Back to IVDR Essentials

    Medical Device Vigilance

    Reporting and management of serious incidents and field safety corrective actions.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

    Definition

    Vigilance is the regulatory process by which manufacturers report serious incidents and field safety corrective actions involving CE-marked devices to the relevant Competent Authorities. Equivalent obligations apply under FDA's Medical Device Reporting (MDR) regulation in 21 CFR Part 803. Under EU MDR Article 87, serious incidents must be reported no later than 15 days after awareness, within 2 days for a serious public health threat, and within 10 days for death or unanticipated serious deterioration in health. Manufacturers must investigate each incident, cooperate with authorities and report field safety corrective actions before taking them, except in urgent cases. MDCG 2023-3 provides vigilance guidance.
    What the regulation says
    Regulation (EU) 2017/745, adopted on 5 April 2017 and applicable from 26 May 2021, establishes MedTech vigilance requirements. Article 87 requires manufacturers to report serious incidents to relevant Competent Authorities without delay, subject to maximum periods after awareness: 2 days for serious public health threats, 10 days for death or unanticipated serious deterioration in health, and 15 days for other serious incidents. Manufacturers must report field safety corrective actions before implementation, except where urgency requires immediate action. Article 89 requires investigation of serious incidents and corrective actions, cooperation with authorities, and communication of corrective actions through field safety notices. In the United States, FDA's Medical Device Reporting regulation, 21 CFR Part 803, establishes distinct reporting criteria and deadlines. Section 803.50 generally requires manufacturer reports within 30 calendar days of awareness of reportable deaths, serious injuries, or malfunctions likely to cause or contribute to death or serious injury if repeated. Section 803.53 requires reports within 5 work days for specified urgent remedial actions or FDA requests. FDA's electronic reporting final rule, published on 14 February 2014 (79 FR 8832) and effective on 14 August 2015, requires manufacturers to submit these reports electronically unless granted an exemption.

    What this means in practice

    Vigilance feeds back into PMS, risk management, and CAPA. Timeliness of reporting is closely scrutinized by regulators.

    Examples

    • A manufacturer promptly reports an incident where a device unexpectedly malfunctioned, leading to a patient's temporary injury, and initiates an investigation.
    • Following several similar reports of a device component failing, a manufacturer issues a Field Safety Corrective Action to recall and replace affected units from the market.
    • A Competent Authority receives an expedited report from a manufacturer about a device-related death and closely monitors the subsequent investigation and planned corrective actions.

    Use cases

    1 scenario
    1

    Serious incident with a surgical robot

    Vigilance officer

    A patient injury linked to a robot's instrument is reported to the manufacturer. Within 10 days, an initial vigilance report is filed in EUDAMED; a Field Safety Corrective Action follows with a software update and FSN to all users.

    OutcomeCompetent authorities accept the FSCA; further incidents are prevented and the trend closes out in subsequent PSURs.
    Common pitfalls
    • •Failing to report serious incidents within the stipulated regulatory timelines can lead to significant non-compliance issues, including fines and market access restrictions.
    • •Incomplete or insufficient investigation of reported incidents can hinder effective root cause analysis and delay the implementation of necessary corrective and preventive actions.
    • •Not adequately documenting the decision-making process for incident reporting and Field Safety Corrective Actions can create challenges during regulatory audits and inspections.
    • •Assuming that 'no incidents' means 'no problems' and neglecting proactive post-market surveillance activities, which might uncover potential issues before they escalate to serious incidents.
    • •Misinterpreting the definitions of 'serious incident' or 'serious public health threat,' leading to underreporting or incorrect classification of events.

    Frequently asked questions

    EU vigilance under MDR requires manufacturers to report serious incidents and field safety corrective actions to the Competent Authority of the member state where the incident occurred, generally within 15 calendar days for serious incidents and 2 days for events causing death or serious public health threat. FDA's parallel obligation under 21 CFR Part 803 Medical Device Reporting requires manufacturers to report to FDA directly, using different timeframes and reportability thresholds, so a single global incident often triggers two distinct analyses and filings rather than one harmonized report. Companies selling in both markets need procedures that map a single event to both reporting pathways without missing either deadline.

    Cross-references

    See also

    Grouped by theme
    Cited by

    Where this term appears across MedTech Terms.

    Learning paths (3)

    Latest in MedTech

    Sources

    3 sources

    Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

    Tier 2Regulator guidance and consensus· 3
    Link health: 3 verified· last checked 2026-06-20
    European Commission·2FDA·1
    1. 1
      MDCG Vigilance Guidance
      Tier 2 Verified
      European Commissionhealth.ec.europa.eu
    2. 2
      EUDAMED Public Site
      Tier 2 Verified
      European Commissionec.europa.eu
    3. 3
      FDA MAUDE Database
      Tier 2 Verified
      FDAaccessdata.fda.gov

    Inline markers like [1] jump to the matching reference above.