Why your registry data may not count as valid PMCF evidence

Written by HATEM RABEH, MD, MSc Ing

Your Clinical Evaluation Expert And Partner

in
S

This situation repeats across reviews more often than it should. Patient registries sound like ideal PMCF data sources. They track real-world device use across multiple sites, over years, with standardized follow-up. For manufacturers, they appear as ready-made evidence streams that satisfy MDR Article 83 requirements without the complexity of running proprietary studies.

But here is where the logic breaks down: citing a registry as a data source is not the same as having access to usable, valid evidence. And the gap between these two realities creates major deficiencies during reviews.

What the MDR actually requires from PMCF data sources

MDR Article 83 establishes the obligation for manufacturers to actively collect and analyze post-market data on safety and performance. The data must be relevant to the device, systematically collected, and suitable for confirming that residual risks remain acceptable.

MDCG 2020-8 on PMCF clarifies that manufacturers can use various data sources, including registries, as long as the data quality and relevance are established. This sounds straightforward until you start asking practical questions about how registry data actually reaches your clinical evaluation report.

Most manufacturers approach registries with assumptions that do not hold in practice. They assume registries will share patient-level data. They assume data fields align with their PMCF objectives. They assume access is straightforward once they identify the relevant registry.

What reviewers see is a plan built on intention, not on verified capability. And when regulatory pressure increases, that distinction becomes the reason for major observations.

Access is not automatic, even for device-specific registries

Let us be precise about what access means. It does not mean the registry exists and tracks your device. It means you have a formal agreement that specifies what data you will receive, in what format, at what intervals, and under what conditions.

Many registries are run by professional societies, academic institutions, or national health authorities. They operate under strict data protection rules. They serve research and public health goals that may not align with your commercial objectives. They do not automatically share data with manufacturers, even if the registry tracks those manufacturers’ devices.

I have seen manufacturers reference major national registries in their PMCF plans, assuming they could request data as needed. When they finally contacted the registry administrators, they discovered multi-year waiting lists for data requests, ethics committee approvals required for each query, or flat refusals to share individual manufacturer data.

In some cases, registries publish aggregate annual reports but do not provide patient-level data to manufacturers at all. You can cite the registry’s published findings in your clinical evaluation, but that is literature review, not active PMCF data collection.

The question is not whether the registry is relevant. The question is whether you have contractual, operational access to usable data.

Data validity depends on registry design and your clinical objectives

Even when access is secured, the validity of registry data is not guaranteed. Validity here means the data is fit for purpose relative to your PMCF objectives, residual risks, and benefit-risk profile.

Registries are designed to answer specific research or surveillance questions. Those questions may overlap with your PMCF needs, but they rarely match exactly. A registry tracking surgical outcomes for a procedure may not capture device-specific complications. A registry following long-term implant survival may not document functional outcomes or quality of life measures that matter for your device’s intended benefits.

You need to assess whether the registry’s data fields, follow-up intervals, and endpoint definitions align with the safety and performance claims you made in your clinical evaluation. If your device’s residual risk profile includes rare but serious complications, does the registry capture those events with sufficient granularity? If your performance endpoints are operator-dependent, does the registry document operator experience?

This assessment must be documented. MDCG 2020-8 expects manufacturers to describe how PMCF data sources address specific PMCF objectives. A general statement that a registry tracks your device category is not sufficient.

Reviewers look for evidence that you analyzed the registry’s protocol, understood its limitations, and confirmed it can generate data that addresses your PMCF plan’s stated objectives.

What happens when the registry data arrives

Assume you secured access and confirmed relevance. The registry sends you data. Now you face operational realities that most PMCF plans do not anticipate.

Registry data often arrives in formats that require significant cleaning and restructuring before analysis. Variables may be coded differently than your internal systems. Missing data may exceed acceptable thresholds for certain endpoints. The patient population in the registry may include off-label use, pediatric cases, or co-interventions that confound interpretation.

You need internal processes to handle this. Who receives the data? Who verifies its completeness and accuracy? Who integrates it into the periodic safety update reports and clinical evaluation updates? These are not trivial questions. They require resources, competencies, and documented procedures.

If the registry data reveals safety signals or performance concerns, you must have a process to escalate, investigate, and report. MDR Article 87 and Article 88 establish timelines for incident reporting and field safety corrective actions that do not wait for your next scheduled PMCF report.

So access to registry data creates operational obligations. Your quality management system must account for these workflows. Your PMCF plan should reference the procedures that govern data receipt, analysis, and escalation.

When registries replace proprietary PMCF studies

Some manufacturers use registry participation as a substitute for conducting their own PMCF studies. This can be justified, but only under specific conditions.

If a registry comprehensively addresses your PMCF objectives, provides timely data, and allows you to meet MDR requirements for active evidence collection, then relying on the registry may be appropriate. But you must demonstrate this in your PMCF plan and clinical evaluation.

What I see in deficient submissions is manufacturers citing registries as their sole PMCF activity without explaining why proprietary studies are unnecessary. They do not compare the registry’s scope to their residual risks. They do not justify why the registry’s follow-up intervals are sufficient. They do not address gaps where the registry does not collect relevant data.

MDCG 2020-8 is clear that PMCF should be tailored to the device. If your device has unique features, novel indications, or specific risk concerns, a general registry may not provide targeted evidence. You may need supplementary studies, targeted surveillance, or enhanced data collection even if you participate in a registry.

Notified Bodies evaluate whether your PMCF approach is proportionate to the device’s risk class, novelty, and clinical claims. A Class III implant with limited pre-market data cannot rely solely on a registry that provides annual aggregate statistics.

Documentation that closes the gap

The gap between citing a registry and having valid access closes through documentation. Here is what reviewers expect to see:

Data access agreements: Formal contracts or letters of agreement that specify what data you will receive, how often, and under what conditions. These should be referenced in the PMCF plan and available for audit.

Registry protocol review: A documented assessment of the registry’s design, data fields, follow-up intervals, and endpoint definitions. This assessment should map registry outputs to your PMCF objectives and identify any gaps.

Data management procedures: QMS procedures that describe how registry data will be received, verified, analyzed, and integrated into clinical evaluation updates and PSURs.

Gap analysis: If the registry does not fully address your PMCF objectives, document what additional data sources or studies will cover the remaining needs.

Validity assessment: A reasoned argument for why the registry’s data quality, patient population, and endpoint definitions are suitable for confirming your device’s safety and performance.

This documentation does not need to be extensive, but it must be explicit. Reviewers need to see that you thought through the practical realities, not just the theoretical convenience of using registry data.

When registry data does not materialize

I need to address the scenario where registry access falls through. You planned to use registry data, submitted that plan to your Notified Body, but the registry denies access or imposes conditions you cannot meet.

This happens. And when it does, you must update your PMCF plan and clinical evaluation before your next significant submission or audit. You cannot leave outdated commitments in your technical documentation.

The updated plan should explain what happened and what alternative data sources you will use. This might mean conducting a proprietary PMCF study, using literature surveillance more actively, or enhancing complaint and vigilance data analysis.

Notified Bodies understand that post-market plans evolve. What they do not accept is discovering that your documented PMCF strategy has not been operational for months or years without any formal update or alternative.

This is about maintaining alignment between what your documentation states and what you actually do. MDR Annex IX and Annex XI require manufacturers to inform Notified Bodies of significant changes to post-market surveillance and PMCF plans. Loss of a major data source qualifies.

Final perspective

Patient registries are valuable PMCF data sources when access and validity are verified, not assumed. They can provide real-world evidence at scale, support benefit-risk assessments, and complement proprietary studies.

But they are not automatic solutions. They require the same rigor in planning, documentation, and operational management as any clinical investigation. The manufacturers who succeed with registry-based PMCF are those who secure formal agreements early, validate data relevance against their specific risks, and maintain active oversight of data quality and completeness.

If your PMCF plan relies on registries, review whether you have closed the gap between intention and capability. If not, address it now, before the next audit.

Peace,
Hatem
Clinical Evaluation Expert for Medical Devices
Follow me for more insights and practical advice.