Malfunction Reporting Deadlines: The 15-Day and 30-Day Rules

1. Key takeaways

The deadline for a malfunction report in Japan is determined by two variables: the severity of the health damage, and whether the event is already described in the package insert (known versus unknown). The determination yields four tiers: death — 15 days; serious and unknown — 15 days; serious and known — 30 days; non-serious and unknown — periodic reporting. The clock starts on the day of awareness, not on the day the event occurred. Because the same event can fall into a different tier depending only on whether the package insert already describes it, keeping the insert current is itself part of meeting the deadline.

• Severity times known-or-unknown status produces the four reporting tiers.
• Death is always 15 days; serious unknown cases are 15 days; serious known cases are 30 days.
• Non-serious unknown events go into periodic reporting rather than individual reports.
• The start point is the day of awareness, so evidence of when the company first knew matters. An incomplete investigation never justifies a late report, because the regime is deliberately built around submitting first and completing the analysis afterwards.

2. Legal basis

The tier system described in the source guidance is anchored in the following provisions of the current framework (Act No. 145 of 1960) and in PMDA guidance materials. The same terms are reproduced here and should be checked against the current text before use in a live case.

1. PMD Act Article 68-10, paragraph 1: the duty to report malfunctions and related events.
2. Implementing Rules Article 228-20, paragraph 1: the classification of reportable events by severity and related categories; paragraph 2: depending on the degree of health damage that has occurred or may occur, reporting within 15 days or 30 days from the day of awareness, or submission as a periodic report.
3. PMD Act Article 68-13, paragraph 3: reports are submitted to PMDA.
4. PMDA public material, Post-marketing Safety Measures of Medical Devices: a deadline comparison table organized by degree of health damage crossed with whether the event is described in the package insert.
5. PMDA notification (PSB/PSD Notification No. 0115-2, January 15, 2024): malfunction report formats and the operation of deadlines, including the reporting determination for cybersecurity-related malfunctions.
6. Current legal framework: Act No. 145 of 1960.

3. Expert insights

Insight 1: the skeleton of the determination table is severity crossed with known status. According to the PMDA public material, for events of health damage where a link to the device cannot be denied, the deadlines are as follows: death, whether known or unknown, is 15 days; serious events other than death that are unknown (not described in the package insert) are 15 days; serious and known events are 30 days, reduced to 15 days where the incidence shows an otherwise difficult-to-understand rise; non-serious and unknown events fall into periodic reporting; and non-serious and known events in principle require no individual report. Read from the top down, the strictest deadline attaches to death regardless of documentation status, and the documented-versus-undocumented distinction then separates the remaining serious tiers.

Insight 2: the clock starts on the day of awareness, and an incomplete investigation does not excuse a late report. The PMDA notification makes this explicit: investigation activity should be conducted on the assumption that 15 days is the strictest applicable deadline; even if the investigation cannot be completed within the deadline, the deadline must be strictly observed, an incomplete report must be submitted based on the investigation results known at that time, and a follow-up report must be submitted afterwards. This establishes report-first-investigate-later as the operating principle. For the company, this means the investigation plan and the reporting plan must run in parallel from the day of awareness: the report goes out on the evidence available at the deadline, and the case file continues to be completed afterwards through the follow-up submission.

Insight 3: cybersecurity-related malfunctions follow the same rule set. The PMDA notification lists examples of cybersecurity-related events that may constitute reportable matters, including malfunction or functional abnormality caused by unauthorized access, networked devices stopped by DDoS attacks, and tampering with the settings of infusion pumps or insulin pumps. The determination still turns on Article 228-20, paragraph 2 of the Implementing Rules. In other words, a cyber incident is judged by its clinical consequence rather than by its technical cause: if the outcome is a malfunction or functional abnormality of the device, the ordinary malfunction determination applies.

4. Practical recommendations

• Turn the determination table into an internal four-tier triage tool. The input is severity plus known-or-unknown status against the package insert; the output is the deadline. Coding the tool around the four tiers keeps the determination consistent across staff and products.
• Design the investigation workflow around 15 days as the default strictest deadline. Submit an incomplete report on time even when the investigation is unfinished, and follow up later. Treating 15 days as the universal design assumption removes the risk of missing the shorter tier while a longer one is being assumed.
• Bring cybersecurity incidents into the vigilance workflow. Functional abnormality caused by exploitation of a vulnerability should enter the malfunction determination, with the same severity and known-status analysis as any other event.
• Make the awareness date traceable. The day of awareness should be supported by evidence such as emails and system timestamps, because the tier applied and the deadline met both depend on proving when the company first knew.

5. Verification checklist

• □ Does the triage tool cover the four tiers of severity times known status (15 days / 15 days / 30 days / periodic report)?
• □ Is the start point fixed as the day of awareness, with traceable records kept?
• □ Is the investigation workflow designed with 15 days as the default strictest deadline?
• □ Are cybersecurity-related events within the scope of the malfunction determination?
• □ Has the specific triage been finally re-confirmed against the current text of Article 228-20 of the Implementing Rules?

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, in-country representative and local testing support for the Japanese market. Our team manages adverse event reporting and recall coordination with PMDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com