Updated post-market surveillance (PMS) rules for medical devices in the UK: differences from the EU regulations

The post-market surveillance statutory instrument was laid in Parliament on 21 October 2024 to amend the Medical Devices Regulations 2002 (the UK MDR). This draft legislation seeks to insert new post-market surveillance (PMS) requirements for medical devices placed on the market in Great Britain (GB) after 16 June 2025.

This legislation will come into force on 16 June 2025. The publishing of the legislation follows the consultation on the future regulation of medical devices in the UK and is part of the wider revamp of the UK's medical device regulatory framework following Brexit. Medical devices placed on the market in Northern Ireland will continue to be subject to the EU regulatory framework under the Northern Ireland Protocol.

The requirements in the proposed PMS regulations closely resemble those already established in the EU Medical Device Regulation 2017/745 (the EU MDR) and the EU In Vitro Diagnostic Medical Devices Regulation 2017/746 (the EU IVDR). However, there are differences, some of which are subtle, and some significant, but which nevertheless mean that the requirements will not be the same in GB as in the EU.

Manufacturers across Europe should check their planned PMS activities specifically against the UK legislation and not automatically assume that they are the same as in the EU.

Naturally, reports for devices placed on the market or put into service in GB must be submitted to the MHRA and in some cases to the UK approved body and UK responsible person (UKRP), if any. If the MHRA is separately notified of incidents and informs the manufacturer of the complaints, the manufacturer must determine if it is a "serious incident" and if so, must take action accordingly and if not, explain why. Similarly, if the MHRA notifies a manufacturer of an identified risk or safety concern, then the manufacturer is obliged to investigate and report back to the MHRA on its conclusion and provide any corrective and preventive action (CAPA). The MHRA has clarified in its response to WTO comments on the draft statutory instrument that if the MHRA determines that an incident is reportable, there is no process for appealing that decision. Judicial review would therefore be the only means to do so.

Same as EU regulations

There are some PMS aspects which are the same as the EU. These include the requirement to maintain a PMS system based on the PMS plan for each device placed on the market. As in the EU, this system is to be used to identify preventive and corrective actions. However, there are many subtle differences which will require careful analysis when comparing the requirements in GB with an EU PMS strategy to ensure that the UK regulations are respected for devices placed on the market or put into service in GB.

Different from EU regulations

In its response to the WTO, the MHRA explained that it has decided on divergent definitions from the EU for the purposes of clarity or global alignment, looking to the IMDRF for inspiration. The MHRA has also defended its prescriptive requirements for data collection as being necessary to ensure a consistent level of stricter safety standards.

Different definitions

• The GB definition of "incident" is similar to the EU regulations, but includes some additions, capturing more potential failures. This includes a "side-effect" (not defined) with a negative impact on health of an individual, patient management or even public health. Furthermore, for diagnostic products an "incident" includes an "erroneous result". Unlike in the EU regulations, this does not require harm arising from a consequential decision. It also does not take account of the fact that the erroneous result might be within the permitted tolerance for the diagnostic device. Consequently, more events will be captured by the GB definition of "incident".
• The GB definition of "serious incident" includes the same terminology as the EU regulations, but then extends it to include a definition of "serious deterioration of any person's state of health" which are defined as: life-threatening illness or injury, permanent impairment of a body structure or body function, hospitalisation or prolongation of hospitalisation, medical treatment, chronic disease, and foetal distress or foetal death. This potentially expands the types of serious incidents captured by the definition. MHRA guidance clarifies that any intervention to prevent a serious deterioration of state of health would amount to a "serious incident", and that this would include self-administered treatment.
• The GB definition of "preventive action" is potentially broader and includes action to "reduce a risk posed by a device", which does not require that any "non-conformity" has occurred, although this could be similar to any "other undesirable situation".

Manufacturers would be wise to consider the EU and the GB definitions separately in relation to a specific issue to determine whether different action is required in each region.

Different requirements

Content of PMS plan: The MHRA guidance requires that the PMS plan should be proportionate to the risk posed by the device. The guidance provides that obtaining user feedback on the usability of the device and adequacy of the IFU provided is particularly important for devices used with limited or no involvement from HCPs (ie over the counter devices and devices used at home). This should be done in the most suitable and least burdensome manner.

Importance of similar devices to PMS system: Under the new UK regime, the PMS system must be expanded to include a review of publicly available information on the safety of competitor's devices that may have an impact on the manufacturer's own device as well as on the performance of the device in markets outside GB.

Reporting and investigation of serious incidents: the reporting requirements match the EU ones, except on a few points:

• UK law specifies the information to include in the report, so manufacturers should check this list before reporting serious incidents in GB.
• Perhaps obviously, the final report must be submitted to the MHRA via the MORE portal. Where the manufacturer is aware that completion of the investigation may take several months, it should keep the MHRA updated by submitting interim follow-up reports via the MORE portal.
• Although not required by the new PMS regulations, the MHRA guidance encourages that reportable incidents are notified to the approved body (if there is one) as good practice.
• The exception of expected and documented side-effects does not appear in the UK legislation. These must therefore be reported in GB where they might not be in the EU.
• The manufacturer is required to respond to MHRA requests with respect to any investigation of incidents within three working days – with some MHRA discretion if the information is not expected to be readily available.

The WTO considered that under-reporting of incidents to manufacturers is not addressed. This would require legal obligations on those other than manufacturers, such as HCPs and HCOs to report, which has never been considered as an obligation to be included in UK law. We note however the recent pro-active approach by the MHRA in directing patients to report safety problems with continuous glucose monitors or insulin pumps.

Preventive and corrective actions: manufacturers should of course note the potentially broader definition of "preventive action", and that the notification is to the UKRP or approved body (if either exist) and the MHRA. The provisions are otherwise in parallel with the EU regulations. The WTO noted the additional reporting requirement as being divergent from EU, but the MHRA consider this as a means to update their Approved Body (if of course they have one).

Post-market surveillance report (PMSR): the requirements are the same as EU regulations, save that:

• Classification is determined based on the legislation under which the device is placed on the market (MDD/MDR or UK regulations). Under those a PMSR is required for Class I general medical devices, or class A and B of the IVDR, or those which are not listed in Annex II of the IVDD.
• There is greater clarity on timings, in that the PMSR must be: (i) produced within three years of the device being placed on the GB market or put into service, whichever is sooner; and (ii) updated every three years until the end of the PMS period (see definition below) for that device. The duration of the requirement is not specified in EU regulations.
• "PMS period" is the period when the manufacturer is obliged to undertake their PMS activities for a particular device, from the sooner of the date it is first put into service or placed on the market in Great Britain until the end of the lifetime of the last device of that model to be put into service or placed on the market. The "lifetime of a device" is defined as the shelf life of a device (if there is one), plus the period that the manufacturer expects that device to perform as intended. MHRA guidance acknowledges that many devices continue to be used beyond their device lifetime, and consequently encourages manufacturers to continue to undertake PMS throughout the device's potential lifespan when it is reasonable and realistic to expect that the device may remain in use – which is significantly longer than the "life time" of the device under the EU Regulations.
• Periodic Safety Update Report (PSUR) The requirement for a PSUR applies to each device or category or group of devices and not, as in the EU regulation, for each device and categories or groups of devices. Categories are determined by either: (i) if the devices are covered by the same clinical evaluation report under EU regulation; or (ii) if the devices have the same or a similar intended purpose and are based on the same or similar technology and the manufacturer considers that the similarity between the devices justifies a single PSUR.
• The content of the PSUR will be different in GB, as it additionally includes: (i) a description of any preventive or corrective action and the rationale for doing so; and (ii) the conclusions of any post-market clinical follow-up required. Obviously, sales volumes are those for the UK, but additional information required includes a description of the characteristics of the population using the devices, with estimates for numbers using the device in the UK and outside the UK, as well as how often they use the device.
• Each PSUR must be submitted to the approved body (if there is one) for review if the device is: (i) class III; (ii) implantable (including active implantable); or (iii) listed in Annex II of the in vitro diagnostic directive 98/79 (IVDD). The approved body must then issue a report to the manufacturer and any UKRP setting out its conclusions. Since class C and D IVDs are not currently required to have an approved body under UK legislation, the MHRA guidance encourages that manufacturers follow the EU requirements to create and submit PSURs produced in relation to data from the UK to their EU notified bodies.
• "required risk analysis" has been clarified by the MHRA as being a systematic analysis of hazards and an estimation of risk that is undertaken before conducting a benefit-risk determination.
• The MHRA has also clarified that it will require where appropriate for a device that "patient and public engagement" (PPE) is engaged in to identify improvements to meaningful outcomes for patient safety and public health.
• Similar incidents occurring outside Great Britain must be reported at the final reporting stage.

Field safety corrective actions and field safety notices: the requirements are mostly the same as for the EU. Under MHRA guidance if the manufacturer has received no response from the MHRA within five days of the manufacturer's submission of the proposed field safety notice to the MHRA, then the manufacturer may go ahead and circulate the field safety notice to users. The GB regulations require the manufacturer to take all reasonable steps to ensure the field safety notice is sent to users of the device, and the MHRA guidance sets out the extent of these obligations, including that the field safety notice be hosted on the manufacturer's website and remain there for the entire PMS period. Furthermore if the manufacturer receives no confirmation of receipt of a field safety notice from users, it should try an alternative communication method such as telephone call or on-site visit to the customer. The field safety notice must also set out the details of the UKRP.

Trend reporting: these requirements are similar to the EU regulations, albeit with slightly different language, and a detailed list of information to submit. The MHRA guidance includes examples such as higher-than-expected numbers of complaints, and significant increases in the number of expected false results from a diagnostic test in comparison to the stated performance of the device in the IFU. The manufacturer must make these reports to the MHRA via the MORE portal. It is advisable for manufacturers to check the GB list of information before submitting a trend report. The manufacturer is required to respond to MHRA requests with respect to any investigation of the trends within three working days with some flexibility if more time is required, but this should be agreed with the MHRA. The regulation also requires manufacturers to inform the MHRA of FSCA's outside the GB market for the same model of device.

Retention of PMS documentation: the manufacturer and the UKRP (if there is one) must retain documentation until the later of: (i) the PMS period for that device model (see above); or (ii) 15 years in the case of an implantable device, or ten years in the case of any other device. This is different from the EU regulations for which the requirement is "10/15 years after the last device has been placed on the market". This makes the 10/15 years an absolute number and the period of use the more definitive figure for devices with greater longevity. For devices with an expected "lifetime" beyond the 10/15 years (as applicable), the retention period will therefore be longer in GB. Manufacturers of these devices will have to consider what this period is and justify it in their PMS systems for GB.

What this means for manufacturers

Manufacturers supplying their medical devices in GB must adapt to the stricter PMS obligations than those currently in place from 16 June 2025. This will involve amending any current PMS systems, developing PMS plans, and having procedures in place to promptly report and act on incidents, corrective actions and trends in accordance with the GB requirements. Any PMS policies and procedures already developed to handle the EU MDR or EU IVDR will need to be reviewed in light of the differing GB requirements. Manufacturers should also review their contracts with distributors and third-party organisations to ensure there are sufficient traceability and information sharing provisions, to enable the manufacturer to comply with the requirements of reaching all end users affected by field safety corrective action.

The MHRA guidance also suggests that several requirements may be updated further to be commensurate with the device risk class, and so manufacturers should remain alert to such changes and be prepared to update any PMS processes and policies accordingly.