In Europe You Plan, in the US You Are Told: 522 Orders and Post-Approval Studies

If you work with the MDR, you are used to a certain structure for post-market activities. You have a PMS plan under Annex III and a PMCF plan under Annex XIV Part B. You write them, you update them, and the notified body reviews them during the audit. The initiative is yours, and the oversight is theirs.

In the US it works differently. There is no general obligation that parallels the Annex III PMS plan.

There are obligations to report events, obligations related to recalls and corrections, and two dedicated mechanisms through which the FDA requires you, individually, to collect data: the 522 order and the Post-Approval Study.

The difference is not technical.

In Europe, you come with a plan.

In the US, you receive a document that tells you what you will do, and from that moment a clock starts running, with sanctions at the end of it.

This article is about these two mechanisms and how they connect to the PMS work you are already doing.

Where this sits in the US picture

Before we go into the details, it helps to lay out the map. On the US side of post-market, there are:

• Event reporting, Medical Device Reporting

• Corrections and removals, 21CFR Part 806, and recalls

• Device tracking, 21CFR Part 821, which applies to a small group of devices

• The 522 order, when the FDA decides there is a public health question that needs an answer

• The Post-Approval Study, as a condition of PMA approval

The last two are the subject here, and they are the only ones that require you to generate new data, not just report on what happened.

The 522 order

Who can receive such an order

Section 522 of the Act allows the FDA to require post-market surveillance for a Class II or Class III device that meets one of four criteria:

1. A device whose failure would be reasonably likely to have serious adverse health consequences

2. A device expected to have significant use in pediatric populations

3. A device intended to be implanted in the human body for more than one year

4. A life-supporting or life-sustaining device used outside a device user facility

Pay attention to the wording: it says Class II or Class III.

This means it is not limited to devices that went through PMA.

A device with only a 510(k) can receive a 522 order, and this is a point that surprises many companies.

If you have a long-term implant, or a life-supporting device that the patient takes home, you are in the category where this can happen.

What triggers the FDA

The FDA identifies issues from a variety of sources:

"adverse event reports, a recall or corrective action, post-approval data, review of premarket data, reports from other governmental authorities, or review of scientific literature".

In other words, the input can be your own report to the FDA, a recall you carried out, scientific literature, or even a report from another regulatory authority.

If you reported something to an authority in Europe, that information can reach the FDA.

The FDA may issue an order at the time of marketing authorization or at any time afterwards. There is no window that closes.

Timelines: the critical point

Thirty days to submit a study plan is not much time to decide on study design, sample size, endpoints and sites.

Fifteen months to start surveillance sounds like a lot, until you count backwards and realize you need plan approval, site recruitment, ethics committees (Helsinki committees) or an IRB, agreements, training, and only then the first patient. Anyone who starts thinking about this in month ten will not make it.

Reporting

Interim reports:

These are due every six months for the first two years, and once a year after that. Each report includes:

• Enrollment progress against the approved milestones

• Participant tracking: "subject accountability (e.g., enrolled, randomized, completed, withdrawn, lost to follow-up)"

• A summary of safety and effectiveness findings

• Plans for dealing with enrollment delays

Final report:

This includes full participant accountability and follow-up rates, final safety and effectiveness findings, a discussion of possible bias caused by loss to follow-up, and an assessment of whether the surveillance actually answered the public health question for which the order was issued.

The last item deserves attention: it is not enough to carry out the study. You need to show that it answered the question.

What happens if you don't comply

Failure to comply with a 522 order is a violation of section 301(q)(1)(C) of the Act, and the device is considered misbranded under section 502(t)(3).

The violations listed explicitly are:

• Failure to submit a plan within 30 days

• Failure to obtain approval of the plan

• Failure to start surveillance within 15 months

And the result:

"violations of sections 301(q)(1)(C) or misbranding under section 502(t)(3) may lead to enforcement actions including seizure of product, injunction, prosecution, and/or civil money penalties, as appropriate".

In other words, your device becomes misbranded not because of a problem with the device or its labeling, but because you did not submit a document on time.

This is a mechanism worth knowing about in advance.

The Post-Approval Study

What it is and how it differs

A Post-Approval Study, or PAS for short, is not an order that comes afterwards. It is a condition of approval imposed as part of the PMA process.

The regulatory basis is 21CFR 814.82, and the authority derives from section 513 of the Act, which allows the FDA to consider

"whether postmarket data collection or other conditions may be structured to permit approval subject to those conditions".

The logic:

At the time of approval, some uncertainty remains about the benefits or risks, and the FDA is willing to accept it given the overall benefit-risk profile, on the condition that it will be answered later.

In the FDA's words:

"Post-approval studies can be imposed at the time of approval to continue evaluation, and reporting on the safety, effectiveness, and reliability of the device".

Timelines and milestones

The milestones are counted from the protocol approval date.

The new status categories

This is a change worth knowing, because it affects how your study looks to the outside world.

The old categories, Progress Adequate and Progress Inadequate, apply only to submissions received before October 7, 2022.

Since then there have been four categories:

• Ongoing: the study is progressing on schedule or ahead of it

• Delayed: the study is behind the set timelines

• Redesigned/Replaced: the original design cannot be carried out

• On Hold: the study has been temporarily paused

On delays, the FDA says two things that are worth reading together. First, the sponsor should "inform FDA of study delays as soon as possible", and include in the interim reports the reasons for the delay or for missing the milestones. Second, the agency "generally does not intend for sponsors to routinely modify the PAS protocols to adjust study milestones", and changes are considered case by case.

In other words, don't change the timeline to make the status look good. Report the delay and explain it.

Transparency:

The FDA now requires the sponsor to propose summary data for publication on the FDA website, with the agency making the final decision on what is published, subject to disclosure laws.

Comparison table

The last difference in the table is the one I want to dwell on.

Two public databases worth adding to your PMS plan

I wrote here before about how to turn other companies' recalls into PMS input. The same idea works here too, and even better.

The FDA has a public database of 522 studies and a parallel database of Post-Approval Studies. Both are open, both are free to use, and both show you things that are hard to get from any other source:

• Which types of devices the FDA has decided have an open question. This is a direct indication of how the regulator sees risk in your category

• What the public health question is that the study is meant to answer

• The status of the studies, including those that are behind schedule

• The study design: sample size, endpoints and length of follow-up

If your competitor received a 522 order about a question of implant wear after five years, that information is directly relevant to your risk analysis, your State of the Art and your PMCF plan.

This is also the kind of information that MDR Annex III, section 1.1 asks you to collect: publicly available information about similar devices.

A short record documenting a periodic review of these two databases is very good evidence for that section.

A practical suggestion: Add two sources to the periodic PMS review you already do: the 522 studies database and the PAS database, filtered by your product code and by the codes of similar devices. It adds about twenty minutes to the review, and it produces a record that is hard to argue with in an audit.

What this means for you

If you only have a 510(k): You have no PAS, but a 522 order is entirely possible. Check whether your device meets one of the four criteria. If it does, this is a scenario your management should be familiar with.

If you have a PMA: A PAS is almost certainly part of the picture, and it affects budget and timelines already at the submission stage, not afterwards.

In both cases: The deadlines are 30 days and 15 months, and both are counted from the moment a document lands in your mailbox. If you don't have a mechanism that recognizes such a document and starts a process, those days get burned on "we need to talk to the consultants".

And a point that is easy to miss: The information you report in Europe, such as the PSUR, vigilance reports and FSCAs, can reach the FDA through other authorities and serve as grounds for considering an order. The two sides are not disconnected.

What to put in your procedures

What the requirement is.

You need to recognize in time that you have received a 522 order or a PAS condition, submit a plan or protocol on time, start on time, and report on the set dates.

Is there already a mechanism?

Some companies have one, in part. Usually there is a procedure for handling correspondence from authorities, and a PMS procedure that defines periodic reports.

What is missing is the connection: a document that arrives from the FDA and starts a 30-day clock.

What is the minimum that meets the requirement?

1. Identification and escalation. Define in the regulatory correspondence procedure that a 522 order or a PAS condition is a top-priority document, with escalation to management within 48 hours and the appointment of an owner.

2. A documented schedule for every active order or condition: the submission date, the start date, and the reporting dates for the next two years.

3. A reference in the PMS procedure stating that 522 and PAS reports are PMS outputs in every sense, and that their findings feed back into risk management and the technical documentation.

4. A review of the two public databases as part of collecting public information in the PMS plan.

What is the minimum change?

One section in the regulatory correspondence procedure, one section in the PMS procedure, and a schedule table.

There is no need for a new procedure.

Recurring mistakes

Treating a 522 order as a request for information. It is not. It has statutory deadlines and a misbranding sanction.

Assuming a 510(k) automatically protects you from a 522 order. The criterion is Class II or III, not the approval pathway.

Amending the protocol to improve the status. The FDA says explicitly that it does not expect routine protocol changes to move milestones. A delay is reported and explained.

Forgetting that surveillance must start within 15 months, and not just be planned within 15 months.

Running the study outside the quality management system. The findings are input to risk management, the technical documentation and management review. If they sit only with the clinical department, they will not find their way there.

Not using the public databases. They give you free information about what the regulator considers risky in your category.