Vigilance reporting is the regulated process by which a medical device manufacturer notifies competent authorities of serious incidents and field safety corrective actions involving its devices on the market. Under EU MDR, it covers serious incident reports, FSCAs, and trend reporting, with strict timelines tied to incident severity.
What is vigilance reporting?
Vigilance reporting is the post-market mechanism that gets safety problems with marketed devices in front of regulators quickly. In the EU, it is set out in Regulation (EU) 2017/745 (EU MDR), Chapter VII, Section 2, Articles 87 to 92, and in the parallel Articles 82 to 87 of the IVDR for in vitro diagnostics.
The term covers three obligations: reporting serious incidents, reporting field safety corrective actions (FSCAs), and trend reporting for a statistically significant rise in non-serious incidents or expected side effects. Not every complaint is reportable. Only events that meet the serious incident definition trigger a vigilance report; the rest are still documented and investigated inside the quality system.
Why vigilance reporting matters in medical device development
A device that performs well in verification can still fail in the field, and vigilance reporting is how that real-world signal reaches the people who can act on it. Late or missed reports are one of the fastest ways to draw a competent authority finding, a notified body nonconformity, or a market restriction.
The stakes are direct. Patients can be harmed by a fault that goes unreported across multiple sites. Regulators can suspend a CE certificate or order a recall. For a manufacturer, a weak vigilance process shows up in audits as a systemic gap because reporting touches complaint handling, risk management, and CAPA all at once.
How vigilance reporting works
Vigilance starts with awareness. Once a manufacturer becomes aware of a possible serious incident, the clock starts. The MDR sets reporting deadlines by severity:
Serious public health threat
Immediately, and no later than 2 days after awareness.
Death or an unanticipated serious deterioration in health
Immediately, and no later than 10 days.
Any other serious incident
Immediately, and no later than 15 days.
The reporting flow follows a consistent pattern:
Capture and triage the complaint or signal.
Often through ISO 13485 complaint handling.
Assess reportability
Determine whether it meets the serious incident criteria in Article 2(65) MDR, using MDCG 2023-3 for interpretation.
Submit the report
Submit a Manufacturer Incident Report (MIR) to the relevant national competent authority, with an initial report allowed even when data is incomplete.
Investigate and assess risk.
Conduct an investigation, including a risk assessment under ISO 14971, and decide whether an FSCA is needed.
Implement corrective action
Where corrective action is required, issue a Field Safety Notice (FSN) to affected users and report the FSCA.
Close the case
Close out with a final MIR once the investigation concludes.
Reporting currently runs through the MIR form (version 7.3.1) sent to national authorities, because the EUDAMED Vigilance module is still under development. The first four EUDAMED modules became mandatory on 28 May 2026, but Vigilance and PMS were not in that set. Until that module is live, manufacturers follow MDCG 2021-1. MDCG 2024-1 adds device-specific vigilance guidance (DSVGs) for higher-risk product groups.
One naming point trips people up. EU “vigilance reporting” is not the same as FDA Medical Device Reporting (MDR) under 21 CFR Part 803, even though both cover post-market safety events. The acronym MDR means the EU Medical Device Regulation in one context and Medical Device Reporting in the other, so always state which you mean.
Common challenges and best practices
The most common failure is a late report caused by a slow awareness-to-decision path. Teams lose days deciding whether an event is reportable. A clear reportability decision tree, mapped to the MDR definitions and MDCG 2023-3, removes most of that delay.
A second problem is treating vigilance as a standalone task. It is not. Reporting should pull from the same complaint record, risk file, and CAPA that the quality system already maintains, so the same event is not assessed three different ways. Good teams also distinguish reportable serious incidents from trendable non-serious events early, because mixing the two either floods authorities with noise or hides a real safety signal.
Documentation discipline matters as much as speed. Record the awareness date, the reasoning behind each reportability call, and any explanatory statement when you conclude an event is not reportable. That trail is what an auditor checks first.
How SJML helps with vigilance reporting
SJML supports post-market surveillance and vigilance as part of its Compliance-as-a-Service offering. That includes complaint intake and handling, serious incident assessment, adverse event reporting, FSCA support, and Field Safety Notice preparation, with root cause analysis feeding CAPA. The team also helps maintain the surrounding documentation: PMS and PMCF plans, PSUR and PMSR outputs, ISO 14971 risk files, and EUDAMED readiness. Support scales from startups standing up a first vigilance procedure to established OEMs needing extra QARA capacity during peak periods.
Frequently asked questions
An incident is any malfunction, deterioration in performance, or inadequacy in the information supplied with a device. A serious incident is one that led, might have led, or might lead to death, serious deterioration in health, or a serious public health threat. All incidents are documented, but only serious incidents are reportable through vigilance.
Timelines depend on severity. A serious public health threat must be reported immediately and within 2 days of awareness. A death or unanticipated serious deterioration in health must be reported within 10 days. Any other serious incident must be reported within 15 days. Manufacturers can file an initial report before the investigation is complete.
No. EU vigilance reporting follows Articles 87 to 92 of the EU MDR and is submitted to national competent authorities. FDA Medical Device Reporting falls under 21 CFR Part 803 and goes to the FDA. The processes overlap in purpose but differ in definitions, forms, and timelines, so a global manufacturer needs both.
Until the EUDAMED Vigilance module is functional, manufacturers submit the Manufacturer Incident Report (MIR) form to the national competent authority in the country where the incident occurred. EUDAMED will eventually centralize this as structured data linked to the device UDI, but that module was not part of the modules made mandatory in May 2026.
Related terms
- Field Safety Corrective Action (FSCA)
- Post-Market Surveillance
- Adverse Event
- Complaint Handling
- Medical Device Reporting
