Templates and records · ISO 13485 · Clause 8.2.1

Medical device post-market surveillance plan

How the manufacturer will find out, actively and systematically, whether its device is still safe and performing as promised once it is in users' hands.

In one sentence

The post-market surveillance plan defines the data sources — complaints, incidents, literature, registries, surveys, similar devices — the indicators and thresholds that trigger a review of the benefit-risk ratio, the trend analysis methods and the reporting frequency, because ISO 13485 requires a documented feedback process gathering production and post-production data (8.2.1) and the MDR requires such a plan for each device (Article 84 and Annex III).

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 8.2.1 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory document Documented feedback procedure (8.2.1); the plan itself is required by Article 84 of the MDR
Who fills it in: Regulatory affairs and quality With clinical evaluation for the clinical data; overseen by the person responsible for regulatory compliance
When: Before placing on the market Reviewed with each periodic report and whenever the device or its risks change
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

ISO 13485 requires a documented feedback process that gathers production and post-production data, with that information serving as an input to risk management and product improvement. If regulations require specific post-market experience, its review forms part of this process.

The European Regulation goes further: every manufacturer must have a post-market surveillance system proportionate to the device class (Article 83), based on a plan that forms part of the technical documentation (Article 84 and Annex III). From it come the post-market surveillance report for class I (Article 85) and the periodic safety update report for classes IIa, IIb and III (Article 86).

A plan that only says "complaints will be analysed" is reactive and does not meet the MDR: it must include proactive data collection and defined thresholds.

Read it in context: Measurement, analysis and improvement, in the ISO 13485 Academy

Structure

Fields the template should include

Device or family and its class
Reactive data sources: complaints, incidents, returns
Proactive sources: surveys, registries, literature, similar devices
Indicators and alert thresholds
Statistical and trend analysis methods
Link to risk management and clinical evaluation
Post-market clinical follow-up or justification for not carrying it out
Communication with authorities, notified bodies and distributors
Type of resulting report and frequency
Responsibilities and date of next review

Example

Example: plan for a class IIa pulse oximeter

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Device	Oxilite pulse oximeter (fictitious) · class IIa
Reactive sources	Complaints, returns and incidents reported by distributors
Proactive sources	Six-monthly survey of 20 user sites · annual literature review · alerts on similar devices
Indicator	Accuracy complaint rate per 1,000 units sold
Threshold	More than 0.5‰ in a half-year opens a review of the risk analysis
Trends	Six-monthly control chart; a significant increase is assessed for trend reporting (Article 88)
Report	Periodic safety update report every two years (class IIa)
Next review	January 2027

At the audit

Mistakes auditors commonly flag

A generic plan identical for devices of very different classes and risks.
Reactive sources only, with no active data collection.
Indicators with no threshold: nobody knows when to act.
Results do not feed back into the risk management file or the clinical evaluation.
Periodic reports not delivered at the frequency the Regulation sets.

In Kimobox

How this record is kept in Kimobox

1Post-market surveillance is managed with regulatory reporting alerts.
2Indicators are configured on the dashboard, and the system calculates the monitoring.
3Each complaint is linked to its batch, its cause and its action.
4Management review arrives with complaints and vigilance already preloaded.

Frequently asked questions

What people ask us before getting started

What is the difference between post-market surveillance and vigilance?

Post-market surveillance is the systematic collection and analysis of all experience with the device. Vigilance is one specific part of it: reporting and handling serious incidents and field safety corrective actions (Articles 87 to 92 of the MDR).

Is the plan part of ISO 13485?

As a plan, it is required by the MDR, not ISO 13485. But the standard requires a feedback process that gathers post-production data, and in the EU the natural way to meet it is with the Article 84 plan.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring