Serious Incident Reporting Under the MDR: 2, 10 and 15 Days
Updated: Aug 15
Serious incident reporting under Regulation (EU) 2017/745 is not primarily a form-filling exercise. It is a set of definitions and a clock, and manufacturers established outside the Union lose time on both. The definitions decide whether something is reportable at all; the clock starts earlier than most quality systems assume. Article 87 gives you two days, ten days or fifteen days depending on the outcome, and all three are calendar days.
What counts as an incident, and what makes it serious
Article 2(64) defines an incident as any malfunction or deterioration in the characteristics or performance of a device made available on the market, including use-error due to ergonomic features, as well as any inadequacy in the information supplied by the manufacturer and any undesirable side-effect. Article 2(65) defines a serious incident as any incident that directly or indirectly led, might have led or might lead to the death of a patient, user or other person, the temporary or permanent serious deterioration of a person's state of health, or a serious public health threat. Article 2(66) defines that last term as an event that could result in imminent risk of death, serious deterioration or serious illness, that may require prompt remedial action, and that may cause significant morbidity or mortality or is unusual or unexpected for the given place and time.
MDCG 2023-3 Rev.2 converts these into three cumulative criteria in Q2. An incident within Article 2(64) has occurred; it led, might have led or might lead to one of the Article 2(65) outcomes; and a causal relationship with the device has been established, is reasonably possible, or is suspected. The guidance defines reasonably possible plainly: the device cannot reasonably be excluded as a contributory cause. In complex situations it should be assumed that the device may have contributed, and in case of doubt the report must nevertheless be submitted.
Q2 also lists what serious deterioration covers: life-threatening illness or injury; temporary or permanent impairment of a body structure or function; a condition necessitating hospitalisation or its prolongation; medical or surgical intervention to prevent either of the first two; a chronic disease; and foetal distress, foetal death, congenital abnormality or birth defect. The second gate is the one that is missed — if the manufacturer cannot exclude that the incident could have led to one of those outcomes under less favourable circumstances, it must be treated as serious.
The three serious incident reporting deadlines in Article 87
Article 87(3) is the default: report immediately after establishing that a causal relationship between the serious incident and the device exists or is reasonably possible, and in any event not later than 15 days after becoming aware of it.
Article 87(4) applies to a serious public health threat: report immediately, and not later than 2 days after becoming aware of the threat. Article 87(5) applies where the incident involves death or an unanticipated serious deterioration in a person's state of health: report immediately after establishing, or as soon as suspecting, a causal relationship, and not later than 10 days. Suspicion is enough to start the ten-day clock — the higher evidentiary bar in 87(3) does not apply here. MDCG 2023-3 Rev.2 Q12 explains unanticipated: a deterioration is unanticipated where the condition leading to it was not considered in the manufacturer's risk assessment.
Two provisions keep the clock from being gamed. Article 87(6) allows an incomplete initial report followed by a complete or follow-up report, so a pending investigation is not a reason to miss the deadline. Article 87(7) requires the manufacturer to report within the applicable timeframe even where it is uncertain whether the incident is reportable. Q13 defines immediately as without any delay intentionally or negligently caused by the manufacturer, and Q10 adds that where the manufacturer cannot demonstrate within the Article 87(3) to (5) deadlines that a potentially serious incident is an expected undesirable side-effect, the report must be submitted anyway.
When the clock starts, and why it starts earlier than you think
MDCG 2023-3 Rev.2 Q14 states that the timelines are calendar days — weekdays, public holidays, Saturdays and Sundays all count — and that the reporting period begins on the day after the awareness date. The flowchart in the guidance labels the awareness date itself as day zero, so serious incident reporting is already running before anyone in your quality department has opened a file.
Q15 defines the awareness date as the date on which the first employee or representative of the manufacturer's organisation receives information about the potentially serious incident, meaning any natural or legal person acting on the manufacturer's behalf. For a manufacturer established outside the Union this is the single most consequential sentence in the guidance. When your EU distributor's service technician takes the call, or your authorised representative receives a complaint under Article 11(3)(g), the clock is already running. Head office learning of it four days later does not reset the count — it consumes four of the fifteen.
The operational answer is a defined escalation route with a stated internal deadline that sits well inside the legal one, and contractual clarity with distributors about what constitutes receipt. Q16 provides the discipline at the other end: the Final (Non-reportable incident) report type may be used only where the manufacturer's investigation establishes that the criteria for a serious incident were not met. If root cause analysis is unfinished and the cause or contributing factors are not established, the case cannot be treated as non-reportable.
Where the report goes, and why one authority is not enough
Serious incident reporting routes by geography, and it routes differently for each report type. Serious incidents are reported to the competent authority of the Member State in which the incident occurred. Trend reports under Article 88 go to the competent authorities of the Member States in which the underlying incidents occurred. Field safety corrective actions are different again: the evaluating competent authority under Article 89(2) and 89(3) is the authority of each Member State in which the action is being or is to be undertaken — and the guidance adds that the competent authority of the Member State where the manufacturer or its authorised representative has its registered place of business must always be informed, even where the action is not taking place there.
Article 89(9) then provides for a coordinating competent authority, which informs the other authorities, the manufacturer and the Commission that it has assumed that role. The content requirements for a field safety notice sit in the second paragraph of Article 89(8), and MDCG 2023-3 Rev.2 notes that the manufacturer must allow 48 hours — two weekdays — for comment on a draft field safety notice, unless the nature of the action dictates a shorter timescale, as with a serious public health threat.
Two current practicalities. The vigilance and post-market surveillance module of EUDAMED is not yet in use; until it becomes mandatory, reporting continues through the national systems described in MDCG 2021-1 Rev.1. And the form has changed: the Manufacturer Incident Report version 7.3.1 published by the Commission is mandatory from 1 May 2026, and MIR 7.3.1 versions published before December 2025 can no longer be used. A validated internal template built on an earlier file is now a rejected submission.
Trend reports, periodic summary reports, and what is not reportable at all
Article 88 covers a statistically significant increase in the frequency or severity of incidents that are not serious incidents, or of expected undesirable side-effects. The methodology is not left to judgement: Annex III Section 1.1 requires the post-market surveillance plan to specify the methods and protocols for establishing that increase, including the observation period, and to set suitable indicators and threshold values. A plan that says trends will be monitored, without stating the method or the observation period, does not meet Annex III — and a device with no defined threshold has no defensible line between trend reporting and serious incident reporting.
Article 87(9) allows periodic summary reporting — an alternative regime by which, in agreement with the coordinating national competent authority, similar serious incidents involving the same device or device type are reported in a consolidated way. MDCG 2023-3 Rev.2 Q23 and Q24 limit it: it is available where the root cause has been identified, where a field safety corrective action has been implemented, or where the serious incidents are common and well documented — meaning clearly identified in the risk analysis, already reported and assessed by the manufacturer and the relevant competent authority, and clinically well known.
Then there is the distinction that decides a large share of complaint files. Q5 and Q6 separate three things. A plain use error, where the user's action or inaction leads to a different outcome than intended, does not fall within the definition of an incident and is handled in the quality management system. A use-error due to ergonomic features — caused by the design and physical configuration of the device, including measurement and monitoring features, display scales, alarms, software menus and other user-interface factors — is an incident, and is reportable where the serious incident criteria are met. Abnormal use, the deliberate violation of the intended use beyond further reasonable interface-related risk controls, is documented but not reported. Q18 adds one more trap: a field safety corrective action undertaken in a third country must be notified to the relevant competent authorities where the device is also legally made available on the Union market, unless the reason for the action is limited to devices supplied in that third country.
What the representative does, and what the PRRC signs for
Article 11(3)(g) requires the authorised representative to immediately inform the manufacturer about complaints and reports from healthcare professionals, patients and users about suspected incidents relating to devices for which it has been designated. That is a forwarding duty. It is not a delegation of the serious incident reporting obligation, which Article 11(4) leaves with the manufacturer along with the rest of Article 10(13) — the obligation to have a system for recording and reporting incidents and field safety corrective actions under Articles 87 and 88.
Article 15(3)(d) puts a name to it. The person responsible for regulatory compliance must ensure that the reporting obligations under Articles 87 to 91 are fulfilled. That person can be inside the manufacturer's organisation or, for a manufacturer outside the Union, available to the authorised representative under Article 15 — but the responsibility identified in 15(3)(d) is specific and personal.
For a non-EU manufacturer, workable serious incident reporting is a narrow arrangement and should be written down: the representative forwards within a stated number of hours, the manufacturer decides reportability, the person responsible for regulatory compliance signs, and the submission goes to the right national authority in the right form. We are not a law firm and do not provide legal advice.
Sources
Regulation (EU) 2017/745, Articles 2(62) to 2(69), 10(12), 10(13), 11(3)(g), 11(4), 15(3)(d), 87, 88, 89 and 92; Annex III Section 1.1
MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746, January 2025
MDCG 2021-1 Rev.1 — Guidance on administrative practices until EUDAMED is fully functional, May 2021
European Commission, Manufacturer Incident Report (MIR) form version 7.3.1 and Helptext, mandatory from 1 May 2026
MDCG 2025-10 — Guidance on post-market surveillance of medical devices and in vitro diagnostic medical devices, December 2025
Who wrote this
Medex is a medical device manufacturer established in Ankara and a registered authorised representative in EUDAMED under SRN TR-AR-000057550. We are not a law firm and do not provide legal advice. Send us your device list and your current vigilance procedure, and we will respond in writing.
Comments