Jonathan Messer,
Head of signal and surveillance products at Qinecsa
Major regulators already expect the structured capture of medical device safety data. Now they are starting to analyse it, with implications for the vigilance activities of both device manufacturers and pharma companies offering combination products. Qinecsa’s Jonathan Messer explains.
Keywords: Medical device, pharma, safety data, MDR, drug safety, Adverse Event Monitoring
The withdrawal of Bayer’s Essure permanent contraceptive device from global markets (1) and the recall of DePuy’s ASR metal-on-metal hip system (2) are among the high-profile safety failures that have seen major regulatory authorities strengthen their post-market surveillance frameworks, taking medical device monitoring closer to the long-established rigour of pharma safety surveillance. Closer, but different.
This introduces a particular challenge for providers of combination products, including GLP-1 auto-injectors, which are at least one part device and one part medicine. This complexity will be felt particularly as manufacturers are called upon to not only collect safety data, but also to make sense of its insights.
Evolving medical device regulations
In December 2025, the EU’s Medical Device Coordination Group (MDCG) published its most detailed guidance to date on post-market surveillance (PMS) under the Medical Device Regulation (MDR) and the In Vitro Diagnostic Regulation (IVDR) (3), making it clear that passive complaint handling is no longer sufficient.
Manufacturers will be expected to apply systematic, documented and reproducible methods to analyse post-market data — not just individual incidents but cumulative trends — and to describe this analysis routinely in PMS plans or PSURs. Findings must feed actively into risk management, benefit-risk reassessments and risk minimisation measures.
In the UK, revised Medical Devices (Post-Market Surveillance Requirements) regulations came into force in June 2025, introducing explicit device PMS and vigilance requirements for manufacturers, including shortened timelines for serious incident reporting and requirements for enhanced real-world data collection (4). The MHRA notes that the changes are designed to enable faster regulatory response when safety issues emerge — implying active monitoring, not merely passive receipt of data. In the US, the Quality Management System Regulation (QMSR), aligning FDA requirements with ISO 13485, has reinforced similar expectations (5).
Taken together, these developments represent a shift to device safety surveillance as an ongoing analytical discipline.
The complications of combination products
Combination products add the need to monitor for inter-dependencies: a safety issue may originate in the medicinal product, a device component, the interaction between the two, or the instructions for use. These are not cleanly separable phenomena and cannot be adequately monitored by systems designed to handle only one element.
In many organisations, drug safety and device-related product complaints have historically been managed through separate processes, by separate teams. This situation is unsustainable now. The risk is not just one of operational inefficiency; where data is managed in parallel systems that are not connected, signals which exist in the relationship between drug and device data may not be visible at all.
Pharmacovigilance statistical methods cannot simply be transplanted into device surveillance. Disproportionality analysis relies on large datasets built over many years; even a major regulator’s device incident database may contain only hundreds of thousands of cases. Device surveillance requires approaches that detect meaningful frequency changes at lower volumes and normalise against exposure levels. There is also an obligation to monitor beyond a company’s own data. Since many device approvals rest on demonstrated equivalence to similar products, broader class data (e.g. in FDA’s new unified Adverse Event Monitoring System and the European Commission’s EUDAMED) must also be reviewed.
Limitations of current approaches
Some companies working to fulfil evolving device surveillance requirements have looked to existing product complaint systems (e.g. TrackWise, Veeva Vault), augmenting these to capture the new structured data fields required under the MDR/IVDR framework. However, these systems were not designed for statistical analysis. For this reason, once the data is captured, teams typically pull the findings into spreadsheets and assess them manually, or process them using statistical packages outside of the core safety infrastructure.
This workaround is becoming less defensible as surveillance requirements mature. The MHRA has recently begun active signal detection on device data submitted through the Yellow Card system. As those capabilities develop, manufacturers can expect specific regulatory queries about patterns in their data — and will need to demonstrate not only that they submitted it, but that they have been routinely interrogating it, with an auditable record.
Building a more coherent surveillance strategy
For combination product companies, analysing drug and device data within the same framework makes it possible to identify signals that cross the drug-device boundary — distinguishing issues originating in the medicinal product, a device component, or their interaction. It also enables safety topics to be managed within a single governance structure, with traceable relationships between related signals rather than fragmented across parallel systems.
Granularity matters here. An ocular implant, for instance, may incorporate the active medicinal component alongside several distinct physical elements, each associable with safety data via component-level identifiers such as the GMDN code or UDI. That specificity becomes particularly valuable when a safety concern involves a component shared across a product portfolio, enabling rapid scoping and response.
For organisations currently running separate surveillance systems, the path forward is integration rather than replacement. Companies with mature pharmacovigilance infrastructure are best placed to extend that capability to encompass device surveillance. Those coming to structured device surveillance for the first time — whether from a pharma background or as a pure device manufacturer — will need to build or acquire the capability.
Getting ahead of regulatory scrutiny
In practical terms, the shift from reporting to analysis means reviewing device safety data at defined intervals using statistically appropriate methods; maintaining a governance framework that creates an auditable trail of signal detection decisions; and assessing linked drug and device safety data in relation to each other, not in isolation.
The companies best positioned for the scrutiny to come will be those that already know what their data shows. The cost of a reactive approach is not only reputational: regulatory findings in safety surveillance carry material consequences, and the window for remedial action once an issue has been identified externally is short.
About the author
Jonathan Messer is head of signal and surveillance products at Qinecsa, and product lead for the Qinecsa Vigilance Workbench (QVW).
References and notes
- US FDA, FDA Activities Related to Essure. Bayer discontinued US sales of Essure at end of 2018 following a black box warning (2016), sales restrictions (April 2018), and more than 73,000 medical device reports filed with the FDA between 2002 and 2024. https://www.fda.gov/medical-devices/essure-permanent-birth-control/fda-activities-related-essure
- DePuy Orthopaedics voluntarily recalled its ASR Hip Resurfacing System and ASR XL Acetabular System in August 2010 after National Joint Registry (England and Wales) data showed 5-year revision rates of 12–13%, far exceeding the expected device lifespan of approximately 15 years. The recall notice stated explicitly that the risk of revision was highest “among female patients” — a finding linked to the device having been tested predominantly in male patients, whose hip anatomy differs significantly from that of women. Johnson & Johnson subsequently settled claims globally for $2.5 billion. See: Health Sciences Authority (Singapore), Recall of Medical Devices — DePuy ASR Hip Resurfacing System and DePuy ASR XL Acetabular System, citing MHRA Medical Device Alert MDA/2010/033 and NJR data. https://www.hsa.gov.sg/announcements/safety-alert/recall-of-medical-devices—depuy-asr-hip-resurfacing-system-and-depuy-asr-xl-acetabular-system; also Hutchison, K., “Gender Bias in Medical Implant Design and Use,” Hypatia (2019); ICIJ Implant Files, https://www.icij.org/investigations/implant-files/are-women-more-likely-to-be-harmed-by-medical-device-failures/ (noting women experienced a 29% higher rate of hip implant failure than men).
- European Commission Medical Device Coordination Group, MDCG 2025-10: Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025. https://health.ec.europa.eu/latest-updates/mdcg-2025-10-guidance-post-market-surveillance-medical-devices-and-vitro-diagnostic-medical-devices-2025-12-19_en
- UK Government / MHRA, “MHRA guidance on new Medical Devices Post-Market Surveillance requirements.” The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024 came into force 16 June 2025. https://www.gov.uk/government/news/mhra-guidance-on-new-medical-devices-post-market-surveillance-requirements; Medical devices: post-market surveillance requirements: https://www.gov.uk/government/publications/medical-devices-post-market-surveillance-requirements
- US FDA, Quality Management System Regulation (QMSR) Final Rule, aligning 21 CFR Part 820 with ISO 13485:2016. https://www.fda.gov/medical-devices/quality-system-qs-regulationmedical-device-good-manufacturing-practices/quality-management-system-regulation-qmsr-final-rule
