What Level 2 Post-Market Surveillance Maturity Looks Like in Medical Device Organizations

You have PMS plans for your marketed products. You produce PSURs on the required cadence. You've even started monitoring clinical literature. So why did your notified body issue a major nonconformity for PMS when your last audit went clean on complaint handling?

Because your PMS system is complaint handling under a different name, and your notified body finally looked closely enough to see it. The PMS plans reference data sources beyond complaints — literature monitoring, registry data, user feedback — but the actual data flowing into your surveillance analyses comes almost entirely from your complaint system. The PSURs compile that complaint data into tables and charts, summarize it dutifully, and conclude that the device continues to meet its intended purpose. What they do not do is analyze. They do not compare observed adverse event rates against the expected rates established in your clinical evaluation. They do not update the benefit-risk determination with any rigor. They do not define actions based on findings because the findings never go deeper than "we received X complaints in Y categories."

This is the Level 2 plateau. The documentation looks right. The operational reality underneath it is thin.

The Level 2 Tells

There are reliable indicators that distinguish Level 2 from genuine systematic surveillance, and auditors know them. The first tell is portfolio inconsistency. Pull your PMS plans for five products and compare them. At Level 2, the plan for your newest product — the one submitted under the MDR — is detailed, product-specific, and operationally credible. The plan for the legacy device that's been on market for a decade is a lightly edited template with generic language about "monitoring relevant data sources." The gap between your best plan and your worst plan reveals your actual maturity level.

The second tell is the PSUR that summarizes without concluding. Open any of your PSURs and look for the benefit-risk determination. At Level 2, you will find one — the MDR requires it — but it will read as a formulaic restatement rather than a genuine analytical exercise. "Based on the data reviewed, the benefit-risk profile remains favorable" appears without the analytical work that would make that conclusion credible. No observed-versus-expected comparison. No discussion of whether new post-market data introduces previously unidentified risks. No assessment of whether the competitive landscape or state of the art has shifted in ways that affect the benefit-risk balance.

The third tell is PMCF that exists on paper but not in practice. PMCF plans describe literature review, registry participation, and possibly post-market clinical studies. Execution relies almost entirely on literature searches and complaint data analysis, because the organization lacks the clinical operations infrastructure to collect proactive clinical data. The PMCF plan and the PMCF reality occupy different universes.

The fourth tell is signal detection by intuition. Someone reviews complaint data quarterly and looks for patterns. There is no statistical methodology. There is no normalization of complaint counts against installed base. There is no predefined threshold for what constitutes a signal versus normal variation. When asked how they determine whether a trend is statistically significant per Article 88 reporting obligations, the answer is a pause followed by something about using professional judgment.

Why Level 2 Feels Like Enough

Level 2 is a comfortable place. The regulatory infrastructure exists. Plans are written. Reports are produced. Audits generate minor findings, not major nonconformities — at least until a notified body applies genuine scrutiny to the analytical depth of your PSURs or the execution status of your PMCF plans. Organizations can operate at Level 2 for years without crisis, which creates the illusion that Level 2 is adequate.

It is not adequate under the MDR, and the gap is closing. Notified bodies are applying increasing scrutiny to PMS documentation as they work through MDR certification and recertification cycles. The questions are getting more specific. Show me the expected adverse event rates from your clinical evaluation and show me how your PSUR compares observed rates against them. Show me the PMCF evaluation report — not the plan, the report. Walk me through your signal detection methodology. These are not unreasonable questions. They are the questions that Articles 83 through 86 were designed to answer. They are the questions Level 2 organizations cannot answer with substance.

Crossing to Level 3

The transition from Level 2 to Level 3 is not a documentation exercise. It is an execution discipline problem. Five investments close the gap.

Standardize PMS plan quality across the portfolio. Audit every existing plan against the operational specificity of your best plan. Upgrade the weakest to match. Every plan must specify concrete data sources, collection methods, evaluation criteria, and action triggers — not generic references to "relevant post-market data."

Build analytical rigor into PSURs. Create a PSUR template that requires observed-versus-expected rate comparison, an updated benefit-risk determination grounded in data, and a defined action plan with owners and timelines. Train PSUR authors on the analytical methodology, not just the template structure.

Validate literature search protocols. Test each protocol against a set of known relevant publications. If the protocol does not capture them, the protocol is inadequate regardless of how well-documented it is. Expand database coverage beyond PubMed where the validation reveals gaps.

Operationalize PMCF beyond literature review. For each product requiring PMCF, determine whether literature review alone generates sufficient clinical evidence or whether registry participation, surveys, or post-market studies are needed. Where additional methods are required, commit resources and timelines.

Implement a statistical trending methodology. Define what constitutes a signal. Adopt a recognized approach — reporting odds ratios, proportional reporting ratios, or threshold-based methods calibrated to your data volumes — and apply it consistently to complaint data normalized against distribution volumes.

The common thread across all five investments is the same: stop treating the documentation as the deliverable. The deliverable is the analytical capability the documentation describes.

Take the Post-Market Surveillance Maturity Assessment to measure your current PMS capability across all eight dimensions and identify the specific gaps between Level 2 and Level 3.