Adverse Event Reporting Timelines: Choosing the 2-Day, 10-Day or 30-Day Tier

1. Key takeaways

MDS-REQ 11 V2.0 sets the reporting deadlines in three statutory tiers, all counted from the date the event occurs or becomes known: events constituting a serious public health threat must be reported within 2 days; events that may have directly or indirectly led to or contributed to death or serious injury must be reported within 10 days; any other impact outside the above must be reported within 30 days. A separate independent deadline also applies: when the NCMDR contacts a company for follow-up on an investigation, the company must reply within 5 days. These four figures do not substitute for one another, and a wrong tiering decision directly constitutes an overdue report. For Chinese manufacturers, the highest-frequency error is equating no deaths and no serious injuries with the 30-day tier, thereby missing the 2-day or 10-day tier.

• Serious public health threat: report within 2 days.
• Death or serious injury caused or contributed to: report within 10 days.
• All other impacts: report within 30 days.
• NCMDR investigation follow-up contacts: reply within 5 days, a standalone procedural red line.
• The clock starts on the awareness date, not on internal technical confirmation.

2. Legal basis

The three reporting tiers and the separate reply deadline all derive from the reporting timeframe provisions of MDS-REQ 11, anchored in the parent law and its implementing regulation, with the MD Reporting Form and the three reporting channels defined alongside.

3. Expert insights

1. The first two tiers are two different criteria, not light and heavy versions of the same thing. In MDS-REQ 11, a serious public health threat and an event that may have led to or contributed to death or serious injury are two parallel criteria pointing at different kinds of risk. The former looks at populations and systems: a sterilisation failure affecting one batch, the same software defect reproducing on every installed unit of the same version, the same failure mode appearing in volume on one model, these situations constitute a threat to public health even before any single personal injury has occurred, and they fall in the 2-day tier. The latter looks at individual outcomes: a single use that led to or contributed to a death or serious injury falls in the 10-day tier. The assessment should first ask whether the event is batch-wide, systemic and capable of spreading, and only then ask what the individual outcome is. Merging the two criteria effectively deletes the entire 2-day tier. When GRZAN reviews client incident ledgers, batch-wide character is screened as a separate first filter.

2. The starting point is awareness, not confirmation. The wording of the document is from the date the event occurs or becomes known. For a company, the operable and provable starting point is the awareness date: the day on which any internal role (sales, after-sales, quality, AR) receives information about the event. This means companies must build a registration system for the awareness date: a customer email received, a hospital complaint received, a distributor relay received, each should be logged immediately with the timestamp frozen. If the clock is started only after internal technical confirmation, the 2-day tier will almost certainly be missed. EU MDR Article 87 follows the same awareness logic, but its third tier is 15 days while Saudi Arabia allows 30 days; under the US FDA adverse event reporting system, deaths and serious injuries are 30 calendar days and events requiring remedial action 5 working days; under the Chinese NMPA system, death events are 7 days and serious injuries 20 days. The same multinational company runs three clocks simultaneously across jurisdictions, and trying to enforce the strictest one uniformly will instead produce missed 2-day reports; the correct approach is to run each jurisdiction independently.

3. The 5-day reply deadline is an independent procedural red line. Beyond the three reporting tiers, MDS-REQ 11 also provides that when the NCMDR contacts a company for follow-up on an investigation, the company must reply within 5 days. This clause is often overlooked because companies habitually treat it as cooperation with an investigation rather than a statutory deadline. It does not look at event severity, only at whether the reply came within 5 days; even if the event itself falls in the 30-day tier, failing to reply in time is an independent violation. In practice, NCMDR correspondence should be set as the highest-priority ticket, received locally by the AR and synchronised to the manufacturer’s quality lead, so that time zones and holidays do not consume the window.

The investigation and final report deadlines after a report are covered at https://www.grzan.cn/regulations/saudi/incident-investigation-and-final-report-deadlines-43 , and the notification and closure loop of FSCA at https://www.grzan.cn/regulations/saudi/field-safety-corrective-action-process-44 .

4. Practical recommendations

• Define the awareness date in the adverse event and complaint follow-up procedure, and require any role receiving event information to log a timestamp within 24 hours.
• Produce a one-page tiering decision table: first decide whether the event is batch-wide or systemic, then decide the individual outcome, then land on the 2-day, 10-day or 30-day tier, with a second person cross-checking the decision.
• Run the three tiers on a shortest-applicable-tier rule: whenever a case could straddle two tiers, start reporting on the shorter deadline.
• Agree forwarding deadlines for NCMDR and Saudi Vigilance correspondence in the AR agreement, so that the 5-day reply window is not swallowed by time zones and holidays.
• Pre-fill the fixed fields of the MD Reporting Form (device name, UDI-DI, model, batch or serial number, MDMA number, legal manufacturer) to compress report drafting to hours.
• Run an annual drill for the distribution and after-sales teams, walking a fictitious batch-wide event through the 2-day tier process and retaining the drill record.
• Maintain a multi-jurisdiction timing ledger in which Saudi Arabia, the EU, the US and China are each timed independently; using one set of dates to cover all jurisdictions is prohibited.

5. Verification checklist

• □ The procedure document defines the awareness date and requires logging within 24 hours
• □ The one-page tiering decision table has been issued and includes batch-wide character as the first question
• □ The shortest-applicable-tier rule is written into the procedure document
• □ A pre-filled template of the MD Reporting Form fixed fields exists
• □ A 5-day reminder mechanism for NCMDR follow-up replies is configured
• □ The AR has confirmed it can receive and immediately forward NCMDR and Saudi Vigilance correspondence
• □ A multi-jurisdiction independent timing ledger has been established
• □ The annual 2-day tier drill record has been archived

Regulatory information verified as of October 29, 2026.

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support for the Saudi Arabian market. Our team manages adverse event reporting and recall coordination with the SFDA National Center, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com