MDR Vigilance Reporting
Vigilance reporting is the regulatory mechanism through which manufacturers notify competent authorities of serious incidents involving their devices and of field safety corrective actions taken to address device-related risks. Under EU MDR the process runs through EUDAMED with defined incident-reporting timelines; FDA’s equivalent is Medical Device Reporting under 21 CFR 803. Getting the reportability determination right — and getting it in on time — is one of the highest-scrutiny areas of device post-market compliance.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 20 LINKSVigilance is a decision under a clock: the reportability assessment must be made, recorded and defensible even when the answer is no — and an unrecorded decision not to report is indistinguishable from never having looked.
06 · QUALITY MATURITY — MDR VIGILANCE REPORTING, REACTIVE TO ADAPTIVE
Reporting happens when someone senior thinks it should. The clock starts when the decision is made rather than when the information arrived.
Criteria and timelines are documented, but awareness is dated from when the complaint reached the regulatory team rather than from when the company first knew.
Awareness is dated from first receipt anywhere in the organisation, every assessment is recorded including the decisions not to report, and the reasoning would survive being read by a regulator.
Field safety corrective actions are managed as a controlled process with effectiveness checks, and vigilance findings feed the wider surveillance system rather than closing on submission.
The trigger conditions are understood well enough to be designed against, and reportable events fall because the device changed, not because the threshold moved.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 3
Derived from the 3 standards SPEQ maps to this subject, across 2 regulatory bodies: EC, FDA.
RECORDS & OBJECTIVE EVIDENCE
- The reportability decision record for each incident, including those assessed as not reportable
- Date of awareness, evidenced from first receipt anywhere in the organisation
- Submitted reports with their timelines, and any follow-up or final reports
- Field safety corrective action records, including the notice issued and its distribution
- Effectiveness verification for corrective actions taken in the field
COMMON INSPECTION FINDINGS
- Awareness dated from when the regulatory function saw the complaint rather than from first receipt
- Decisions not to report recorded as an outcome with no reasoning behind them
- Incidents downgraded during assessment with no documented basis for the downgrade
- Field safety corrective actions issued without verification that they reached the users concerned
- Vigilance handled entirely separately from surveillance, so neither informs the other
What Triggers a Report
Under EU MDR, a “serious incident” — broadly, a malfunction, deterioration, or inadequacy of labelling or instructions that did or could lead to death, temporary or permanent serious deterioration of health, or a serious public health threat — triggers a mandatory report to the relevant competent authority within defined timelines that shorten as severity increases (the tightest deadlines apply to serious public health threats and deaths).
FDA’s Medical Device Reporting requirement under 21 CFR 803 similarly obligates manufacturers to report events reasonably suggesting a device may have caused or contributed to a death or serious injury, or that malfunctioned in a way that would likely cause or contribute to death or serious injury if it recurred.
The Reportability Decision
Not every complaint or adverse event is reportable — the determination requires a documented, defensible causal and severity assessment applying the specific regulatory definitions and thresholds, not a subjective judgement made case by case without a consistent methodology. This determination is one of the most heavily scrutinised elements of a device quality system precisely because getting it wrong in the under-reporting direction has direct patient-safety consequences.
Organisations typically maintain a documented decision tree or procedure for reportability assessment, applied consistently by trained personnel, with the underlying rationale retained as part of the complaint or incident record — not just the final yes/no conclusion.
Field Safety Corrective Actions and Recalls
When a device-related risk requires action in the field — a design change, additional instructions, or removal of product — EU MDR requires a Field Safety Corrective Action (FSCA) with an accompanying Field Safety Notice to affected users, alongside vigilance reporting to the relevant authorities. FDA’s parallel mechanism runs through 21 CFR 806 (corrections and removals) alongside MDR reporting where applicable — the two obligations (report the incident; correct the field risk) are related but legally distinct and both must be tracked.
Vigilance vs. Broader Post-Market Surveillance
Vigilance reporting is the acute, threshold-triggered obligation sitting inside the broader, continuous post-market surveillance system — PMS is where signals accumulate and get trended; vigilance reporting fires when a specific event meets a defined severity threshold and a regulatory clock starts. SPEQ interpretation: a PMS system that is functioning well should rarely be surprised by what triggers a vigilance report, because the underlying signal was typically already visible in complaint or service data before it crossed the reportability threshold.
FREQUENTLY ASKED
What is the deadline for reporting a serious incident under EU MDR?
Timelines are severity-dependent and defined in the regulation and its implementing guidance — the most serious events (deaths, serious public health threats) carry the shortest deadlines, with longer windows for less severe serious incidents; the exact number of days should always be confirmed against the current in-force text rather than assumed from memory.
Does a near-miss with no patient harm ever need to be reported?
Potentially, yes — both EU MDR and FDA’s MDR framework can capture events where harm did not occur but the malfunction, if it recurred, would be likely to cause death or serious injury; “no harm this time” is not by itself a reason to conclude an event is non-reportable.
Is a Field Safety Corrective Action the same as a product recall?
A recall is one possible type of field safety corrective action (physically removing product from the field), but FSCAs also include other actions such as issuing updated instructions for use, software patches, or additional training — a recall is a subset of the broader FSCA/corrections-and-removals category, not a synonym for it.