UKCA post-market surveillance (PMS) is a legal obligation under the UK Medical Devices Regulations, overseen by the MHRA. It requires medical device manufacturers to maintain a structured system for monitoring device safety and performance after market approval. The PMS must include plan for incident reporting, corrective actions, and periodic safety updates. The aim is to protect patients and users.
What is UKCA post-market surveillance?
UKCA post‑market surveillance (PMS) for medical devices is the structured system manufacturers must establish to continuously monitor the safety, performance, and quality of their devices once they are placed on the Great Britain market. Under the UK Medical Devices Regulations (as amended post‑Brexit), PMS requires manufacturers to implement a documented PMS plan and collect and analyze real‑world data, such as user feedback, complaints, and adverse incidents. Additionally, they must integrate findings into their risk management and technical documentation. Depending on device class, manufacturers must prepare either a Post‑Market Surveillance Report (PMSR) or a Periodic Safety Update Report (PSUR). Moreover, they are required to report serious incidents or field safety corrective actions to the MHRA through its vigilance portal.
The PMS system must be embedded within the Quality Management System (aligned with ISO 13485), thereby ensuring corrective and preventive actions (CAPA) are taken promptly and that device safety is reassessed throughout its lifetime. This framework not only protects patients and users but also ensures manufacturers remain compliant during MHRA audits, where PMS data is a critical focus.
UKCA post-market surveillance: Key requirements
We have presented in details the key requirements of UKCA post-market surveillance.
1. PMS plan
Manufacturers must establish a documented PMS plan that outlines how they will monitor device performance and safety once it is on the market. The plan should specify methods for collecting data, analyzing trends, and reporting findings to the MHRA. It must be proportionate to the device’s risk class and complexity, thereby ensuring higher‑risk devices have more rigorous monitoring. Moreover, the PMS plan should be integrated into the Quality Management System (QMS) and updated regularly. Therefore, it serves as the foundation for demonstrating ongoing compliance and patient safety.
2. Data collection
Manufacturers are required to gather real‑world evidence from multiple sources, including user feedback, complaints, and clinical performance data. This collection must be systematic and continuous, not limited to isolated events. Data should cover both expected performance and unexpected incidents, ensuring a full picture of device behavior. Manufacturers must also monitor scientific literature, registries, and competitor devices for relevant safety signals. The goal is to detect emerging risks early and prevent harm before issues escalate.
3. Risk management integration
Findings from PMS activities must feed directly into the device’s risk management file. This ensures that identified hazards are reassessed and mitigated through design changes or updated instructions for use. Risk management updates must be documented and traceable, thereby showing clear linkage between PMS data and corrective actions. Manufacturers should use trend analysis to identify patterns that may indicate systemic risks. By integrating PMS into risk management, manufacturers maintain a proactive approach to patient safety.
4. Corrective and Preventive Actions (CAPA)
When PMS identifies risks, manufacturers must implement corrective and preventive actions promptly. Corrective actions may include recalls, safety notices, or modifications to the device design. Preventive actions focus on addressing root causes to avoid recurrence of similar issues. CAPA processes must be documented within the QMS and subject to internal audits. This ensures accountability and demonstrates manufacturers are actively managing risks.
5. Reporting obligations
Manufacturers must prepare PMS Reports (PMSR) for most devices and Periodic Safety Update Reports (PSUR) for higher‑risk classes. These reports summarize PMS findings, corrective actions, and updated risk assessments. Serious incidents and field safety corrective actions must be reported to the MHRA via the vigilance portal. Notably, timelines for reporting are strict, with serious incidents often requiring notification within 10–15 days. Compliance with reporting obligations is critical, as failure can lead to regulatory enforcement or loss of UKCA marking.
Device‑specific considerations of UKCA post-market surveillance requirements
We have presented the device specific requirements of UKCA post-market surveillance.
1. Active implantable medical devices
These devices carry the highest risk. Hence, the UKCA post-market surveillance requirements for active implantable medical devices are particularly stringent. Manufacturers must prepare detailed Periodic Safety Update Reports (PSURs) that include trend analysis and long‑term performance data. Clinical follow‑up studies are often required to validate ongoing safety and effectiveness. Any adverse incident must be reported to MHRA within strict timelines, often shorter than for lower‑risk devices. The PMS system must remain active for the full lifetime of the implant, even beyond the validated use period.
2. In vitro diagnostic devices (IVDs)
IVDs require PMS systems that monitor diagnostic accuracy and reliability in real‑world use. Manufacturers must track false positives/negatives and assess clinical performance continuously. Trend analysis is critical, as small deviations can have significant public health implications. PSURs are mandatory for higher‑risk IVDs, while lower‑risk ones require PMS Reports. Manufacturers must also monitor scientific literature and registries for emerging diagnostic risks.
3. Software as a Medical Device (SaMD)
SaMD requires PMS systems that account for frequent updates and cybersecurity risks. Manufacturers must monitor software performance, user complaints, and interoperability issues. Post‑market vigilance includes tracking algorithm drift and unintended consequences of updates. CAPA processes must address both technical bugs and clinical safety concerns. The PMS plan should include proactive monitoring of cybersecurity vulnerabilities and patches.
4. Home healthcare devices
Devices, such as BP monitors or glucose meters, require PMS systems focused on usability and reliability in non‑clinical settings. Manufacturers must collect feedback from patients and caregivers and not just healthcare professionals. Data collection should emphasize ease of use, error rates, and device durability. Adverse incidents must be reported promptly, even if they occur outside hospitals. PMS findings often lead to updates in user manuals or training materials to improve safe use.
Pro tips for manufacturers to comply with UKCA post-market surveillance requirements
- Embed PMS into QMS early: Integrate PMS into your ISO 13485 QMS from the beginning. This ensures that vigilance reporting, CAPA, and risk management updates flow naturally into your operational processes. Auditors will look for seamless integration. Embedding PMS early reduces duplication and strengthens audit readiness. It also builds organizational discipline around continuous monitoring.
- Standardize PMS reporting templates: Create uniform templates for PMS Reports (PMSR) and Periodic Safety Update Reports (PSUR). This saves time, ensures consistency, and makes regulatory submissions smoother. Templates should include sections for trend analysis, CAPA actions, and updated risk assessments. Standardization also helps cross‑functional teams contribute effectively. Regulators appreciate clarity and consistency in documentation.
- Leverage digital tools for vigilance: Use automated systems to capture complaints, adverse events, and feedback in real time. Digital vigilance tools reduce reporting delays and improve data accuracy. They also have provisions for trend analysis dashboards that highlight emerging risks. This proactive approach demonstrates regulatory maturity.
- Train teams on PMS responsibilities: Ensure staff across manufacturing, quality, and customer support understand PMS obligations. Training should cover incident detection, reporting timelines, and CAPA execution. Role‑specific training builds accountability and reduces compliance gaps. Refresher sessions help teams stay aligned with evolving MHRA guidance. A well‑trained workforce is your strongest defense during audits.
- Plan for dual compliance (UKCA + EU MDR): If you are planning to sell in both GB and NI/EU, design PMS systems that satisfy both frameworks. Maintain separate reporting streams for MHRA and EU. Align PMS plans to avoid duplication while meeting divergent requirements. Dual compliance planning reduces operational burden and audit stress. It also future‑proofs your regulatory strategy against further divergence.
In this blog, we have summarised UKCA post-market surveillance requirements. For any assistance with UKCA marking, drop an email at [email protected] or call/Whatsapp on 9996859227.
