Templates and records · ISO 13485 · Clause 8.2.3

Medical device serious incident report

What must be put in writing when a device may have caused or contributed to a death or serious deterioration in health: what was known, when, who it was reported to and what was done.

In one sentence

The serious incident report records the date on which the manufacturer became aware, the assessment of the causal relationship, the applicable deadline and the date of reporting to the authority, the investigation and any field safety corrective actions, because ISO 13485 requires documented procedures and records of reports to regulatory authorities (8.2.3) and Article 87 of the MDR sets maximum deadlines of 15 days, 10 in the event of death or unanticipated serious deterioration and 2 for a serious public health threat.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 13485 · Clause 8.2.3 Clauses are cited using the numbering of ISO 13485:2016, the current edition and the same one the Academy uses.
Type of information: Mandatory record Records of reports to the regulatory authority (8.2.3)
Who fills it in: Regulatory affairs With the person responsible for regulatory compliance; quality runs the technical investigation
When: As soon as the possible incident becomes known Deadlines run from awareness, not from the end of the investigation
How long it is kept: Product lifetime, at least two years ISO 13485 requires records to be kept for at least the lifetime of the device as defined by the manufacturer, and never less than two years from release (4.2.5); the MDR requires technical documentation to be available for ten years after the last device was placed on the market, fifteen for implantables (Article 10(8)).

What the standard requires

What ISO 13485 demands and what it leaves to your judgement

Where regulations require complaints meeting certain criteria to be reported or advisory notices to be issued, ISO 13485 requires a documented procedure for doing so and a record of each report to be kept.

In the EU, Article 87 of the MDR sets the deadlines: immediately after establishing a causal relationship or its reasonable possibility, and never later than 15 days after becoming aware of the incident. The deadline drops to 10 days in the event of death or an unanticipated serious deterioration in health, and to 2 days for a serious public health threat.

An incomplete initial report can be submitted to meet the deadline and completed later. The investigation and field safety corrective actions are coordinated with the competent authority.

Read it in context: Measurement, analysis and improvement, in the ISO 13485 Academy

Structure

Fields the template should include

Originating complaint or source
Date and time the manufacturer became aware
Description of the incident and consequences for the patient
Device, batch or serial number and UDI
Assessment of severity and causal relationship
Applicable deadline: 2, 10 or 15 days
Competent authority notified, date and reference
Follow-up and final reports
Field safety corrective action and field safety notice, if any
Link to the CAPA and to risk management

Example

Example: report for a catheter breakage

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Source	COMP-2026-071 · call from a hospital on 2 June 2026
Incident	Tip retained after insertion; endoscopic removal; patient recovered
Device	Uroflex catheter size 12 · batch UF12-26-0390 (fictitious)
Assessment	Serious deterioration in health, not unanticipated: 15-day deadline
Report	Initial report to the competent authority on 9 June · reference NI-26-0451
Investigation	Retained samples from the batch: tensile strength below the minimum in 2 of 20
Safety action	Recall of batch UF12-26-0390 with a field safety notice to 34 sites
Closure	Final report on 21 July · CAPA-2026-015

At the audit

Mistakes auditors commonly flag

No record of the date the manufacturer became aware, so compliance with the deadline cannot be shown.
Waiting for the investigation to finish before reporting.
The decision not to report is not justified.
Distributors who receive the incident and do not pass it on to the manufacturer in time.
The risk management file is not updated after the incident.

In Kimobox

How this record is kept in Kimobox

1Post-market surveillance is managed with regulatory reporting alerts.
2Each complaint is linked to its batch, its cause and its action.
3Batch and UDI traceability shows who received the affected batch.
4The corrective action follows its route of root cause, action and verification of effectiveness.

Frequently asked questions

What people ask us before getting started

What is a serious incident?

The MDR defines it as an incident that directly or indirectly led, might have led or might lead to the death of a patient, user or other person, a temporary or permanent serious deterioration in their state of health, or a serious public health threat.

What about incidents that are not serious?

They are not reported individually, but they count towards trend reporting under Article 88: a statistically significant increase in their frequency or severity that could affect the benefit-risk analysis must also be reported.

Keep your ISO 13485 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring