EU MDR Vigilance: MIR and FSCA Reporting

Why EU MDR Vigilance Looks Different

Manufacturers transitioning from MDD to EU MDR find that vigilance reporting is one of the most operationally changed areas. The forms changed (MIR replaces the old vigilance forms), the timelines tightened (some categories from 30 days to 10 days or 2 days), the submission channel changed (EUDAMED replaces NCA-specific portals), and the trend reporting expectations expanded.

The transition is largely complete for organizations already operating under MDR. For organizations still preparing — or transitioning specific product lines from MDD legacy to MDR scope — the operational redesign matters.

This guide covers MIR (Manufacturer's Incident Report) submission mechanics, FSCA (Field Safety Corrective Action) trigger criteria and Field Safety Notice (FSN) authoring, trend reporting obligations, and multi-state narrative consistency management.

The Regulatory Anchors

EU MDR Article 87 requires manufacturers to report:

• Serious incidents within 15 days (general)
• Death or unanticipated serious deterioration in state of health within 10 days
• Serious public health threat within 2 days

EU MDR Article 89 requires manufacturers to undertake FSCA when necessary and notify the competent authorities.

EU MDR Article 90 requires trend reporting for non-serious incidents and expected undesirable side-effects when statistical analysis shows a significant increase.

MIR Submission Workflow

The Manufacturer's Incident Report is the structured form for reporting serious incidents and FSCAs. EUDAMED is the intended submission portal. Until EUDAMED full functionality, several EU Member State competent authorities accept submissions through legacy national portals — the transition is uneven.

Form Structure

The MIR captures:

• Administrative information — manufacturer, authorized representative, importer, device identification (including UDI-DI)
• Affected device — model, lot, serial, UDI-PI
• Incident description — what happened, when, where, to whom
• Health effects — clinical outcomes
• Manufacturer's assessment — initial analysis, root cause investigation status
• Corrective actions — taken or planned, with timelines
• FSCA decision — whether FSCA is triggered

Free-text narrative sections — incident description, manufacturer's assessment, corrective actions — are the most-scrutinized.

Initial vs Follow-up vs Final MIR

The 10/15/2-day timeline is for the initial MIR. The initial MIR may have incomplete investigation findings — that is acceptable. Follow-up MIRs update the record as investigation progresses. A final MIR closes the case.

Practical timeline:

• Day 0 — manufacturer becomes aware
• Day 2 / 10 / 15 — initial MIR submitted (timeline depending on severity category)
• Day 30-60 — follow-up MIR with preliminary investigation findings
• Day 60-90 — follow-up MIR with root cause and corrective action
• Final MIR — case closure, typically at CAPA completion

For multi-state incidents (same event reported by multiple Member States or affecting devices distributed across multiple states), narrative consistency across MIRs is critical. EUDAMED aggregates reports; inconsistencies surface immediately.

FSCA Trigger Criteria

Field Safety Corrective Action is triggered when the manufacturer determines that action in the field is necessary to reduce risk of death or serious injury. FSCA types:

• Device recall — removal of devices from the field
• Device modification — modification of devices already in use
• Device exchange — replacement of devices in the field
• Device labeling update — distribution of updated IFU or labeling
• Software update — distribution of corrected software
• Customer advisory — communication of new safety information without physical device action

The trigger decision is the manufacturer's, but it is reviewed by competent authorities. A pattern of incidents that should have triggered FSCA but did not is a major regulatory concern.

FSCA Decision Framework

A working decision framework:

1. Is the incident root cause systemic? Single random event vs pattern. Random events typically do not trigger FSCA; patterns typically do.

2. Are devices in the field affected? Devices with the affected lot/serial range or design are scoped.

3. What is the risk if no action is taken? Probability of recurrence × severity if recurrence occurs.

4. What action reduces the risk to acceptable levels? Recall, modification, advisory, etc.

5. What is the impact of the action? Patient safety, supply continuity, commercial considerations.

The decision and rationale are documented in the FSCA file. Auditors and post-market reviewers examine this rationale.

Field Safety Notice (FSN) Authoring

The FSN is the communication artifact distributed to users and healthcare professionals as part of FSCA. EU MDR Annex III specifies FSN content:

• Manufacturer identification
• Device identification (model, lot ranges, UDI)
• Nature of the issue
• Affected user populations
• Action requested from users
• Timing of action
• Manufacturer contact information

FSN must be:

• Clear, in language understood by intended users (typically requires multi-language versions for EU distribution)
• Distributed through reliable channels (direct customer contact, not just website posting)
• Tracked — manufacturers must document distribution to specific users

For implantable devices, FSN distribution includes both implanting clinicians and (where appropriate) patients. The implant card linkage helps trace affected patients.

Multi-Language FSN

For EU-wide FSCA, FSN translation into all relevant EU languages is required for the markets affected. A working pattern:

1. Master FSN in English (the manufacturer's authoritative version)
2. Translation to each affected language by qualified medical translation
3. Local review by in-country quality or regulatory contacts
4. Coordinated distribution through national channels

The translation step is often where FSCA timelines compress. Pre-arranged translation services with 5-day turnaround are standard for organizations with significant EU presence.

Trend Reporting (Article 90)

Article 90 requires reporting of non-serious incidents and expected undesirable side-effects when statistical analysis indicates a significant increase. Operational requirements:

• Define baseline incident rates — typically established during pre-market clinical evaluation and refined post-launch
• Define statistical significance methodology — what counts as a significant increase
• Execute periodic analysis — typically quarterly, against the established baseline
• Document the analysis — even when no trend is identified, the analysis is documented
• Report when triggered — through EUDAMED trend reporting

Statistical methodology choices matter. Naive rate comparisons (this quarter vs last quarter) often produce false signals. Established methodologies (CUSUM, sequential probability ratio test, control chart-based) provide more reliable signal detection.

For SaMD and AI/ML devices, trend reporting expectations are evolving. Performance drift, retraining-triggered changes, and edge-case failure pattern emergence are all candidates for trend reporting in the SaMD/AI context.

EUDAMED Integration

EUDAMED is the EU's central database for medical device information. The vigilance module is one of seven EUDAMED modules. Functionality timeline has been delayed multiple times; the current expectation is full functionality during 2026.

Once fully operational, EUDAMED:

• Receives MIRs through structured submission
• Maintains UDI-linked device records
• Allows competent authorities to cross-reference reports across states
• Provides public-facing summaries (FSCAs, FSNs)
• Aggregates trend reporting data

For manufacturers, EUDAMED integration design choices matter. Direct EUDAMED submission from internal vigilance systems via API is the highest-efficiency model. Manual submission through the EUDAMED web interface is the entry-level model.

Korean MFDS Cross-Reference

Korean MFDS vigilance is operationally distinct (see MFDS Vigilance 2026 Update). However, operational alignments save effort:

Aligned investigation depth. EU MDR's 10/15-day timelines are tighter than Korean MFDS's 7/15-day timelines for death/serious injury — but both require preliminary investigation depth that is similar. A unified investigation procedure satisfies both.

Reuse of root cause analysis. The RCA performed for EU MIR submission can support Korean MFDS vigilance reporting with translation only.

FSCA international coordination. When an FSCA affects multiple jurisdictions, coordinated communication to EU competent authorities and Korean MFDS through the KLH avoids inconsistent narratives. EUDAMED FSCA postings will be visible to Korean reviewers; consistency matters.

SaMD/AI device alignment. Both EU MDR and Korean MFDS are evolving expectations for SaMD vigilance in parallel. Trend reporting and performance drift methodologies developed for one jurisdiction increasingly satisfy the other.

Six Practical Recommendations

1. Build the unified investigation procedure first, then layer jurisdiction-specific reporting on top. Investigation depth is similar across FDA / EU / Korea; only deadlines differ.

2. Pre-arrange medical translation services with 5-day turnaround. FSN distribution is where FSCA timelines compress.

3. Document FSCA trigger decisions even when not triggered. The decision rationale is what auditors examine when patterns emerge later.

4. Adopt established statistical methodology for trend reporting. Naive comparisons produce false signals; established methods are defensible.

5. For multi-state incidents, ensure narrative consistency across MIRs. EUDAMED aggregation surfaces inconsistencies.

6. Plan EUDAMED API integration as the vigilance system architecture target. Manual web submission becomes operationally fragile at higher volumes.

Where Leanabl Plugs In

The Vigilance service handles EU MDR vigilance infrastructure including MIR submission and FSCA coordination. For organizations with multi-region exposure (EU + FDA + Korea), the unified investigation procedure and reporting architecture is implemented through PMS and Platform RIM integration. Korean-specific vigilance integration is handled through Korea Post-Market Operations.