WorkflowEU MDR

EU MDR vigilance reporting workflow

This workflow is relevant when complaint, support, PMS, distributor, importer, healthcare-professional, user, patient, or authority information may involve a medical device incident on the Union market.

The workflow separates intake, seriousness assessment, serious incident reporting, FSCA and FSN handling, trend reporting, EUDAMED routing, notified-body communication, CAPA, PMS, clinical evaluation updates, and records.

Back to main artifact Review sources

Author

Sorena AI

Published

May 9, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published May 9, 2026

Updated Jul 24, 2026

Overview

EU MDR vigilance reporting starts when the manufacturer receives information about a possible issue with a device made available on the Union market. The working file should capture the product identifiers, event facts, patient or user outcome, causal assessment, reporting route, authority communication, corrective action decision, and the PMS records that need updating.

Section 1

1. Intake and triage the vigilance signal

Open a vigilance record as soon as the manufacturer receives information from complaints, technical support, PMS or PMCF activity, literature, registries, healthcare professionals, users, patients, importers, distributors, authorised representatives, or competent authorities. Operational convenience does not affect reportability. Decide whether the information describes an with a device and whether serious-incident criteria can be excluded.

Use a controlled manufacturer awareness date. MDCG 2023-3 treats awareness as the date when the manufacturer's organisation first receives information that reasonably suggests a potentially reportable event, including receipt by employees or persons acting on the manufacturer's behalf. Do not reset the clock when the case moves between complaint handling, medical review, an authorised representative, or regulatory affairs.

Record device name, Basic UDI-DI or UDI-DI where available, model, lot or serial number, software or firmware version, market status, country of occurrence, reporter type, date first received by the manufacturer's organisation, and whether any outsourced complaint handler or authorised representative received the information first.
Classify the issue type: malfunction or deterioration, use error due to ergonomic features, inadequacy in information supplied by the manufacturer, undesirable side-effect, or another device-related quality, performance, or safety signal.
Preserve the original complaint, returned device status, logs, images, service records, IFU or labelling version, and any clinical context needed to assess actual or potential harm.
If the information is not an , close the vigilance-reportability path only after documenting the rationale in the quality management system and routing the data into PMS, complaint, CAPA, supplier, or usability review as applicable.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

MDR source for incident, serious incident, FSCA, FSN, PMS, vigilance, and Article 87 to Article 92 reporting duties.

MDCG 2022-7 - UDI system Q&A

Grounds the need to connect UDI data with vigilance records and to provide UDI-PI for individual devices involved in vigilance incidents.

MDCG 2023-3 Rev.2 - vigilance terms and concepts Q&A

Grounds the intake sources, incident-versus-serious-incident triage, uncertainty handling, manufacturer awareness date, FSCA examples, FSN handling, and EUDAMED vigilance-module caveat.

Section 2

2. Decide whether the event is a serious incident

Assess the actual and reasonably possible outcome, not only the outcome that happened in this case. Under the MDR, a is an that directly or indirectly led, might have led, or might lead to death, serious deterioration of health, or a serious public health threat.

Treat the case as reportable if death, temporary or permanent serious deterioration of health, or a serious public health threat occurred or could have occurred under less favourable circumstances.
Check whether an expected side-effect is clearly documented in product information, quantified in technical documentation, and subject to ; otherwise do not use expectedness as a shortcut to avoid Article 87 assessment.
When reportability is uncertain, submit within the applicable MDR timeframe rather than waiting for complete root-cause evidence.
If later evidence shows that a submitted case was not reportable, document the investigation conclusion and rationale instead of deleting the reporting history.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

Article 2 defines serious incident and Article 87 requires reporting despite uncertainty when an incident may be reportable.

MDCG 2023-3 Rev.2 - vigilance terms and concepts Q&A

Grounds the practical serious-incident assessment rule that potential outcomes under less favourable circumstances must be considered.

Section 3

3. Apply MDR reporting timelines only after the reporting trigger is clear

Use the MDR Article 87 clocks for reports. Calculate the deadline from the manufacturer-awareness date; causal relationship being established, reasonably possible, or suspected determines the obligation to report immediately, subject to the applicable outer deadline.

General : report immediately after causal relationship is established or reasonably possible, and not later than 15 days after awareness of the .
Serious public health threat: report immediately and not later than 2 days after awareness of the threat.
Death or unanticipated serious deterioration in a person's state of health: report immediately after causal relationship is established or suspected, and not later than 10 days after awareness of the .
Clock record: retain the first-receipt timestamp, information available on that date, causal-assessment date, seriousness decision, applicable deadline, submission timestamp, and reason for any corrected or follow-up report.
Incomplete information is not a reason to miss the clock; submit an initial report where necessary and follow with a complete report.
For recurring similar serious incidents, use periodic summary reporting only where the MDR conditions are met and the relevant competent authority has agreed the format, content, and frequency.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

Article 87 provides the 15-day, 2-day, and 10-day serious incident reporting limits and permits incomplete initial reports followed by complete reports.

MDCG 2023-3 Rev.2 - vigilance terms and concepts Q&A

Grounds manufacturer awareness date handling and the point that incomplete information does not justify delaying the initial MIR.

Section 4

4. Route FSCA, FSN, trend reporting, and EUDAMED correctly

Separate the regulatory outputs. A report, an report, a field safety notice, a trend report, a periodic summary report, and PMS or PSUR updates are not substitutes for each other.

Report any for devices made available on the Union market, including a third-country FSCA for the same device where the reason is not limited to the third-country device.
Except in urgent cases where immediate is needed, report the FSCA without undue delay before undertaking it.
Send an without delay to users or customers affected by an ; identify the device, relevant UDI, manufacturer SRN where issued, reason for the action, associated patient or user risks, and actions users must take.
Report trend signals when there is a statistically significant increase in frequency or severity of non-serious incidents or expected undesirable side-effects that could affect benefit-risk and lead or may lead to unacceptable risk.
As of 24 July 2026, the EUDAMED Vigilance and post-market surveillance module is still in development and is not one of the four modules made mandatory on 28 May 2026. Continue using the applicable national vigilance reporting processes until that module becomes mandatory; after mandatory use, follow EUDAMED processes and the alternative data-exchange mechanisms for technical unavailability.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

Articles 87 to 92 ground FSCA reporting, FSN content, trend reports, periodic summary reports, and the electronic system for vigilance and PMS.

European Commission - EUDAMED overview

Confirms that four EUDAMED modules became mandatory on 28 May 2026 while the Vigilance and post-market surveillance module remains in development.

Commission Implementing Regulation (EU) 2021/2078 on EUDAMED

Grounds EUDAMED setup, maintenance, data exchange, and alternative mechanisms when the system is unavailable or malfunctioning.

MDCG 2023-3 Rev.2 - vigilance terms and concepts Q&A

Grounds the interim requirement to use national reporting processes until the EUDAMED Post-market surveillance and Vigilance module becomes mandatory.

Section 5

5. Communicate with authorities, notified bodies, customers, and internal owners

The workflow should make communication ownership explicit because MDR vigilance involves several audiences. The relevant competent authority depends on where the occurred or where the is being or will be undertaken; notified bodies receive access or information where the case relates to devices for which they issued certificates or where PMS, PSUR, certificate, or conformity-assessment follow-up requires it.

For serious incidents, identify the competent authority of the Member State where the occurred and keep the investigation, risk assessment, and follow-up action traceable to that authority file.
For FSCAs, identify every Member State where the action is being or will be undertaken and the Member State where the manufacturer or its authorised representative has its registered place of business.
Coordinate with the notified body where the MDR, certificate conditions, PSUR review, clinical evaluation follow-up, or authority assessment makes the vigilance information relevant to certified devices.
For customers and users, control the text, translations, issue date, recipient list, acknowledgement tracking, and effectiveness checks; the notice must not understate the risk.
Assign internal owners for regulatory reporting, medical or clinical assessment, complaint investigation, product engineering, quality/CAPA, supply chain, customer communication, legal review, and PMS or clinical evaluation updates.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

Article 89 grounds competent-authority evaluation, manufacturer cooperation, notified-body relevance, and FSN communication to users.

MDCG 2023-3 Rev.2 - vigilance terms and concepts Q&A

Grounds evaluating competent-authority routing for serious incidents, FSCAs, draft FSNs, and relevant notified-body information flow.

Section 6

6. Close the loop through CAPA, PMS, clinical evaluation, and records

Do not close a vigilance file at submission. MDR post-market surveillance requires active gathering, recording, and analysis of quality, performance, and safety data throughout the device lifetime, with conclusions feeding preventive and corrective actions and updates to technical documentation.

Link the vigilance case to CAPA where the investigation identifies a need for preventive action, corrective action, design change, supplier action, labelling update, software update, servicing instruction, recall, or other .
Update the PMS plan inputs, PMS report or PSUR, trend thresholds, risk management file, benefit-risk determination, IFU and labelling, design and manufacturing information, and technical documentation where the case changes the evidence base.
Update the clinical evaluation and PMCF planning where the , trend, , or user feedback affects clinical safety, performance, residual risk, undesirable side-effects, or the benefit-risk conclusion.
Maintain the audit trail: intake record, seriousness assessment, rationale for reportability or non-reportability, submitted MIR or national report, report, draft and final versions, authority comments, customer distribution evidence, investigation reports, CAPA records, PMS and clinical evaluation updates, and final report to the competent authority where required.
Keep UDI and device-status data aligned with vigilance and PMS records so affected devices can be identified, recalled, monitored, or excluded from scope without relying on free-text descriptions.

Sources for this answer

Regulation (EU) 2017/745 on medical devices

Articles 83 to 86 ground PMS, PSUR, preventive and corrective actions, technical documentation updates, and clinical evaluation updates.

MDCG 2022-7 - UDI system Q&A

Grounds linking UDI data with vigilance records, trend reporting, PMS reports, MIR, and PSUR handling.

Recommended next step

Turn MDR vigilance events into reportable records

Use Sorena to keep intake facts, seriousness assessment, reporting clocks, FSCA and FSN actions, EUDAMED caveats, CAPA links, PMS updates, and source citations together.

Research workflow

Open the EU MDR Research Copilot

Answer MDR vigilance, PMS, EUDAMED, and evidence questions with cited outputs.

Explore next step

Talk to Sorena

Talk through MDR implementation

Review your vigilance intake model, reportability decisions, records, and escalation process.

Explore next step

Primary sources