---
title: Field Safety Corrective Actions (FSCAs) Under MDR: When and How to Act
description: A Field Safety Corrective Action under MDR is any manufacturer action taken to reduce risk on a device already on the market. Here is when to trigger one and how to execute it.
authors: Tibor Zechmeister, Felix Lenhard
category: Post-Market Surveillance & Vigilance
primary_keyword: field safety corrective actions FSCA MDR
canonical_url: https://zechmeister-solutions.com/en/blog/field-safety-corrective-actions-fscas-mdr
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# Field Safety Corrective Actions (FSCAs) Under MDR: When and How to Act

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **A Field Safety Corrective Action under MDR is any action taken by a manufacturer, for technical or medical reasons, to prevent or reduce the risk of a serious incident in relation to a device already made available on the market. The definition sits in Article 2(68) of Regulation (EU) 2017/745. The reporting obligation sits in Article 87(1)(b). The investigation and coordinating-authority mechanics sit in Article 89. The interpretive reference for edge cases is MDCG 2023-3 Rev.2, revised January 2025. An FSCA is triggered the moment the manufacturer decides that a field-level intervention is necessary to reduce risk — not when the intervention finishes, and not when the communication is ready. The decision is the trigger.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- An FSCA is defined in MDR Article 2(68) as any corrective action taken by a manufacturer, for technical or medical reasons, to prevent or reduce the risk of a serious incident in relation to a device made available on the market.
- Every FSCA in respect of a device made available on the Union market is reportable under Article 87(1)(b) — including an FSCA initiated in a third country when the same device is legally on the EU market.
- An FSCA can take many forms: device return, modification, exchange, destruction, retrofit, software update, permanent withdrawal, IFU change, or advice on use. Recall is one specific form of FSCA, not a synonym.
- Every FSCA requires a Field Safety Notice as defined in Article 2(69) — the written communication that the manufacturer sends to users, customers, or patients explaining the action.
- For devices made available in more than one Member State, the coordinating competent authority mechanism under Article 89(4) applies, and MDCG 2023-3 Rev.2 describes how the submission is coordinated so that a single aligned FSCA runs across markets rather than fragmenting into national actions.

---

## The moment an FSCA is born

An FSCA rarely arrives as a single dramatic event. It arrives as a decision — usually made in a small room under time pressure, usually after a week of data gathering that nobody planned for, and usually before anybody on the team is entirely comfortable calling it. That is the moment this post is about.

The Regulation does not describe that moment in pretty language, but it does describe the obligation precisely. The manufacturer has identified a risk associated with a device already on the market. The risk is serious enough that reducing it requires action out in the field — not just in the next production batch, not just in the next software release planned for Q3, but now, in the installed base. When that decision is made, an FSCA is born, and a chain of obligations starts running under Articles 87, 89, and 92 of Regulation (EU) 2017/745.

What this post covers is the article-by-article anatomy of that chain, the distinctions that trip up startups, and the lean version of the process that actually runs when the clock is live.

## What an FSCA is under MDR Article 2(68)

The definition in Article 2(68) of Regulation (EU) 2017/745 is a field safety corrective action means a corrective action taken by a manufacturer for technical or medical reasons to prevent or reduce the risk of a serious incident in relation to a device made available on the market. Every phrase in that definition matters.

"Taken by a manufacturer." The manufacturer owns the decision. A distributor cannot trigger an FSCA. A competent authority can compel one under the market surveillance chapter, but the FSCA itself is a manufacturer action.

"For technical or medical reasons." The trigger is technical or clinical — a design defect, a component failure mode, a labelling error that could mislead a clinical decision, a software behaviour that produces unsafe outputs, a material change that alters biocompatibility. Commercial reasons — rebranding, end-of-life decisions, pricing changes — are not FSCAs.

"To prevent or reduce the risk of a serious incident." The standard is the Article 2(65) definition of a serious incident. The FSCA does not require that a serious incident has already occurred. It requires that the manufacturer has identified a risk of one and decided that field-level action is needed to reduce it. Preventive FSCAs — taken before any harm occurs — are not only valid, they are the ones regulators respect most.

"In relation to a device made available on the market." The obligation attaches to devices already in distribution or use. A correction made in the factory before shipping is not an FSCA. Once the device crosses into the field, the definition applies.

Article 2(68) is anchored next to two related definitions that any FSCA process has to carry with it. Article 2(69) defines a field safety notice as the communication sent by the manufacturer to users or customers in relation to an FSCA. Article 2(70) defines market surveillance as the activities carried out and measures taken by the competent authorities to check and ensure that devices comply with the Regulation. The three definitions together frame where the manufacturer's obligation starts and where the authority's begins.

## When an FSCA is triggered

An FSCA is triggered at the point of decision, not at the point of execution. MDCG 2023-3 Rev.2 is explicit on this — the reportable event under Article 87(1)(b) is the decision to undertake the action. Waiting until the letters are printed, the returns are scheduled, or the software patch is compiled is not an option.

Practically, the decision point tends to sit at the end of a short investigation. A signal arrives through the PMS system or a direct complaint. The signal is assessed against EN ISO 14971:2019 + A11:2021 risk management and against the current risk-benefit analysis for the device. The assessment answers two questions. First: does the risk now exceed what was considered acceptable in the technical documentation. Second: can the risk be adequately reduced through actions limited to the factory, or does the installed base also need to be touched. If the answer to the second question is that the installed base must be touched, an FSCA is triggered.

The test is not severity in isolation. A very high-severity event can be closed without an FSCA if the root cause is fully contained to a production lot that has never shipped. A lower-severity pattern can trigger an FSCA if the affected devices are in clinical use and the risk cannot be mitigated any other way. What matters is whether a field-level action is required to bring risk back inside the acceptable envelope.

Article 87(1)(b) makes one further point that startups routinely miss. An FSCA undertaken in a third country in relation to a device that is also legally made available on the Union market is reportable in the EU. A US recall of a device also sold in Germany is a reportable FSCA to the relevant competent authority in the Union. The geography of the trigger does not limit the reach of the obligation.

## FSCA versus recall — the distinction that matters

"Recall" and "FSCA" are not synonyms. A recall is one possible form of an FSCA. The FSCA is the umbrella term for any field-level risk reduction action. The recall is the specific action of retrieving devices from the field — typically for destruction, return, or exchange.

Other forms of FSCA include device modification in the field (a technician visits and replaces a component), retrofit (a firmware or mechanical upgrade), software update addressing a safety issue (a patch distributed to the installed base), advice on use (a new precaution communicated to clinicians, with the IFU updated accordingly), temporary quarantine (a directive to stop using the device until a fix is ready), permanent withdrawal (the device is removed from the market entirely), and labelling correction (the IFU is reissued to address a safety-relevant error).

The reason the distinction matters is that startups sometimes assume that if no physical retrieval is happening, no FSCA is happening. That is wrong. A software update distributed to address a safety issue is an FSCA. An advisory letter that changes how clinicians use the device is an FSCA. An IFU reissue triggered by a safety concern is an FSCA. All of them are reportable under Article 87(1)(b) and all of them require a Field Safety Notice under Article 2(69).

The inverse mistake is also common. Not every software update is an FSCA. A routine feature release that happens to include a safety-adjacent improvement, where the driver was not risk reduction, is not an FSCA. The test is the manufacturer's intent: was this action taken for technical or medical reasons to prevent or reduce the risk of a serious incident. If yes, it is an FSCA. If the action would have happened anyway for commercial or roadmap reasons and the safety benefit is incidental, it is not.

## The Field Safety Notice under Article 2(69)

Every FSCA requires a Field Safety Notice (FSN). Article 2(69) defines the FSN as the communication sent by a manufacturer to users or customers in relation to a field safety corrective action. The FSN is the public face of the FSCA. It is what clinicians, procurement officers, patients, and national registries actually see.

MDCG 2023-3 Rev.2 sets out what an FSN should contain. At a minimum, the FSN identifies the manufacturer, the affected devices by name, model, lot, serial, or UDI range, the nature of the problem in plain language, the clinical risk, the action required from the recipient, the timeline for that action, and contact details for follow-up. An FSN written in regulatory jargon that the clinician cannot act on is a failed FSN, regardless of how compliant it looks on paper.

The language test is simple. If a nurse in a unit using the device can read the FSN once and know what to do next, the FSN is working. If the nurse has to call the supplier to ask what the letter means, the FSN has failed in its purpose even if every legal element is present. The FSN is a risk-reduction tool, not a legal filing.

The FSN template should be pre-drafted before any FSCA occurs. Building the FSN under time pressure, for the first time, at the moment of the first real FSCA, is a pattern that produces bad FSNs and late reporting.

## Coordinated multi-market FSCAs under Article 89(4)

For devices made available in more than one Member State, the coordinating competent authority mechanism under Article 89(4) applies. The idea is simple: one designated competent authority coordinates the assessment across all affected Member States, the manufacturer interfaces with that coordinating authority as the primary point of contact, and the FSCA runs as one coordinated action rather than fragmenting into parallel national actions.

For a startup with pan-European distribution, this is a feature, not a burden. Without the coordinating-authority mechanism, the manufacturer would be negotiating with a different national authority for every market the device touches, with potentially conflicting expectations on timing, wording, and scope. With it, there is one interlocutor, one aligned FSN, one aligned timetable, and one shared assessment.

MDCG 2023-3 Rev.2 addresses how the coordinating-authority mechanism works in practice and how to identify which competent authority is expected to coordinate — usually, but not always, the competent authority of the Member State in which the manufacturer or its authorised representative has its registered place of business. The manufacturer is expected to cooperate actively; cooperation is an Article 89 obligation, not a courtesy.

Once the Eudamed vigilance module under Article 92 is fully operational, the coordinated FSCA flow is carried through the electronic system automatically. In the interim, the national channels remain in use and the coordination happens through direct authority-to-authority communication, with the manufacturer supporting the process.

## The reporting obligations — what, when, to whom

The FSCA is reportable under Article 87(1)(b). The report goes to the relevant competent authority — the same authority that would receive a serious incident report under Article 87(1)(a). For devices in more than one Member State, the coordinating competent authority under Article 89(4) handles the assessment once the initial reports are in.

On timing, the Regulation requires reporting without undue delay. The 2/10/15-day ceilings in Article 87(3) are written around serious incidents, but the underlying "without delay" obligation applies to FSCA reporting as well, and MDCG 2023-3 Rev.2 makes clear that FSCAs should be reported as soon as the decision to act has been taken — not after execution, not after the FSN has been fully drafted, not after the returns have been counted. For the mechanics of the 2/10/15-day clocks and the awareness date, see [Vigilance Reporting Timelines: 15-Day, 10-Day, and 2-Day Clocks](/blog/vigilance-reporting-timelines-15-day-2-day).

What has to be reported is the nature of the FSCA, the affected devices, the technical or medical reason driving the action, the risk assessment, the intended FSN, the expected timeline, and the Member States affected. The report is updated as the action progresses — FSCAs are typically reported in stages, not as a single final filing.

The reporting obligation continues through execution. Progress updates, final closure, effectiveness data, and the outcome of the root-cause investigation all feed back to the competent authority. Closure of the FSCA in the eyes of the authority happens when the authority accepts the closure, not when the manufacturer declares it internally.

## The Subtract to Ship angle

FSCAs are the part of vigilance where the gap between bureaucratic compliance and working compliance is the widest. Startups build elaborate FSCA SOPs that nobody can execute in the 48 hours after a real decision is made, and then the first real FSCA runs by text message and improvised emails because the SOP was never operable.

The Subtract to Ship approach is the same as for the rest of the vigilance chapter: every step in the process must trace to a specific MDR article, annex, or MDCG 2023-3 Rev.2 Q — and the process must be short enough to run end to end on a single working day. One named FSCA owner. One short SOP that maps each step to the article it derives from. One pre-drafted FSN template ready to be populated. One decision log that records the technical or medical reasoning against Article 2(68). One escalation path into CAPA under EN ISO 13485:2016 + A11:2021 and the risk management file under EN ISO 14971:2019 + A11:2021. One contact list for the relevant competent authority and, where the device is multi-market, the expected coordinating authority. And one dry-run on the calendar, at least annually, that simulates an FSCA decision and runs it through the full loop. For the general methodology, see [the Subtract to Ship framework for MDR](/blog/subtract-to-ship-framework-mdr).

## Reality Check — Where do you stand?

1. Can your team distinguish, in writing, between an FSCA under Article 2(68) and a routine corrective action that is not an FSCA?
2. Is your FSN template pre-drafted and reviewed by a clinician who can confirm it is actionable under real clinical conditions?
3. Do you have a written trigger rule for when an FSCA decision has been made — separable from the execution steps that follow it?
4. Does your process explicitly capture FSCAs initiated in third countries when the same device is legally made available on the Union market?
5. For devices sold in more than one Member State, have you identified the competent authority you expect to act as coordinating authority under Article 89(4), and documented the reasoning?
6. Is your FSCA log structured in a way that Eudamed will accept once the vigilance module is fully operational under Article 92?
7. When was the last dry-run of your FSCA process — a simulated decision pushed through the full loop from risk assessment to FSN distribution and competent-authority reporting?

## Frequently Asked Questions

**What is a Field Safety Corrective Action under MDR in one sentence?**
An FSCA under Article 2(68) of Regulation (EU) 2017/745 is any action taken by a manufacturer, for technical or medical reasons, to prevent or reduce the risk of a serious incident in relation to a device already made available on the market.

**Is a recall the same thing as an FSCA?**
No. A recall is one specific form of FSCA, defined by physical retrieval of devices from the field. An FSCA is the umbrella term and can also take the form of modification, retrofit, software update, IFU change, advice on use, quarantine, or permanent withdrawal. Every recall is an FSCA, but not every FSCA is a recall.

**When exactly is an FSCA triggered?**
At the moment the manufacturer decides that a field-level action is necessary to prevent or reduce the risk of a serious incident. The trigger is the decision, not the execution. MDCG 2023-3 Rev.2 is explicit that the reportable event under Article 87(1)(b) is the decision to undertake the FSCA, which means the reporting clock does not wait for the FSN to be drafted or the logistics to be finalised.

**Does an FSCA always require a Field Safety Notice?**
Yes. Every FSCA requires a Field Safety Notice as defined in Article 2(69) — the written communication from the manufacturer to users or customers in relation to the action. The FSN explains the problem, the risk, the required action, and the timeline in language that the recipient can act on.

**Is an FSCA initiated in a third country reportable in the EU?**
Yes, when the same device is legally made available on the Union market. Article 87(1)(b) explicitly captures FSCAs undertaken in third countries in relation to devices that are also on the EU market. A US recall of a device also sold in France triggers an EU reporting obligation.

## Related reading

- [What Is Vigilance Under MDR?](/blog/what-is-vigilance-mdr) — the pillar post for the vigilance cluster, placing FSCAs inside the full reporting framework.
- [MDR Articles 87–92: The Vigilance Reporting Framework](/blog/mdr-articles-87-92-vigilance-framework) — the article-by-article anatomy of the full vigilance chapter.
- [Serious Incidents Under MDR](/blog/serious-incidents-mdr) — the Article 2(65) definition that the FSCA trigger references.
- [How to Report a Serious Incident to the Competent Authority](/blog/report-serious-incident-competent-authority) — the operational reporting workflow that sits alongside FSCA reporting.
- [Vigilance Reporting Timelines: 15-Day, 10-Day, and 2-Day Clocks](/blog/vigilance-reporting-timelines-15-day-2-day) — the Article 87(3) timing rules and their relationship to FSCA reporting.
- [Trend Reporting Under MDR Article 88](/blog/trend-reporting-mdr-article-88) — how trend signals can escalate into an FSCA decision.
- [The PMS–Vigilance–CAPA Relationship](/blog/pms-vigilance-capa-relationship) — where the FSCA sits in the loop between PMS, vigilance, and CAPA.
- [MDCG 2023-3 Rev.2 Explained](/blog/mdcg-2023-3-explained) — the interpretive reference for FSCA edge cases.
- [The Subtract to Ship Framework for MDR](/blog/subtract-to-ship-framework-mdr) — the methodology behind the lean FSCA process in this post.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(68) (definition of field safety corrective action), Article 2(69) (definition of field safety notice), Article 2(70) (definition of market surveillance), Article 87 (reporting of serious incidents and field safety corrective actions), Article 89 (analysis of serious incidents and field safety corrective actions), Article 92 (electronic system on vigilance and on post-market surveillance). Official Journal L 117, 5.5.2017.
2. MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746, first publication February 2023, Revision 2 January 2025.
3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.

---

*This post is part of the Post-Market Surveillance & Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. An FSCA is not a failure of the product — it is the vigilance system working as designed, catching a risk in the field and reducing it before it compounds. The manufacturers who run FSCAs cleanly are the ones competent authorities trust the most.*

---

*This post is part of the [Post-Market Surveillance & Vigilance](https://zechmeister-solutions.com/en/blog/category/pms-vigilance) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*