Periodic safety update and post-market surveillance reports for devices
The EU Medical Device Regulation gave devices two surveillance reports: the periodic safety update report, long required in pharmacovigilance, and the slimmer post-market surveillance report. Which report a device needs turns on its class. The first safety update reports fell due before the guidance on writing them was final, and in 2022 their content was set out only in a draft guidance that is ambiguous in places. The workload the reports bring has led to the view that companies should invest in automating their authoring.
Purpose of the two reports
The periodic safety update report is required under Article 86 of the EU Medical Device Regulation 2017/745 (MDR) and the post-market surveillance report under Article 85. The safety update report has long been a requirement in pharmacovigilance and is now an obligation for devices. As in the pharmaceutical industry, the reports aim at a more robust surveillance system. They are meant to strengthen the effectiveness of surveillance activities and to serve as a source for identifying new safety signals, monitoring how well those mechanisms work, updating the benefit-risk profile, and keeping an effective and transparent dialogue between manufacturers, regulators and patients. Creating the reports will strengthen the surveillance and vigilance system for devices by improving quality and patient safety.
The safety update report summarises three things: the results and conclusions of the surveillance data gathered through the activities in the Article 84 surveillance plan, the manufacturer's conclusions from those activities, which may result in corrective and preventive action, and the conclusion on any change in the benefit-risk profile. The surveillance report has similar content with fewer requirements and is the slimmer document. As of June 2022, the regulation still described both at a somewhat high level, leaving a fair amount to interpretation by manufacturers and notified bodies.
Reports by device class
| Post-market surveillance report | Periodic safety update report | |
|---|---|---|
| Device class | Low-risk class I devices | Medium- to high-risk class IIa, IIb and III devices, including class IIa and IIb implantables |
| Update | As needed, determined by the manufacturer | At least every two years or yearly according to class |
| Submission | Kept available to the EU competent authorities on request, but need not be submitted regularly | For class III and implantable devices, must be submitted through the European Database for Medical Devices (EUDAMED) |
Both reports carry the results and conclusions of the analyses of the surveillance data gathered under the Article 84 plan, and the rationale and description of any preventive and corrective actions taken. Both draw on complaint handling and vigilance, covering serious and non-serious incidents under Article 88; recalls and field safety notices; the scientific and technical literature; and, if applicable and based on the class and type of device, customer feedback and other proactive activities such as satisfaction or user surveys, social media listening, focus groups and expert panels. If applicable and based on the class and type of device, the safety update report adds the following.
- information on similar devices from adverse event and field safety corrective action databases, such as MAUDE, the Manufacturer and User Facility Device Experience database
- registries, such as national joint arthroplasty registries
- the main findings of post-market clinical follow-up activities, such as specific literature, hospital registries, patient databases, specific clinical customer surveys and follow-up studies
- the sales volume, with an estimate of the size and other characteristics of the population using the device and, where practicable, its frequency of use
- the conclusions of the benefit-risk determination
The first reports and the draft guidance
The first safety update reports for class IIb devices, implantables included, and for class III devices were due on 26 May 2022, one year after the regulation's date of application, before the guidance on writing them was final. The Commission had worked for several years on MDCG guidance for the report, but as of June 2022 only drafts had been shared for comment. The guidance still showed as MDCG work in progress on the Commission's website, although its expected endorsement was listed for the fourth quarter of 2021. With no official guidance to refer to, the device sector and the notified bodies could not expect manufacturers to follow the draft to the letter. Regular conversations and agreements with the notified body on the submissions and their content are therefore highly recommended.
Several drafts have circulated since 2020, and the guidance grew from a lean, high-level document into a dense, intricate and extensive one. It sets out the regulation's high-level points in more detail and precision, and in doing so introduces more ambiguity in certain sections. Some sections lack clarity because of complexities that manufacturers can interpret differently. The repeated redrafting without a final version added hardship for manufacturers, especially as the first deadlines approached. The draft covers what corrective and preventive actions to present, how to group devices, surveillance requirements for devices remaining under the directives, until when a report is required (the device lifetime), data collection periods, subsequent updates, and the timelines and submission with and without EUDAMED. Its six annexes include a content checklist, data reporting and evaluation, terminology, and a form for EUDAMED submission. One annex proposes table templates for presenting data, and the templates make evident how time-consuming authoring a report to the guidance will be and what regulators will probably expect.
Sections of the draft guidance and their difficulties
The 2021 draft sets out the report's content as follows, here with the difficulties two authors writing in 2022 saw in several of its parts.
- Executive summary. It gives background on the benefit-risk profile, where applicable a brief status of the actions the manufacturer and the notified body took in the previous report, and the data collection period. Based on the main results of the current report, it states clearly whether the benefit-risk profile has been affected positively or negatively.
- Device description. It gives the classification, CE date or first market availability, market status, intended purpose, indications, contraindications and target population. MDR devices are described by Basic Unique Device Identification – Device Identifier (Basic UDI-DI) group, outlining where applicable the device changes within the groups since previous reports. Legacy and custom-made devices are described by model or group.
- Grouping of devices. Several Basic UDI-DIs or device families may share one report as long as they have the same notified body. A device marketed under successive certificates from different notified bodies should be cross-referenced in the report. The draft introduces the concepts of leading and secondary devices and of changes in the leading device. Where a report covers several Basic UDI-DIs, the data must be presented so that the performance of each can be followed, which can become very complex depending on the manufacturer's portfolio and number of devices.
- Sales volume. Units sold, shipped or implanted, or another suitable measure, are given for all devices placed on the market, yearly and by size, model and configuration. Sales or shipments can be hard to establish for multiple-use instruments, because many are supplied in loaner kits that go to the hospital and come back to the manufacturer. Implant sales can, for example, serve instead as a reference for the number of surgeries.
- Size and characteristics of the population using the device. They are reported as far as the manufacturer can. They are often hard to obtain. Patient information is sensitive and shareable only at a high level, and hospitals and surgeons do not usually report it.
- Surveillance data. It covers complaints with trend analyses, serious incidents reported to competent authorities, and non-serious incidents under the Article 88 trend report, using the adverse event terminology of the International Medical Device Regulators Forum (IMDRF). The draft gives no guidance on which statistical tools to use for trending and no template or guidance for trending under Article 88, and trending on IMDRF data might be hard without enough historical data. General follow-up data include complaints not reported in the vigilance section, grouped by IMDRF code or internal event code with occurrence rates and a justification for any excluded. They also include the scientific literature, public registry data and public information on similar devices. For example, most national joint registries collect data only on hip and knee implants, and many registries have incomplete data and cannot produce special reports for industry. For adverse events found in the literature, product information is extremely limited or missing, so a proper investigation is hardly possible, and they may duplicate complaints. Corrective and preventive actions arising from the surveillance system are included. Those relating to the quality management system are excluded unless they could directly affect safety, performance or quality, but which can be excluded is hard to decide, since every such action can somehow directly affect them. Field safety corrective actions under Article 87 arising from the surveillance system are listed.
- Specific follow-up data. The section summarises data from follow-up activities, not limited to follow-up studies, which may include registers, manufacturer registries, surveys and real-world evidence analyses. It may refer to the follow-up report, but the safety update report should itself give enough detail. Surveys might not provide specific enough information on adverse events.
- Findings and conclusion. They cover data validity and limitations, where applicable newly identified risks with their potential clinical impact and newly identified benefits, whether the benefit-risk profile has changed, the specific actions taken to address any identified unknown risks, and the actions taken during the data collection period.
Workload of the reports
The requirements of the safety update report should not be underestimated. Beyond the challenges of its content, creating a safety update report involves numerous steps, such as retrieving, processing and analysing the data, keeping it consistent and accurate, developing and sustaining proactive surveillance activities, and building quality into the process. The surveillance requirements apply to legacy and older devices too, with some flexibility to write leaner documents for older devices. An older device not phased out of the market before the date of application comes under the conditions of the MDR. As of 2022, many non-EU countries had followed the MDR's example with stricter surveillance requirements of their own, so companies were starting to receive requests for surveillance reports that may or may not need the same content, which adds to the workload.
One writer experienced in pharmaceutical and device work held in 2018 that the post-market surveillance report may prove the most difficult device document for medical writers to prepare, because at that time some companies had not consistently gathered information about a product once it was marketed. In such cases the writer would first need to gather enough information about the product from literature searches and from the data the company already holds, and then perform gap analyses.
The two reports are among the regulation's most effective tools for showing cohesion among vigilance, surveillance, clinical evaluation, risk processes and regulators. They are therefore crucial to determining changes in the benefit-risk profile. As with any process implemented for the first time, their first implementation brings challenges from the additional resources, workload and high costs it brings, notably where data mining is involved. Preparation should take into account resource planning with clear roles and responsibilities, training to build expertise, metrics such as late submissions, errors and inconsistencies and audit observations, automation of data mining and authoring to reduce manual labour and human error, and clear and constant communication with the notified body on content and timelines.
Automating the authoring
The automation and AI that pharmacovigilance has applied to safety data are transferable to devices, specifically to authoring the safety update and surveillance reports. One 2022 assessment of the draft MDCG guidance holds that device companies, especially those with large portfolios, should seriously consider investing in automating the creation of both reports. The aim would be to reduce the cost of creating them manually, shorten lead times, reduce workload, increase the number of reports produced and meet submission deadlines while keeping content quality and compliance with the MDR and other applicable regulations, with a beneficial business and cost impact. The same assessment holds that such automation is the future for the device sector. The challenges, risks and limits of automation to consider include cost-benefit, ensuring consistent source data, errors in pulling it, and maintaining the tool as regulations change.