EU MDR · Articles 83–89 · Vigilance · CAPA
A medical device failed. What must the manufacturer do?
Protect the patient, contain the suspected product, preserve the evidence and record the manufacturer-awareness date. Then decide reportability without waiting for the technical investigation to finish.
A failure may remain a documented complaint, become a reportable serious incident, reveal a reportable trend or require a field safety corrective action. The route depends on possible harm, causality, frequency and the population exposed—not on whether the returned device has already been examined.
Start the response ↓Control
the event
Harm contained
Clock recorded
Evidence preserved
- 01
Contain
Protect patients
- 02
Record
Fix awareness day
- 03
Assess
Decide reportability
- 04
Correct
Control field risk
- 05
Learn
Update CAPA and PMS
The reporting decision waits for the returned device or a confirmed root cause
The direct answer
A device failure triggers one controlled response with parallel safety and regulatory decisions
The first objective is to prevent further harm. At the same time, the manufacturer must open the complaint record, determine the awareness date, preserve evidence and assess whether the event could meet the MDR serious-incident criteria. Technical root-cause work continues in parallel and must not hold up an initial vigilance report.
Protect people and preserve the facts before evidence disappears
- Stop use, shipment or installation where justified
- Arrange clinical support or alternative treatment where needed
- Secure the device, packaging, accessories, logs and photographs
- Record who first received the information and when
- Identify UDI, serial number, lot, software and configuration
- Notify the designated complaint and vigilance owners
Assess potential outcome, causality, population and recurrence
- Complaint, nonconformity, incident or serious incident
- Actual and reasonably possible health consequences
- Established, reasonably possible or suspected causality
- Potentially affected units, markets and patient groups
- Individual reporting, trend reporting or both
- Containment, correction, FSCA, withdrawal or recall
If a pump stops but an alarm prompts immediate replacement before harm occurs, the event may still be serious because the malfunction might have led to serious deterioration without timely intervention. A near miss is assessed by its potential outcome, not only by the outcome that happened.
Before the investigation begins
Secure the first-response record while the evidence is still available
The first record should separate known facts, reporter statements, immediate actions and open questions. Do not change the returned device, delete digital logs or merge assumptions into facts before the competent authority has had an opportunity to request access to the evidence.
Contain immediate exposure
Quarantine suspect stock, pause use or shipment and issue interim instructions when the available risk justifies action
Preserve clinical continuity
Coordinate alternatives so that corrective action does not create a greater risk by interrupting essential care
Control the returned product
Preserve device state, accessories, packaging, labels, disposables, photographs, handling history and chain of custody
Secure digital and manufacturing data
Retain logs, audit trails, software versions, production records, release results, complaints and distribution data
Safety action does not need to wait for perfect information. It should be proportionate, documented and revised as facts emerge. Evidence preservation is equally urgent because altering the device can make both root-cause analysis and authority review impossible.
Create one record that controls the clock, product identity and open decisions
The file should let a new reviewer understand what happened, what remains unknown and why each immediate action was chosen.
- Reporter, date, time, location and event narrative
- Patient or user outcome and intervention required
- Device, UDI, serial, lot, software and accessories
- Awareness date and applicable reporting deadline
- Distribution scope and immediately exposed population
- Containment owner, decisions, approvals and next review
Could the event have led to a serious outcome?
Consider what would have happened without timely detection, clinical intervention, redundancy or chance.
What is the manufacturer-awareness date?
Record when the first employee or representative received enough information to identify a potentially serious incident.
Which other units could share the failure?
Map lots, components, suppliers, software versions, sites, processes, markets and common failure mechanisms.
Classify the regulatory route
Four routes can arise from the same initial complaint
Select the route that matches the current facts. Routes can overlap and may change as new information arrives, so document the decision date, evidence and person responsible for reassessment.
A non-serious complaint remains a controlled PMS input
The case may not require an individual authority report, but it still requires documented assessment, proportionate investigation and inclusion in trend detection.
- SCREEN
Confirm product identity, event facts, possible outcome, causality and whether the serious-incident criteria could be met.
- INVESTIGATE
Determine failure mode, scope and risk and decide whether correction, CAPA or supplier action is needed.
- TREND
Code the complaint consistently and include it in frequency and severity analysis using a meaningful denominator.
Report when incident, serious outcome and device causality align
Actual harm is not required. The event is reportable when the serious outcome might have occurred and a relationship with the device is established, reasonably possible or suspected.
- APPLY A–B–C
Confirm an incident, an actual or possible serious outcome and an established, reasonably possible or suspected causal relationship.
- REPORT ON TIME
Use the two-, ten- or fifteen-day route from awareness and submit an initial MIR when facts remain incomplete.
- KEEP UPDATING
Provide follow-up and final reports as investigation, root cause, risk, corrective action and outcome become known.
Report a statistically significant increase that can change benefit–risk
Non-serious incidents and expected undesirable side-effects may become reportable as a trend when their frequency or severity increases significantly and creates an unacceptable risk.
- DEFINE BASELINE
Specify event categories, severity, denominator, observation window, expected rate and statistical detection method in the PMS plan.
- DETECT CHANGE
Analyse complaints, service data, sales or usage exposure and clinical information by device, version, lot and market.
- REPORT AND ACT
Submit the trend report when the threshold is met and update risk controls, CAPA, PMS and benefit–risk conclusions.
Act in the field when correction is needed to prevent or reduce serious risk
An FSCA may involve return, modification, exchange, destruction, software correction or safety advice. Recall is one possible measure, not a synonym for every field action.
- ASSESS HEALTH RISK
Define the hazard, probability, severity, exposed population, detectability, alternatives and risk of the corrective action itself.
- NOTIFY BEFORE ACTION
Notify the relevant competent authorities before implementation unless urgent action is necessary to protect health.
- REACH AND VERIFY
Issue a clear field safety notice, reconcile recipients, track completion and verify that the measure controls the risk.
Make the triage reproducible
Seven decisions make the incident assessment defensible
The record should show what was known at each decision point and why the selected route was reasonable at that time. New information can change the conclusion, but it should not erase the earlier assessment.
Awareness
Device
Outcome
Causality
Scope
Reportability
Action
Eight controlled records connect the first complaint to final closure
Record names may differ. The chronology and decision trail should not.
- 01
Complaint intake
Source, chronology, device identity, use conditions, outcome and immediate measures.
- 02
Initial triage
Seriousness, causality, awareness date, deadline, scope and approvals.
- 03
Authority record
MIR, trend report, FSCA notification, correspondence and report revisions.
- 04
Product evidence
Chain of custody, photographs, logs, configuration, returned unit and retain samples.
- 05
Investigation report
Failure mode, testing, root cause, affected population and limitations.
- 06
Health-risk assessment
Hazard, severity, probability, detectability, exposure and benefit–risk impact.
- 07
CAPA and field action
Containment, corrections, systemic actions, communications and effectiveness checks.
- 08
Closure package
Final decision, residual risk and updates to PMS, PSUR, CER and technical documentation.
Cross-functional ownership
Six functions must work from the same incident record
Vigilance is not a Regulatory Affairs hand-off. Safety, reporting, root cause, correction and communication depend on coordinated decisions with one accountable case owner and defined escalation rules.
Capture the event without filtering it
Record oral, written, service, distributor and digital reports promptly and preserve the reporter’s facts and original wording.
Do not let commercial channels decide reportabilityAssess actual and possible health outcomes
Evaluate clinical course, intervention, alternative causes, vulnerable populations and what could have happened without mitigation.
Near misses require a potential-outcome assessmentControl deadlines and authority reporting
Determine awareness, jurisdiction, report type and revisions and coordinate the authorised representative and notified body as applicable.
Incomplete information does not stop the clockConnect correction with systemic action
Control nonconforming product, investigate process failure, open CAPA where justified and verify that actions prevent recurrence.
A repair is not automatically a corrective actionDetermine failure mode, cause and scope
Analyse the returned product, design, software, production, suppliers, servicing and related lots without destroying critical evidence.
Test hypotheses against production and field dataReach every affected recipient
Use distribution records to stop supply, deliver field safety notices, reconcile responses and maintain product availability where safely possible.
Measure completion, not only notice deliveryReporting, investigation and correction do not wait for one another to finish
The initial MIR can precede root cause. Containment can precede the final health-risk assessment. An urgent field action can precede routine notification steps. Each workstream should use current evidence, document uncertainty and trigger reassessment when new facts arrive.
The MDR reporting clock
Six rules determine when the initial report is due
The deadlines are outer limits, not waiting periods. Article 87 requires reporting immediately, with two, ten or fifteen days as the latest permitted timing according to severity.
Manufacturer awareness
The date the first employee or representative receives information about the potentially serious incident normally fixes the clock.
Intake records preserve the first receipt date and source
Serious public health threat
Report immediately and no later than two calendar days after awareness when prompt remedial action is required for an imminent population-level threat.
The escalation route operates outside ordinary office hours
Death or unanticipated serious deterioration
Report immediately once device causality is established or suspected and no later than ten calendar days after awareness.
Clinical review does not wait for confirmed technical cause
Other serious incidents
Report immediately and no later than fifteen calendar days after awareness for other events meeting the serious-incident criteria.
The final day is treated as a limit, not a target
Initial report first
Missing device returns, clinical records or root cause do not justify delay. Submit available information and update it through follow-up reports.
Open questions and planned follow-up are stated clearly
Report first and refine the conclusion
- A
Submit within the applicable deadline
- B
Continue investigation and risk assessment
- C
Update or close with documented rationale
Use calendar days and preserve the exact awareness timestamp
- The awareness date is day zero and is not counted in the period
- The reporting period begins at the start of the following day
- Weekdays, weekends and public holidays are calendar days
- EU time-calculation rules apply when the last day is not a working day
- The requirement to report immediately still applies
- The first employee or representative can trigger awareness
- An authorised representative or outsourced handler can trigger awareness
- Every transfer and escalation should retain its timestamp
A controlled investigation sequence
Seven gates from first report to verified closure
The sequence keeps patient safety, reporting, root cause and correction connected. Passing a gate means that the next decision can rely on controlled facts while unresolved uncertainty remains visible.
- GATE 01INTAKE
Stabilise the event and preserve evidence
Record the reporter, chronology, outcome, product identity, use conditions and immediate actions and secure the device, data and packaging.
PASS WHENThe case is complete enough to screen, awareness is fixed and critical evidence is protected.
- GATE 02TRIAGE
Decide seriousness and reportability
Apply the incident definition, potential outcome, causality, jurisdiction and reporting clock without waiting for a confirmed technical cause.
PASS WHENThe route and deadline are approved or the initial MIR has been submitted.
- GATE 03SCOPE
Determine the potentially affected population
Map lots, components, suppliers, software versions, production sites, markets, common processes and the suspected failure mechanism.
PASS WHENThe containment scope is justified and does not stop at the returned unit by default.
- GATE 04INVESTIGATION
Test hypotheses without destroying key evidence
Examine the device, logs, production, service, supplier, complaint and retain-sample evidence and record the limits of every test.
PASS WHENThe evidence supports or excludes credible causes and unresolved limitations remain explicit.
- GATE 05HEALTH RISK
Reassess benefit–risk and the need for field action
Evaluate severity, probability, exposure, detectability, vulnerable users, alternatives and risks introduced by the proposed correction.
PASS WHENThe decision on correction, FSCA, withdrawal or recall has a documented clinical rationale.
- GATE 06CORRECTION AND CAPA
Control the current risk and prevent recurrence
Define product corrections and any design, process, supplier, software, labelling, training or quality-system actions required.
PASS WHENOwners, dates, field completion criteria and effectiveness checks are approved.
- GATE 07CLOSURE
Return the conclusions to the regulatory system
Complete authority reports and update the risk file, PMS or PSUR, clinical evaluation, technical documentation, complaints and affected communications.
PASS WHENResidual risk is acceptable, actions are effective and every open commitment is closed or controlled.
Common incident-response failures
Six delays that turn a manageable failure into a compliance problem
Most failures are not caused by a missing form. They arise when the organisation delays the clock, narrows the affected population too early or closes the technical problem without completing the regulatory consequences.
Waiting for the returned device before assessing reportability
The device may never arrive and the clock continues. Assess the available facts, report on time where required and update the authority later.
Starting awareness when Regulatory Affairs reviews the case
The first employee or representative may already have triggered awareness. Preserve the original receipt time across service, sales and distributors.
Calling a near miss non-serious because nobody was harmed
Assess what might have happened without an alarm, intervention, redundancy or chance. Potential serious outcomes can make the event reportable.
Equating repair with root cause and CAPA
Replacing a part corrects one unit. The manufacturer must still determine cause, affected population and whether systemic action is needed.
Containing only the complaint unit
A common component, lot, software version, supplier or process may expose many devices. Distribution and configuration data must set the scope.
Closing without updating risk and PMS outputs
Return the conclusion to the risk file, PMS or PSUR, clinical evaluation, technical documentation and trend baseline wherever it changes them.
Practical questions
Medical device failures, vigilance and field action under the EU MDR
Open the question that affects reportability, the reporting deadline, trend reporting, field safety action or final closure.
Is every medical device failure reportable to a competent authority?+
No. Every complaint and suspected failure must be recorded, assessed and trended, but individual reporting under Article 87 MDR is required for serious incidents. A failure may still require containment, investigation, CAPA, risk-management updates or a field action even when it is not individually reportable. A statistically significant increase in the frequency or severity of non-serious incidents or expected undesirable side-effects may require trend reporting under Article 88.
When does a device failure qualify as a serious incident?+
A serious incident requires three elements. An incident occurred, it led, might have led or might lead to death, serious deterioration in health or a serious public health threat, and a causal relationship with the device is established, reasonably possible or suspected. The absence of actual injury does not exclude reporting when timely clinical action or another circumstance prevented the serious outcome.
When does the MDR vigilance reporting clock start?+
Day zero is generally the date on which the first employee or representative of the manufacturer receives information about the potentially serious incident. This can include the authorised representative or an outsourced complaint-handling organisation acting for the manufacturer. The clock does not wait for management review, receipt of the returned device or completion of the investigation.
What are the 2-, 10- and 15-day reporting deadlines?+
A serious public health threat must be reported immediately and no later than two calendar days after awareness. Death or an unanticipated serious deterioration in health must be reported immediately and no later than ten calendar days. Other serious incidents must be reported immediately and no later than fifteen calendar days. Submit an initial report if information is incomplete and follow it with updates.
What should the manufacturer do when reportability is uncertain?+
Report the potentially serious incident within the applicable deadline. Article 87 permits an initial report followed by additional information, and uncertainty is not a reason to delay. If the investigation later shows that the serious-incident criteria were not met, the case can be concluded with a final non-reportable incident report and a documented rationale.
What is the difference between a complaint, nonconformity and incident?+
A complaint is information alleging a deficiency in a device or related service and is an input to the manufacturer’s assessment. A nonconformity is failure to fulfil a specified requirement and may arise before or after release. An incident is the MDR-defined malfunction, deterioration, ergonomics-related use error, inadequacy in supplied information or undesirable side-effect involving a device made available on the market. One event can fall into all three categories.
When is a field safety corrective action required?+
An FSCA is a corrective action taken for technical or medical reasons to prevent or reduce the risk of a serious incident involving a device made available on the market. It may involve return, withdrawal, exchange, modification, destruction, software correction, revised instructions or specific user advice. The decision follows the health-risk assessment and is not limited to cases where an injury has already occurred.
What is the difference between a recall and a withdrawal?+
Under the MDR, a recall aims to achieve the return of a device that has already been made available to the end user. A withdrawal aims to prevent a device in the supply chain from being made further available. Either measure may form part of an FSCA, but an FSCA can also be implemented without physically recovering every device.
Does identifying the technical root cause close the event?+
No. The manufacturer must also determine the affected population, assess health risk, decide on correction and field action, update the risk-management file and clinical evaluation where relevant, open CAPA when the issue is systemic, verify effectiveness, update PMS or PSUR outputs and maintain required communications with authorities and economic operators.
Where should a serious incident be reported when the device is sold across the EU?+
The serious incident is reported to the competent authority of the Member State in which it occurred, using the applicable vigilance route and current MIR. A field safety corrective action is notified to the competent authorities of the Member States where it is undertaken, normally before implementation unless urgent action is required to protect health. The manufacturer should coordinate the case across its authorised representative, importers, distributors and notified body as applicable.
Primary sources
Use the current MDR text, vigilance guidance and reporting forms
National submission routes and EUDAMED arrangements can change. Confirm the current competent-authority process and form version before submitting an incident, trend report or field safety corrective action.
Regulation (EU) 2017/745
Definitions, manufacturer duties, PMS, vigilance, trend reporting and field safety action in Articles 2, 10 and 83–89
MDCG 2023-3 Rev.2
Serious-incident criteria, manufacturer awareness, timelines, causality and reporting under the MDR and IVDR
MDCG 2025-10
PMS data, complaint handling, trend detection, analysis and updates to the regulatory system
PMS and vigilance reporting forms
Current MIR, trend, periodic summary, FSCA and field safety notice forms published by the European Commission
MIR helptext 7.3.1
Field-by-field guidance for preparing initial, follow-up, combined and final manufacturer incident reports
ISO 14971
Risk-management requirements for production and post-production information, risk evaluation and risk control
Build the response before the first serious complaint
Need to establish or repair an MDR vigilance and field-action process?
MDRC can create complaint and vigilance decision trees, reporting timelines, investigation and CAPA workflows, health-risk assessments, FSCA and field safety notice packages, PMS links and review-ready incident files.
