---
title: EUDAMED Vigilance Module: Reporting Serious Incidents Through the Platform
description: The EUDAMED vigilance module is where serious incidents and FSCAs flow under MDR Article 87. Here is what it captures and how to report.
authors: Tibor Zechmeister, Felix Lenhard
category: EUDAMED, UDI & Registration
primary_keyword: EUDAMED vigilance module
canonical_url: https://zechmeister-solutions.com/en/blog/eudamed-vigilance-module
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# EUDAMED Vigilance Module: Reporting Serious Incidents Through the Platform

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **The EUDAMED vigilance module is the part of the European Database on Medical Devices that holds serious incident reports, field safety corrective actions, trend reports, and periodic summary reports submitted by manufacturers under the MDR. It is built around MDR Article 87, which defines what a manufacturer must report and on what timeline, and MDR Article 92, which establishes the electronic system on vigilance and post-market surveillance that sits behind the module. When operational as mandatory, every serious incident notified to a Competent Authority becomes a structured record that authorities in every Member State can see. Until then, reporting happens through national Competent Authority routes in parallel with voluntary EUDAMED entry. Either way, the Article 87 clock — immediately and not later than 15 days after awareness, 10 days for serious public health threats, 2 days for death or unanticipated serious deterioration — runs the moment the manufacturer becomes aware.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- The EUDAMED vigilance module is one of the six modules of EUDAMED, established around MDR Article 33 and operationalised by Commission Implementing Regulation (EU) 2021/2078. It sits on top of the electronic system on vigilance and post-market surveillance defined in MDR Article 92.
- MDR Article 87(1) obliges manufacturers to report any serious incident involving devices made available on the Union market (except expected side effects documented and quantified in the technical documentation and subject to trend reporting under Article 88) and any field safety corrective action (FSCA) taken in respect of such devices.
- The reporting clock in Article 87(3) is strict: immediately and in any event not later than 15 days after the manufacturer becomes aware of the event; not later than 10 days in the case of a serious public health threat; not later than 2 days in the case of death or an unanticipated serious deterioration in a person's state of health.
- The module captures the initial report, follow-up reports, the final report, trend reports under Article 88, periodic summary reports where agreed under Article 87(9), and FSCAs together with the associated Field Safety Notice.
- Until the Commission declares the vigilance module mandatory under the Article 34 mechanism, manufacturers continue to report through the Competent Authority of the Member State where the incident occurred, and the voluntary EUDAMED route runs in parallel. The Article 87 obligation itself is not voluntary — only the channel is transitional.

---

## A weekend phone call that starts the 15-day clock

A clinical user in a German hospital calls the founder on a Saturday afternoon. A patient using their device experienced an event the clinician describes as "worse than anything we have seen before" and is in the ICU. The clinician is not sure yet whether the device contributed. The founder listens, takes notes, and hangs up.

At that moment, two things are true. The first is that they may or may not have a serious incident on their hands — the clinical picture is unclear, the causal link is unclear, and the investigation has not started. The second is that the Article 87 clock may have just started. Not after the investigation. Not after legal advice. Not after the lab results come back. Awareness — the legal trigger — is the moment the manufacturer first has information that could reasonably indicate a serious incident may have occurred. In practice that is often a phone call like this one.

The vigilance module is the place those reports go. It is also the reason founders cannot treat vigilance as "something my regulatory consultant handles." The decisions about awareness, reportability, and timing happen inside the company, fast, and under pressure. The module is simply the record of the decision you made.

## What MDR Article 87 requires

Article 87(1) is the operative sentence. Manufacturers of devices made available on the Union market, other than investigational devices, shall report to the relevant Competent Authorities any serious incident involving devices made available on the Union market — except expected side effects which are clearly documented in the product information and quantified in the technical documentation and are subject to trend reporting pursuant to Article 88 — and any field safety corrective action in respect of devices made available on the Union market, including any field safety corrective action undertaken in a third country in relation to a device which is also legally made available on the Union market if the reason for the field safety corrective action is not limited to the device made available in the third country.

Read slowly, that sentence does four things. It defines who reports (manufacturers). It defines what is reported (serious incidents and FSCAs). It carves out a narrow exception (expected, documented, quantified side effects that are instead handled through Article 88 trend reporting). And it extends the geographical scope to third-country FSCAs when the device is also on the Union market.

"Serious incident" is defined in Article 2(65) and "incident" in Article 2(64). The operational guidance on how to interpret these definitions in practice is MDCG 2023-3 Rev.2, the Q&A on vigilance terms and concepts under the MDR and IVDR. Manufacturers who rely on memory rather than on the current revision of MDCG 2023-3 make classification errors that later turn into non-conformities — the document exists precisely because the text of the definitions leaves room for judgement.

Article 87(3) sets the timelines. Immediately after the manufacturer establishes the reportable nature of the event and in any event not later than 15 days after awareness. For serious public health threats, not later than 2 days after awareness. For death or unanticipated serious deterioration in a person's state of health, not later than 10 days after awareness. These timelines are not "up to" — they are hard ceilings. A report that lands on day 16 is late, and late is a finding.

Article 87(5) adds follow-up reporting obligations. The manufacturer updates the initial report as the investigation progresses and submits a final report after the investigation is complete. Article 87(8) governs reporting of FSCAs before they are undertaken, unless urgency requires immediate action. Article 87(9) allows manufacturers, in agreement with the Competent Authority, to provide periodic summary reports (PSRs) in place of individual incident reports when similar serious incidents with the same device or device type have occurred and the root cause has been identified or an FSCA implemented — the PSR mechanism is the way vigilance scales without drowning either the manufacturer or the authority in duplicate paperwork.

## What Article 92 and the vigilance module capture

MDR Article 92 is the legal basis for the electronic system on vigilance and post-market surveillance. It tells the Commission, in collaboration with the Member States, to set up and manage an electronic system to collate and process the information referred to in the vigilance articles. That electronic system is what the EUDAMED vigilance module implements.

The module is built to hold, at minimum, the following data objects.

The manufacturer's serious incident reports under Article 87(1) and 87(3), including the initial, follow-up, and final reports, each time-stamped and linked to the underlying event.

The field safety corrective action notifications under Article 87(1) and 87(8), together with the associated Field Safety Notice that the manufacturer sends to users and patients. The Field Safety Notice is part of the vigilance record, not a separate document kept in a drawer.

The trend reports under Article 88, where a statistically significant increase in the frequency or severity of incidents that are not serious incidents, or in expected undesirable side effects, has been detected.

The periodic summary reports under Article 87(9), where the Competent Authority has agreed to this reporting format.

Cross-references between reports and the manufacturer, the device (via Basic UDI-DI and UDI-DI from the UDI module), and the certificate (from the certificates module — see [the EUDAMED certificates module](/blog/eudamed-certificates-module)).

Responses and actions by Competent Authorities, including any conclusions they reach on the manufacturer's investigation, because Article 89 tasks the Competent Authorities with analysing serious incidents and FSCAs and communicating with each other through the electronic system.

The design intent is a single structured data layer across the Union where a Competent Authority in one Member State can see, in near real-time, that a manufacturer has reported a serious incident in another Member State, what the FSCA is, and what the final conclusion was. Before EUDAMED, that coordination happened through email between authorities. The module replaces that with a structured electronic record.

## Voluntary or mandatory — the current reality

This is where founders get tripped up. The vigilance obligation in Article 87 is not optional and never has been. From the date of MDR application, manufacturers have been obliged to report serious incidents and FSCAs on the Article 87 timelines. What has been transitional is the channel.

The Article 34 mechanism governs when each EUDAMED module becomes the mandatory reporting channel. Until the Commission issues the notice in the Official Journal declaring the vigilance module fully functional and its use mandatory for a given obligation, manufacturers continue to report to the national Competent Authority of the Member State where the serious incident occurred, through that authority's existing vigilance reporting route. In parallel, the EUDAMED vigilance module has been available on a voluntary basis as rollout progresses. The live status — which obligations are covered, whether mandatory use has been declared — is published on the Commission's EUDAMED information page and should be checked before every reporting cycle. See [EUDAMED status in 2026](/blog/eudamed-status-2026) for the living view.

The practical consequence is that your vigilance SOP has to cover both routes. It has to name the Competent Authority reporting route for every Member State where your device is on the market, and it has to name the EUDAMED route for the day mandatory use is declared. Treating this as "we will figure it out when EUDAMED goes mandatory" is not a strategy — it is a deferral that runs directly into the 2-day, 10-day, and 15-day clocks the first time something happens.

## A worked report flow — from awareness to final report

Take the Saturday phone call from the opening. Here is what the next 15 days look like if the manufacturer has their act together.

**Hour 0 — awareness.** The founder logs the call in the vigilance intake log with date, time, caller, device, lot, and the clinical description. This log is the evidentiary basis for the "awareness" timestamp if a Competent Authority later asks when the clock started.

**Hour 0–24 — triage and reportability decision.** The vigilance owner (in a startup, this is often the PRRC or the regulatory lead) applies the MDCG 2023-3 Rev.2 framework to the facts known so far. Is this an incident within Article 2(64)? Is it a serious incident within Article 2(65)? Is it one of the expected side effects carved out in Article 87(1) and handled through Article 88? The decision is documented. If there is uncertainty, the default is to proceed as if it is reportable — under-reporting is the larger risk.

**Hour 24–48 — assess for death or unanticipated serious deterioration.** If the event fits, the 2-day clock applies, and an initial report goes to the Competent Authority of the Member State where the incident occurred within 2 days from awareness. The report is submitted on the Manufacturer Incident Report (MIR) form that the Commission publishes — the MIR is the common structured template the vigilance module is designed to ingest. In parallel, if the EUDAMED vigilance module is being used voluntarily, the same data goes into the module.

**Day 2–10 — assess for serious public health threat.** If the event indicates a serious public health threat under Article 87(4), the 10-day clock applies instead. The initial report goes to the Competent Authority within 10 days from awareness.

**Day 10–15 — default 15-day clock.** For all other serious incidents, the initial report goes to the Competent Authority within 15 days from awareness. The manufacturer does not wait for the investigation to be complete. The initial report contains what is known so far, marked as preliminary.

**Day 15–N — follow-up reports.** As the investigation progresses — device return, root cause analysis, engineering assessment, clinical re-review — the manufacturer submits follow-up reports updating the initial report. The vigilance module holds these as linked updates to the original record.

**FSCA — parallel track.** If the investigation concludes that a Field Safety Corrective Action is needed (recall, customer notification, software update, labelling change), the FSCA is notified to the Competent Authorities before it is undertaken per Article 87(8), unless urgency requires immediate action. The Field Safety Notice is drafted, reviewed, and sent to users. The FSCA record in the module links back to the original incident report.

**Final report.** Once the investigation is complete, the manufacturer submits the final report. The module holds this as the closing entry on the original record. Competent Authorities then apply Article 89 to analyse and, where relevant, coordinate their response across Member States.

This is what a clean vigilance flow looks like. Most startups do not have this flow documented before the first call comes in — see [serious incidents under the MDR](/blog/serious-incidents-mdr) and [vigilance reporting timelines under the MDR](/blog/vigilance-reporting-timelines-mdr) for the underlying definitions and clock rules.

## A Subtract to Ship vigilance reporting playbook

The temptation for a resource-constrained startup is to build a 60-page vigilance SOP that no one will read when the phone rings. The opposite works better: a short, printable playbook that names the decisions and the timelines, supported by the SOP in the background for auditors.

The playbook strips to seven items.

One. A single intake channel. Every report — from users, distributors, sales reps, authorised representatives, support emails, social media — routes to one mailbox and one on-call phone number. The intake timestamp is the evidentiary anchor for Article 87 awareness.

Two. A named vigilance owner. One person decides reportability. In a startup this is usually the PRRC or the regulatory lead. There is a named backup for holidays and sickness.

Three. A one-page reportability decision aid. Not a textbook — a decision aid that takes the MDCG 2023-3 Rev.2 definitions, turns them into yes/no questions, and produces an output of reportable / not reportable / trend / escalate for review. The decision is always documented.

Four. The three clocks on the wall: 2 days for death or unanticipated serious deterioration; 10 days for serious public health threat; 15 days default. These are the Article 87(3) timelines.

Five. The reporting channel map. For every Member State where the device is on the market, the current route to the Competent Authority, the MIR form version, and the EUDAMED vigilance module status (voluntary or mandatory for this obligation). Updated quarterly.

Six. The FSCA trigger list. A short internal list of the kinds of findings that automatically trigger FSCA evaluation — repeated root causes, safety signal trends from Article 88 monitoring, design or labelling weaknesses that could affect other units.

Seven. The link-back discipline. Every vigilance entry in EUDAMED links to the device (via Basic UDI-DI from the UDI module) and, where relevant, to the certificate (from the certificates module). This is not optional decoration — the module is built to be queryable across these cross-references, and an unlinked entry is an entry that will eventually generate a finding.

Seven items. One page. Laminate it. Put it next to the on-call phone. Train every founder, every PRRC, and every engineer on the intake flow so that nobody lets the call end without logging it.

## Reality Check — Where do you stand on vigilance reporting?

1. If a clinical user called you this weekend with a serious event, do you know who would take the call, who would decide reportability, and what the timestamp of "awareness" under Article 87 would be?
2. Have you mapped, in writing, which Competent Authority receives reports for every Member State where your device is on the market, and do you know which channels are currently voluntary versus mandatory for the EUDAMED vigilance module?
3. Is your reportability decision aid based on the current revision of MDCG 2023-3, or on an older version or on memory?
4. Do your staff — not just the PRRC, but the engineers and the sales team — understand that the Article 87 clock starts at awareness, not at investigation, and not at legal advice?
5. Do you have a drafted Manufacturer Incident Report (MIR) template filled in with the static manufacturer data so that the variable fields can be completed under time pressure, not from a blank page?
6. Do you have a written trigger list for FSCA evaluation, and a separate Field Safety Notice template ready for review?
7. Does your quality system treat Article 88 trend reporting as a live process with thresholds and review cadence, or as a box-ticking annual exercise?

If you cannot answer five or more of these cleanly, your vigilance process will fail its first real test. The fix is not a longer SOP — it is a shorter, rehearsed playbook.

## Frequently Asked Questions

**What is the EUDAMED vigilance module?**
The EUDAMED vigilance module is one of the six modules of the European Database on Medical Devices, established around MDR Article 33 and sitting on top of the electronic system on vigilance and post-market surveillance defined in MDR Article 92. It holds serious incident reports, field safety corrective actions, Field Safety Notices, trend reports under Article 88, and periodic summary reports under Article 87(9), each linked to the manufacturer and the device.

**What is the deadline to report a serious incident under MDR Article 87?**
Article 87(3) sets three deadlines. Death or unanticipated serious deterioration in a person's state of health: not later than 2 days after the manufacturer becomes aware. Serious public health threat: not later than 10 days after awareness. All other serious incidents: immediately and in any event not later than 15 days after awareness. The clock starts at awareness, not at the end of the investigation.

**Do I report serious incidents to EUDAMED or to my Competent Authority?**
Until the Commission declares the EUDAMED vigilance module mandatory under the Article 34 mechanism for a given vigilance obligation, manufacturers report through the Competent Authority of the Member State where the serious incident occurred, using the national reporting route and the Manufacturer Incident Report (MIR) form. The EUDAMED route runs in parallel on a voluntary basis during rollout. The Article 87 obligation itself has always applied — only the channel is transitional. Check the live status on the Commission's EUDAMED information page before reporting.

**What is the difference between a serious incident report and a trend report under MDR?**
A serious incident report under Article 87 covers individual events that meet the Article 2(65) definition of a serious incident. A trend report under Article 88 covers statistically significant increases in the frequency or severity of incidents that are not serious incidents, or in expected undesirable side effects documented and quantified in the technical documentation. The two flow into different parts of the vigilance module and follow different evaluation paths. MDCG 2023-3 Rev.2 is the operational guidance for the classification decision.

**Who in a startup should own vigilance reporting?**
In practice the Person Responsible for Regulatory Compliance (PRRC) required under MDR Article 15 owns the vigilance reporting decision, with a named backup. The intake, however, has to be everyone's job — anyone receiving a user call, a distributor complaint, or a service report has to know how to log it immediately, because the Article 87 clock starts at awareness, not at escalation.

**Does the EUDAMED vigilance module show reports publicly?**
The vigilance module is primarily a tool for manufacturers, Competent Authorities, and the Commission to exchange vigilance information under Articles 87, 88, 89, and 92. The level of public visibility differs from the certificates module and depends on the Commission's operational implementation and on the Article 34 declarations. Consult the Commission's EUDAMED information page for the current public view — and assume, in any case, that authorities across Member States can see the full record once entered.

## Related reading

- [What is EUDAMED? The European database on medical devices explained](/blog/what-is-eudamed-european-database-medical-devices) — the pillar post for the EUDAMED cluster.
- [The EUDAMED certificates module](/blog/eudamed-certificates-module) — the companion module for Notified Body certificate data.
- [The EUDAMED UDI module](/blog/eudamed-udi-module) — the device identification layer the vigilance module links into.
- [EUDAMED status in 2026](/blog/eudamed-status-2026) — which modules are voluntary and which are mandatory right now.
- [Serious incidents under the MDR: definitions and reportability](/blog/serious-incidents-mdr) — how Article 2(64), Article 2(65), and MDCG 2023-3 Rev.2 define the reportable set.
- [Vigilance reporting timelines under the MDR](/blog/vigilance-reporting-timelines-mdr) — the Article 87(3) 2-day, 10-day, and 15-day clocks explained with worked examples.
- [Field Safety Corrective Actions and Field Safety Notices](/blog/fsca-field-safety-notice-mdr) — the FSCA track and what the notice has to contain.
- [Trend reporting under MDR Article 88](/blog/mdr-article-88-trend-reporting) — the Article 88 track for non-serious incidents and expected side effects.
- [Periodic Summary Reports under MDR Article 87(9)](/blog/mdr-psr-periodic-summary-report) — when PSRs replace individual serious incident reports.
- [The Subtract to Ship framework for MDR](/blog/subtract-to-ship-framework-mdr) — the methodology behind the minimal vigilance playbook.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2 (definitions, including "incident" and "serious incident"), Article 33 (European database on medical devices — Eudamed), Article 34 (functioning of Eudamed), Article 87 (reporting of serious incidents and field safety corrective actions), Article 88 (trend reporting), Article 89 (analysis of serious incidents and field safety corrective actions), and Article 92 (electronic system on vigilance and on post-market surveillance). Official Journal L 117, 5.5.2017.
2. Commission Implementing Regulation (EU) 2021/2078 of 26 November 2021 laying down rules for the application of Regulation (EU) 2017/745 of the European Parliament and of the Council as regards the European Database on Medical Devices (Eudamed). OJ L 426, 29.11.2021.
3. MDCG 2023-3 Rev.2, Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746. First publication February 2023; Revision 2, January 2025.
4. European Commission, EUDAMED information page — current module status, Commission notices under Article 34, and the Manufacturer Incident Report (MIR) form. Readers should consult the Commission page directly for live module status before relying on mandatory application.

---

*This post is part of the EUDAMED, UDI and Registration category in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. For the live status of the vigilance module and for the pillar overview of EUDAMED, see the companion posts linked above.*

---

*This post is part of the [EUDAMED, UDI & Registration](https://zechmeister-solutions.com/en/blog/category/eudamed-udi) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*