What Is a PSUR? How to Write a Periodic Safety Update Report — 4-Level Guide (2026)

Level 1 — Explain It Like I'm Five

Think of a report card — but for your medical device. Every year (or every two years), you have to write a report card that says: "Here's everything that happened with our device this year. Here's what went wrong. Here's what we fixed. And here's why we believe our device is still safe and helpful."

That report card is called a PSUR — a Periodic Safety Update Report. You hand it to the teacher (the Notified Body), and they decide if your device passes or needs improvement.

Level 2 — The General Picture

A PSUR (Periodic Safety Update Report) is a document required under the EU Medical Device Regulation (MDR 2017/745) Article 86 for Class IIa, IIb, and III medical devices. It summarizes all post-market surveillance data collected during a defined period and concludes whether the device's benefit-risk ratio remains acceptable.

Who needs one?

Class IIa: PSUR required at least every 2 years
Class IIb and III: PSUR required at least annually
Class I: No PSUR required — instead, a simpler PMS Report (Article 85) updated "when necessary"

Why is it important?

The PSUR is your primary evidence that you are actively monitoring your device and maintaining its safety profile. Notified Bodies review it. Competent authorities can request it. An inadequate PSUR can lead to CE certificate suspension.

Level 3 — How to Actually Write a PSUR

The structure (per MDCG 2022-21)

MDCG 2022-21 provides the definitive PSUR template. Here's what each section must contain:

Section	Content	Common Mistake
1. Device description	Intended purpose, device classification, UDI-DI, variants covered	Using marketing descriptions instead of regulatory intended purpose
2. PMS data summary	Complaints, vigilance reports (own + similar devices), FSCAs, CAPAs taken	Listing data without analysis — regulators want conclusions, not data dumps
3. Sales volume & population	Units sold, estimated user/patient population, usage frequency	Omitting this entirely — it's required by Art. 86(1)(c) and frequently missed
4. PMCF findings	Summary of PMCF plan status, data collected, key results	Writing "see PMCF report" without a summary — NB wants conclusions here
5. Trend analysis	Statistical analysis of complaint rates, adverse event rates over time	No statistical methodology — just counting complaints is not trend analysis
6. Benefit-risk conclusion	Updated benefit-risk determination based on all new PMS data	Copy-pasting the original benefit-risk from the CER without updating with post-market data
7. Actions taken/planned	CAPAs, label changes, design changes, training updates triggered by PMS findings	Stating "no action needed" without evidence-based justification

Practical tips for RA/QA writing the PSUR

Start collecting data from day one — don't wait until the PSUR is due. Set up a quarterly data pull from complaints, CAPA, service, and external monitoring.
Use actual numbers — complaint rate per 1,000 units sold, not just "we received 47 complaints." Context matters.
Compare to previous period — NBs want to see trends, not snapshots. Is the complaint rate going up or down?
Link to the CER — the PSUR must reference and update the Clinical Evaluation Report. New PMS data changes the CER conclusions.
Link to the risk file — every PSUR finding that reveals a new risk or changes risk probability must appear in the ISO 14971 risk management file.

Level 4 — The Deeper Analysis

Why the PSUR exists: the MDD gap

Under the old MDD (93/42/EEC), there was no PSUR requirement. Manufacturers could — and many did — certify a device, sell it for 10 years, and never formally reassess its safety profile with real-world data. The PIP breast implant scandal (2010) and the metal-on-metal hip implant crisis exposed this gap catastrophically. The MDR's PSUR requirement is a direct regulatory response: force manufacturers to periodically prove their device is still safe, using actual post-market evidence.

PSUR vs. FDA: why the US doesn't have one

FDA doesn't require a PSUR-equivalent document. Instead, FDA relies on continuous MDR (Medical Device Reporting) flow through MAUDE, plus enforcement-driven inspections. FDA's philosophy: "show us your events in real time; we'll inspect your system when we choose." The EU's philosophy: "write us a comprehensive report periodically; we'll review it systematically." Both approaches have trade-offs — FDA catches acute problems faster through real-time reporting; the PSUR forces manufacturers into periodic self-assessment that may catch chronic issues better.

The NB review gap

For Class IIb and III devices, the Notified Body must review the PSUR and record its evaluation. But NBs are capacity-constrained — the transition from MDD to MDR created a massive workload increase while the number of designated NBs decreased. The practical result: PSUR reviews may be delayed or less thorough than intended. This creates a perverse incentive for manufacturers to produce minimal PSURs, counting on light review. Smart RA/QA teams use thorough PSURs as a competitive advantage — demonstrating post-market data quality that accelerates NB reviews and builds regulatory trust.

Frequently Asked Questions

What is a PSUR in medical device regulation?

A PSUR (Periodic Safety Update Report) is a document required under EU MDR 2017/745 Article 86 for Class IIa, IIb, and III medical devices. It summarizes all post-market surveillance data (complaints, adverse events, literature findings, PMCF data, sales volume, trend analysis) collected during a defined reporting period and provides an updated benefit-risk determination. PSURs must be updated at least every 2 years for Class IIa and annually for Class IIb/III devices. They are submitted to the Notified Body and, for Class III, uploaded to EUDAMED.

How long does it take to write a PSUR?

For a first PSUR, expect 40–80 hours of work per device family, primarily spent on data gathering (70% of effort), analysis, and benefit-risk assessment. Subsequent annual updates typically take 20–40 hours if data collection is continuous throughout the year. The key time saver is maintaining a running PSUR data file — updating it quarterly instead of gathering 12 months of data at the end of the reporting period. With an automated regulatory intelligence platform handling external monitoring data, the external PMS section can be populated in hours instead of days.

What is the difference between a PSUR and a PMS Report?

A PMS Report (Article 85) is the simpler version required for Class I devices — it summarizes PMS data and actions taken, updated "when necessary." A PSUR (Article 86) is required for Class IIa/IIb/III and must additionally include: a benefit-risk determination, PMCF findings, sales volume and user population estimates, statistical trend analysis, and a conclusion on whether the benefit-risk ratio remains acceptable. The PSUR is submitted to the Notified Body; the PMS Report is only provided to competent authorities on request.

Does the US FDA require a PSUR?

No. FDA does not require a PSUR-equivalent document. FDA relies on continuous real-time reporting through the MDR system (21 CFR 803) plus annual reports for PMA-approved devices. However, if you sell in both the US and EU, you can use PSUR data collection as the basis for both — the PMS data gathered for PSUR preparation also satisfies FDA's expectation that you systematically monitor your device's post-market performance.

What Is a PSUR and How Do I Write One? 4-Level Guide (2026)