---
title: Vigilance Reporting Timelines Under MDR: The 15-Day and 2-Day Rules
description: MDR Article 87 sets three vigilance deadlines: 15 days for standard serious incidents, 10 days for death or unanticipated deterioration, and 2 days for public health threats.
authors: Tibor Zechmeister, Felix Lenhard
category: Post-Market Surveillance & Vigilance
primary_keyword: vigilance reporting timelines MDR
canonical_url: https://zechmeister-solutions.com/en/blog/vigilance-reporting-timelines-mdr
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# Vigilance Reporting Timelines Under MDR: The 15-Day and 2-Day Rules

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **MDR Article 87(3) sets three upper limits for reporting serious incidents to the competent authority. The default is not later than 15 days after the manufacturer becomes aware of the event. The limit drops to 10 days in the event of a serious public health threat. It drops further to 2 days in the event of death or an unanticipated serious deterioration in a person's state of health. The underlying obligation in Article 87(3) is to report immediately and without delay; the numeric limits are ceilings, not targets. The clock starts at the manufacturer's awareness date, not at the end of the internal investigation.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- MDR Article 87(3) sets three reporting deadlines: 15 days for standard serious incidents, 10 days for serious public health threats, and 2 days for death or unanticipated serious deterioration in state of health.
- The clock starts at the manufacturer's awareness date, which is defined by MDCG 2023-3 Rev.2 as the date any part of the manufacturer's organization (including distributors and authorised representatives acting on its behalf) first received information that an event might qualify as a serious incident.
- "Without delay" is the governing obligation. The numeric limits are the outer envelope, not the goal. A manufacturer who reports on day 14 when day 3 was possible is not compliant with the spirit or the letter of Article 87(3).
- The 2-day rule applies not only to confirmed deaths but also to unanticipated serious deterioration of state of health — a category wider than most startups assume.
- Missing a timeline is a serious non-conformity. It is one of the most common findings in competent authority investigations and Notified Body audits of the vigilance system.

---

## Why the timelines exist in the first place

The old Directives left reporting timelines loose. Member States interpreted the windows differently, some manufacturers reported in weeks and some in months, and cross-border signals disappeared into the gaps between national systems. By the time a pattern was visible at Union level, patients had already been harmed more than once. Chapter VII of Regulation (EU) 2017/745 was written to close that gap, and the numeric timelines in Article 87(3) are how it does so.

The logic is simple. A serious incident is, by definition under Article 2(65), an event that led, might have led, or might lead to death, serious deterioration in state of health, or a serious public health threat. If the signal is real, the next patient at risk is already using the device somewhere in the Union. Every day of delay is a day in which that next patient may be harmed. The regulator's job is to cut the detection-to-action loop as short as the investigation permits. The manufacturer's job is to cooperate with that cut, not to use the timeline as a buffer for internal process.

This is why the framing in Article 87(3) is "immediately" and "without delay," with the numbers added as hard ceilings. Felix's version of the same point applied to regulatory work generally: the size of your compliance buffer is usually a measure of how little you trust your own process. A vigilance system built with the 2/10/15 days as targets is already behind the intent of the Regulation.

## What triggers each timeline

Article 87(3) distinguishes three categories of serious incident and assigns a different upper limit to each.

**The 15-day rule.** The default upper limit is not later than 15 days after the manufacturer becomes aware of the event. This applies to any serious incident that does not fall into one of the two accelerated categories below. It is the standard case — a malfunction or deterioration that meets the Article 2(65) threshold but did not cause death and is not a serious public health threat. Most reportable events sit in this bracket.

**The 10-day rule.** The limit drops to not later than 10 days in the event of a serious public health threat. The Regulation does not define "serious public health threat" through a bright-line test; MDCG 2023-3 Rev.2 provides the interpretive guidance. In practice, a serious public health threat is an event or signal that could affect many people at once, that indicates a systemic risk rather than an isolated case, or that touches on a condition whose public impact goes beyond the individual patient. A contaminated batch, a security vulnerability with wide deployment, a design flaw reproducible in every unit in the field — these are the kinds of signals that put the 10-day clock into motion.

**The 2-day rule.** The limit drops further to not later than 2 days in the event of death or an unanticipated serious deterioration in a person's state of health. Two things matter in that phrasing. First, it is not only death — an unanticipated serious deterioration also triggers the 2-day clock, and "unanticipated" is the key word. An adverse event that was expected and documented in the IFU and the clinical evaluation is treated differently from the same event occurring in a way nobody predicted. Second, the word "unanticipated" sends the manufacturer back to the risk file and the clinical evaluation — the comparison is against what was anticipated in those documents, not against the manufacturer's current feelings about the event.

Article 87(4) further provides that where necessary to ensure timely reporting, the manufacturer may submit an initial report that is incomplete followed by a complete report. This is an important operational provision. The 2-day rule does not require a complete investigation in 2 days — it requires a report in 2 days. The investigation continues and the file is updated as facts become available. Waiting until the investigation is complete before the first report is a misreading of the Regulation that has produced numerous Notified Body findings.

## The awareness date concept

Every timeline in Article 87(3) runs from the manufacturer's awareness date. This is the single most consequential concept in vigilance timekeeping and the one most commonly mis-set by startups.

MDCG 2023-3 Rev.2 addresses the awareness date in detail. The awareness date is the date on which the manufacturer or any person working on its behalf — including distributors, importers, authorised representatives, and subcontractors acting within their role — first received information suggesting that an event might meet the serious incident threshold. It is not the date of internal confirmation. It is not the date the investigation concluded. It is not the date the classification decision was finalised. It is the earliest point at which a qualifying signal reached the manufacturer's organisation in any form.

Three practical consequences follow.

First, the manufacturer is on the clock even when the event happened weeks earlier somewhere in the field — the clock starts when the information reached the organisation, which means a late-arriving complaint can put a manufacturer on a 2-day fuse for an event that occurred a month ago. Whether the delay was the customer's or the distributor's does not matter for the Article 87(3) clock.

Second, distributor and authorised representative information counts. The organisation's boundary for awareness purposes is the full network acting on the manufacturer's behalf. A distributor who sits on a complaint for a week and then forwards it has already burned a week of the manufacturer's budget — the awareness date is the date the distributor received the information, not the date the manufacturer's head office did. This is why distributor contracts have to include immediate forwarding obligations and why the vigilance system has to include distributor intake as a monitored channel.

Third, partial information counts. The awareness date is not conditional on the manufacturer having a complete picture. If the signal is enough to suggest the event might be a serious incident, that is enough to start the clock. The manufacturer then has the Article 87(3) window to classify, investigate enough to file, and report. Article 87(4) allows the first report to be incomplete — the clock is on the report, not on the certainty.

MDCG 2023-3 Rev.2 includes worked examples and Q&As on awareness date determination. Any vigilance SOP that does not reference the current revision of that document is already out of alignment with how competent authorities and Notified Bodies read Article 87(3).

## How to avoid missing a clock

The vigilance systems that miss clocks almost always share the same failure patterns. The systems that do not miss clocks share the same design choices. The difference is structural, not heroic.

**One monitored intake channel.** Every signal route — customer service email, phone line, distributor report, service technician form, user community, literature scan, social listening, sales team escalation — feeds into a single intake point with a documented maximum latency from receipt to triage. If the intake latency is one day and the triage latency is one day, a 2-day event arriving at 5pm Friday has already eaten most of its budget before anyone looks at it. The intake pipe has to be faster than the tightest clock it could ever trigger.

**A named owner who is reachable outside business hours.** The Article 15 PRRC holds the formal responsibility. The operational vigilance owner — who may or may not be the PRRC — needs to be named and contactable. A 2-day clock that lands over a weekend is the standard stress test, not the edge case.

**A decision tree pinned to the desk.** The classification decision under Article 2(65) and the timeline selection under Article 87(3) should be a one-page flow, not a twenty-page SOP nobody reads under pressure. The one page traces every branch to a specific Article paragraph or MDCG 2023-3 Rev.2 Q&A.

**A distributor and authorised representative forwarding obligation in every contract.** The forwarding deadline in the contract has to be shorter than the reporting deadline it feeds into. A contract that lets a distributor take 72 hours to forward a complaint makes the 2-day rule impossible on paper.

**A Friday-evening drill.** Once a quarter, a simulated serious incident signal is injected into the intake channel at an inconvenient time and the team runs the decision tree against the clock. The drill reveals the gaps — the on-call gap, the authorisation gap, the documentation gap — before a real event does.

The drill is the Subtract to Ship test in practice. If a simulated 2-day event cannot be reported in 2 days with the current system, the current system is already out of compliance with Article 87(3) — the only question is when the real event will expose it.

## The Eudamed submission flow

Once a report is ready, it enters the electronic reporting flow established by MDR Article 92. Paragraph 1 of Article 92 requires the Commission, in collaboration with the Member States, to set up and manage the electronic system on vigilance and post-market surveillance to collate and process reports of serious incidents and field safety corrective actions referred to in Article 87(1), updates thereto, periodic summary reports, trend reports under Article 88, field safety notices under Article 89, and related information exchanged between competent authorities.

Until the vigilance module of Eudamed reaches full operational status for vigilance reporting and the applicable transitional arrangements end, reports continue to flow through the applicable national competent authority systems. MDCG 2023-3 Rev.2 covers the interim arrangements in detail. The manufacturer obligation is to report, on time, through whatever reporting channel is currently designated — the substance of Article 87(3) does not wait for Eudamed to be perfect.

Whichever channel is in use, the data fields required are substantively the same: device identification (including UDI where applicable), the event description, the classification decision against Article 2(65), the awareness date, the preliminary causal assessment, the preliminary risk assessment under EN ISO 14971:2019+A11:2021, and the corrective action taken or planned. A vigilance record system that stores events as free-text notes cannot feed these fields cleanly under time pressure. The structured data fields have to exist from the day the vigilance SOP is written, not added later when Eudamed tightens up.

## What happens when a deadline is missed

A missed Article 87(3) deadline is not a minor administrative matter. It is one of the most reliable triggers for competent authority action and one of the most consistently logged non-conformities in Notified Body audits of the vigilance system.

The immediate consequences are concrete. The competent authority that receives the late report can open an investigation into the vigilance system itself under Article 89(2) — the authority's own assessment obligation. The Notified Body, on its next audit, will review the vigilance records, identify the missed clock, and record a non-conformity. Depending on the severity and the pattern, the non-conformity can be minor, major, or — in cases of systemic vigilance failure — a finding that places the certificate at risk.

The downstream consequences compound. A missed clock is almost never isolated. When an auditor finds one, the natural next question is whether the vigilance system could have produced the same failure in other cases, which means the audit widens from one event to the whole system. The CAPA required to close the finding typically extends beyond fixing the specific process gap to rebuilding the intake, triage, and escalation chain.

The honest framing is that the cost of missing a 2-day clock once, because the Friday-evening drill was never run, is much higher than the cost of running the drill every quarter for the life of the product. The Subtract to Ship response is not to invent a thicker SOP — it is to cut the SOP down to the one page that actually runs and to run it against the clock regularly enough that the team does not freeze when it counts.

## The Subtract to Ship angle

Vigilance timelines are the part of Article 87 where the instinct to over-build meets the reality that over-built systems are slower, not safer. A thirty-page vigilance SOP with five approval layers does not report faster than a two-page SOP with one named owner — it reports slower, because every approval layer adds latency and every page adds friction. When the 2-day clock is ticking, the system that wins is the system that has been stripped to the minimum that satisfies Article 87(3) and MDCG 2023-3 Rev.2 and nothing else.

The [Subtract to Ship framework applied to MDR](/blog/subtract-to-ship-framework-mdr) gives the general methodology. The specific application to vigilance timelines is three moves. First, map every step in the vigilance intake-to-report chain to a specific paragraph of Article 87 or a specific Q in MDCG 2023-3 Rev.2 — if the step does not trace, cut it. Second, measure the current latency from any intake channel to a filed report and compare it against the tightest clock the system could ever face — if the current latency exceeds the 2-day rule, the system is already out of compliance with the spirit of Article 87(3) even if it has not yet missed an actual case. Third, run the drill.

What remains after those three moves is the vigilance system that actually meets the timelines. What was cut was the paperwork that gave the illusion of control while making the real response slower. That is the whole framework applied to one article.

## Reality Check — Where do you stand?

1. Can you write out, on one page and from memory, the three Article 87(3) deadlines and the specific trigger for each?
2. Is your awareness date defined in writing against MDCG 2023-3 Rev.2, including distributor and authorised representative information as part of the manufacturer's awareness boundary?
3. What is the measured latency, in hours, from a complaint arriving at your intake channel to a classification decision being made? Is it shorter than the 2-day rule under realistic off-hours conditions?
4. Do your distributor and authorised representative contracts contain a forwarding deadline shorter than your tightest Article 87(3) clock?
5. Have you run a simulated serious incident drill in the last quarter, at an inconvenient time, and did the team meet the 2-day clock?
6. If a report under Article 87(4) has to be filed incomplete to meet the clock, does your team know that is allowed and how to do it?
7. When your vigilance SOP was last revised, was it checked against the current revision of MDCG 2023-3 Rev.2?

## Frequently Asked Questions

**What are the reporting timelines under MDR Article 87(3)?**
MDR Article 87(3) sets three upper limits for reporting serious incidents to the relevant competent authority: not later than 15 days after the manufacturer becomes aware of the event for the default case, not later than 10 days in the event of a serious public health threat, and not later than 2 days in the event of death or an unanticipated serious deterioration in a person's state of health. The underlying obligation is to report immediately and without delay; the numeric limits are ceilings, not targets.

**When does the reporting clock start under Article 87(3)?**
The clock starts at the manufacturer's awareness date, which MDCG 2023-3 Rev.2 defines as the date on which the manufacturer or any person working on its behalf — including distributors, importers, and authorised representatives — first received information suggesting that an event might meet the serious incident threshold. It is not the date of internal confirmation, not the date the investigation concluded, and not the date the classification decision was finalised.

**Does the 2-day rule apply only to death?**
No. Article 87(3) applies the 2-day rule to death and to unanticipated serious deterioration in a person's state of health. "Unanticipated" is judged against what was documented in the risk management file, the clinical evaluation, and the IFU. A serious deterioration that was not anticipated in those documents triggers the 2-day clock even if nobody died.

**Can the first report be incomplete?**
Yes. Article 87(4) allows the manufacturer to submit an initial report that is incomplete followed by a complete report where necessary to ensure timely reporting. The obligation is to report on time, not to investigate to completion before reporting. The investigation continues and the file is updated as more facts become available.

**What happens if a manufacturer misses an Article 87(3) deadline?**
A missed deadline is a serious non-conformity. The competent authority can open an investigation into the vigilance system under Article 89(2). The Notified Body, on its next audit, will record a non-conformity against the vigilance system, and depending on the pattern and severity the finding can range from minor to a finding that places the certificate at risk. The CAPA typically extends beyond the specific case to the whole intake and escalation chain.

## Related reading

- [What Is Vigilance Under MDR?](/blog/what-is-vigilance-mdr) — the pillar post for the vigilance cluster and the starting point for the Article 87 duties.
- [MDR Articles 87–92: The Vigilance Framework](/blog/mdr-articles-87-92-vigilance-framework) — the full Regulation text of the vigilance chapter, article by article.
- [Serious Incidents Under MDR: How to Determine If an Event Must Be Reported](/blog/serious-incidents-mdr) — the classification decision tree that feeds into the timeline selection.
- [How to Report a Serious Incident to the Competent Authority](/blog/report-serious-incident-competent-authority) — the operational step-by-step once a reportable event is confirmed.
- [Field Safety Corrective Actions (FSCAs) Explained](/blog/field-safety-corrective-actions-fscas) — the FSCA leg of Article 87 and its own timing rules.
- [Trend Reporting Under MDR Article 88](/blog/trend-reporting-mdr-article-88) — the separate stream for non-serious events and expected side-effects.
- [Periodic Safety Update Reports Under MDR Article 86](/blog/psur-mdr-article-86) — the periodic reporting interface between PMS and vigilance.
- [Eudamed Vigilance Module: What Manufacturers Need to Know](/blog/eudamed-vigilance-module) — the Article 92 electronic system through which reports flow.
- [The Subtract to Ship Framework for MDR](/blog/subtract-to-ship-framework-mdr) — the methodology behind the lean vigilance system described in this post.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(65) (definition of serious incident), Article 87(3) (reporting timelines), Article 87(4) (incomplete initial report followed by complete report), Article 89 (analysis of serious incidents and field safety corrective actions), Article 92 (electronic system on vigilance and on post-market surveillance). Official Journal L 117, 5.5.2017.
2. MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746, first publication February 2023, Revision 2 January 2025.
3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.

---

*This post is part of the Post-Market Surveillance & Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. The Article 87(3) clocks are the part of vigilance where a lean, drilled system beats a thick, unused SOP every time — and where the difference shows up when it matters most.*

---

*This post is part of the [Post-Market Surveillance & Vigilance](https://zechmeister-solutions.com/en/blog/category/pms-vigilance) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*