Articles 87 to 92 of the MDR govern the vigilance of medical devices. It is the most operational obligation in the regulation. A manufacturer can hold a flawless technical file and still be sanctioned for a report submitted three days too late.
What is a serious incident within the meaning of the MDR?
Article 2(65) defines a serious incident by its potential consequences, not only its actual ones. Malfunction, deterioration in performance, inadequacy of the labelling or the IFU: as soon as one of these events has led, might have led or might lead to death or a serious deterioration in state of health, the reporting obligation is triggered.
The phrase “might have led” changes everything. A near miss avoided by chance, with no actual harm, remains a reportable serious incident. Many manufacturers still reason in terms of harm that actually occurred. Under the MDR, this reading is wrong and costs missed deadlines.
Three distinctions the MDCG 2023-3 guidance settles
The MDCG 2023-3 guidance, the Commission’s questions and answers on vigilance, resolves three grey areas that recur in almost every vigilance system we audit.
Incident and serious incident are not synonyms. Article 2(64) defines the incident, Article 2(65) the serious incident. Only the second triggers an individual report under Article 87. Non-serious incidents feed post-market surveillance and trend analysis (Article 88), not the vigilance portal.
Use error and abnormal use are not treated the same way. A use error linked to the ergonomics of the device is an incident, reportable if its consequences qualify it as serious. Abnormal use — that is, a use deliberately contrary to the intended purpose — falls outside the scope of vigilance: it is handled through post-market surveillance, not through an incident report.
Expected side effects are not reported one by one. An adverse effect documented in the technical file, quantified in the benefit/risk analysis and mentioned in the IFU is not the subject of an individual report. It moves into vigilance as soon as a statistically significant increase in its frequency or severity is detected: this is the trend reporting of Article 88, with its own channel.
The reporting deadlines, without rounding
The MDR sets three deadlines according to severity (Article 87, paragraphs 3 to 5):
Serious public health threat: immediate reporting, at the latest 2 days after becoming aware.
Death or unanticipated serious deterioration in state of health: immediate reporting as soon as a causal link is established or reasonably suspected, at the latest 10 days after becoming aware of the incident.
Other serious incidents: reporting at the latest 15 days after becoming aware of the incident.
The starting point is awareness of the incident, not confirmation of the causal link. Article 87.7 is explicit on this point: in case of doubt over the classification, the manufacturer submits a report within the prescribed deadline and not after clarification. An incomplete report may be filed first, followed by a complete report (Article 87.6).
FSCAs, a field safety corrective action
An FSCA (Field Safety Corrective Action) is any measure taken by the manufacturer to reduce a risk of death or serious deterioration linked to a device already on the market: batch recall, software update, modification of the IFU, addition of a warning, market withdrawal.
It is notified to the competent authority before it is undertaken. The only exception: urgency that requires acting without delay, in which case the notification is simultaneous with the action (Article 87.8). The FSCA is accompanied by a Field Safety Notice, a formal document addressed to the relevant users and healthcare professionals.
Where to report in 2026: EUDAMED is not yet the channel
Since 28 May 2026, four EUDAMED modules are mandatory to use: registration of actors, UDI and devices, notified bodies and certificates, market surveillance. The Vigilance module, however, is still not functional. Its declaration of functionality is expected by the end of 2026, its mandatory use around mid-2027.
Direct consequence: serious incident reports continue to go through the national portals of the competent authorities. In France, that is the ANSM’s electronic reporting portal, and nothing else. A manufacturer waiting for EUDAMED to structure its reporting channel would be confusing the tool with the obligation: the Article 87 deadlines are already running, whatever the channel. To stay ahead, keep an eye on the other MDR deadlines to keep track of"".
The role of the ANSM
In France, the ANSM receives reports through its televigilance portal. It examines the file, may request additional information, and informs its European counterparts as part of the coordinated follow-up provided for in Article 89. The manufacturer remains responsible for the investigation, but the authority may join it or launch its own investigation if the situation requires. A manufacturer established outside the EU shares these vigilance obligations with its authorised representative (EC REP)"".
What it concretely changes for an SME manufacturer
A vigilance system that raises an alert at the moment of writing the report arrives too late. The 10- or 15-day clock runs from awareness of the incident, often before the quality department is formally notified.
The classic scenario: a customer tells after-sales support that a device stopped during use, with no consequence for the patient. The technician opens a ticket, replaces the product, closes the case. Twelve days later, the monthly complaints review reclassifies the event: the stoppage might have led to a serious deterioration if the patient had been alone. It is a serious incident within the meaning of Article 2(65). The 15-day deadline is already four-fifths consumed, and awareness of the incident dates from the support ticket, not the monthly review.
The remedy is not a piece of software, it is a rule for the flow of information: any complaint mentioning a malfunction in a use situation is escalated to the person responsible for regulatory compliance (PRRC, Article 15) within 48 hours, with a three-question qualification grid. In an SME without a dedicated quality department, structuring your MDR vigilance system"" starts by naming this responsibility, writing it into a procedure, and making it known to after-sales support. A serious incident detected on day 2 is reported calmly. Detected on day 12, it is reported in a rush, with an incomplete report and a nonconformity in the making for the next audit of your ISO 13485 QMS"".
Regulatory source: Articles 87 to 92 of Regulation (EU) 2017/745 — EUR-Lex — MDCG 2023-3 guidance, European Commission.