Vigilance and Adverse Event Reporting under SAHPGL-MD-03

1. Key takeaways

South Africa’s medical device vigilance system is governed by SAHPGL-MD-03, the SAHPRA guidance on vigilance covering the reporting of adverse events by establishment licensees and holders of certificates of registration (HCR), of which the current version is v4, dated 13 December 2024. Reporting timelines are set in three tiers: a serious public health threat must be reported within 48 hours; death or serious injury within 10 calendar days; and an event whose recurrence could lead to death or a serious deterioration in health within 30 days. The obligation to report rests on establishment licensees and holders of certificates of registration (HCR), using form GLF-MD-11A, submitted through the SAHPRA medical device vigilance mailbox. Because no product registration numbers have yet been called up in South Africa, it is the establishment licence that activates these vigilance duties in practice, making this guidance one of the most concrete expressions of the principle that holding no registration number does not mean carrying no obligations.

2. Legal basis

3. Expert insights

Insight one: the starting point of the assessment is whether the device is suspected to have contributed, not whether causation has been confirmed. The decision tree in Annex 1 of SAHPGL-MD-03 opens with the question of whether the device, including an IVD, is suspected to have contributed to the event. As soon as the answer is affirmative, the reporting assessment process begins, and no completed root cause investigation is required first. This mirrors the logic of Article 29 of the Macao, China framework, under which notification is due upon knowledge or suspicion of an event — reporting first and investigating afterwards is the only safe approach.

Insight two: the three timeline tiers are triggered by independent conditions and must be assessed item by item. The branches of the decision tree ask whether the event constitutes a serious public health threat (leading to 48 hours), whether it led to death or serious injury (leading to 10 calendar days), and whether recurrence could lead to death or serious injury (leading to 30 days). A single event can fall into more than one tier at the same time, and in that case the shortest timeline applies. Compliance teams should therefore never stop at the first branch that matches.

Insight three: the exemptions are set out in four defined categories, but the conditions for applying them are strict. Annex 2 lists the exemption rules, for example: a device defect identified by the user before use (although the exemption does not apply if the device has already been used); an adverse event resulting purely from the patient’s condition; a failure occurring beyond the expected lifetime or shelf life of the device (provided the failure mode is not abnormal); and the correct functioning of a protective feature. The common premise of all these exemptions is that the device performed as intended and no harm occurred — as soon as harm is involved, the exemption no longer holds.

Insight four: reports are divided into initial, follow-up and final reports, and incomplete information is permitted. SAHPRA makes clear that an initial report is the information first submitted by the licensee or HCR, which may be complete or incomplete and must be supplemented subsequently; a follow-up report adds information that was not previously available; and a final report is the last report in the sequence. This design removes the justification of delaying a report because information is incomplete — incomplete information is not a reason for late reporting.

Insight five: vigilance duties are not waived because a product has not yet been called up for registration. South Africa currently has no product registration numbers, but the establishment licence itself activates the vigilance obligations. SAHPGL-MD-03 defines the obligated parties as the establishment licensee and the holder of a certificate of registration (HCR), and the slash indicates that the two stand side by side rather than as alternatives. This is the most specific illustration of the principle that having no registration number does not equal having no obligations.

4. Practical recommendations

1. Establish a 48-hour duty roster and escalation chain: serious public health threats come due first, so the reporting chain must work outside office hours.
2. Assess the decision tree branch by branch, not just one tier: when several tiers are triggered, apply the shortest timeline.
3. Report first even when information is incomplete: the initial report is expressly allowed to be incomplete.
4. Verify the exemption rules in Annex 2 line by line: never extend the exemptions by private interpretation.
5. Submit GLF-MD-11A with one form per device: and retain the submission timestamp as evidence.
6. Integrate the vigilance process with complaint handling: complaints are the primary source of reportable events.

5. Verification checklist

• □ The current text of SAHPGL-MD-03 v4 (13 December 2024) has been obtained
• □ The obligated reporting parties are clearly defined (licensee and HCR standing side by side)
• □ All three timeline tiers are configured: 48 hours, 10 calendar days, 30 days
• □ The Annex 1 decision tree has been incorporated into the SOP and is applied item by item
• □ The four exemption categories in Annex 2 have been understood and applied correctly
• □ The GLF-MD-11A form and the submission channel are in place (one form per device)
• □ Processes for initial, follow-up and final reports have been established
• □ The vigilance process has been connected with the complaint handling mechanism

Regulatory information verified as of 29 October 2026. The regulations, guidance and effective dates described in this article are limited to the official sources listed in the legal basis section above as published on that date; where official documents have been updated, the most recently published version prevails.

• Local resources in South Africa: GRZAN assists manufacturers from the Chinese mainland and other markets with SAHPRA medical device establishment licence (MDEL) applications and product registration preparation, including authorised representative (AR) scheme design, ISO 13485 certification pathway planning and CAB selection, GMDN coding and classification determination, technical documentation, and the setup of vigilance and adverse event notification mechanisms.
• Service capabilities: product attribute determination and risk classification (Class A, B, C, D), establishment licence applications and renewals, reliance pathway argumentation, technical documentation and essential principles conformity argumentation, labelling and instructions for use localisation in English, and support for post-market vigilance and annual compliance submissions.
• Contact: info@grzanglobal.com; hito.lin@grzan.cn; website www.grzan.cn.