PMS Reporting Checklist for Startups: Everything Due and When

Every MedTech startup operating under MDR must deliver a specific set of post-market reports on fixed cadences: a PMS Report (Class I, Article 85) or a PSUR (Class IIa/IIb/III, Article 86), vigilance reports at 15/10/2-day deadlines under Articles 87 to 92, trend reports under Article 88, field safety corrective action notices under Article 89, PMCF updates under Annex XIV Part B, and SSCP updates under Article 32 for implantables and Class III devices. This checklist lists every report, the exact article that mandates it, and the deadline — organised by device class so a founder can see the full year at a glance.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

• Class I devices owe a PMS Report under Article 85 of Regulation (EU) 2017/745, updated when necessary and available to the competent authority on request.
• Class IIa devices owe a PSUR under Article 86, updated when necessary and at least every two years.
• Class IIb and Class III devices owe a PSUR under Article 86, updated at least annually; Class III and implantable PSURs are submitted via the Article 92 electronic system to the notified body.
• Vigilance reporting under Articles 87 to 92 runs on fixed clocks: 15 days for serious incidents, 10 days for serious public health threats, and 2 days for death or unanticipated serious deterioration in health.
• MDCG 2025-10 (December 2025) is the current operational guidance that describes how these reports and cadences are implemented in practice.

How to use this checklist

The opener here is short because the rest of the post is the product. Each section below is one reporting obligation. For each one, the same four fields: what the report is, which article or annex mandates it, which device classes it applies to, and the cadence or deadline. Where the Regulation fixes an exact clock, the clock is quoted. Where it says "when necessary" or "at least every X," both parts are quoted so you do not accidentally read the minimum as the target.

The arm-strap sleep-monitor story from the pillar post on PMS is the context that makes this checklist worth printing. A manufacturer whose PMS system caught a skin-irritation trend because the reports were actually running on cadence — not because someone filed them the week before an audit. This checklist is the calendar that makes that outcome possible.

Every cadence below is the minimum the Regulation sets. Your notified body may expect more on contract, and your own risk file may pull the cadence tighter. The checklist is the floor, not the ceiling.

1. The PMS Plan itself (Article 84, Annex III)

What it is. The document that describes how the PMS system operates. Not a report — the plan that the reports are generated against. Listed here because the plan is what keeps the reporting cadences visible.

Mandating text. Article 84 of Regulation (EU) 2017/745 and Annex III, Section 1.1.

Who it applies to. Every manufacturer of every class. No exceptions.

Cadence. Updated whenever the PMS system changes — new data sources, new trigger criteria, new analysis methods — or whenever PMS findings reveal the plan no longer fits the real-world risks. The Regulation does not set a calendar cadence for the plan. For the structure walkthrough, see the PMS plan under MDR Annex III.

2. PMS Report for Class I devices (Article 85)

What it is. The post-market surveillance report that summarises the results and conclusions of PMS data analyses, together with a rationale and description of any preventive and corrective actions taken.

Mandating text. Article 85 of Regulation (EU) 2017/745.

Who it applies to. Manufacturers of Class I devices only. Class IIa, IIb, and III devices are covered by Article 86 instead.

Cadence. Updated "when necessary" and made available to the competent authority upon request. "When necessary" is not "never" — the report must reflect what the underlying PMS system has actually produced. A Class I manufacturer with an annual PMS review cycle will, in practice, update the report annually. For the Class I mechanics, see the PMS Report for Class I devices under Article 85.

3. PSUR for Class IIa devices (Article 86)

What it is. The Periodic Safety Update Report. Contains the results and conclusions of PMS data analysis, preventive and corrective actions taken, conclusions of the benefit-risk determination, main findings of the PMCF, and sales volume plus an estimate of the population using the device with usage frequency where practicable.

Mandating text. Article 86(1) of Regulation (EU) 2017/745.

Who it applies to. Manufacturers of Class IIa devices.

Cadence. Updated when necessary and at least every two years. The biennial floor is fixed by the Regulation — the PSUR cannot be skipped beyond that interval. Made available to the notified body and, upon request, to competent authorities.

4. PSUR for Class IIb and Class III devices (Article 86)

What it is. The same PSUR as Section 3, with the same five content elements.

Mandating text. Article 86(1) of Regulation (EU) 2017/745.

Who it applies to. Manufacturers of Class IIb and Class III devices. Implantable devices that are Class IIb or III are also covered here.

Cadence. Updated at least annually. The annual floor is fixed. For Class III and implantable devices, Article 86(2) additionally requires submission via the electronic system referred to in Article 92 to the notified body involved in the conformity assessment. The notified body evaluates the PSUR and adds its evaluation to the electronic system, together with any action taken. For Class IIb non-implantables, the PSUR is made available to the notified body and, upon request, to competent authorities. For the full submission mechanics, see PSUR for Class IIa, IIb, and III devices under MDR.

5. Serious incident reports — the 15-day deadline (Article 87)

What it is. A report of any serious incident involving devices made available on the Union market, excluding expected side effects that are clearly documented in the product information and quantified in the technical documentation and subject to trend reporting under Article 88.

Mandating text. Article 87(3) of Regulation (EU) 2017/745. The term "serious incident" is defined in Article 2(65). Interpretive detail on incident versus serious incident is in MDCG 2023-3 Rev.2 (January 2025).

Who it applies to. Every manufacturer, every class.

Deadline. Not later than 15 days after the manufacturer becomes aware of the event. This is the default vigilance clock. The clock starts at "awareness" — MDCG 2023-3 Rev.2 clarifies how the awareness date is determined in practice. For the vigilance deep dive, see what is vigilance under MDR and serious incidents under MDR — definition and reporting.

6. Serious public health threat reports — the 2-day deadline (Article 87)

What it is. A report of a serious incident that represents a serious public health threat.

Mandating text. Article 87(4) of Regulation (EU) 2017/745.

Who it applies to. Every manufacturer, every class.

Deadline. Immediately after the manufacturer has established a causal relationship or a reasonably possible causal relationship between the incident and the device, and not later than 2 days after becoming aware of that threat. This is the fastest clock in the vigilance system.

7. Death or unanticipated serious deterioration — the 10-day deadline (Article 87)

What it is. A report of a serious incident in the case of death or an unanticipated serious deterioration in a person's state of health.

Mandating text. Article 87(4) of Regulation (EU) 2017/745.

Who it applies to. Every manufacturer, every class.

Deadline. Immediately after the manufacturer has established or as soon as it suspects a causal relationship between the device and the serious incident, and not later than 10 days after the date on which the manufacturer becomes aware of the serious incident. The three vigilance clocks — 2, 10, and 15 days — are the fixed deadlines founders must know by heart.

8. Trend reports (Article 88)

What it is. A report of any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or expected undesirable side effects, that could have a significant impact on the benefit-risk analysis and that have led or may lead to risks to health or safety.

Mandating text. Article 88 of Regulation (EU) 2017/745. The methodology for trend detection must be described in the PMS plan under Annex III, Section 1.1.

Who it applies to. Every manufacturer, every class.

Deadline. Reported immediately to the relevant competent authorities through the Article 92 electronic system. No fixed day-count — the trigger is the statistical detection itself, and the expectation is that reporting follows without delay. For more, see trend reporting under MDR Article 88.

9. Field safety corrective action (FSCA) notices (Article 89)

What it is. A report of any field safety corrective action taken in respect of devices made available on the Union market, including any field safety corrective action undertaken in a third country in relation to a device which is also legally made available on the Union market, if the reason for the field safety corrective action is not limited to the device made available in the third country.

Mandating text. Article 89(8) of Regulation (EU) 2017/745. FSCAs are also addressed in MDCG 2023-3 Rev.2.

Who it applies to. Every manufacturer, every class, whenever an FSCA is initiated.

Deadline. Reported to the relevant competent authorities in advance of the FSCA being undertaken, except in cases of urgency where the FSCA must be taken immediately. A Field Safety Notice (FSN) is issued to affected users and healthcare professionals. The CA must be notified through the Article 92 electronic system. For the FSCA mechanics, see field safety corrective actions under MDR.

10. PMCF Plan and PMCF Evaluation Report (Annex XIV Part B)

What it is. The Post-Market Clinical Follow-up Plan and the PMCF Evaluation Report. The plan specifies the methods and procedures for proactively collecting and evaluating clinical data from the use of a CE-marked device. The evaluation report documents the results and feeds the clinical evaluation update.

Mandating text. Annex XIV Part B of Regulation (EU) 2017/745. Referenced by Article 61(11) for the clinical evaluation update loop and by Annex III for inclusion in the PMS plan.

Who it applies to. Every manufacturer, every class, unless a justification for non-applicability of PMCF is documented inside the PMS plan.

Cadence. The PMCF plan is updated whenever the PMCF activities or findings change. The PMCF Evaluation Report feeds the PSUR cycle (annual for Class IIb/III; at least every two years for Class IIa) and the PMS Report cycle (when necessary, for Class I). In practice, a PMCF Evaluation Report runs on the same cadence as the class-specific PMS output that consumes it. For the PMCF walkthrough, see PMCF under MDR — a guide for startups.

11. SSCP updates (Article 32)

What it is. The Summary of Safety and Clinical Performance. A public-facing document drafted by the manufacturer for implantable devices and Class III devices, validated by the notified body, and made publicly available through Eudamed.

Mandating text. Article 32 of Regulation (EU) 2017/745.

Who it applies to. Manufacturers of implantable devices and Class III devices. It does not apply to custom-made or investigational devices.

Cadence. The SSCP is updated throughout the lifecycle of the device, drawing on the PSUR findings, the PMCF evaluation, and the clinical evaluation updates. There is no fixed calendar in Article 32 itself — the update is driven by what the PSUR and PMCF cycles surface. Because the SSCP is public, the update discipline matters: an SSCP that lags behind the PSUR is an SSCP that misrepresents the current benefit-risk picture. For more, see the Summary of Safety and Clinical Performance under Article 32.

12. Risk management file updates driven by PMS (feedback loop)

What it is. Not a report in the vigilance sense, but a mandated output of the PMS loop. Every PMS finding that changes the risk profile must flow into the risk management file maintained under EN ISO 14971:2019 + A11:2021, which is the harmonised standard for MDR Annex I GSPR 1 to 9.

Mandating text. Article 83(3) of Regulation (EU) 2017/745 names "updating the benefit-risk determination" as one of the required uses of PMS findings. EN ISO 14971:2019 + A11:2021 establishes risk management as a lifecycle activity.

Cadence. Updated whenever PMS data surfaces a new hazard, a higher occurrence rate, a higher severity, or a new risk control. The auditor tests this loop by asking you to trace one finding from the PSUR or PMS Report through to a risk file update. A PMS system that has no risk file updates in its history either has no real-world data or has a broken loop. For the feedback mechanics, see risk management file updates driven by PMS.

The at-a-glance table

For the founder who wants the whole year on one page, the cadences condense like this.

Print this table. Put it on the wall next to whoever owns PMS at your company. The calendar on the wall is the difference between a system that runs and a system that exists on paper.

The Subtract to Ship angle

Applied to PMS reporting, the Subtract to Ship framework for MDR does not cut obligations — every item in the checklist above is mandated by a specific article. It cuts the machinery around the obligations.

The lean move: for each row in the table, name the owner, the source data, the template, and the calendar entry. That is four pieces of information per row. Twelve rows. Forty-eight fields. A founder who can fill in all 48 fields has a PMS reporting system that will survive an audit. A founder who cannot name an owner for row 5 has a gap the auditor will find.

Subtract the rest. No elaborate dashboards, no parallel tracking spreadsheets, no process documents that repeat what the template already encodes. One table, one owner per row, one calendar. Everything else is overhead that steals time from actually reading the incoming data. And reading the incoming data is the only reason any of this exists — the arm-strap skin-irritation trend was caught because someone actually looked at the complaints, not because someone built a better dashboard.

For every item you keep outside this minimum, ask the test: which article or MDCG 2025-10 section requires it? If no answer, subtract.

Reality Check

1. For each of the twelve reporting obligations above, can you name the owner on your team today — not "the regulatory person" but a specific name?
2. Is the PMS Report (Class I) or PSUR (Class IIa/IIb/III) for your device currently on the cadence the Regulation sets, or is it past due?
3. If a serious incident were reported to your support inbox tomorrow morning, would the 15-day clock start on the day of receipt, and can you prove the awareness date?
4. Do you have a written decision rule for distinguishing a serious public health threat (2-day) from a death or unanticipated serious deterioration (10-day) from a standard serious incident (15-day)?
5. Does your PMS plan define the statistical trigger for trend reporting under Article 88, or does it leave the trigger unspecified?
6. If your device is Class III or implantable, is your Eudamed PSUR submission route actually set up and tested — not "on the roadmap"?
7. Does your PMCF plan exist, or is PMCF non-applicability justified in writing inside the PMS plan?
8. For Class III or implantable devices, is the SSCP being updated on the same cadence as the PSUR, or has it drifted?
9. Can you trace at least one PMS finding from the last cycle into a documented risk file update?
10. Have you read MDCG 2025-10 (December 2025) end to end, and have you cross-checked your reporting cadences against the interpretations in the guidance?

Frequently Asked Questions

What is the difference between a PMS Report and a PSUR?

The PMS Report is the Class I output under Article 85 of Regulation (EU) 2017/745. It summarises PMS data analyses and any preventive or corrective actions. The PSUR is the Class IIa, IIb, and III output under Article 86 and includes additional content: benefit-risk conclusions, PMCF main findings, and sales volume plus population estimates. The update cadences also differ by class.

How fast must a serious incident be reported under MDR?

Not later than 15 days after the manufacturer becomes aware of the event, per Article 87(3). A serious public health threat must be reported within 2 days, and a death or unanticipated serious deterioration in health within 10 days, under Article 87(4).

Do Class I manufacturers have vigilance reporting obligations?

Yes. Articles 87 to 92 apply to every manufacturer regardless of device class. The vigilance clocks (2, 10, 15 days) are identical across classes. The only PMS reporting element that differs by class is the PMS Report (Class I) versus the PSUR (Class IIa, IIb, III).

Where is the PSUR for Class III devices submitted?

Via the Article 92 electronic system to the notified body involved in the conformity assessment, per Article 86(2). The notified body evaluates the PSUR and adds its evaluation to the electronic system. The PSUR and the notified body evaluation are made available to competent authorities through the same system.

Is the PMCF plan the same as the PMS plan?

No. The PMS plan is the umbrella document required by Article 84 and Annex III. The PMCF plan is specified in Annex XIV Part B and is either included in the PMS plan or referenced by it. Annex III requires the PMS plan to either include a PMCF plan or document the justification for why PMCF is not applicable.

How often must the SSCP be updated?

Article 32 of Regulation (EU) 2017/745 does not set a fixed calendar cadence for the SSCP. In practice, the SSCP is updated whenever the PSUR and PMCF evaluation surface material changes, so the update rhythm tracks the underlying reports. For Class III and implantable devices, the SSCP is public through Eudamed, so the update discipline has external visibility.

What is the statistical threshold for trend reporting under Article 88?

Article 88 requires reporting of any "statistically significant increase in frequency or severity" of non-serious incidents or expected side effects that could have a significant impact on the benefit-risk analysis. The Regulation does not fix a specific statistical test — the methodology is defined in the PMS plan under Annex III, Section 1.1. The plan must name the method the manufacturer uses.

Related reading

• What is post-market surveillance under MDR? — the pillar post for the PMS cluster.
• MDR Articles 83 to 86 — the PMS framework explained — the article-by-article framework this checklist operationalises.
• The PMS plan under MDR Annex III — the plan content specification element by element.
• The PMS Report for Class I devices under Article 85 — the Class I output mechanics.
• PSUR for Class IIa, IIb, and III devices under MDR — the higher-class report mechanics including Eudamed submission.
• Trend reporting under MDR Article 88 — the trend trigger the PMS plan must operationalise.
• Serious incidents under MDR — definition and reporting — the 2/10/15-day vigilance clocks in detail.
• PMCF under MDR — a guide for startups — the clinical arm of the PMS system.
• The Summary of Safety and Clinical Performance under Article 32 — the public-facing report for implantables and Class III.
• The Subtract to Ship framework for MDR compliance — the methodology behind the lean reporting test.

Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 32 (SSCP), Article 83 (PMS system), Article 84 (PMS plan), Article 85 (PMS Report for Class I), Article 86 (PSUR), Article 87 (reporting of serious incidents and FSCAs), Article 88 (trend reporting), Article 89 (analysis of serious incidents and FSCAs), Articles 90 to 92 (vigilance data analysis and electronic system), Annex III (technical documentation on PMS), and Annex XIV Part B (PMCF). Official Journal L 117, 5.5.2017.
2. MDCG 2025-10 — Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices. Medical Device Coordination Group, December 2025.
3. MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746. Medical Device Coordination Group, Revision 2, January 2025.
4. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
5. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.

This post is the reporting calendar for the Post-Market Surveillance & Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The cadences listed here are the minimums the Regulation sets — your notified body contract or risk file may pull them tighter, but never looser. Print the table, name the owners, mark the calendar, and let the system run.