Post-Market Study and Risk Control Plans

1. Key takeaways

Article 16(3) of Law No. 12/2025 requires registration holders and filers to formulate post-market study and risk control plans and ensure their effective implementation. This is the only one of the six obligations with a forward-looking study dimension, and it interlocks with the post-market evaluation system for medical devices under Article 30. For products registered subject to conditions, Article 17(4) further requires the registration holder to monitor benefits and risks on a continuing basis, take effective measures to control risks proactively, and complete the required studies within the period designated by ISAF and submit the relevant materials. The plan is not a document filed away for record; it is a continuing arrangement that must be effectively implemented and can be inspected.

2. Legal basis

The instruments and provisions governing post-market studies, risk control and conditional approval are listed below.

3. Expert insights

Insight one: the plan and the evaluation are two distinct systems and cannot substitute for each other. Article 16(3) requires a plan that is formulated in advance and implemented continuously; Article 30 provides for a post-market evaluation carried out in specified situations. The former is a standing mechanism; the latter is a triggered mechanism. When designing the compliance architecture, companies should manage the two separately while drawing on the same data sources.

Insight two: ensuring effective implementation is the core of this obligation. The provision does not stop at formulation; it requires the plan to be formulated and its effective implementation ensured. This means ISAF can require evidence that the plan is being executed during inspections or renewal — records of study progress, evidence that risk control measures have landed, and interim conclusions. Submitting an elegant plan without executing it equals non-performance of the obligation.

Insight three: conditional approval pushes this obligation to its strictest level. Article 17(3) lists the situations in which registration subject to conditions may be granted (treatment of rare diseases, diseases that seriously endanger life and currently lack effective treatment, and devices needed to respond to public health emergencies); paragraph 4 attaches continuing monitoring duties and requires studies to be completed within the period designated by ISAF and the materials submitted; Article 19(2) further requires the conditions to be stated on the registration certificate. This is the price of placing the product on the market first and completing the evidence afterwards — companies taking this fast track must build their study capability at the same time.

Insight four: the data protection period for innovative devices mirrors the post-market study timeline. Article 18 provides that for 6 years after registration of an innovative medical device, its product research, clinical evaluation and clinical trial data are protected and may not be used in another party’s registration procedure without the registration holder’s consent. The 6-year protection window does not coincide with the 5-year validity of registration, so companies planning their data assets should calculate the two cycles separately.

Insight five: the output of the plan enters the renewal package. Article 18 of the Implementation Rules requires a medical device adverse event monitoring report at renewal, and the conclusions of post-market studies are among the core contents of that report. A solid study is an asset at renewal; a study never started is a gap at renewal.

4. Practical recommendations

• Formulate a plan for each product: study objectives, methods, timetable, risk control measures and responsible persons are all indispensable.
• Retain evidence of execution: interim reports, data records and proof that measures have landed should all be filed.
• Apply extra pressure to conditionally approved projects: schedule backwards from the period designated by ISAF.
• Share the data source with adverse event monitoring: avoid two systems operating in isolation.
• Plan the 6-year data protection period for innovative devices in parallel: define internal rules on data use and authorisation.
• Bring study conclusions into the renewal package: complete the archiving ahead of the 5-year cycle under Article 20.

5. Verification checklist

• □ A post-market study and risk control plan has been formulated for each product
• □ The plan states the study objectives, methods, timetable, risk control measures and responsible persons
• □ Interim evidence of plan execution has been retained
• □ The designated periods for conditionally approved projects (Article 17(4)) have been scheduled backwards
• □ The interface with the post-market evaluation system under Article 30 is defined
• □ Data sources for adverse event monitoring and post-market studies are connected
• □ The 6-year data protection period for innovative devices (Article 18) is reflected in internal planning
• □ Study conclusions have entered the renewal package

Legal information verified as of October 29, 2026. The laws, guidelines and effective dates described in this article are limited to the published content of the official sources listed under Legal basis as of that date; where official documents are updated, the most recently published version prevails.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for Macao, China. Our team manages adverse event reporting and recall coordination with the Health Bureau, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com