Post-Market Surveillance for Medical Devices: South African Obligations Explained

Once a medical device reaches the South African market, the regulatory obligation does not end — it intensifies. Post-market surveillance (PMS) is the structured process by which manufacturers and authorised representatives continuously monitor a device's safety and performance in real-world use. Under South Africa's Medicines and Related Substances Act (Act 101 of 1965), as amended, and the regulations administered by SAHPRA, holders of medical device licences carry explicit PMS duties. Getting these wrong exposes companies to licence suspension, product recalls, and — most critically — patient harm that could have been prevented.

The Legal Foundation: What the Act and SAHPRA Expect

South Africa's medical device regulatory framework draws heavily on the Global Harmonisation Task Force (GHTF) and its successor, the International Medical Device Regulators Forum (IMDRF). SAHPRA's guidance documents for medical devices align with the IMDRF's PMS and vigilance recommendations, which means companies already operating in markets governed by EU MDR or FDA requirements will recognise most of the concepts — but must still address SAHPRA-specific filing obligations.

The core expectation is straightforward: the licence holder must have a documented PMS system that proactively collects, analyses, and acts upon data related to the safety, performance, and clinical effectiveness of every device on the market. This is not a passive exercise. SAHPRA expects evidence of active surveillance, not merely a complaints mailbox.

Incident Reporting: Timelines and Thresholds

Vigilance reporting to SAHPRA follows a tiered approach based on severity. Understanding the reporting thresholds is non-negotiable.

A reportable incident is any event that has led to, or could lead to, death or serious deterioration in the health of a patient, user, or other person. This includes device malfunctions that, had they occurred in clinical use, could have caused serious harm — even if no actual injury resulted.

The reporting timelines mirror IMDRF guidance:

• Death or unanticipated serious public health threat: report to SAHPRA within 10 calendar days of the manufacturer becoming aware.
• Serious injury or serious deterioration in health: report within 30 calendar days.
• Other reportable incidents requiring investigation: an initial report within 30 days, with follow-up reports as the investigation progresses.

Late reporting is one of the most common compliance failures SAHPRA identifies during inspections. Companies that rely on informal email chains rather than defined escalation workflows routinely miss these windows.

Field Safety Corrective Actions

When a PMS signal identifies a risk that requires intervention, the licence holder must implement a Field Safety Corrective Action (FSCA). This can range from a device modification or software update to instructions for use amendments, and in serious cases, a full market recall.

Every FSCA must be accompanied by a Field Safety Notice (FSN) — a communication to customers and users explaining the issue, the risk, and the corrective steps. SAHPRA requires that FSCAs and FSNs be reported promptly, including confirmation that all affected units in South Africa have been traced and that distributors have been notified. Traceability records, often overlooked during distribution setup, become critical at this stage. Without robust lot and serial number tracking to end-user level, an FSCA becomes operationally impossible to execute effectively.

Building a PMS System That Satisfies Both SAHPRA and IMDRF

A compliant PMS system is not a single document — it is an integrated set of processes. At minimum, it should include:

A PMS plan for each device or device family, defining the data sources to be monitored (complaints, clinical literature, post-market clinical follow-up, registries, regulatory authority databases), the methods of analysis, and the criteria that trigger escalation.

A complaints handling procedure with defined timelines for triage, investigation, and determination of reportability. Every complaint must be assessed against the reportable incident threshold, and that assessment must be documented — including the rationale for deciding an event is not reportable.

Trend analysis and periodic reporting. SAHPRA expects licence holders to review aggregate data, not only individual incidents. A single non-serious malfunction may not be reportable, but a statistically significant increase in the same malfunction type absolutely is.

A PMS report or periodic safety update report (PSUR), maintained and available for inspection. Higher-risk devices (Class C and D under IMDRF classification) warrant more frequent and more detailed reporting.

Management review and CAPA integration. PMS outputs must feed into the quality management system. If trend data reveals a design-related issue, the corrective and preventive action process must be engaged — and the link between PMS finding and CAPA must be traceable.

Where Companies Stumble

The most frequent gaps are not technical but procedural: no written PMS plan, complaints handled by sales teams without regulatory oversight, FSCAs executed in other jurisdictions but never reported to SAHPRA, and trend reports that exist in theory but are never actually generated. SAHPRA's inspection capacity is growing, and these gaps are increasingly being identified.

Ensuring your PMS documentation, vigilance reports, and FSCA records meet SAHPRA's expectations — while aligning with IMDRF best practice — requires careful review of every component. Avidara's Document Review service helps medical device licence holders audit their PMS plans, incident reports, and FSN communications against current SAHPRA requirements, identifying gaps before an inspector does. Book a review to stress-test your post-market surveillance system.