ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
MDR serious incident reporting is the manufacturer duty under Article 87 of Regulation (EU) 2017/745 to tell the competent authorities about serious incidents involving their devices within fixed time limits: 15 days as a general rule, 10 days for death or an unanticipated serious deterioration in health, and 2 days for a serious public health threat. The clock runs from the moment the manufacturer becomes aware, and that moment is often earlier than teams expect.
This guide explains what counts as a serious incident, what “becoming aware” means, how the three deadlines work, how initial reports and follow-ups fit together, what trend reporting and field safety corrective actions add, and how to build a workflow that meets the timelines. It is general information for manufacturers and is not legal advice.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
The MDR defines a serious incident in Article 2(65). In summary, it is any incident that directly or indirectly led, might have led or might lead to the death of a patient, user or other person, the temporary or permanent serious deterioration of their state of health, or a serious public health threat. The words “might have led” matter: the outcome does not need to have happened. A device malfunction that could have harmed someone, but was caught in time, can still qualify.
The Commission’s Medical Device Coordination Group explains the vigilance terms in its guidance MDCG 2023-3, which covers both the MDR and the IVDR. You can read the current text at the European Commission MDCG 2023-3 document. Use it alongside the regulation to interpret borderline cases.
| Situation | Deadline from awareness |
|---|---|
| Serious incident, general case | Not later than 15 days |
| Death or unanticipated serious deterioration in state of health | Not later than 10 days |
| Serious public health threat | Not later than 2 days |
MDCG 2023-3 describes these as calendar days. The shorter deadline applies where the more serious outcome is involved, so an incident that first looked ordinary but turns out to involve a death moves to the 10-day rule from the point you learn that.
The manufacturer must report when it has established a causal relationship between the device and the incident, or when such a relationship is reasonably possible. Certainty is not needed. The regulation says that if the manufacturer is unsure whether the event is reportable, it must nevertheless submit a report within the timeframe. In practice, awareness starts when any part of the organization with a responsibility to receive complaints, such as customer service, a distributor or a field engineer, learns of the event, so your intake process must move information to the vigilance team on the same day.
Where a full investigation cannot be done in time, the manufacturer may submit an incomplete initial report and follow it with a complete one. The important thing is to meet the deadline with what you know and to keep the authority updated. Do not delay a report to finish the root cause analysis, and record in your file when each piece of information became available.
Serious incident reporting sits next to two related obligations. First, field safety corrective actions, such as a recall, a modification or a warning notice, must be reported before they are carried out, except in urgent public health situations where the action is needed immediately. Field safety notices are sent to users and also made available through the European database, in the official languages required.
Second, Article 88 requires trend reporting. Manufacturers must report a statistically significant increase in the frequency or severity of incidents that are not serious, where the increase could affect the benefit-risk analysis. To do this the manufacturer needs to have defined what counts as a significant increase in its post-market surveillance plan, so decide the method and thresholds before you need them.
This is a hypothetical illustration. A manufacturer of infusion pumps receives a complaint from a hospital on a Monday: a pump delivered the wrong volume and a patient needed additional monitoring but recovered without lasting harm. The complaints handler logs it and the vigilance lead reviews it the same day. Because the pump might have contributed to a serious deterioration, the lead decides the event is reportable and records the date of awareness. The general deadline of 15 days applies, and the team plans an initial report within a week. Two days later the hospital says the patient later died, though the cause is unclear. The lead treats the possible causal relationship as reasonably possible, moves to the shorter deadline, and files the initial report at once, noting that the investigation is ongoing. The full report follows once the device has been returned and analyzed.
Vigilance depends on people who can act. Everyone who might receive a complaint needs to know what to do with it, so train sales staff, service engineers and customer support, not just the quality team, and repeat the training when the process changes. Name a deputy for the vigilance lead so the deadline is still met on holidays. The person responsible for regulatory compliance, described in our guide to the PRRC role, should have visibility of all serious incident decisions. Records should show each decision and its rationale, including events judged not reportable, since an inspector may ask why. Reports also connect to your MDR technical documentation, your post-market surveillance and your registration in EUDAMED, so keep the files consistent.
Distributors and importers are often the first to hear about an incident, so your agreements should oblige them to forward complaints and suspected incidents to you promptly, ideally within one business day. Test this flow: send a mock complaint through a distributor and measure how long it takes to reach your vigilance lead. If it takes a week, half of your 15-day allowance is already gone before you begin.
An auditor or notified body will expect a vigilance procedure, a decision tree for reportability, forms for initial and follow-up reports, a trend reporting method, and training records. The EU MDR Toolkit provides Medical Device Regulation templates that you can adapt to your devices and processes. For the wider regime, read our overview of the EU MDR, and check the current status of transition deadlines in our note on EU MDR transition deadlines.
Within 15 days of becoming aware in the general case, within 10 days for death or unanticipated serious deterioration in health, and within 2 days for a serious public health threat.
No. The manufacturer must report where a causal relationship is established or reasonably possible, and where it is unsure whether the event is reportable it must still report within the deadline.
Yes. An initial report may be incomplete, provided a complete report follows once the investigation is done.
It is the requirement to report a statistically significant increase in non-serious incidents, or in expected side effects, that could affect the benefit-risk analysis. Define your method in the post-market surveillance plan.
Yes, and normally before they are carried out, except in urgent cases where immediate action is needed to protect public health.
September 30, 2026
