Adverse event reporting — what must be reported
Regulatory basis - MDR Art. 87 and IVDR Art. 82 define the reporting obligations for serious incidents and field safety corrective actions. Manufacturers must report to the National Competent Authority of the member state(s) where the incident occurred or the FSCA is being taken.
Disclaimer - This site provides general information only and does not constitute legal or regulatory advice. Always consult the official regulation text and a qualified regulatory professional.
The vigilance system — purpose
The EU vigilance system exists to ensure that safety information about marketed devices reaches competent authorities quickly, enabling regulatory action where needed. It operates in parallel with — and is fed by — the manufacturer's PMS system.
The two key triggers for mandatory reporting are:
- Serious incidents — adverse events involving a marketed device that meet defined criteria
- Field safety corrective actions (FSCAs) — actions taken by manufacturers to reduce risk from a device already on the market
Serious incidents — definition
Under MDR Art. 2(65), a serious incident is any malfunction or deterioration in the characteristics or performance of a device made available on the market, including use-error due to ergonomic features, as well as any inadequacy in the information supplied by the manufacturer and any undesirable side-effect, that, directly or indirectly, has led, might have led, or might lead to:
| Outcome | Examples |
|---|---|
| Death of a patient, user, or other person | Fatal device failure, device-associated infection leading to sepsis |
| Temporary or permanent serious deterioration of the state of health of a patient, user, or other person | Permanent injury, permanent impairment of body function, foetal distress requiring intervention |
| Serious public health threat | Contaminated batch affecting multiple patients, infectious disease transmission risk |
The "might have led" standard
The definition includes events that might have led to serious harm — not only those that actually caused it. This means:
- Near-misses must be evaluated and reported if the potential for serious harm existed
- Device malfunctions that were caught before reaching the patient may still be reportable
- The threshold is not certainty of harm but reasonable possibility of harm
What is NOT a serious incident
Not every adverse event or device complaint is reportable. The following are explicitly excluded:
- Events where the serious outcome was due to the patient's underlying condition and not the device
- Expected and clinically anticipated side-effects and outcomes documented in the labelling
- Events where investigation confirms the device performed correctly and the outcome was unrelated to device performance
- Device deficiencies identified in manufacturing before reaching patients (covered by QMS non-conformance process, not vigilance)
Serious incidents vs. near-misses
| Category | Definition | Reportable? |
|---|---|---|
| Serious incident | Malfunction/deterioration that led to, or might have led to, death or serious deterioration | Yes — within timeframes |
| Near-miss | An event that could have resulted in a serious incident but was intercepted before reaching the patient | Yes — if meets the "might have led" criteria |
| Non-serious incident | Malfunction or complaint that did not and could not lead to serious harm | No — managed through PMS/complaints system |
| FSCA | Corrective action taken to reduce unacceptable risk from a marketed device | Yes — notify NCA before or concurrent with implementation |
IVD-specific serious incident considerations
For IVDs, serious incidents include:
- False negative results where failure to diagnose a serious condition led to or could have led to delayed or inappropriate treatment with serious consequences (e.g. false negative HIV test, false negative cardiac troponin)
- False positive results that led to or could have led to unnecessary procedures with serious risk (e.g. false positive cancer diagnosis leading to major surgery)
- Cross-contamination events between patient samples causing misidentification
- Calibration failures affecting the reliability of results across multiple patients
The key question is the same: did the IVD malfunction or provide incorrect information in a way that led to or might have led to serious harm to a patient?
Who must report?
Manufacturers bear the primary reporting obligation. However:
- Authorised representatives must cooperate and may report on behalf of non-EU manufacturers
- Importers and distributors who become aware of serious incidents must immediately inform the manufacturer (and if the manufacturer cannot be reached, may report directly to the NCA)
- Healthcare institutions are required in most member states to report serious incidents they become aware of to their NCA — but the manufacturer's obligation is independent
What information must be reported?
The initial report (within the required timeframe) must contain sufficient information to allow the NCA to:
- Identify the device (UDI, model, lot/serial number)
- Understand the nature of the incident
- Assess the seriousness and urgency
Full information is submitted in the final report after investigation is complete. EUDAMED provides the vigilance module for structured electronic reporting.
Related pages
- Serious incidents & near-misses
- Reporting timeframes
- How to report — NCAs
- EUDAMED vigilance module
- Trend reporting
- When an FSCA is required
Official references
| Reference | Description |
|---|---|
| MDR Art. 87 | Reporting of serious incidents and FSCAs |
| MDR Art. 2(65) | Definition of serious incident |
| IVDR Art. 82 | IVDR reporting obligations |
| MDCG 2023-3 | Guidance on serious incident reporting |
| MDCG 2019-14 | Vigilance reporting — worked examples |