Do manufacturers need to file two separate reports for the same incident under MDR and the AI Act?

For incidents already reportable under MDR Article 87 vigilance requirements, manufacturers should align their reporting timelines and channels so the same underlying event does not require entirely duplicate, disconnected submissions to different authorities. In practice, this means updating internal vigilance procedures to explicitly reference both regulations and ensure a single incident triggers a coordinated response covering both obligations rather than two independently managed workflows.

Who receives the Article 73 serious incident report?

The report goes to the market-surveillance authority of the Member State where the incident occurred, which for medical devices may be a different national body or contact point than the one handling MDR vigilance reports depending on how each Member State has organized its market surveillance functions. Manufacturers operating across multiple EU Member States need to map which national authority receives AI Act reports in each jurisdiction, since this can differ from their established MDR vigilance contacts.

What is a common mistake manufacturers make in their vigilance procedures regarding AI Act reporting?

A common mistake is failing to update existing MDR vigilance SOPs to explicitly reference the AI Act serious incident definition and reporting pathway, leaving staff to handle AI-related incidents using only device vigilance criteria that may not fully capture AI Act reportable categories such as fundamental rights breaches. Manufacturers should train vigilance and quality teams on both definitions side by side so an incident is correctly triaged against both frameworks from the outset.

All terms

RegulatoryRegulated Pathways AI / ML in Devices Quality System Post-Market & Safety

AI Act Serious Incident Reporting

Duty on providers of high-risk AI systems to report serious incidents to national market-surveillance authorities.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed July 25, 2026

Definition

Article 73 obliges providers to report any serious incident involving a high-risk AI system to the market-surveillance authority of the Member State where the incident occurred. Serious incident is defined in Article 3(49) and includes death, serious harm to health, serious and irreversible disruption of critical infrastructure, breach of fundamental rights, or serious harm to property or the environment.

What the regulation says

Regulation (EU) 2024/1689, adopted on 13 June 2024, requires providers under Article 73 to report serious incidents involving high-risk AI systems to the market-surveillance authority where the incident occurred. Article 3(49) covers death or serious health harm, serious and irreversible disruption of critical infrastructure, infringement of Union-law obligations protecting fundamental rights, and serious harm to property or the environment. Reporting is required immediately once a causal link, or its reasonable likelihood, is established, and no later than 15 days after awareness. Shorter deadlines apply to deaths, widespread infringements and qualifying critical-infrastructure incidents. An incomplete initial report may be followed by a complete report. For MedTech, Article 73 limits notifications concerning high-risk AI systems that are medical devices or device safety components covered by Regulation (EU) 2017/745 or Regulation (EU) 2017/746 to fundamental-rights incidents, reported to the designated national competent authority. Separate vigilance duties remain under MDR Article 87 and IVDR Article 82; those regulations became applicable on 26 May 2021 and 26 May 2022, respectively. The AI Act generally applies from 2 August 2026, but Article 6(1) and its corresponding obligations for product-related high-risk AI apply from 2 August 2027.

What this means in practice

For medical devices, reporting timelines and channels align with MDR Article 87 vigilance reporting for incidents already reportable under device law, avoiding duplicate submissions. Manufacturers should update their vigilance procedures to reference both regulations.

Examples

An AI-enabled infusion device delivers an unsafe dose that seriously injures a patient. The manufacturer assesses and reports the event under MDR vigilance requirements, while checking the AI Act's device-specific reporting limitation rather than automatically duplicating the submission.
A high-risk AI medical device systematically excludes patients from a diagnostic pathway because of a protected characteristic. If this infringes obligations under Union law protecting fundamental rights, the provider assesses notification under Article 73 to the designated national competent authority.
A medical-device manufacturer updates its incident-handling procedure to distinguish patient-safety events from fundamental-rights incidents. The revised workflow assigns responsibility for assessing both regulations and records the reporting route selected for each event.

Common pitfalls

•Assuming every AI error is a serious incident. Reportability depends on the statutory incident categories and the circumstances, not simply an incorrect output.
•Assuming every medical-device incident needs identical submissions under the MDR and AI Act. The AI Act includes a specific reporting limitation for systems covered by EU medical-device legislation.
•Treating MDR vigilance procedures as sufficient without reviewing the AI Act. Procedures should also address fundamental-rights incidents and identify the appropriate authority and applicable reporting deadlines.

Frequently asked questions

Article 3(49) defines a serious incident to include death, serious harm to a person's health, serious and irreversible disruption of critical infrastructure, breach of obligations under Union law intended to protect fundamental rights, or serious harm to property or the environment that is caused by, or attributable to, a high-risk AI system. For medical devices, several of these categories, particularly death and serious health harm, closely mirror the reportable event definitions already used under MDR vigilance requirements.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Regulatory

EU Medical Device Regulation(MDR)

Regulation (EU) 2017/745 governing medical devices in the European Union.

Regulatory

High-Risk AI System (EU AI Act)

AI systems captured by Article 6 of the EU AI Act because they are safety components of regulated products or listed in Annex III.

Post-Market

Medical Device Vigilance

Reporting and management of serious incidents and field safety corrective actions.

More in Regulatory

· Same category

Regulatory

510(k) Premarket Notification(510(k))

FDA submission demonstrating a device is substantially equivalent to a legally marketed predicate.

Regulatory

510(k) Summary vs 510(k) Statement

Two alternative disclosure mechanisms in a 510(k) submission, a Summary is public on FDA's website; a Statement promises to share Safety & Effectiveness info on request.

Regulatory

513(g) Request for Information(513(g))

Formal mechanism to ask FDA whether a product is a device and, if so, its likely classification.

Regulatory

Abbreviated 510(k)

510(k) variant that relies on FDA guidance, special controls, or recognized consensus standards.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (4)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 1Binding law and standards· 1Tier 2Regulator guidance and consensus· 2

Link health: 3 verified· last checked 2026-06-20

EUR-Lex·1FDA·1European Commission·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Regulatory0 / 101

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Regulatory
Sources: 3
Updated: 7/25/2026

Compare with another term

Learn in 60 seconds

Duty on providers of high-risk AI systems to report serious incidents to national market-surveillance authorities.

·For medical devices, reporting timelines and channels align with MDR Article 87 vigilance reporting for incidents already reportable under device law, avoiding duplicate submissions.
·Manufacturers should update their vigilance procedures to reference both regulations.

Remember this

Watch out: Assuming every AI error is a serious incident. Reportability depends on the statutory incident categories and the circumstances, not simply an incorrect output.

Related terms

You may also need

Auto-suggested from Regulatory and shared keywords.

All Regulatory terms

From the Blue Goat network

Related resources and services on this topic.