---
title: The Periodic Safety Update Report (PSUR) for Class IIa, IIb, and III Devices
description: The PSUR under MDR Article 86 is the periodic safety update for IIa, IIb, and III devices. Here is the structure, the frequency by class, and what Notified Bodies look for.
authors: Tibor Zechmeister, Felix Lenhard
category: Post-Market Surveillance & Vigilance
primary_keyword: PSUR class IIa IIb III MDR
canonical_url: https://zechmeister-solutions.com/en/blog/psur-class-iia-iib-iii
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# The Periodic Safety Update Report (PSUR) for Class IIa, IIb, and III Devices

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **The Periodic Safety Update Report (PSUR) is the class-specific post-market report that manufacturers of Class IIa, IIb, and Class III devices must prepare under MDR Article 86 of Regulation (EU) 2017/745. It summarises the results of the post-market surveillance data analyses, the conclusions of the benefit-risk determination, the main findings of the post-market clinical follow-up, and the sales volume and user population data. Class IIb and Class III PSURs are updated at least annually. Class IIa PSURs are updated when necessary and at least every two years. For Class III and implantable devices, the PSUR is submitted via the Article 92 electronic system to the notified body involved in the conformity assessment, which evaluates it and adds its evaluation to the same system.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- The PSUR is required by MDR Article 86 for every Class IIa, IIb, and Class III device. It is the output of the PMS system required by Article 83 and the PMS plan required by Article 84.
- The content is fixed by Article 86(1): PMS data analyses, preventive and corrective actions, benefit-risk conclusions, main PMCF findings, and sales volume plus population and usage data where practicable.
- Update frequency is set by the Regulation itself. Class IIb and Class III: at least annually. Class IIa: when necessary and at least every two years. No negotiation with the notified body.
- Class III and implantable device PSURs are submitted via the Article 92 electronic system (Eudamed) to the notified body, which reviews the PSUR and adds its evaluation. Class IIa and IIb PSURs are made available upon request.
- MDCG 2025-10 (December 2025) is the current operational guidance and the document a notified body auditor will apply when reviewing your PSUR.

---

## The sleep arm strap. Why the PSUR is the document that catches the pattern

A small MedTech company we worked with had built a sleep-monitoring arm strap with a textile-polymer casing that passed biocompatibility testing before market. Once the device was in continuous overnight use across real patients, mild and occasionally not-mild skin irritations began to show up. We told the story in full in the [PMS pillar post](/blog/what-is-post-market-surveillance-mdr) and again in [the Articles 83 to 86 deep dive](/blog/mdr-articles-83-86-pms-framework). It belongs here too, because the PSUR is the document where that pattern becomes visible to a regulator.

A Class IIa device like that arm strap must produce a PSUR under Article 86. The PSUR is where the complaint rate gets trended against expected rates. Where the benefit-risk determination gets re-stated against what the field is actually showing. Where PMCF findings on prolonged skin contact get written down. Where the sales volume and user population frame how many people are actually exposed to the risk. The skin irritation finding, the material change, and the updated IFU all land in the PSUR because Article 86 requires them to. A PSUR that only reports complaint counts without trending, without benefit-risk conclusions, and without PMCF findings would not have surfaced the pattern in a way a notified body could act on. The PSUR is not a formality. It is the document that proves the loop closed.

## What Article 86 actually requires

Article 86(1) of Regulation (EU) 2017/745 sets the content of the PSUR in a single sentence that packs five elements. Manufacturers of Class IIa, IIb, and Class III devices prepare a Periodic Safety Update Report for each device and, where relevant, for each category or group of devices, summarising the results and conclusions of the analyses of the post-market surveillance data gathered as a result of the post-market surveillance plan, together with a rationale and description of any preventive and corrective actions taken. The PSUR shall, throughout the lifetime of the device concerned, set out the conclusions of the benefit-risk determination, the main findings of the post-market clinical follow-up, and the volume of sales of the device and an estimate evaluated on the basis of the data available to the manufacturer of the size and other characteristics of the population using the device and, where practicable, the usage frequency of the device.

That is five content elements. Every PSUR must contain all five. A PSUR that summarises complaints and skips benefit-risk is non-compliant. A PSUR that reports benefit-risk and skips PMCF findings is non-compliant. A PSUR that reports PMCF findings and has no sales or population data is non-compliant. The article names the elements; the auditor checks the elements.

Article 86(1) also sets the update frequency, which we break out in the next section.

Article 86(2) sets the submission route for Class III and implantable devices: the PSUR is submitted by means of the electronic system referred to in Article 92 to the notified body involved in the conformity assessment. The notified body reviews the PSUR and adds its evaluation to the electronic system, together with details of any action taken. The PSUR and the notified body evaluation are made available to competent authorities through the same electronic system.

For Class IIa and Class IIb devices, the PSUR is made available to the notified body and, upon request, to competent authorities. The continuous electronic submission loop applies specifically to Class III and implantables.

## PSUR frequency by class

The cadence is set by the Regulation itself. There is no room for a notified body to agree a longer cycle, and no room for the manufacturer to defer.

**Class IIa devices.** The PSUR is updated when necessary and at least every two years. "When necessary" is a real trigger. If a signal emerges mid-cycle, the PSUR is updated before the two-year deadline. The two years is a ceiling, not a target.

**Class IIb devices.** The PSUR is updated at least annually. Annually means once per twelve-month period, with the reporting period clearly stated in the document.

**Class III devices.** The PSUR is updated at least annually. The same annual cadence as Class IIb, but with the additional obligation under Article 86(2) that the PSUR is submitted via the electronic system to the notified body every cycle.

**Implantable devices.** Implantable devices follow the same electronic submission route as Class III devices, regardless of their base classification. For an implantable Class IIb device, the annual PSUR is submitted to the notified body via the electronic system. For a non-implantable Class IIb device, the annual PSUR is made available to the notified body on a different route.

For the class-specific overview of what else changes with class, see [Class IIa devices under MDR](/blog/class-iia-medical-devices-under-mdr), [Class IIb devices under MDR](/blog/class-iib-medical-devices-under-mdr), and [Class III devices under MDR](/blog/class-iii-medical-devices-under-mdr).

## The five required content elements. A HowTo walkthrough

A PSUR is not a free-form document. Article 86(1) dictates the content. The cleanest PSURs we see at audit map one-to-one to the five elements, with each element as a labelled section. Here is the walkthrough.

### Step 1. PMS data analyses and conclusions

The first element is the summary of the results and conclusions of the analyses of the PMS data gathered under the PMS plan. This section describes what data the PMS system collected during the reporting period, what analysis methods were applied, and what the analysis concluded. Complaint data, trend data, literature findings, similar-device monitoring, service records, and any other source named in the PMS plan under Annex III belongs here. The section is analytical, not transcriptional: auditors want conclusions drawn from the data, not raw logs appended as annexes.

### Step 2. Preventive and corrective actions

The second element is a rationale and description of any preventive and corrective actions taken during the reporting period. Every PMS finding that triggered a CAPA, a design change, a labelling update, an IFU revision, or a field safety corrective action belongs here. The description includes the finding, the rationale for the action, the action itself, and the verification of effectiveness. If no actions were taken during the period, the section states that and explains why the findings did not warrant action. Silence is not acceptable.

### Step 3. Benefit-risk determination conclusions

The third element is the conclusions of the benefit-risk determination. This is where the PSUR re-states the benefit-risk balance for the device in light of what the PMS data showed during the reporting period. The underlying risk management file lives under EN ISO 14971:2019 + A11:2021. The benefit-risk conclusions in the PSUR must be consistent with the risk file and must reflect any updates the PMS data triggered. An auditor who sees a PSUR benefit-risk conclusion that contradicts the risk file will press on the inconsistency.

### Step 4. Main PMCF findings

The fourth element is the main findings of the post-market clinical follow-up. PMCF is required by Annex XIV Part B and feeds the clinical evaluation under Article 61. The PSUR does not reproduce the full PMCF report. It summarises the main findings, with references to the underlying PMCF documentation. If the PMS plan includes a justification for why PMCF is not applicable, that justification is re-stated here. If PMCF activities were planned but not executed, the PSUR must explain why. "We did not get to it" is not an acceptable explanation.

### Step 5. Sales volume and population data

The fifth element is the volume of sales of the device and an estimate, based on data available to the manufacturer, of the size and other characteristics of the population using the device and, where practicable, the usage frequency. This section frames the denominator for everything else in the PSUR: complaint rates, incident rates, and safety signals only mean something against the number of devices in use and the profile of the users. Startups sometimes skip this section because they do not have perfect sales telemetry. Article 86 says "where practicable," which is flexibility on precision, not on presence. A best-estimate sales figure with the methodology explained is compliant. A missing section is not.

For the PMS plan elements under Annex III that feed the PSUR, see [the PMS plan under MDR Annex III](/blog/pms-plan-mdr-annex-iii). For the class-specific report contrast with Class I, see [the PMS Report for Class I devices](/blog/pms-report-class-i-devices).

## The notified body and Eudamed submission flow

For Class III devices and implantable devices, Article 86(2) creates a live submission loop that is structurally different from the rest of the PMS framework.

The flow runs like this. The manufacturer prepares the PSUR for the reporting period. The PSUR is submitted via the electronic system referred to in Article 92. That is, Eudamed. To the notified body involved in the conformity assessment of the device. The notified body reviews the PSUR, evaluates it against the manufacturer's PMS plan and the underlying data, and adds its evaluation to the electronic system together with details of any action taken. The PSUR and the notified body evaluation are made available to competent authorities through the same electronic system.

Three implications of this flow that startups shipping their first Class III device consistently miss.

First, the submission is electronic. It is not an email attachment. It is not a PDF handed over at the next surveillance audit. The Eudamed module for PSUR submission is the route, and the operational details live in Commission Implementing Regulation (EU) 2021/2078 for the Eudamed database itself. Having your Eudamed actor registration and device registration in place is a prerequisite for the PSUR submission flow to even start.

Second, the notified body evaluation becomes part of the regulatory record. A weak PSUR that the notified body flags generates a public evaluation alongside the PSUR. This is a different posture from a surveillance audit finding that lives inside a report. It is a persistent, visible mark on the regulatory file.

Third, the cadence is annual, not "at the next audit." A Class III PSUR that slips by a quarter is not a minor administrative lapse. It is a missed legal obligation. The notified body is watching the calendar, and so is the competent authority once the evaluation is posted to the electronic system.

For Class IIa and Class IIb non-implantable devices, the PSUR route is lighter: the document is made available to the notified body (typically reviewed during surveillance audits) and to competent authorities on request. But "made available" does not mean "written the night before". The document exists on the required cadence, and the notified body can ask for it at any point.

## How the PSUR interlocks with PMCF and the risk file

The PSUR is not a standalone report. It sits inside a loop that the PMS system runs continuously, and three documents feed and are fed by the PSUR every cycle.

**The PMS plan (Annex III).** The plan specifies the data sources, analysis methods, trigger criteria, and feedback loops the PMS system runs. The PSUR reports what the system produced during the reporting period. A PSUR that reports on data sources and methods not named in the plan. Or vice versa. Indicates the plan and the PSUR are out of sync.

**The PMCF plan and report (Annex XIV Part B).** The PMCF plan sits inside or alongside the PMS plan and describes the clinical data that will be collected post-market. The PMCF report summarises the clinical findings. The PSUR incorporates the main findings of the PMCF under Article 86(1). The PSUR is where the clinical feedback loop becomes visible to the notified body on the annual (or biennial) cadence. See [PMCF under MDR. A guide for startups](/blog/pmcf-mdr-guide-startups) for the full PMCF side of this loop.

**The risk management file (EN ISO 14971:2019 + A11:2021).** The risk file is a living document. PMS findings update the risk file; the updated risk file feeds the benefit-risk determination; the benefit-risk determination becomes the third content element of the PSUR. A PSUR whose benefit-risk conclusion does not match the current state of the risk file is either reporting stale conclusions or running ahead of documented risk analysis. Both are audit findings.

The interlock is also why MDCG 2025-10 (December 2025) describes the interaction between PMS and other QMS processes explicitly. Notified bodies assess PSURs with the expectation that the plan, the PMCF, the risk file, and the clinical evaluation are all telling the same story. A PSUR that reads as if it lives in isolation is a PSUR that generates questions.

## Common PSUR mistakes

Six mistakes recur in first-cycle PSURs at startups. Each is specific enough to fix before the notified body reads the document.

**Mistake 1. Missing content elements.** The PSUR summarises complaints, reports a few CAPAs, and stops. Benefit-risk conclusions, PMCF findings, and sales/population data are not in the document. All five Article 86(1) elements are mandatory. All five go in every PSUR.

**Mistake 2. Wrong cadence.** The first Class IIb PSUR is written 14 months after market launch because "we did not have enough data sooner." The Regulation sets annual cadence. The first PSUR is written at the one-year mark with whatever data the PMS system has, even if that data is thin.

**Mistake 3. The PSUR contradicts the risk file.** The PSUR states a benefit-risk conclusion that is more optimistic (or more pessimistic) than the current risk file supports. The two documents must be consistent, and the risk file is updated first if PMS findings shifted the analysis.

**Mistake 4. Copy-paste from the previous cycle.** The second PSUR is 90 per cent identical to the first, with only the cover date changed. Notified bodies have seen this pattern thousands of times and flag it on sight. Each cycle must reflect the reporting period's actual data.

**Mistake 5. Sales and population section left blank because the startup has no analytics.** Article 86(1) says "where practicable" for usage frequency, not for sales volume or population estimate. Best-estimate figures with documented methodology are compliant. A missing section is not.

**Mistake 6. Class III PSUR not submitted via the Article 92 electronic system.** The manufacturer prepares the PSUR correctly but leaves it in a shared drive, expecting the notified body to collect it at the next audit. For Class III and implantable devices, the electronic submission is the legal route, and "ready to send" is not the same as "submitted."

For the wider list of PMS pitfalls, see [8 common PMS mistakes startups make under MDR](/blog/8-common-pms-mistakes-startups-mdr).

## The Subtract to Ship angle

The [Subtract to Ship framework for MDR](/blog/subtract-to-ship-framework-mdr) applied to the PSUR produces a specific discipline. The PSUR is a legally defined output. Article 86(1) names the five content elements. Anything inside the PSUR that is not one of those five elements, or not a clearly labelled sub-section of one of them, is either waste or miscategorised.

In practice this means the cleanest startup PSURs we have seen are 15 to 40 pages, organised as five sections mirroring Article 86(1), with a short front-matter summary and an annex for the underlying data tables. Consultancy templates that arrive at 80 to 120 pages typically pad the document with generic regulatory commentary, duplicated content from the clinical evaluation report, and copy from the risk file. Every duplicated paragraph is a paragraph the manufacturer has to keep consistent with its source across cycles. A maintenance tax that earns nothing at audit.

The test is the same one the framework applies everywhere: for every paragraph in your PSUR, can you name the sub-element of Article 86(1) it addresses, or the specific Annex III PMS plan element it reports on, or the specific PMCF or risk file reference it carries forward? If yes, keep it. If no, cut it. What survives is a PSUR where every sentence is load-bearing and the notified body can read it in the time they actually have.

## Reality Check. Where do you stand?

1. Do you know the exact class of your device, the corresponding PSUR cadence under Article 86, and the next PSUR due date?
2. Does your PSUR contain all five Article 86(1) content elements as explicitly labelled sections?
3. For a Class III or implantable device, is your Eudamed actor and device registration in place and is your PSUR submission route via the Article 92 electronic system operational?
4. Can you trace every benefit-risk statement in your PSUR to the current version of the risk management file under EN ISO 14971:2019 + A11:2021?
5. Does the PSUR reference the PMCF plan and the main PMCF findings for the reporting period, or does the PMCF section say "not applicable" without a documented justification inside the PMS plan?
6. Have you estimated sales volume and the user population for the reporting period, with the methodology documented?
7. If your next PSUR cycle started tomorrow, how many days would it take to produce it, and how much of the content would be genuine period-specific analysis versus copy-paste from the previous cycle?
8. Have you read MDCG 2025-10 end to end, or only the PSUR subsections?

## Frequently Asked Questions

**Which device classes need a PSUR under MDR?**

Classes IIa, IIb, and III. MDR Article 86 of Regulation (EU) 2017/745 applies to all three classes. Class I devices prepare a PMS Report under Article 85 instead. The PSUR is specifically the higher-class report.

**How often must a Class IIb PSUR be updated?**

At least annually. Article 86(1) sets the cadence for Class IIb and Class III devices as at least once per year. The reporting period is clearly stated in the document, and the update is not deferred to the next surveillance audit.

**How is a Class IIa PSUR different from a Class IIb PSUR?**

The content elements are the same. All five Article 86(1) elements apply to both. The cadence differs: Class IIa is updated when necessary and at least every two years, while Class IIb is updated at least annually. The submission route also differs: neither is submitted via the Article 92 electronic system unless the device is implantable, but Class IIb PSURs typically come under closer surveillance during notified body audits because of the annual cycle.

**Do I submit a Class III PSUR to my notified body via Eudamed?**

Yes. For Class III devices and implantable devices, Article 86(2) requires the PSUR to be submitted via the electronic system referred to in Article 92. Eudamed. To the notified body involved in the conformity assessment. The notified body reviews the PSUR and adds its evaluation to the same electronic system.

**Can a PSUR and a PMCF report be the same document?**

No. The PMCF report is the clinical follow-up document required under Annex XIV Part B. The PSUR is the periodic safety update required under Article 86. The PSUR incorporates the main findings of the PMCF. It does not replace the PMCF report. The two documents are separate and reference each other.

**What happens if a Class III PSUR is late?**

A late Class III PSUR is a missed legal obligation under Article 86(1) and Article 86(2). The notified body will raise it as a non-conformity. Depending on severity, it can trigger restriction of the certificate, additional surveillance activities, or escalation to the competent authority. There is no grace period built into the Regulation.

**Does MDCG 2025-10 change what goes into the PSUR?**

No. MDCG 2025-10 (December 2025) is operational guidance. It describes how notified bodies assess PMS systems, including the PSUR, in practice. The content of the PSUR is fixed by Article 86(1) of the Regulation. The guidance interprets how the Regulation is applied, not what it requires.

## Related reading

- [What is post-market surveillance under MDR?](/blog/what-is-post-market-surveillance-mdr) – the pillar post for the PMS cluster, covering the full Article 83 to 86 framework.
- [MDR Articles 83 to 86. The PMS framework explained](/blog/mdr-articles-83-86-pms-framework) – the article-by-article deep dive that frames the PSUR against the other three PMS obligations.
- [The PMS plan under MDR Annex III](/blog/pms-plan-mdr-annex-iii) – the plan that feeds the PSUR with the data sources, methods, and cadences the PSUR reports on.
- [The PMS Report for Class I devices under Article 85](/blog/pms-report-class-i-devices) – the Class I-specific report that contrasts with the PSUR.
- [PMCF under MDR. A guide for startups](/blog/pmcf-mdr-guide-startups) – the clinical follow-up whose main findings are a required element of the PSUR.
- [8 common PMS mistakes startups make under MDR](/blog/8-common-pms-mistakes-startups-mdr) – the wider list of post-market pitfalls, including PSUR-specific ones.
- [PMS reporting checklist for startups](/blog/pms-reporting-checklist-startups) – a practical checklist covering the PMS Report and PSUR outputs.
- [Class IIa medical devices under MDR](/blog/class-iia-medical-devices-under-mdr) – the class-specific overview including PSUR cadence.
- [Class IIb medical devices under MDR](/blog/class-iib-medical-devices-under-mdr) – the class-specific overview including annual PSUR cadence.
- [Class III medical devices under MDR](/blog/class-iii-medical-devices-under-mdr) – the class-specific overview including Eudamed PSUR submission.
- [The Subtract to Ship framework for MDR compliance](/blog/subtract-to-ship-framework-mdr) – the methodology behind the lean PSUR structure.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 10(9) (QMS obligation), Article 61 (clinical evaluation), Article 83 (post-market surveillance system), Article 84 (post-market surveillance plan), Article 85 (post-market surveillance report for Class I devices), Article 86 (Periodic Safety Update Report for Class IIa, IIb, and III devices), Article 92 (electronic system on vigilance and on post-market surveillance), Annex III (technical documentation on post-market surveillance), and Annex XIV Part B (post-market clinical follow-up). Official Journal L 117, 5.5.2017.
2. MDCG 2025-10. Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices. Medical Device Coordination Group, December 2025.
3. EN ISO 13485:2016 + A11:2021. Medical devices. Quality management systems. Requirements for regulatory purposes.
4. EN ISO 14971:2019 + A11:2021. Medical devices. Application of risk management to medical devices.

---

*This post is a deep-dive spoke in the Post-Market Surveillance & Vigilance series of the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The PSUR is where the PMS system becomes visible to the notified body on a defined cadence. And where the difference between a PMS system that runs and a PMS system that exists on paper is no longer possible to hide.*

---

*This post is part of the [Post-Market Surveillance & Vigilance](https://zechmeister-solutions.com/en/blog/category/pms-vigilance) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*