An incident report is a formal notification a medical device manufacturer submits to a regulatory authority when a marketed device is linked to a death, serious injury, or a malfunction that could cause harm if it recurred. It is a core post-market surveillance obligation under EU MDR and FDA rules.
What is an incident report?
An incident report sits in the post-market phase of the device lifecycle, after a product reaches the market and real-world use begins. It is how a manufacturer tells a regulator that something went wrong, or could have, with a device in the field.
Terminology differs by region. Under EU MDR 2017/745, the reportable event is a “serious incident,” and the submission is made on a Manufacturer Incident Report (MIR) form. In the United States, the equivalent obligation is Medical Device Reporting (MDR) under FDA 21 CFR Part 803, which uses “adverse event” and “reportable event” language. The acronym MDR does double duty: Medical Device Regulation in Europe, Medical Device Reporting in the US, so context matters.
Why incident reports matter in medical device development
Incident reporting is how safety signals reach regulators before a localized problem becomes widespread. A single report can trigger an investigation, a field safety corrective action, or a recall that protects patients still using the device.
The consequences of getting it wrong are direct. Late, missing, or inconsistent reports are among the most common findings in FDA inspections and MDSAP audits. Regulators compare internal complaint records against what was actually reported, and gaps invite warning letters, import alerts, or criminal exposure. Reporting decisions also feed risk management under ISO 14971 and post-market surveillance, so a weak incident process undermines the wider quality system.
How incident reporting works
Incident reporting runs as a governed workflow connecting complaint intake to a regulator submission.
Intake and awareness
Information arrives from customers, service engineers, sales, literature, or trend analysis. The “awareness date” starts the reporting clock.
Reportability assessment
A trained decision-maker checks the event against defined criteria: did it involve, or could it involve, death, serious injury, or a reportable malfunction? EU MDR applies the “serious incident” threshold; FDA Part 803 uses the definitions in 21 CFR 803.3.
Investigation
Root cause analysis links to CAPA and the ISO 14971 risk file. Reports can be staged, so teams do not wait for a complete investigation before notifying.
Submission
Europe files the MIR form to the Competent Authority via EUDAMED; the US files Form 3500A through the eMDR gateway, feeding the MAUDE database.
Follow-up and closure
Supplemental and final reports add investigation results and corrective action.
Timelines are tied to severity. Under EU MDR Article 87, a serious public health threat is reported no later than 2 days after awareness, a death or unanticipated serious deterioration in health no later than 10 days, and other serious incidents no later than 15 days, all counted in calendar days. Under FDA 21 CFR Part 803, manufacturers file most reports within 30 calendar days, and a 5 working day report when an event needs remedial action to prevent an unreasonable risk of substantial harm to public health.
Common challenges and best practices
The hardest part is rarely the form. It is the judgment call on reportability, made fast and consistently across many cases.
Common failure modes:
- Inconsistent reportability decisions, with no documented rationale a regulator can review.
- An unclear “day 0,” which quietly blows the timeline before anyone notices.
- A complaint system that does not talk to the reporting process, so events surface late.
- Treating every region the same, when EU vigilance and US MDR use different thresholds and clocks.
Stronger programs fix triage and governance first. They define the awareness date precisely, use a documented decision tree, require a written rationale for every call (including non-reportable ones), and link each event to CAPA and risk review. Centralizing intake and investigation, then mapping each case to each market’s criteria, lets one global process feed several regulators without losing local nuance.
How SJML helps with incident reporting
SJML supports incident reporting as part of its QARA and post-market surveillance services. Its complaints and vigilance teams handle event intake, reportability assessment, adverse-event and serious-incident reporting, and root cause analysis tied to CAPA. SJML also helps build and sustain the underlying quality system, including ISO 13485 procedures, ISO 14971 risk files, and post-market surveillance and PMCF planning, so reporting decisions stay consistent and defensible in audits. For manufacturers selling across regions, SJML maps a single intake and investigation process to FDA, EU MDR, and other national requirements, with on-demand scaling for surges in volume.
Frequently asked questions
Under EU MDR 2017/745, an incident is any malfunction or deterioration in a device’s characteristics or performance, including use errors caused by ergonomic design and inadequate labeling. A serious incident is one that led, might have led, or might lead to death, serious deterioration in health, or a serious public health threat. All incidents are documented and investigated, but only serious incidents must be reported to a Competent Authority.
FDA Medical Device Reporting requires manufacturers to submit most incident reports within 30 calendar days of becoming aware of a device-related death, serious injury, or reportable malfunction. A faster 5 working day report applies when an event needs remedial action to prevent an unreasonable risk of substantial harm to public health, or when FDA makes a written request. Reports are filed electronically on Form 3500A through the eMDR system.
No, though the terms overlap. An adverse event is the underlying occurrence, such as a patient injury or device malfunction. An incident report is the formal notification a manufacturer sends to a regulator once that event meets reporting criteria. Not every adverse event is reportable; reportability depends on severity and the specific thresholds set by EU MDR or FDA 21 CFR Part 803.
The clock starts on the awareness date, the day the manufacturer first receives information suggesting a reportable event, not the day the investigation finishes. Under EU MDR, reporting periods are counted in calendar days beginning the day after awareness. Defining “day 0” precisely and routing complaints quickly to the reporting decision-maker are the two changes that most often keep teams inside the timeline.
Related terms
- Vigilance Reporting
- Adverse Event
- Field Safety Corrective Action (FSCA)
- Post-Market Surveillance (PMS)
- Medical Device Reporting (FDA)
