Vigilance and Adverse Event Reporting for Medical Devices in Iran

1. Key takeaways

Iran requires medical devices to be continuously monitored after they are placed on the market, and adverse events that occur during use must be reported to the competent authority. The executing party for these obligations is the local authorised representative or the importing company, not the foreign manufacturer acting on its own account. GRZAN’s assessment is that the real difficulty of a vigilance system lies not in the question of whether to report, but in keeping information flowing in both directions. Whether the manufacturer can promptly learn about adverse events that occur inside Iran is the precondition on which the entire system depends. If the manufacturer never hears about an event, no reporting timeline, however strict, can actually be met, because the obligation to compile and submit a report sits with a party that holds the technical knowledge, while the information sits with another party that holds the market presence. Mandatory notification obligations and minimum notification timelines must therefore be written into the agency contract from the outset, so that the local party is contractually bound to pass every adverse event to the manufacturer without delay and without filtering.

2. Legal basis

1. Post-market vigilance obligations: the local authorised representative or the importing company bears the in-country obligations of vigilance and adverse event reporting — see public industry sources; the official Iranian document number has not been published through public channels, and this is a practical estimate. Companies should therefore treat the allocation of responsibility described here as settled practice rather than as a provision anyone can cite from an official gazette, and should confirm the allocation in writing with the local party at the moment the agency relationship is created.
2. Rapid reporting timeline for serious events: public industry sources refer to the practice of reporting serious events within 72 hours — this timeline does not appear in any unified text published officially by Iran, and it is a practical estimate. The actual timeline is governed by the registration approval documents issued for the product concerned, or by the requirements of the competent authority in the specific case. Companies should consequently not hard-code the 72-hour figure into procedures as a statutory deadline, but should confirm the applicable timeline for each product against its own approval documents and against any instruction the authority gives in an individual case.
3. Law on the Administration of Medical, Pharmaceutical, Food and Beverage Affairs, FAOLEX LEX-FAOC227692, dated 1955-06-20, Article 3 and Article 11. This law is the general statutory backdrop against which the vigilance obligations described above operate, and it is the reference point to cite when the contractual allocation of duties needs to be anchored to a legal instrument.

3. Expert insights

Insight one: the separation between the responsible party and the source of information is an inherent tension of this system. The reporting obligation rests with the local entity, while the technical capability to judge whether an event is reportable, how serious it is, and how it should be described rests with the manufacturer. If the contract does not stipulate a notification obligation, the manufacturer may only learn of an adverse event after the regulator has already intervened, and at that point the window for proactive handling has already been lost. What could have been an orderly, well-documented report becomes a defensive explanation delivered under pressure, and the difference between those two situations is visible to the authority.

Insight two: the practical estimate character of the timelines requires companies to set stricter internal standards. Because the official timeline has not been uniformly published, GRZAN recommends that companies enforce a stricter internal timeline (for example, initiating an internal evaluation within 24 hours for serious events) so that late reporting caused by differences in interpretation can be avoided. An internal standard that is tighter than any external expectation leaves a margin of safety no matter which timeline the authority ultimately applies, and it converts an open-ended interpretation question into a fixed internal deadline that staff can actually follow.

Insight three: vigilance data is an evidence asset for subsequent registration work and change filings. Systematically maintained vigilance records will support renewal applications, change filings, and submissions for additional models, because they document how the product has behaved in real use over its whole market life. Companies that treat vigilance purely as a compliance burden waste the evidentiary value of this data, which has already been generated at cost and can be reused in later regulatory submissions instead of being locked in a folder that nobody opens until an authority asks for it.

4. Practical recommendations

1. Write mandatory notification clauses into the contract: define the scope of notifiable events, the minimum notification timeline, and the designated contact persons on both sides, so that the flow of information does not depend on goodwill or on whoever happens to be available when an event occurs.
2. Keep internal timelines stricter than the external practical estimate: initiate an internal evaluation within 24 hours for serious events, and only then decide on the external reporting step, so that the company always has a considered position before any deadline set by the authority begins to run.
3. Establish event classification criteria: grade events by severity, and attach a corresponding reporting and handling process to each grade, so that the response is proportionate and predictable and staff do not have to improvise a decision path in the middle of an incident.
4. Archive and reuse vigilance data: file records by model and by batch, so that they can serve as evidence in renewal and change filings rather than remaining locked in a reporting folder, and review the archive periodically to keep it retrievable.

5. Verification checklist

• □ The agency contract contains a mandatory adverse event notification obligation and a minimum notification timeline
• □ Internal reporting timelines stricter than the external practical estimate have been established
• □ Event classification criteria and the corresponding handling processes have been established and trained
• □ Vigilance records are archived by model and by batch
• □ The official reporting timeline applicable to this product has been confirmed, based on the registration approval documents

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Iranian market. Our team manages adverse event reporting and recall coordination with IFDA, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com