRA develops the future medical devices framework, further consultation on inclusion of this requirement will be considered.
If the device subject to the action is a software app, the manufacturer should also communicate this via the app or in the app store.
(iii) Field safety corrective actions outside GB (Regulation 44ZK)
If the manufacturer is undertaking FSCA outside Great Britain (excluding NI) and the same type of devices are supplied in Great Britain but are not affected, they should notify the MHRA within 3 UK working days of the FSN being circulated. This is to provide transparency and avoid confusion by clarifying in the FSCARF the reason that action does not affect the UK. This is to decrease the burden on both the manufacturer and MHRA, where the MHRA would otherwise raise queries with the manufacturer on a case-by-case basis requesting justification why action affecting the same type of devices is not being implemented in the UK.
The MHRA considers devices which differ only by the name under which they are marketed in different geographical locations to be the same ‘type’.
Manufacturers should send this submission to the aic@mhra.gov.uk mailbox with a copy of the FSN or the equivalent notice and an explanation. Until further notice, do not submit these reports via the MORE portal unless they affect devices in NI.
Circumstances where this applies includes a LOT specific FSCA where affected models were supplied in Great Britain, but devices from the affected LOTs were not, or where the risk arises due to local environmental conditions such as high/low temperatures.
This requirement (regulation 44ZK) does not apply to custom-made devices.
Important changes introduced with implementation of SI:
-
requirement to submit the proposed FSN to the MHRA before sharing with customers, and detailed advice on subsequent timing of distribution to affected customers
-
the FSN must contain UDI information where available and must be sent in a searchable format
-
the manufacturer should host a copy of the FSN on their website (unless they do not have a website)
-
if the manufacturer is undertaking FSCA outside Great Britain and the same type of devices are supplied in Great Britain but are not affected, they must notify the MHRA
-
provide the MHRA within 3 UK working days any information requested relating to an ongoing investigation or FSCA