Adverse-Event Reporting Compared: FDA 21 CFR 803, EU MDR, Brazil, Thailand & SA

Five Frameworks, Five Clocks — Same Incident, Different Form

When a device already on the market may have caused or contributed to a death, serious injury, or a dangerous malfunction, five legal texts decide who must report, to whom, on what form, and how fast: the FDA's Medical Device Reporting rule (21 CFR Part 803), the EU MDR's vigilance regime (Articles 87 and 92), Brazil's technovigilance resolution (ANVISA RDC 67/2009), Thailand's Ministry of Public Health notification on device defects and adverse events (MoPH Notification B.E. 2563/2020), and South Africa's SAHPRA adverse-event reporting guideline (SAHPGL-MD-03 v4, 2024). They share a common purpose — turn adverse-event awareness into a documented, traceable report on a defined clock — but the reporting entity, the filing object, and the counting method (calendar days vs. working hours) diverge sharply.

This is a regulatory-research comparison for compliance planning, not legal advice for a specific product. Verify every hook against the official text listed at the end. It complements our recall / FSCA comparison, which covers field actions (what you do to the device); this one covers incident reports (what you tell the regulator about the event).

Side-by-Side: Who Reports, on What, and How Fast

FDA: 21 CFR Part 803 and the Three-Actor Model

The US system is unusual in imposing a direct reporting duty on three distinct actors, each with a different destination for its report.

• §803.10 (manufacturers): report when the manufacturer becomes aware that its device may have caused or contributed to a death or serious injury, or has malfunctioned in a way that would be likely to cause or contribute to death or serious injury if it were to recur. Standard clock is within 30 calendar days of becoming aware.
• §803.50 (five-work-day reports): where an event requires immediate remedial action to prevent an unreasonable risk of substantial harm to the public health, or where FDA specifically designates an event, the manufacturer reports within 5 work days.
• §803.40 / §803.42 (importers): importers report deaths and serious injuries to both FDA and the manufacturer within 30 calendar days, but report malfunctions to the manufacturer only (not to FDA).
• §803.30 (user facilities): hospitals, nursing homes, and similar facilities report device-related deaths to FDA and the manufacturer, and serious injuries to the manufacturer (or to FDA if the manufacturer is unknown). User facilities do not report malfunctions.
• Form and channel: mandatory reports use Form FDA 3500A (MedWatch mandatory form); manufacturers and importers must submit electronically through the eMDR system via the Electronic Submissions Gateway (mandatory since 14 August 2015). Submitted reports populate the public MAUDE database. Key terms are defined in §803.3.

Cross-market trap: the US splits reporting by who you are — a manufacturer, an importer, and a user facility each file a different report to a different place, and an importer's malfunction report never reaches FDA. Firms that centralize vigilance on a single "manufacturer MDR" template miss the importer-to-manufacturer and user-facility channels. The 30-day clock is in calendar days, but the urgent-report clock is in work days — a frequent unit-conversion error.

EU MDR: Vigilance Is a Causality-Gated, Calendar-Day Clock

The EU MDR (Chapter VII, Section 2, Articles 87–92) concentrates the reporting duty on the manufacturer and ties the clock to the moment the manufacturer establishes (or reasonably suspects) a causal link between the device and the serious incident.

• Article 87(1): manufacturers report (a) any serious incident involving devices made available on the Union market, and (b) any field safety corrective action (FSCA) — the FSCA-report side is covered in our recall comparison.
• Article 87(3) — general clock: report immediately, and not later than 15 calendar days after becoming aware of the incident, once a causal link is established or reasonably possible.
• Article 87(5) — death / unanticipated serious deterioration: report not later than 10 calendar days after awareness.
• Article 87(4) — serious public health threat: report not later than 2 calendar days after awareness of the threat.
• Article 87(6): an initial, incomplete report followed by a complete report is expressly permitted to meet the clock; Article 87(7) requires a report even when the manufacturer is uncertain whether the incident is reportable.
• Article 88 (trend reporting): expected side-effects clearly documented and quantified in the technical documentation are excluded from incident reporting and handled under trend reporting instead.
• Channel: reports go through the EUDAMED electronic system (Article 92), using the Manufacturer Incident Report (MIR) form; the MDCG 2023-3 (rev. 2) Q&A fixes "day 0" as the manufacturer's awareness date and confirms the period runs in calendar days.

Cross-market trap: the EU's 15-day general clock replaced the old Medical Device Directive's 30-day report, so firms still operating on a legacy 30-day vigilance SOP are filing late. The report is also causality-gated — the clock starts at awareness plus the causal-link determination — which is later than the US "became aware" trigger for the same event. Importers and distributors do not file a public MIR; under Article 14 / Article 89 they must pass adverse-event information up to the manufacturer, which then files.

Brazil: RDC 67/2009 Technovigilance, Anchored on the BRH

Brazil does not let a foreign manufacturer self-file. The reporting entity is the Brazil Registration Holder (BRH), acting through the National Health Surveillance System (SNVS) and reporting to ANVISA.

• RDC 67/2009 sets the general technovigilance obligations — the post-market surveillance system for adverse events and technical complaints — and the notification timelines that depend on incident severity.
• Reportable trigger: an adverse event report (Notivisa) is required when a device malfunction or misuse results in death or serious injury, could lead to death or serious injury if it were to recur, or falls under other circumstances stipulated in the regulation; a technical complaint is also reportable where a recurrence could lead to a severe adverse event.
• Core clocks (per RDC 67/2009): verified events occurring in Brazil — death, a serious threat to public health, or counterfeiting — must be reported within 72 hours of awareness; the same events occurring in another country (but affecting products registered in Brazil) within 10 days; other verified serious incidents within 10 days.
• Alert + follow-up: where a field action is necessary, the BRH notifies ANVISA, distributes an alert message to consumers, and submits monitoring and final reports under the technovigilance regime; field-action notification itself is governed by RDC 551/2021.
• Documentation: all reports are added to ISO 13485 / quality-system records; documents for foreign manufacturers are translated into Portuguese.

Cross-market trap: Brazil's 72-hour clock for in-country death or public-health threat is the fastest of the five frameworks here — faster than the EU's 2-day and the US's 5-work-day urgent report. A manufacturer that assumes "the EU's 10-day death clock is the tightest globally" will breach the Brazilian window. And because only the BRH can file, a missing or slow BRH relationship is a structural blocker — not a clerical one.

Thailand: The HPVC and the 10/30-Day Structure

Thailand operationalizes reporting through a single centre — the Health Product Vigilance Centre (HPVC) under the Thai FDA, Ministry of Public Health — under one binding Ministerial Notification.

• MoPH Notification B.E. 2563 (2020): "Criteria, procedures and conditions for preparation of reports on medical device defects or adverse events occurring to consumers and reports on field safety corrective actions for medical devices" — the binding instrument.
• Thai FDA guidance: Guidance for the Medical Device Industry: Reporting of Device Defects, Adverse Events and Field Safety Corrective Actions — operational detail issued by the HPVC.
• Responsible parties: registered manufacturers/importers and market authorization holders of licensed devices.
• Clocks: report within 10 days of awareness where a death or serious injury has occurred; within 30 days where the available evidence indicates a recurrence could lead to death or serious harm. Reports are submitted to the HPVC (online or in person), which then publishes vigilance news and recalls on its website.

Cross-market trap: Thailand's 30-day "potential" track is triggered by recurrence-risk evidence, not by an actual injury — a standard closer to the EU's "incident + causal link" than to the US's "malfunction likely to cause SI if it recurred." Firms that map Thailand onto the US malfunction rule will under- or over-report depending on how they read the recurrence evidence.

South Africa: SAHPGL-MD-03 v4 and the Licensee / HCR Duty

South Africa's reporting duty sits with the establishment licensee (the holder of a medical device establishment licence) and the holder of a certificate of registration (HCR), under a guideline that explicitly covers IVDs.

• SAHPGL-MD-03 v4 (13 December 2024): Guideline for Medical Device Vigilance: Adverse Events Reporting — defines the regulatory requirements, classification of events, timeframes, and exemptions for reporting adverse events for a medical device (including an IVD).
• SAHPGL-MD-11 v1 + GLF-MD-11A: the companion guideline and the Medical Device Adverse Event Reporting Form (one device per form), submitted to the SAHPRA medical-device vigilance mailbox.
• Core clocks: 48 hours for a serious public-health threat (clinical-study sponsors: serious health threat to the study population within 48 hours of determination); 10 calendar days for events involving death or serious injury (clinical-study USADE / serious adverse events within 10 days); 30 days for recurring events that may lead to severe outcomes.
• Classification: events are categorized by severity — death, serious injury, minor injury, life-threatening, near adverse event, quality issue — with a decision-tree to help the licensee/HCR determine reportability.

Cross-market trap: SAHPRA's 48-hour public-health-threat clock rivals Brazil's 72-hour clock as the fastest in this set, and it runs on a determination trigger (when the serious-health-threat is determined), not merely awareness. For licensees still staging the SAHPRA call-up, the adverse-event duty is already in effect — establishment licensing activates the vigilance obligation regardless of whether a specific product registration has been called up.

What to Verify in the Original Text

• 21 CFR Part 803 — §803.3 (definitions), §803.10 (manufacturer 30-day), §803.30 (user facility), §803.40/§803.42 (importer), §803.50 (five-work-day): confirm the three-actor split, the death-to-FDA-and-manufacturer rule for user facilities, the importer's malfunction-to-manufacturer-only rule, and the calendar-vs-work-day distinction; cross-check the eMDR mandate and the Form 3500A requirement on FDA's mandatory-reporting page.
• EU MDR Articles 87(1),(3),(4),(5),(6),(7), 88, 89, 92: confirm the 2/10/15-calendar-day clocks, the causality gate, the incomplete-then-complete allowance, and the EUDAMED channel; read MDCG 2023-3 (rev. 2) for the awareness-date ("day 0") rule and the trend-reporting carve-out in Article 88.
• ANVISA RDC 67/2009: confirm the technovigilance trigger (death, SI, recurrence-risk malfunction/misuse, counterfeiting), the 72-hour in-country and 10-day foreign clocks, and the Notivisa/SNVS channel — then pull RDC 551/2021 for the field-action notification and consumer-alert rules.
• MoPH Notification B.E. 2563 (2020) and the Thai FDA HPVC guidance: confirm the responsible parties and the 10/30-day reporting structure, and which form each track (adverse event vs FSCA) requires.
• SAHPRA SAHPGL-MD-03 v4 (2024) and SAHPGL-MD-11 v1 + form GLF-MD-11A: confirm the licensee/HCR duty, the 48-hour / 10-day / 30-day structure, the event-classification decision-tree, and that the duty covers IVDs.

Practical Implications for a Global Vigilance System

If the same serious incident surfaces across all five markets, the binding constraints stack and they do not align: the EU wants a causality-gated MIR within 2/10/15 calendar days via EUDAMED, the US wants manufacturer/importer/user-facility MDRs on Form 3500A within 30 calendar days (or 5 work days) via eMDR, Brazil requires the BRH to file a Notivisa report within 72 hours for an in-country death or public-health threat, Thailand wants an awareness-date HPVC report on a 10- or 30-day clock, and South Africa wants a licensee/HCR report within 48 hours for a serious public-health threat. The single biggest planning errors are (1) treating these as one global "adverse event" with one deadline — Brazil's 72-hour and SAHPRA's 48-hour clocks will be breached before the EU's 10-day clock even starts; (2) mis-assigning the reporting entity — the US three-actor model, the EU manufacturer-only MIR, and the Brazil-BRH anchor are not interchangeable; and (3) confusing calendar days with working hours. Build a single global vigilance SOP that maps each jurisdiction's reporting entity, filing object, and clock unit separately, pre-clear the BRH relationship before any incident forces it, and treat the EU's causality determination and SAHPRA's threat-determination as distinct trigger events on the master timeline. On the data side, map your internal complaint / MDR database to the IMDRF adverse-event terminology codes (the global cross-border vocabulary) and keep an export path to the NCAR (National Competent Authority Report) format, so one incident record can feed Notivisa, EUDAMED, and MAUDE without re-keying.

Sources

• US FDA / eCFR, 21 CFR Part 803 — Medical Device Reporting: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-803 ; FDA, Mandatory Reporting Requirements: Manufacturers, Importers and Device User Facilities: https://www.fda.gov/medical-devices/postmarket-requirements-devices/mandatory-reporting-requirements-manufacturers-importers-and-device-user-facilities
• European Union, Consolidated Regulation (EU) 2017/745 on medical devices (MDR), Articles 87–92: https://eur-lex.europa.eu/eli/reg/2017/745/oj ; European Commission, MDCG 2023-3 (rev. 2) — Questions and Answers on vigilance terms and concepts: https://health.ec.europa.eu/document/download/af1433fd-ed64-4c53-abc7-612a7f16f976_en
• ANVISA, Resolução RDC nº 67, de 21 de dezembro de 2009 — Sistema Nacional de Tecnovigilância (technovigilance; published DOU 23/12/2009); Resolução RDC nº 551, de 30 de agosto de 2021 — ações de campo: https://www.in.gov.br/en/web/dou/-/resolucao-rdc-n-551-de-30-de-agosto-de-2021-341672897
• Thai FDA, Ministry of Public Health, Notification on preparation of reports on medical device defects or adverse events and field safety corrective actions, B.E. 2563 (2020) and Guidance for the Medical Device Industry: Reporting of Device Defects, Adverse Events and FSCAs: https://en.fda.moph.go.th/health-products-vigilance-center/documet-01
• SAHPRA, Guideline for Medical Device Vigilance: Adverse Events Reporting (SAHPGL-MD-03 v4, 13 December 2024): https://www.sahpra.org.za/wp-content/uploads/2024/12/SAHPGL-MD-03_v4-Guideline-for-Medical-Device-Adverse-Event-Reporting.pdf ; Guideline for Completing the Medical Device Adverse Event Form (SAHPGL-MD-11 v1): https://www.sahpra.org.za/wp-content/uploads/2024/12/SAHPGL-MD-11_v1-Guideline-for-Completing-Medical-Device-Adverse-Event-Form.pdf