Skip to main content

Reporting timeframes — the 15/30-day rules

note

Regulatory basis - MDR Art. 87(5)–(8) / IVDR Art. 82(5)–(8). Timeframes run from the date the manufacturer becomes aware of the incident. EUDAMED is the reporting platform for EU vigilance reports.

warning

Disclaimer - This site provides general information only and does not constitute legal or regulatory advice. Always consult the official regulation text and a qualified regulatory professional.

Overview of reporting timeframes​

MDR and IVDR define tiered reporting timeframes based on the urgency and severity of the incident. The clock starts when the manufacturer becomes aware of the incident — not when the investigation is complete.

Incident typeInitial report timeframe
Serious public health threatImmediately — without delay; as soon as possible and no later than 2 days
Death or unanticipated serious deterioration of healthAs soon as possible and no later than 15 days
All other serious incidentsAs soon as possible and no later than 30 days
FSCA (field safety corrective action)Before implementation, except where delay would cause greater risk — in which case, at latest concurrent with implementation

Serious public health threat — 2-day reporting​

A serious public health threat is defined in MDR Art. 2(66) as an event which could result in imminent risk of death, serious deterioration in a person's state of health, or serious illness, that may require prompt remedial action, and that may cause significant morbidity or mortality in humans, or that is unusual or unexpected for the given place and time.

The 2-day timeframe is intentionally very short — it applies to scenarios where mass patient exposure or widespread harm is possible. Examples:

  • Contaminated batch of a critical sterile product reaching multiple hospitals
  • Widespread software failure affecting critical life-support devices across multiple sites
  • Infectious disease transmission event via an IVD or implantable device

Death or unanticipated serious deterioration — 15 days​

The 15-day timeframe applies where the incident has already resulted in:

  • Death of a patient, user, or other person, or
  • Unanticipated serious deterioration of health

"Unanticipated" means not previously known or documented as a risk of the device, even if death or serious harm from device use in general was an acknowledged possibility.

All other serious incidents — 30 days​

The 30-day timeframe is the default for serious incidents that did not result in actual death or unanticipated serious deterioration, including:

  • Near-misses where potential serious harm existed
  • Incidents where potential for serious harm was identified without a patient outcome
  • Incidents under investigation where the outcome severity is not yet confirmed

Initial vs. final reports​

Because the timeframes require reporting before investigations are complete, MDR/IVDR use a two-report system:

Initial report​

  • Submitted within the applicable timeframe (2, 15, or 30 days)
  • Contains the information available at time of reporting: device ID, nature of incident, initial assessment, actions taken
  • Does not need to include root cause or final conclusions
  • Alerts the NCA to the event

Final/updated report​

  • Submitted after the investigation is complete
  • Contains full root cause analysis, conclusions, corrective actions, and PMS implications
  • No fixed timeframe specified in the regulation — but NCAs expect it within a reasonable period; many expect a final report within 30–90 days of the initial report for most incidents

Manufacturers may also submit progress reports for complex investigations requiring more than 90 days.

The clock — "became aware"​

The timeframe starts when the manufacturer first becomes aware that an incident may be a serious incident. This means:

  • A customer complaint received by the complaints team → clock starts if the complaint describes a potentially serious outcome
  • A report from a healthcare institution → clock starts upon receipt
  • Internal discovery (e.g. quality control identifies a batch defect that could cause harm) → clock starts upon internal discovery

Manufacturers must have internal escalation procedures that ensure potentially reportable events are identified and escalated quickly within the organisation. Delays in internal processing do not extend the regulatory timeframe.

FSCA timeframes​

Field safety corrective actions must be reported:

  • Before implementation — the manufacturer notifies the relevant NCAs of the FSCA and the associated Field Safety Notice (FSN)
  • Exception: if delaying the FSCA to wait for NCA notification would itself cause greater risk, the manufacturer may implement the FSCA concurrently with notifying NCAs

After implementation begins, the FSN is sent to all affected users/customers. NCAs are kept informed throughout.

Reporting to multiple NCAs​

For incidents occurring in more than one member state, the manufacturer must report to:

  • The NCA of each member state where the incident occurred, and
  • The NCA of each member state where the affected device is on the market if an FSCA is being taken

EUDAMED's vigilance module is designed to facilitate multi-country reporting — a single report submission can be directed to multiple NCAs simultaneously.

Consequences of late reporting​

Late vigilance reporting is a serious regulatory non-compliance. NCAs may:

  • Issue formal warnings or improvement notices
  • Require an explanation of the delay and systemic changes to prevent recurrence
  • Escalate to wider market surveillance actions, particularly for repeated late reporting
  • Include late reporting findings in notified body surveillance audit results

Official references​

ReferenceDescription
MDR Art. 87(5)–(8)Reporting timeframes
IVDR Art. 82(5)–(8)IVDR equivalent
MDR Art. 2(65)–(66)Definitions: serious incident, serious public health threat
MDCG 2023-3Serious incident reporting guidance
EUDAMED user guidesVigilance module submission guidance