Your CER Was Approved Last Year. Why Update It Now?

Written by HATEM RABEH, MD, MSc Ing

Your Clinical Evaluation Expert And Partner

in
S

The confusion is understandable. Under the old directives, a clinical evaluation was often treated as a document you built once and revisited only when the device changed or a major incident occurred. Many teams still operate with that mindset.

But MDR Article 61 changed the contract. Clinical evaluation is now defined as a process, not an endpoint. And that process does not pause when certification is granted. It runs parallel to the device lifecycle, constantly absorbing new data, new evidence, and new risks.

The question is not whether to update your CER. The question is when the update is triggered, what depth it requires, and how to structure it so that reviewers see it as genuine clinical vigilance rather than box-ticking.

What MDR Actually Requires

Article 61(11) states that clinical evaluation shall be updated throughout the lifecycle of the device with data obtained from PMCF activities and from other sources of clinical data. Annex XIV Part A further clarifies that the CER must reflect the current state of the art and continuously assess safety and performance.

MDCG 2020-13 adds operational clarity. It explains that the frequency of updates depends on the device class, maturity of the technology, emerging risks, and data availability. But it also makes one point very clear: updates are mandatory, not optional.

This is where teams get stuck. They treat updates as administrative chores rather than clinical exercises. The result is superficial refresh documents that do not engage with new evidence, do not reassess equivalence validity, and do not integrate PMCF findings in a meaningful way.

Notified Bodies spot this immediately. They see a document dated 2024 that still references literature from 2020, repeats the same conclusions, and adds a short paragraph about PMCF without analyzing whether new data changed anything.

When Is an Update Triggered?

The regulation does not give fixed timelines for every situation. Instead, it defines triggers. Some are obvious. Some are easy to miss.

First trigger: PMCF milestones. If your PMCF plan commits to interim analyses at twelve months, then the CER must be updated when that analysis is completed. This is not just about adding data. It is about interpreting what that data reveals about performance, residual risks, and whether equivalence assumptions still hold.

Second trigger: changes to the device. Any modification that affects clinical performance, intended use, or risk profile requires a clinical evaluation update. This includes software changes, material changes, or new indications. The scope of the update depends on the scope of the change, but it must be justified clinically.

Third trigger: new safety information. This includes field safety notices, vigilance reports, trend analyses, or emerging risks identified through literature surveillance. If new information changes the risk-benefit assessment, the CER must reflect that change and document the reasoning.

Fourth trigger: evolution of the state of the art. This is the one teams underestimate. If new clinical guidelines emerge, if treatment standards shift, if new evidence challenges the comparators used in your analysis, the CER must address those developments. SOTA is not static. Neither is your CER.

Fifth trigger: periodic review obligations. Even if nothing dramatic happens, Class IIb, III, and implantable devices require structured reassessment. The frequency depends on the PMCF plan, but it is typically annual or biennial. This reassessment is not cosmetic. It is a full review of whether prior conclusions remain valid.

What Depth Does an Update Require?

Not all updates are created equal. A minor change in labeling does not require rewriting the entire CER. But a shift in clinical evidence for your equivalent device absolutely does.

The challenge is that many teams default to the lightest possible update, regardless of what the trigger demands. They add a new section, update the date, and submit. This works until the Notified Body asks why new PMCF data showing unexpected adverse events did not lead to a revised risk-benefit analysis.

A proportionate update starts with a gap analysis. What changed? What new data do we have? Does this data challenge any previous assumptions? Does it require new literature searches? Does it affect equivalence validity?

If the update is triggered by routine PMCF reporting and the data confirms expectations, the update can be focused. You integrate the findings, confirm that conclusions hold, and document that no new risks emerged.

If the update is triggered by new safety signals, the depth increases. You must analyze the signal, compare it to literature, assess whether it represents a true risk increase, and adjust your risk-benefit profile accordingly. This often requires revisiting your clinical data appraisal and recalculating benefit-harm ratios.

If the update is triggered by SOTA evolution, the depth increases further. You may need to repeat literature searches, reassess comparators, and re-justify why your device still meets current standards. This is not about defending old conclusions. It is about demonstrating that your device remains clinically acceptable in light of new knowledge.

Equivalence-based evaluations are especially sensitive here. If your equivalent device publishes new long-term data showing complications you did not account for, your equivalence claim is no longer complete. You must either demonstrate that your device does not share those risks or accept that your risk profile has changed.

How to Structure the Update

Structure matters because it signals to the reviewer how you approached the update. A well-structured update makes it clear what changed, why it changed, and what the clinical implications are.

Start with an executive summary of the update. This is not the same as the CER executive summary. It is a short section that explains what triggered the update, what new data was reviewed, and what conclusions were adjusted or confirmed.

Then document the new data sources. This includes PMCF reports, vigilance summaries, new literature, updated SOTA reviews, or post-market surveillance findings. Each source should be appraised for relevance and quality, just as you would in the initial CER.

Next, integrate the new data into the existing appraisal sections. Do not create isolated appendices. If new PMCF data affects your safety profile, update the safety section. If new literature changes your benefit assessment, revise the clinical benefit section. The CER should read as a cohesive document, not a stack of updates.

Then reassess your conclusions. This is the section reviewers focus on. Did the risk-benefit ratio change? Are there new residual risks? Do the performance claims still hold? Is equivalence still justified? If the answers are yes, explain why. If the answers are no, explain what changed and what you will do about it.

Finally, update your PMCF plan if necessary. New findings often reveal gaps that require additional data collection. If your update identifies a new risk, your PMCF plan should reflect how you will monitor that risk going forward.

One common mistake: treating the update as a separate document. Some teams create a “CER Update Report” that lives alongside the original CER. This creates version control issues and makes it harder for reviewers to see the full picture. The updated CER should be a single, integrated document with clear version tracking and change logs.

What Happens If You Do Not Update on Time?

Missed updates are not administrative oversights. They are non-conformities. If your PMCF plan commits to annual CER updates and you miss the deadline, you are out of compliance with your own procedures and with MDR requirements.

Notified Bodies track this closely during surveillance audits. They check PMCF timelines, compare them to CER version dates, and ask why gaps exist. If you cannot justify the delay with solid reasoning, it becomes a finding.

But the bigger risk is clinical, not procedural. If you delay an update, you are operating with outdated clinical knowledge. You may miss emerging risks, fail to act on safety signals, or continue making claims that are no longer supported by current evidence.

This is especially dangerous for devices with equivalence-based evaluations. If your equivalent device is withdrawn or restricted and you do not update your CER, you are making unsupported safety claims. When a serious incident occurs, that delay becomes a liability.

The regulatory pressure is real, but the clinical responsibility is greater. Updates are not about satisfying auditors. They are about ensuring that the device you have on the market is the device you claim it is, based on the best available evidence.

Practical Considerations

Updating a CER is resource-intensive. It requires clinical expertise, literature access, data analysis, and regulatory coordination. Many teams underestimate the time required and end up rushing the process when deadlines approach.

The solution is not to lower the quality. The solution is to plan updates as part of the PMCF cycle. If you know an interim analysis is due in Q3, start preparing the CER update in Q2. If you expect new SOTA guidance to be published, build time into your schedule to review and integrate it.

Another consideration: involving the clinical evaluator early. Many teams treat updates as document management tasks and only involve the clinical evaluator at the final review stage. This leads to superficial updates because the person writing the update does not have the clinical depth to appraise new data or challenge prior conclusions.

The clinical evaluator should be involved from the moment the update is triggered. They should review new PMCF data, assess whether it changes the risk-benefit profile, and decide what depth the update requires. This is not something a regulatory affairs specialist can do alone.

Finally, coordinate with your Notified Body. Some bodies expect to be notified when significant CER updates are made. Others review updates during routine surveillance. Either way, transparency reduces friction. If your update reveals new risks or changes your claims, do not wait for the audit to surface it.

Closing Thought

The device you certified last year is not the same device you have on the market today. Not because it changed physically, but because the evidence around it evolved. New data emerged. New risks were identified. New standards were published. The CER must track that evolution.

This is not about perfection. It is about honesty. When new data challenges old conclusions, the CER should reflect that. When PMCF confirms your assumptions, the CER should document it. When SOTA shifts, the CER should adapt.

The teams that struggle with CER updates are the ones that treat them as compliance tasks. The teams that succeed are the ones that treat them as clinical thinking exercises. The difference shows in every section, every appraisal, and every conclusion.

Your CER is a living document. The question is whether you update it because you have to, or because you understand why continuous evaluation matters.