Vigilance Reporting Under EU MDR: Serious Incidents, Timelines, and Competent Authority Routes

Vigilance is a separate track from PMS

It is easy to treat vigilance — the incident reporting side of post-market surveillance — as just another section of your PMS system. It is related, but it runs on its own regulatory track under Articles 87 to 92 of EU MDR. The key difference in practice: PMS is about systematic data collection and analysis over time; vigilance is about real-time reporting obligations when something goes wrong. The timelines are tight, and missing them is a competent authority matter, not just a Notified Body finding.

What counts as a serious incident

Article 2(65) defines a serious incident as a malfunction or deterioration in the characteristics or performance of a device that has led to, or could have led to:

• Death of a patient, user, or other person
• Serious deterioration in the state of health of a patient, user, or other person

The "could have led to" part is important. This is not limited to events where harm actually occurred. Near-misses — where the device failed but harm was avoided — can still qualify as serious incidents depending on the severity of the potential outcome. Teams that only report when harm occurs miss the point of the definition.

One thing that catches manufacturers off guard: a malfunction that "could have led to" a serious outcome in a different context (different patient, different user, more vulnerable population) may qualify even if no one was actually harmed in the specific event. The assessment is prospective, not just retrospective.

The definition also covers false negatives or false positive results from in vitro diagnostic devices that have led to, or could have led to, serious deterioration in health or death. IVD manufacturers should pay particular attention here.

Reporting timelines

Article 87 sets out three main reporting timelines:

Immediately (without delay, no later than 2 days): For incidents involving an imminent risk of death or serious deterioration in health. In practice, this means if you become aware of a situation where the device is currently in use and represents an active safety risk, the clock starts immediately.

No later than 10 days: For other serious incidents. The 10-day clock starts from the moment you first become aware that a serious incident has occurred or may have occurred.

No later than 15 days: For serious incidents that are non-life-threatening and where the required immediate corrective action has already been taken. This is less common — document the basis for the 15-day classification carefully.

The clock starts when the manufacturer first becomes aware — not when the investigation is complete, not when root cause is confirmed. Initial reports can be partial. What matters is that the report is submitted on time, even if labelled as preliminary. You update it as the investigation progresses.

Where reports go: competent authority routes

Vigilance reports under MDR go to the national competent authority of the Member State where the incident occurred. If the incident involved a device used in France, the report goes to ANSM. If in Germany, to BfArM. If in the Czech Republic, to SÚKL.

One thing teams don't always realise: if your device is used across multiple Member States and a serious incident occurs, you may have reporting obligations to multiple competent authorities — one per Member State where the incident occurred, or where the device is currently available. EUDAMED is intended to be the central reporting channel and is progressively being used for this purpose.

For manufacturers established outside the EU, the Authorised Representative (AR) carries the vigilance reporting obligation. The AR needs to be kept in the reporting loop and have access to the information needed to report on time.

After submitting the initial report, the manufacturer must submit a final report once the investigation is complete — typically within 30 days of the initial report for most incidents, or longer for complex investigations, with justification documented.

Trend reporting

Article 88 introduces a separate but related obligation: trend reporting. This applies when a manufacturer detects a statistically significant increase in the frequency or severity of incidents that are not themselves serious incidents — but where the trend suggests a systematic safety issue.

The thresholds for trend reporting are not defined in the regulation itself — they should be defined in your PMS plan. This is one of the reasons why the PMS plan must include explicit thresholds. If you can't point to a pre-defined threshold in your plan, you have no consistent basis for deciding when to file a trend report.

Trend reports go to competent authorities and should also be reflected in your PSUR. A pattern of non-serious incidents that collectively suggest a device safety concern is exactly the kind of information that needs to feed into both systems.

Field safety corrective actions (FSCAs) and field safety notices (FSNs)

When a vigilance investigation concludes that a recall, field modification, software update, labelling change, or other corrective action is needed, this becomes a Field Safety Corrective Action (FSCA). Any communication to the market about the FSCA is a Field Safety Notice (FSN).

FSCAs must be reported to competent authorities before they are implemented — not after. The FSN must be agreed with the relevant competent authority before distribution in most cases. Sending a recall notice without prior CA communication is a common procedural error that turns a safety issue into a regulatory compliance issue as well.

EUDAMED is progressively being used to register FSCAs and FSNs. Manufacturers should track their EUDAMED obligations in this area alongside their overall EUDAMED registration status.

Common pitfalls

Starting the clock too late. Manufacturers sometimes treat "awareness" as the moment root cause is confirmed. The obligation starts when you first become aware that an incident may have occurred — not when your investigation tells you whether it qualifies.

Only reporting actual harm. Near-misses that meet the "could have led to" threshold must also be reported. Build this into your complaint handling and incident evaluation process.

Not documenting the classification decision. When you decide an incident does not qualify as serious, that decision needs to be documented — with reasoning. Competent authorities may challenge classification decisions.

Forgetting multi-market obligations. An incident involving a device used in three countries potentially means reports to three competent authorities. Have a process for tracking this.

Confusing FSCAs with standard product corrections. Not every field action is an FSCA. But if a field action is taken in response to a safety concern, it is likely an FSCA — and the reporting obligations follow.

Where to go from here

The PSUR and PMSR resources in this category explain how vigilance data feeds into periodic reporting. The EUDAMED registration resource covers your registration obligations and what the EUDAMED vigilance module requires manufacturers to do.