Vigilance is the reporting of serious incidents and field safety corrective actions involving devices on the market to the competent authority (MDR Articles 87–92). In Türkiye the competent authority is TİTCK.
Which events are reported?
The obligation arises for serious incidents where a causal relationship with the device is established or reasonably possible. A serious incident is one that led, or might have led, to death, to a temporary or permanent serious deterioration in a person’s state of health, or to a serious public health threat.
Not every complaint becomes a report. But every complaint has to be assessed for reportability, and that assessment — including a decision not to report — has to be recorded with its reasoning.
Reporting deadlines
The deadlines are short and run from the date of awareness:
- 15 days — general deadline for a serious incident
- 10 days — death or unanticipated serious deterioration in a person’s state of health
- 2 days — serious public health threat
For that reason the procedure has to name the owner, the deputy and the maximum time for every step from receiving the complaint to the reporting decision.
Field safety corrective action (FSCA)
If an action is taken to reduce risk in devices on the market, that action is reported to the competent authority. Recalls, software updates, changes to the instructions for use and withdrawal of a device are typical examples. Users are informed through a field safety notice (FSN); the language should be plain and the action required clear.
If there is an unexpected increase in the frequency or severity of incidents that are not otherwise reportable, trend reporting applies (MDR Article 88).
How important are the records?
A vigilance system is usually audited through its records. The date the complaint was received, the initial assessment, whether the device was returned, the root cause analysis, the reporting decision and its reasoning, correspondence with the authority and the closure — all of it has to be traceable. That chain is also an input to the post-market surveillance report and the PSUR.
What it covers
- Complaint and adverse event assessment procedure
- Reportability decision and preparation of the Manufacturer Incident Report (MIR) form
- Planning a field safety corrective action and drafting the field safety notice
- Trend reporting (Article 88) and the link with PMS data
EUDAMED and ÜTS: where do reports go?
On the European side, registrations and notifications are collected in EUDAMED. The first four modules — actor registration, UDI and device registration, notified bodies and certificates, and market surveillance — became mandatory on 28 May 2026. The vigilance module was left for later; until it goes live, serious incidents continue to be reported to the competent authority on the Manufacturer Incident Report (MIR) form.
In Türkiye, device and certificate records run through the Product Tracking System (ÜTS). TİTCK addressed the effect of mandatory EUDAMED use on ÜTS processes in a separate announcement in 2026. For manufacturers registered in both systems, keeping actor and device data consistent is the first condition of a working reporting chain.
Content matters as much as speed: the description of the incident, the UDI-DI of the device, the current state of the root cause assessment and the actions taken or planned all belong in the initial report. If the root cause is not yet known, the report is not held back; it is completed with a follow-up report.
Who runs the vigilance system?
A manufacturer must designate a person responsible for regulatory compliance (MDR Article 15), and that person’s duties include meeting vigilance obligations. In small companies the role can be covered by a permanently available external service, but the responsibility stays with the manufacturer.
The other links in the chain are importers and distributors (MDR Articles 13 and 14). Forwarding complaint and incident information to the manufacturer, keeping records and cooperating where needed are their obligations too. If the distribution agreement does not state the notification period in days, the 15-day legal deadline is spent on the way.
For recurring incidents of the same type on similar devices, periodic summary reporting can be agreed with the competent authority instead of individual reports (MDR Article 87(9)). That reduces the reporting load but does not remove the discipline of assessment and record keeping.
Vigilance data does not only go to the authority: the same data updates the post-market surveillance report and the risk management file.
What happens after a report?
A report is the beginning of the process, not the end. The competent authority may ask for further information; it asks for the outcome of the root cause analysis and the actions taken. Follow-up reports and the final report run under the same incident number, and when the incident is closed the reasoning for closure is recorded too.
If similar incidents recur on the same device, a question arises beyond the individual reports: should the design or the instructions for use change? That decision goes back into the risk file and, where needed, triggers a field safety corrective action.
The maturity of a vigilance system is measured not by how many reports were filed but by how much those reports changed the design and the information supplied with the device.
Common problems
The most frequent problem is complaints not being assessed for reportability, or the assessment not being recorded. Where no report is made, the reason has to be written down. The second is incident information from distributors reaching the manufacturer late; distribution agreements should define the notification period explicitly.
