How to Report an EU Medical Device Concern

Regulation (EU) 2017/745 does not create one universal public complaint form for every medical-device concern. National competent authorities operate the reporting channels and decide how to assess the information they receive.

This guide helps you choose a route and prepare evidence. It does not decide whether a device is compliant.

First identify the kind of report

An incident or safety problem

An incident can involve a malfunction, deterioration in performance, use error linked to ergonomic features, inadequate supplied information, or an undesirable side effect. If the problem caused or could cause death, serious deterioration, or a serious public-health threat, it may meet the MDR definition of a serious incident.

Manufacturers have mandatory vigilance duties under Article 87. That does not prevent patients, users, or healthcare professionals from reporting a problem to an authority. Use the national authority’s incident route and contact a healthcare professional if the issue affects a patient.

A broader market-surveillance concern

Examples include a potentially misleading CE claim, missing economic-operator details, marketing outside an intended purpose, uncertain registration, or labelling that appears incomplete. These concerns may be sent to a competent authority’s market-surveillance or medical-device contact even when no individual adverse event occurred.

Describe them as concerns supported by evidence, not established violations.

Choose the competent authority

The right authority depends on facts such as where the incident occurred, where the device was made available, and which economic operator is responsible. Cross-border cases may involve cooperation between authorities.

Use the European Commission’s national competent-authority contact page and then follow the current instructions on the authority’s own website. Do not rely on an old article’s country table. Agency responsibilities and submission routes can change.

For example, the HPRA public reporting page explains the Irish route for patients and members of the public. Italy’s medical-device authority is the Ministry of Health, not AIFA, as the Commission contact list confirms.

EUDAMED is not a general public complaint portal. Its vigilance and market-surveillance modules support regulated workflows and authority coordination. Use the reporting route published by the national authority.

Prepare the evidence

Create a short chronology and evidence index:

• product and model name;
• legal manufacturer and other economic operators, if verified;
• UDI, catalogue, lot, serial, software version, or app version;
• CE mark and any four-digit notified-body number;
• where and when the product was obtained or seen;
• exact claim, label, output, malfunction, or incident;
• patient or user impact, without unnecessary personal data;
• screenshots, photographs, instructions, packaging, correspondence, and archived URLs; and
• the facts that remain unknown.

Keep original files. Record access dates and source URLs. If a screenshot is cropped for readability, preserve the full original as well.

Do not take or disclose documents unlawfully. A reporter dealing with employer records, trade secrets, patient data, or retaliation risk should obtain jurisdiction-specific advice.

Verify the economic operator

An app-store developer label may not identify the MDR legal manufacturer. Check the label, Instructions for Use, declaration of conformity, website legal notice, privacy notice, store seller details, and national business registry.

If the identity remains uncertain, say so. Do not select an authority or accuse an entity based on a guessed corporate relationship.

Use MDR citations carefully

Commonly relevant provisions include:

• Article 2 for definitions;
• Article 7 for misleading claims;
• Article 10 for manufacturer obligations;
• Article 13 and Article 14 for importer and distributor duties;
• Article 20 for CE marking;
• Article 27 and Article 29 for UDI and device registration;
• Article 52 for conformity assessment;
• Article 87 for manufacturer reporting of serious incidents;
• Articles 93 to 97 for market surveillance and corrective procedures; and
• Annex I, Section 23 for information supplied with a device.

Only cite a provision you can connect to a fact. A long list of article numbers does not strengthen an allegation.

Classification is an analysis, not a label

Software classification under Annex VIII Rule 11 depends on intended purpose, the decisions informed, and the possible impact of those decisions. Use the European Commission’s MDCG 2019-11 rev.1 guidance and explain missing facts. Do not infer Class III merely because software mentions a serious disease.

Check CE and notified-body claims in scope

The Commission’s notified-body page links to NANDO. A four-digit number must be checked against the applicable legislation and designation scope. A manufacturer may choose an appropriately designated notified body in another Member State.

An ISO 13485 certificate concerns a quality-management system. It is not, by itself, proof of MDR conformity assessment or permission to affix a CE mark.

Date EUDAMED claims

The first four EUDAMED modules became mandatory on 28 May 2026. The Commission publishes transition material for actors, UDI/device registration, notified bodies and certificates, and market surveillance.

A negative database claim needs the correct legal manufacturer, device identifier, search date, and applicable transition. Save the search record. “I could not find it” is not equivalent to “it is unregistered.”

Structure the submission

Use a simple format:

1. Purpose: what you are reporting and why the authority may be relevant.
2. Product: exact device, version, manufacturer, and identifiers.
3. Chronology: dated events and observations.
4. Evidence: numbered items with direct sources.
5. Regulatory questions: each linked to an observation and provision.
6. Risk: plausible patient or user impact, without exaggeration.
7. Unknowns: records or facts you could not verify.
8. Requested action: assessment and any action the authority considers appropriate.
9. Contact preference: whether and how the authority may contact you.

Avoid demanding a recall or penalty as though the evidence already proves the legal conclusion. The authority has investigative powers, access to records you do not have, and a duty to act proportionately.

What happens next

An authority may acknowledge the report, request details, contact the manufacturer, review documents, coordinate with another authority, inspect, test samples, or close the matter. The path depends on risk and evidence. There is no universal one-week or one-month outcome timetable.

Keep the confirmation and reference number. Send later evidence against the same record where possible.

MD Watchdog can structure a submitted concern, but sign-in is required. The platform does not currently guarantee reviewer availability, a filing, a processing time, or regulatory action. Direct authority reporting remains available.

Last checked against EUR-Lex, European Commission, EUDAMED, and HPRA public sources on 29 July 2026. This guide is general information and has not been approved by a lawyer or regulatory professional.