MDR Articles 87 to 92 together form Section 2 of Chapter VII of Regulation (EU) 2017/745 and define the manufacturer vigilance obligations end to end. Article 87 sets the reporting duties for serious incidents and field safety corrective actions. Article 88 governs trend reporting for statistically significant increases in non-serious events and expected side-effects. Article 89 sets out how manufacturers and competent authorities analyse serious incidents and FSCAs. Article 90 covers the analysis of vigilance data at Union level. Article 91 authorises implementing acts for the detailed rules. Article 92 establishes the Eudamed electronic system on vigilance and post-market surveillance through which reports are submitted. For a manufacturer, these six articles are the operational backbone of vigilance.

By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.

TL;DR

  • MDR Articles 87–92 are Section 2 of Chapter VII and form the full vigilance reporting framework. Every manufacturer obligation in vigilance traces to one of these six articles or to Article 2(64)–(65) definitions.
  • Article 87 defines what must be reported (serious incidents and FSCAs), when (15, 10, or 2 days from awareness), and to whom (the relevant competent authority).
  • Article 88 establishes trend reporting for statistically significant increases in non-serious incidents and expected side-effects that could affect the benefit-risk balance.
  • Articles 89 and 90 govern how the data is analysed — first by the manufacturer and the relevant competent authority, then at Union level for cross-border patterns.
  • Article 91 empowers the Commission to adopt implementing acts on the detailed procedures, and Article 92 establishes Eudamed as the electronic system that carries the reports, complaints, periodic summary reports, trend reports, and FSCAs once fully operational.
  • MDCG 2023-3 Rev.2 (January 2025) is the interpretive reference for every edge case in this chapter and should be open whenever a borderline decision is made.

Why Section 2 of Chapter VII exists

Vigilance reporting in the MDR was not an afterthought. It was a deliberate correction. Under the old Directives, reporting was fragmented across national systems, timelines were interpreted unevenly, trend signals disappeared between jurisdictions, and serious incidents in one country rarely surfaced in another until much later than they should have. The PIP breast implant scandal and several other cross-border safety failures made the costs of that fragmentation impossible to ignore.

Chapter VII of Regulation (EU) 2017/745 was written to fix this. Section 1 covers post-market surveillance as a continuous system. Section 2 — Articles 87 through 92 — covers vigilance as the reporting and analysis layer on top of that system. Section 3 covers market surveillance by the authorities. Read together, the three sections describe a single loop: the manufacturer monitors, the manufacturer reports, the authorities analyse, and everyone acts on the signal before harm compounds.

For a startup, the practical consequence is that vigilance is not a separate binder handled by a separate team. It is the reporting edge of the same PMS system described in our what is vigilance under MDR explainer. The question this post answers is: article by article, what does the Regulation actually require of the manufacturer?

Article 87 — Reporting of serious incidents and field safety corrective actions

Article 87 is the operational heart of the chapter. Paragraph 1 requires manufacturers of devices made available on the Union market, other than investigational devices, to report to the relevant competent authorities any serious incident involving devices made available on the Union market (except expected side-effects that are clearly documented in the product information, quantified in the technical documentation, and subject to trend reporting under Article 88), and any field safety corrective action in respect of devices made available on the Union market, including any field safety corrective action undertaken in a third country in relation to a device that is also legally made available on the Union market.

The definitions that feed into Article 87 come from Article 2. A serious incident is defined in Article 2(65) as any incident that directly or indirectly led, might have led, or might lead to the death of a patient, user or other person, to the temporary or permanent serious deterioration of a patient's, user's or other person's state of health, or to a serious public health threat. A field safety corrective action is defined in Article 2(68) as a corrective action taken by a manufacturer for technical or medical reasons to prevent or reduce the risk of a serious incident in relation to a device made available on the market. These definitions are not decorative. They are the tests the manufacturer applies when deciding whether the Article 87 duty is triggered.

Article 87(3) sets the timelines. Reports of serious incidents shall be made immediately after the manufacturer has established the causal relationship, or the reasonable possibility of such a causal relationship, between the incident and the device. The upper limits are 15 days after the manufacturer becomes aware of the incident for the general case, 10 days in the event of a serious public health threat, and 2 days in the event of death or an unanticipated serious deterioration in a person's state of health. "Without delay" is the underlying obligation; the numbers are ceilings, not targets.

Article 87(5) covers the obligation to report, as a minimum, the suspicion of a causal relationship. Paragraphs 8 and 9 address how reports interact between the manufacturer, the relevant competent authority, and other Member State authorities. Paragraph 10 addresses the obligation to take, without undue delay, any necessary corrective action.

Manufacturer obligations under Article 87

  • Identify and classify every signal against Article 2(64) and 2(65) — is it an incident at all, and if so, is it a serious incident.
  • Determine the manufacturer's awareness date, which starts the clock. MDCG 2023-3 Rev.2 sets out how.
  • File reports to the relevant competent authority within the applicable 2/10/15-day window.
  • Report every FSCA in respect of devices made available on the Union market, including FSCAs triggered in third countries when the same device is on the EU market.
  • Take necessary corrective action without undue delay and feed the event into the CAPA process under EN ISO 13485:2016+A11:2021.

Article 88 — Trend reporting

Article 88 is the article most startups forget exists. Paragraph 1 requires manufacturers to report any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or that are expected undesirable side-effects, that could have a significant impact on the benefit-risk analysis referred to in Sections 1 and 5 of Annex I and which have led or may lead to risks to the health or safety of patients, users, or other persons that are unacceptable when weighed against the intended benefits. The significant increase is to be established in comparison to the foreseeable frequency or severity of such incidents in respect of the device or category or group of devices in question.

Paragraph 2 requires the manufacturer to specify how to manage these incidents in the PMS plan referred to in Article 84 and in the technical documentation referred to in Annexes II and III, and to determine what constitutes a statistically significant increase. Paragraph 3 requires reports through Eudamed (or, in the interim, the appropriate national system).

Manufacturer obligations under Article 88

  • Predefine, in the PMS plan, the baseline frequencies and severities of expected side-effects and non-serious incidents.
  • Predefine the method for determining a statistically significant increase — the Regulation does not prescribe the method, but it does require the manufacturer to have one, and it has to be defensible.
  • Monitor continuously against the baseline using PMS data.
  • File a trend report when the threshold is crossed, even if no individual event rises to Article 87 severity.

The misreading we see most often: teams assume trend reporting is only for devices that already have many incidents. It is not. It is for any device where the PMS baseline and the observed frequency diverge significantly. A product with almost no events can still trigger a trend report if the few events that do occur are of a type or severity that was not predicted.

Article 89 — Analysis of serious incidents and field safety corrective actions

Article 89 describes what happens after a report is filed. Paragraph 1 requires the manufacturer to perform the necessary investigations in relation to the serious incident and the devices concerned. This includes a risk assessment of the incident and a field safety corrective action where appropriate, taking into account criteria referred to in paragraph 3. The manufacturer cooperates with the competent authorities and, where relevant, with the Notified Body concerned.

Paragraph 2 places an obligation on the competent authority that received the report to carry out its own assessment. Paragraph 3 sets out the criteria to be taken into account — the causal link, the traceability of the device, the frequency of use, the probability of the occurrence of harm, the severity of harm, the clinical benefit of the device, and the population affected.

Paragraph 4 introduces the coordinating competent authority mechanism for incidents that involve devices made available in more than one Member State, so analysis does not fragment across jurisdictions. Paragraph 5 covers the obligation to keep the manufacturer, the Notified Body, and other competent authorities informed of the assessment and the measures taken.

Manufacturer obligations under Article 89

  • Investigate every reported event, not just the ones that seem severe in hindsight.
  • Perform a risk assessment using the framework of EN ISO 14971:2019+A11:2021 and feed the result back into the risk management file.
  • Decide whether an FSCA is appropriate and, if so, launch it.
  • Cooperate actively with the competent authority and, where relevant, the Notified Body — cooperation is an Article 89 obligation, not a courtesy.
  • Update the technical documentation, the clinical evaluation, and the risk management file with the investigation outcome.

Article 90 — Analysis of vigilance data

Article 90 steps up from individual cases to system-level pattern analysis. Paragraph 1 requires the Commission, in collaboration with the Member States, to put in place systems and processes to actively monitor the data available in the electronic system referred to in Article 92 in order to identify trends, patterns or signals in the data that may reveal new risks or safety concerns. Paragraph 2 authorises the coordinating competent authority to inform the manufacturer, the other competent authorities, and the Commission of identified trends or patterns, so that coordinated analysis and, where necessary, coordinated action can follow.

For the manufacturer, Article 90 is mostly received action — the analysis is performed by the authorities — but the consequences arrive at the manufacturer's door. A signal identified at Union level under Article 90 can trigger a request for additional information, an FSCA requirement, or a formal measure under the market surveillance chapter. Manufacturers whose data quality is poor, whose submissions are late, or whose trend reporting is missing will see the consequences first here.

Article 91 — Implementing acts

Article 91 empowers the Commission to adopt implementing acts, after consultation with the MDCG, laying down the modalities and procedural aspects necessary for the implementation of Articles 85 to 90. This is the legal basis that allows the Commission to keep the vigilance procedures operationally current without re-opening the Regulation itself every time a refinement is needed.

For manufacturers, Article 91 is the article to watch over time. Implementing acts adopted under it may change the format of reports, the reporting thresholds, the structure of periodic summary reports, or the way Eudamed handles vigilance submissions. The obligation is to keep the vigilance SOP aligned with the current implementing acts and MDCG guidance — most importantly MDCG 2023-3 Rev.2.

Article 92 — Electronic system on vigilance and on post-market surveillance

Article 92 is the Eudamed leg of the vigilance framework. Paragraph 1 requires the Commission, in collaboration with the Member States, to set up and manage an electronic system to collate and process the following information: reports by manufacturers on serious incidents and field safety corrective actions referred to in Article 87(1) and updates thereto; periodic summary reports by manufacturers referred to in Article 87(9); reports by manufacturers on trends referred to in Article 88; field safety notices referred to in Article 89(8); information to be exchanged between the competent authorities of the Member States and between them and the Commission in accordance with Articles 89(7) and 89(9); information referred to in Article 90; and PSURs referred to in Article 86.

Paragraph 2 requires the information collated in the electronic system to be transmitted automatically to the relevant competent authorities and, where relevant, to be accessible to Notified Bodies, economic operators, healthcare professionals, the Commission, and the public in the scope set by the Regulation.

Article 92 is the technical pipe the entire vigilance framework flows through once it is fully operational. Until the vigilance module of Eudamed reaches full operational status and the applicable transitional arrangements end, reports still flow through national competent authority systems — but the manufacturer obligation is to report, not to wait for the pipe to be perfect. MDCG 2023-3 Rev.2 addresses the interim reporting path in detail.

Manufacturer obligations under Article 92

  • Report through Eudamed as it becomes operational for vigilance; report through national systems while those remain in use.
  • Ensure the information submitted — device identification, UDI, incident classification, risk assessment, corrective action — is complete and accurate enough for cross-authority analysis under Article 90.
  • Keep internal systems able to produce the data in the formats the electronic system requires, which means structured vigilance records, not free-text binders.

The manufacturer's end-to-end Eudamed vigilance flow

Walking the articles in sequence, the operational flow from signal to closed file looks like this:

  1. A signal enters the PMS system (customer complaint, service report, literature scan, distributor report, PMS data review).
  2. The signal is classified against Article 2(64) and 2(65). If it is a serious incident, the Article 87 clock starts at the manufacturer's awareness date.
  3. If the event is a non-serious incident or an expected side-effect, it enters the trend monitoring stream under Article 88.
  4. Serious incident reports are filed to the relevant competent authority within the Article 87(3) timelines, through Eudamed or the applicable national system.
  5. The manufacturer performs the Article 89(1) investigation, with risk assessment and, where appropriate, an FSCA.
  6. The competent authority performs its Article 89(2) assessment; the coordinating competent authority mechanism under Article 89(4) applies to multi-state cases.
  7. The Commission and Member States monitor the aggregated data under Article 90 for cross-border trends.
  8. The event and its handling feed back into the PMS system (Article 83), the PMS plan (Article 84), and the PSUR under Article 86 for Class IIa and above.
  9. The CAPA process under EN ISO 13485:2016+A11:2021 closes the loop with corrective and preventive actions, and the risk management file under EN ISO 14971:2019+A11:2021 is updated.

The loop is continuous. The six articles are not a sequence run once; they are the standing rules of the continuous post-market safety system.

Common misreadings of Articles 87–92

  • Treating Article 87 as the whole vigilance framework. Article 87 is the most visible article but it is one of six. Startups that build a vigilance system around Article 87 alone miss trend reporting, analysis obligations, and the Eudamed flow.
  • Assuming trend reporting only applies to problem devices. Article 88 applies to every manufacturer. The baseline is set in the PMS plan regardless of whether problems have occurred.
  • Waiting for Eudamed to be fully operational before building vigilance workflows. The obligation under Articles 87 and 88 exists today. The reporting pipe changes, the obligation does not.
  • Treating the coordinating competent authority mechanism as optional. For any device made available in more than one Member State, Article 89(4) applies by default, and the manufacturer is expected to cooperate with the designated authority.
  • Reading Article 91 as dormant. Implementing acts adopted under Article 91 and MDCG guidance updates change the operational rules over time. A vigilance SOP written in 2022 and never updated is already out of alignment.
  • Ignoring FSCAs triggered in third countries. Article 87(1)(b) explicitly captures FSCAs undertaken in third countries when the same device is legally on the EU market. This is the provision most frequently missed in multinational distribution setups.

The Subtract to Ship angle

Articles 87–92 look like a lot of obligations and they are. The Subtract to Ship response is not to cut obligations — every one of them stays in scope. The response is to cut the bureaucratic weight that stops the real work from running under time pressure.

A lean vigilance system, built for Articles 87–92 end to end, has one named owner, one SOP of a few pages mapping each step to a specific article, one intake channel feeding from PMS, one decision log documenting every classification call against Article 2(64)–(65) and MDCG 2023-3 Rev.2, one escalation path to the PRRC under Article 15, one structured record set ready to flow into Eudamed when the vigilance module is fully operational, and one quarterly review that checks the trend monitoring baseline is still current.

That is the whole system. It is auditable, it runs, and it survives the Friday-evening signal. The alternative — the thirty-page vigilance SOP nobody has opened since it was written — fails the audit and, worse, fails the patients. The Subtract to Ship framework for MDR gives the general methodology; Articles 87–92 are the specific target for applying it in the vigilance domain.

Reality Check — Where do you stand?

  1. For each of Articles 87, 88, 89, and 92, can you point to the specific paragraph in your vigilance SOP that maps to it?
  2. Is your trend reporting baseline under Article 88 documented in your PMS plan, with a specific method for determining statistical significance?
  3. Does your intake process capture FSCAs triggered in third countries when the same device is available on the Union market?
  4. Is your awareness date determination — the start of the Article 87(3) clock — defined in writing and tested against MDCG 2023-3 Rev.2?
  5. Do your vigilance records carry the structured data fields Eudamed will require, or are they free-text notes in a binder?
  6. Does your SOP name the relevant competent authority for your principal Member State, and does it describe how the coordinating competent authority mechanism under Article 89(4) applies to your multi-state distribution?
  7. When was the last time your vigilance SOP was reviewed against the latest MDCG 2023-3 Rev.2 revision and the current implementing acts under Article 91?

Frequently Asked Questions

What do MDR Articles 87 to 92 cover? They cover the manufacturer vigilance framework: Article 87 on reporting serious incidents and field safety corrective actions, Article 88 on trend reporting, Article 89 on analysis of serious incidents and FSCAs, Article 90 on Union-level analysis of vigilance data, Article 91 on implementing acts, and Article 92 on the Eudamed electronic system that carries the reports. Together they form Section 2 of Chapter VII of Regulation (EU) 2017/745.

Who does a manufacturer report to under Article 87? The relevant competent authority, defined as the competent authority of the Member State in which the manufacturer or its authorised representative has its registered place of business, with cross-referencing to the competent authorities of other Member States where the device is made available. Once the Eudamed vigilance module is fully operational under Article 92, the reporting route flows through Eudamed to the relevant competent authorities automatically; in the interim, national reporting channels remain in use as the competent authorities direct.

What is the difference between Article 87 and Article 88 reporting? Article 87 reporting is for individual serious incidents and for FSCAs. Article 88 reporting is for statistically significant increases in non-serious incidents and expected side-effects that could affect the benefit-risk balance. An event that does not meet the Article 2(65) serious incident threshold is not reported individually under Article 87, but the aggregated pattern can still trigger an Article 88 trend report.

What is MDCG 2023-3 Rev.2 and how does it relate to Articles 87–92? MDCG 2023-3 Rev.2, revised in January 2025, is the Questions and Answers document issued by the Medical Device Coordination Group on vigilance terms and concepts as outlined in Regulations (EU) 2017/745 and (EU) 2017/746. It is the primary interpretive reference for Articles 87–92 and is used by competent authorities, Notified Bodies, and manufacturers to resolve edge cases consistently across the Union.

Do Articles 87–92 apply before Eudamed is fully operational? Yes. The reporting obligations under Articles 87 and 88 and the analysis obligations under Article 89 apply from the date of application of the MDR regardless of Eudamed status. Article 92 establishes the electronic system; the substantive vigilance duties do not wait for the pipe. In the interim, the applicable national reporting channels are used, and MDCG 2023-3 Rev.2 describes the transitional path.

Sources

  1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(64) (definition of incident), Article 2(65) (definition of serious incident), Article 2(68) (definition of field safety corrective action), Article 83 (post-market surveillance system), Article 86 (periodic safety update report), Article 87 (reporting of serious incidents and field safety corrective actions), Article 88 (trend reporting), Article 89 (analysis of serious incidents and field safety corrective actions), Article 90 (analysis of vigilance data), Article 91 (implementing acts), Article 92 (electronic system on vigilance and on post-market surveillance). Official Journal L 117, 5.5.2017.
  2. MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746, first publication February 2023, Revision 2 January 2025.
  3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
  4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.

This post is part of the Post-Market Surveillance & Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. Articles 87–92 are the operational backbone of vigilance — six articles the manufacturer lives inside, not a chapter read once and filed away.