Database searches under MDR and IVDR Annex III: which sources, how to document them

Annex III Section 1(a) of the MDR names the information whose collection and utilization the PMS plan addresses. For a search in external sources we single out two of them: relevant specialist or technical literature together with databases and registers, and publicly available information about similar medical devices.

What a search in these sources should look like, the annex does not set out in detail. This article works through the three texts the work can rest on: the regulation itself, the guidance MDCG 2025-10 and the technical report ISO/TR 20416:2020. From them follows a list of the details a search record should carry so that the search can be repeated at the next update.

Which sources does Annex III Section 1(a) name?

Under Annex III Section 1(a) MDR, the post-market surveillance plan under Article 84 addresses the collection and utilization of available information, in particular, in the wording of the regulation:

• information concerning serious incidents, including information from PSURs, and field safety corrective actions;
• records referring to non-serious incidents and data on any undesirable side-effects;
• information from trend reporting;
• relevant specialist or technical literature, databases and/or registers;
• information, including feedbacks and complaints, provided by users, distributors and importers; and
• publicly available information about similar medical devices.

Annex III Section 1(a) of the IVDR contains the same list, with minor differences in punctuation and spelling, including the "similar medical devices". For database searches we single out the fourth and the sixth item. The fourth brings databases and registers into the plan. The sixth reaches beyond the manufacturer's own device: what is publicly known about similar devices from other manufacturers also belongs in the surveillance.

In the same plan, Annex III Section 1(b) requires at least a proactive and systematic process to collect this information, one that also allows a comparison with similar products available on the market, effective and appropriate methods and processes to assess the collected data, and suitable indicators and threshold values for the continuous reassessment of the benefit-risk analysis and of risk management. Which databases the manufacturer queries, how often and with which search terms, the regulation does not specify. That is why exactly this choice, with its rationale, belongs in the PMS plan.

What do MDCG 2025-10 and ISO/TR 20416 add?

MDCG 2025-10 is the guidance of the Medical Device Coordination Group on post-market surveillance for medical devices and IVDs, dated December 2025. On the term "proactive" in Annex III Section 1(b) it says: the manufacturer is to actively seek out available information and not merely wait for it to arrive through channels such as complaints. For database searches this is the core point: they are one of the ways in which a manufacturer goes and gets information instead of waiting for it to arrive, and they belong in the plan from the start.

Section 5.1 of the guidance deals with selecting the data sources. Table 2 breaks down each indent of Annex III Section 1(a) and gives examples of the information to be collected and of its use; the examples are expressly not mandatory elements, the selection is up to the manufacturer. Sections 5.2 to 5.4 follow with collecting, assessing and analyzing the data and drawing conclusions. Section 4 of the guidance already asks that the methods fit the device's risk profile and that the rationale for selecting them be documented.

ISO/TR 20416:2020 is a technical report; MDCG 2025-10 lists it among its references. We read it as guidance for manufacturers rather than a standard with requirements, and as we understand it, it does not replace any regulatory obligation.

In quality management terms, we assign the search to the analysis of data under ISO 13485:2016 Section 8.4, and in risk management to ISO 14971:2019. Every result belongs back there.

Which databases come into question?

MDCG 2025-10 names in Table 2, as examples, the websites and databases of competent authorities including EUDAMED, device registers or registries where available, and screening the literature. Candidates include, for example, the MAUDE database and the Enforcement Reports of the FDA, the safety information of the MHRA, and the publications of Swissmedic and the BfArM. This selection is ours and not exhaustive; which sources a manufacturer queries depends on its markets and on the type of device. What each source contains and how it can be searched is best checked at the source itself.

The sixth item of Annex III has a practical consequence for the search terms. Anyone who searches only for their own trade name finds nothing about similar devices. The search therefore needs terms that describe the type of device and, where a database offers it, the product classification kept there. Which terms and codes these are is best set in advance in the PMS plan, not only in the record.

What belongs in the record of a search?

The yardstick is repetition. Anyone who runs the same query a year later with the recorded details should be able to see what has been added and what changes in the assessment. The following list is our compilation from the three sources, not a requirement of the regulation:

1. Link to the plan: which Annex III source the search serves, for which device or device group, and which similar devices are included.
2. Database and time: name and operator of the database, the search interface used and the date of the query.
3. Search strategy: search terms, fields, filters and period exactly as entered, including product codes.
4. Hits: the number of hits per query, unfiltered and unchanged.
5. Selection: the criteria for inclusion and exclusion, the number of hits remaining afterwards and a reason for each exclusion.
6. Assessment: which failure modes and harms the hits show, and whether the risk management file already covers them.
7. Consequence: no action, update of risk management, review for a corrective action or input to the PMS report, each with a reference.
8. Filing: export or image of the results list, author, reviewer and version of the record.

Items 4 and 5 carry the most weight. A number of hits without the selection behind it cannot be assessed, and a selection without reasons for exclusion cannot be checked.

Where does the result go?

Under Article 83(3)(a) MDR, the data from post-market surveillance are used, among other things, to update the benefit-risk determination and to improve risk management. Under the annex, the indicators and threshold values from Annex III Section 1(b) are used in this continuous reassessment; in our reading, that means they set in advance which finding triggers a reassessment.

The search is summarized in the PMS report under Article 85 MDR for class I devices or in the PSUR under Article 86 for classes IIa, IIb and III. The IVDR draws the corresponding line in Articles 80 and 81 between classes A and B on one side and C and D on the other.

We support setting up the PMS system in Post-Market Surveillance and the reporting routes in Medical Device Vigilance. Where the results feed back into the file, that is Risk Management.