The gap between your PSUR and CER is a regulatory blind spot

Written by HATEM RABEH, MD, MSc Ing

Your Clinical Evaluation Expert And Partner

in
S

This is not an isolated case. It is one of the most common structural deficiencies I encounter during CER reviews and pre-submission audits.

Most manufacturers understand that the Periodic Safety Update Report (PSUR) must summarize post-market surveillance data. Most understand that the Clinical Evaluation Report (CER) must remain current. But the workflow that connects them—the actual process of translating PSUR findings into CER updates—is often missing, informal, or delayed until an audit forces action.

This creates a gap. Not just a documentation gap. A reasoning gap. A gap that exposes clinical evaluation as reactive rather than continuous.

Why the PSUR-to-CER Link Matters Under MDR

The MDR makes clinical evaluation a continuous obligation. Article 61(11) requires manufacturers to update the CER throughout the lifecycle of the device. Annex XIV, Part A explicitly states that the clinical evaluation must be updated with data from post-market surveillance and post-market clinical follow-up.

The PSUR, required under Article 86, consolidates post-market data at defined intervals. It includes vigilance data, trend analysis, complaint patterns, emerging risks, and literature findings that were not available at the time of the last CER update.

MDCG 2020-7 and MDCG 2020-8 reinforce this connection. The clinical evaluation must integrate findings from the SSCP and PSUR. The PSUR is not just a summary for the competent authority. It is input for clinical re-evaluation.

But here is the problem: many organizations treat the PSUR as a compliance deliverable managed by post-market surveillance, and the CER as a technical document managed by regulatory affairs or clinical affairs. Different teams. Different timelines. Different priorities.

The result? PSUR findings sit in one folder. The CER sits in another. And the link between them is assumed, not executed.

What the Workflow Should Look Like

The workflow is not complex. But it must be formalized, documented, and consistently applied.

First, the PSUR must be written as if it will inform the CER. Not just as a regulatory summary. This means the PSUR conclusion section should explicitly identify findings that challenge or confirm clinical claims, safety assumptions, or benefit-risk conclusions.

Second, once the PSUR is finalized, a formal review must be triggered. This is not a passive step. It is an active decision point: do the PSUR findings require a CER update?

If the answer is yes, the CER must be revised. Not next year. Not at the next periodic review. Now.

If the answer is no, that decision must be documented with reasoning. Why do the findings not require an update? That justification itself becomes part of the traceability.

Third, the updated CER must reference the PSUR by identifier and date. The clinical evaluation must show that it considered the post-market data. The rationale for maintaining or revising clinical conclusions must be explicit.

What Triggers a CER Update

Not every PSUR requires a CER update. But certain findings always do.

If the PSUR identifies a new risk or a shift in the frequency or severity of a known risk, the clinical evaluation must be updated. The safety profile has changed. The benefit-risk balance may have shifted.

If the PSUR documents field safety corrective actions, the CER must reflect the root cause analysis, the implications for clinical use, and any revision to instructions for use or contraindications.

If the PSUR identifies a complaint trend that challenges a clinical claim—such as device underperformance in a specific patient subgroup—the CER must address it. Either by confirming the claim with additional data or by revising the claim.

If the PSUR includes new clinical literature that contradicts the state of the art analysis or the equivalence demonstration, the CER must be updated to integrate or refute that literature.

And if the PSUR identifies gaps in clinical data or performance data, the PMCF plan must be revised, and the CER must acknowledge the gap.

These are not theoretical triggers. These are the findings I see in real PSURs. And too often, they do not lead to CER updates until the next scheduled review—or until a Notified Body raises the issue.

Traceability Is the Real Test

Auditors and Notified Bodies do not just check whether the PSUR and CER exist. They check whether they are connected.

They will open the PSUR and identify key findings. Then they will open the CER and look for how those findings were addressed. If the connection is not visible, the clinical evaluation is not considered continuous.

This is why traceability must be explicit. The CER should have a section or annex that lists PSUR findings and how they were evaluated. Not as a summary. As a decision log.

For example: PSUR 2023-001 identified increased complaints related to connector detachment in humid environments. Clinical evaluation reviewed complaint data and root cause analysis. No safety risk identified. Instructions for use already include storage conditions. No CER revision required. Decision documented on [date] by [role].

That level of documentation shows continuity. It shows that the manufacturer is not passively collecting data. It shows active evaluation.

And if a CER update is required, the revision history should reference the PSUR that triggered it. Version control is not administrative. It is clinical reasoning made visible.

The Organizational Reality

In most organizations, the post-market surveillance team prepares the PSUR. The clinical affairs or regulatory affairs team manages the CER. These teams may sit in different departments. They may report to different managers. They may have different priorities and deadlines.

This is where the workflow breaks down.

The post-market team finalizes the PSUR and uploads it to the document management system. They may inform regulatory affairs by email or in a meeting. But there is no formal handoff. No clear responsibility. No documented trigger.

Months later, during a Notified Body audit, the reviewer asks how the PSUR findings were reflected in the CER. The regulatory affairs team was not aware that an update was needed. The clinical evaluation looks outdated.

The solution is not more communication. The solution is a documented procedure that defines the handoff, the review, and the decision point.

This procedure should specify who reviews the PSUR for clinical implications, who decides whether a CER update is needed, who performs the update, and who approves the decision. It should include timelines. And it should be part of the quality management system.

Without this, the link between PSUR and CER remains informal. And informal processes do not survive audits.

What Happens When the Link Is Missing

The consequences are not always immediate. But they accumulate.

First, the CER becomes less credible. If it does not reflect current post-market data, reviewers question whether the manufacturer is actively monitoring the clinical performance and safety of the device.

Second, the benefit-risk analysis becomes unreliable. If risks identified in the PSUR are not integrated into the CER, the clinical evaluation does not represent the actual risk profile. This can affect conformity assessment.

Third, the manufacturer loses the opportunity to strengthen the clinical case. Positive PSUR findings—such as confirmation of clinical performance in real-world use—can support and reinforce the CER. If they are not integrated, that evidence is wasted.

And finally, during Notified Body review or competent authority inspection, the lack of linkage is flagged as a major nonconformity. Not because a document is missing. Because the process is missing.

I have seen submissions delayed by months because the Notified Body requested a CER revision to address PSUR findings that were already documented—but not linked.

Building the Link Into Your System

The fix is not difficult. But it requires intention.

Start by defining the PSUR-to-CER review as a required step in your post-market surveillance procedure. The PSUR should not be considered complete until the clinical evaluation team has reviewed it for implications.

Create a simple template or checklist for this review. It should list the types of findings that typically require CER updates: risk profile changes, complaint trends, field actions, literature findings, performance data, PMCF results.

Document the decision. If an update is needed, schedule it and track it. If no update is needed, document why and file that justification with the PSUR.

Update your CER template to include a section on post-market surveillance integration. This section should reference the latest PSUR and summarize how its findings were addressed.

And finally, train both teams—post-market surveillance and clinical affairs—on the workflow. They must understand that the PSUR is not just a regulatory output. It is clinical input.

This is not about adding bureaucracy. It is about making clinical evaluation continuous in practice, not just in principle.

Final Thought

The gap between PSUR and CER is a blind spot because it sits between functions. Post-market surveillance believes clinical affairs will handle it. Clinical affairs believes post-market surveillance will flag it. And in the absence of a formal process, nothing happens.

The MDR does not allow that gap. Clinical evaluation must be updated with post-market data. The PSUR is the primary source of that data. If the workflow that connects them is missing, the clinical evaluation is incomplete—no matter how well each document is written.

Next, we will look at how PMCF results flow into both the PSUR and the CER, and why that three-way connection is where most manufacturers lose control of their clinical data.