European Vigilance for Medical Devices: EU MDR Guide

Vigilance is the cornerstone of post-market safety oversight for medical devices in the European Union. Under Medical Device Regulation (MDR) No. 2017/745 and In Vitro Diagnostic Regulation (IVDR) No. 2017/746, manufacturers are legally required to report serious incidents and field safety corrective actions to national competent authorities within defined timelines, and to maintain a documented vigilance system throughout the commercial life of every device.

This guide covers the full EU vigilance framework: what triggers reporting, the six-step reporting process, FSCA and FSN requirements, EUDAMED obligations, trend reporting under Article 88, and the most frequently cited vigilance compliance failures in NCA inspections and notified body audits.

Regulatory basis: MDR 2017/745 Articles 87 to 92 govern vigilance for medical devices. IVDR 2017/746 Articles 82 to 87 apply the equivalent framework to in vitro diagnostics. MDCG 2023-3 provides current guidance on vigilance terminology, serious incident assessment, and reporting obligations. All manufacturers of CE-marked devices are subject to these requirements regardless of device class.

In This Guide

Vigilance: definition and scope

Incident vs serious incident

6-step serious incident reporting process

Reporting timelines: 2, 10 and 15 days

FSCA and Field Safety Notice requirements

EUDAMED vigilance module

Trend reporting under Article 88

Common vigilance mistakes

Fundamental Concepts

What Is Vigilance?

In the context of EU medical devices regulation, vigilance refers to the systematic processes by which manufacturers detect, investigate, evaluate, and report serious incidents, and take field safety corrective actions. Vigilance is distinct from post-market clinical follow-up (PMCF), which involves actively gathering clinical data to confirm ongoing safety and performance. Vigilance is reactive: it responds to actual events. PMCF is proactive: it generates data before problems occur.

Vigilance reporting also differs from post-market surveillance (PMS) more broadly. PMS encompasses all methods of monitoring device safety and performance in commercial use, including literature review, complaint analysis, registry data, and periodic safety update reports. Vigilance is the specific obligation to report defined events to competent authorities within defined timelines.

Incident vs Serious Incident

Incident classification under MDR 2017/745

Type

Definition

Reporting obligation

Incident

Any malfunction or deterioration in the characteristics or performance of a device made available on the market, or any inadequacy in the information supplied or in the labelling

Internal documentation and investigation required; no mandatory NCA report unless serious

Serious incident

An incident that directly or indirectly led to, could have led to, or could lead to death, serious deterioration in health, or public health threat

Mandatory report to national competent authority within 2, 10, or 15 days depending on severity

FSCA

Any corrective action taken to reduce a risk of death or serious deterioration in health associated with a device already on the market

Must be reported before being implemented (or simultaneously in urgent cases)

Key distinction: Not every adverse event involving a patient and a device is a serious incident under MDR. The malfunction or deterioration must be in the device’s characteristics or performance, not solely in the patient’s underlying condition. Where causality is genuinely ambiguous, MDCG 2023-3 guidance recommends reporting; it is better to report and be told it was not required than to fail to report a reportable event.

Who Must Report?

Under MDR 2017/745, the manufacturer or their authorised representative (AR) must file serious incident reports. For non-EU manufacturers, the authorised representative carries the reporting obligation on behalf of the manufacturer. Importers and distributors have separate obligations: they must immediately inform the manufacturer, AR, and relevant competent authority if they become aware of a serious incident or FSCA.

Step-by-Step: Serious Incident Reporting

Step 1: Detect and Document the Event

Vigilance begins with event detection. Sources include customer complaints, post-market surveillance data, clinical literature, spontaneous reports from users or patients, and information from healthcare professionals. All events that may involve a device malfunction or deterioration must be documented at intake regardless of whether they ultimately require NCA reporting.

Intake documentation checklist

✓Date received and source of report (HCP, patient, distributor, internal audit)

✓Device identification: model, lot number, serial number, UDI

✓Description of the event in the reporter’s own words before any interpretation

✓Patient outcome or potential outcome if known

✓Member state(s) where the incident occurred

Step 2: Assess Whether the Incident Is Serious and Reportable

Not every incident triggers a reporting obligation. The assessment must determine whether the incident led to, could have led to, or could lead to death or serious deterioration in health including life-threatening illness, permanent impairment of a body function or structure, or a condition requiring medical or surgical intervention.

Default position: Where causality is unclear, whether the outcome was caused by the device or the patient’s underlying condition, MDCG 2023-3 recommends reporting. Competent authorities will advise if a report was not required. Non-reporting of a reportable event carries significantly greater enforcement risk than over-reporting of a borderline event.

Step 3: Report Within the Required Timeline

MDR serious incident reporting timelines

Timeline

Trigger

Notes

2 days

Serious public health threat

Rare; applies when the incident could lead to immediate widespread risk. Report must be submitted even before the investigation is initiated.

10 days

Death or serious deterioration in health

Applies when the incident has led to, or could have led to, death or unexpected serious deterioration in health. Timeline runs from date of awareness.

15 days

All other serious incidents

Applies to all serious incidents not meeting the 2-day or 10-day criteria. Initial reports may be submitted before investigation is complete.

Reports are submitted to the national competent authority (NCA) of the member state where the incident occurred. For incidents in multiple member states, manufacturers must report to each relevant NCA unless EUDAMED’s vigilance module is operational and accepts centralised reporting.

Step 4: Submit the Manufacturer Incident Report (MIR)

The Manufacturer Incident Report (MIR) is the standardised format for serious incident reporting. Initial reports may be submitted before a full investigation is complete, as long as follow-up reports are submitted as more information becomes available. The MIR must include: device identification, incident description, patient and user information (where available), assessment of seriousness and causality, and planned corrective actions.

Key Takeaway: Initial reports do not need to be complete. They need to be timely. Submit what you have within the required timeline; submit follow-up reports as the investigation progresses. A late complete report is a worse outcome than a timely incomplete one.

Step 5: Investigate and Submit Follow-up Reports

Serious incident reports are not one-time submissions. Manufacturers must submit follow-up reports as the investigation progresses and a final report when the investigation is concluded. The final report must identify the root cause, the FSCA taken or determined not to be necessary, and the outcome.

Step 6: Submit an FSCA Report If Corrective Action Is Taken

A Field Safety Corrective Action (FSCA) is any action taken by a manufacturer to reduce a risk of serious incident in relation to a device already on the market. FSCAs include device recalls, software updates, labelling changes, device modifications, and instructions to discontinue use.

FSCA timing rule

FSCAs must be reported to the NCA before being implemented — or simultaneously in cases where immediate action is required for patient safety. The NCA cannot be notified after the FSCA has already been carried out.

Field Safety Notice (FSN)

FSCAs communicated to users and healthcare professionals are communicated via a Field Safety Notice. The FSN must be approved by the relevant NCA before distribution in most member states. Content requirements are specified in MDCG guidance.

Not all FSCAs are recalls

All recalls are FSCAs, but not all FSCAs are recalls. A software update, a labelling clarification, or an instruction to users to modify device settings are FSCAs that do not involve physical product retrieval.

Requirements and Considerations

EUDAMED Obligations

Under Article 92 of MDR 2017/745, vigilance reports are to be submitted to the EUDAMED database rather than to individual national CAs. Until the EUDAMED vigilance module is operational and mandatory, manufacturers submit reports directly to NCAs using national reporting formats or the harmonised MIR template.

Manufacturers, authorised representatives, and importers must register in EUDAMED and obtain a Single Registration Number (SRN). Device registration, UDI assignment, and vigilance report submission will all eventually centralise through EUDAMED. Manufacturers should track EUDAMED module activation dates and update their vigilance SOPs accordingly.

Trend Reporting Under Article 88

MDR 2017/745 introduces a trend reporting requirement: manufacturers must report statistically significant increases in the frequency or severity of incidents that are not individually serious enough to require NCA reporting. The threshold for what constitutes a “significant increase” must be documented in the manufacturer’s post-market surveillance plan.

Common Assessment Finding

Trend reporting under Article 88 is the vigilance obligation most commonly absent from manufacturer procedures in NCA inspections and notified body audits. Many manufacturers have serious incident reporting SOPs but no documented trend analysis procedure, no defined statistical threshold for “significant increase,” and no mechanism for escalating trend signals to the vigilance team. This is a direct gap against MDR requirements and will receive increased inspection focus as the MDR surveillance framework matures.

Post-Market Surveillance System

Vigilance sits within the wider PMS system required by MDR Article 83. Manufacturers must document their PMS system in a Post-Market Surveillance Plan and summarise outputs in either a Periodic Safety Update Report (PSUR, for Class IIa, IIb and III devices) or a Post-Market Surveillance Report (PMSR, for Class I devices). Vigilance data feeds directly into PSUR and PMSR preparation.

Notified Body Role in Vigilance

Notified bodies do not serve as primary actors in the vigilance reporting system. Their role is to audit the implementation of vigilance procedures during technical documentation review and quality management system audits, and to assess whether the manufacturer’s PSUR reflects vigilance data appropriately. The NCA is the primary recipient of vigilance reports.

Common Mistakes

Waiting for investigation completion before submitting the initial report

Reporting timelines run from the date of awareness, not from investigation completion. Initial reports are expected to be incomplete; that is why follow-up and final reports exist. A late report cannot be excused by an ongoing investigation.

Attributing the incident to patient condition without ruling out device causality

Where causality is ambiguous, the default is to report. A non-report based on assumed patient causality that is later challenged by NCA is a worse outcome than an over-report of a borderline event.

Implementing an FSCA before notifying the NCA

FSCAs must be reported to the NCA before implementation, or simultaneously in urgent cases. Notifying after the FSCA is already underway is a procedural violation in most member states.

No trend reporting procedure or threshold defined

Article 88 trend reporting requires a documented statistical threshold. Many manufacturers have serious incident reporting SOPs but no trend analysis procedure. This is a direct MDR compliance gap increasingly cited in NCA inspections.

Sales team not trained to recognise and escalate vigilance events

Sales representatives are often first to hear of a device problem from a customer or HCP. If they are not trained to recognise a potential serious incident and escalate immediately, the reporting timeline starts running without the manufacturer’s knowledge. Sales team vigilance training is a direct MDR obligation.

Frequently Asked Questions

Does vigilance reporting apply to Class I devices?

Yes. MDR vigilance requirements apply to all CE-marked medical devices regardless of risk class, including Class I devices that are self-declared without notified body involvement. The class affects the regulatory pathway to market; it does not affect post-market vigilance obligations.

What if the device malfunction caused no harm?

If a malfunction did not lead to harm but could have caused serious deterioration in health or death if it had occurred in different circumstances, the serious incident definition may still apply. The assessment is probabilistic: could this malfunction lead to harm? Not: did this malfunction cause harm in this instance?

What is the difference between a recall and an FSCA?

All recalls are FSCAs, but not all FSCAs are recalls. An FSCA includes any corrective action taken to reduce risk of serious incident: device retrieval (recall), software updates, labelling changes, modification of instructions, or advice to users to inspect or modify device settings. The FSCA category is broader than “recall” in common usage.

Do authorised representatives have separate reporting obligations?

The manufacturer or their AR submits the MIR. For non-EU manufacturers, the AR carries the reporting obligation. The AR cannot simply pass on the obligation to the manufacturer without taking responsibility for ensuring timely and accurate reporting. AR obligations under MDR are substantive and subject to NCA enforcement.

When does EUDAMED replace national reporting?

Once the EUDAMED vigilance module is operational and mandatory, manufacturers will submit vigilance reports through EUDAMED instead of directly to individual NCAs. Until then, direct NCA reporting using national formats or the harmonised MIR template applies. Monitor the European Commission’s EUDAMED implementation timeline for activation dates.

European Vigilance for Medical Devices: Full Guide