India’s pharmaceutical quality conversation has spent two years focused on factories — batch releases, site inspections, and the revised Schedule M. Yet a parallel patient-safety system has been quietly expanding next to it, and it covers products that are never tablets or capsules: medical devices.
In September 2026, the Indian Pharmacopoeia Commission (IPC), working with WHO India and other national stakeholders, published an updated framework for how hospitals must monitor and report medical device incidents. For international buyers, importers, and hospital procurement teams, the document is worth reading closely — because it defines the paper trail that should exist behind every device in a supply chain.
🔬 What Is Materiovigilance, and Why It Matters Now
Materiovigilance is India’s system for tracking harm caused by medical devices after they reach the market. It runs through the Materiovigilance Programme of India (MvPI), launched in 2015. The IPC in Ghaziabad serves as the National Coordination Centre; the Sree Chitra Tirunal Institute for Medical Sciences and Technology (SCTIMST) in Thiruvananthapuram is the National Collaborating Centre; and CDSCO acts as the regulator.
The system has grown substantially. As of September 2026, MvPI reports having established 775 Medical Device Adverse Event Monitoring Centres (MDMCs) nationwide, according to the updated guidance document (“Guidance Document for Hospitals in India for Safety Monitoring and Reporting of Medical Device-Related Incidents/Adverse Events,” Version 1.3).
Two things make this timely. First, the guidance itself was revised in September 2026 and substantially widens what hospitals are expected to report. Second, and more importantly for buyers, the scale of reported harm is rising. Reporting by Bhaskar English on 6 November 2026 indicates that medical device-related serious harm cases rose from 808 in 2020 to over 2,000 in 2025 — roughly a tripling in five years.
Note on the data: the 808-to-2,000 figure is single-source in our review. Treat the direction of travel (a steep multi-year increase) as more reliable than the exact 2025 total, which may be revised as reporting matures.
📋 What Hospitals Are Now Asked to Report
The most consequential change is the widening of the reporting trigger. Under Version 1.3 of the guidance, hospitals are expected to report suspected Medical Device Adverse Events (MDAEs) even where a definitive causal link to the device has not been established.
“Early reporting of suspected events facilitates timely assessment, investigation, signal detection, and implementation of appropriate corrective or preventive measures to enhance patient and user safety.”
The guidance explicitly covers incident types that are easy to miss if you think of “adverse events” only as patient injuries:
- Device malfunction or deterioration in performance
- Incorrect or out-of-specification test results produced by a device
- Design flaws
- Labelling inaccuracies
- Use errors (human factors)
- Serious public health threats
- Near misses and performance failures — events that did not cause harm but could have
Where there is uncertainty about whether an incident qualifies for reporting, the guidance advises hospitals to report it anyway. That is a deliberate bias toward over-reporting, and it is the single most important cultural shift in the document.
⏰ The Reporting Timelines: 15 Days and 30 Days
Two clocks now govern hospital reporting. Getting these right matters, because the same timelines appear as legal obligations in the Medical Devices Rules, 2017 (MDR 2017) for licence holders — unlike the hospital guidance, which is programmatic rather than a licence condition.
15 calendar days
- Serious adverse events involving death or serious deterioration in health must be reported to MvPI within 15 days.
- Suspected unexpected serious adverse events must be reported to the concerned licensing authority within 15 days.
The statutory anchor for that second duty is Rule 26(ii) of MDR 2017, which requires Indian manufacturers (holding licences in Form MD-5, MD-6, MD-9 or MD-10) to inform the State or Central Licensing Authority of any suspected unexpected serious adverse event and the action taken on it, including any recall, within 15 days of the event coming to the licence holder’s notice.
30 calendar days
- Non-serious events that did not cause and could not have caused serious harm should be reported within 30 days.
Immediate
- A recall or Field Safety Corrective Action (FSCA) must be notified to the authority immediately on the decision to act, under Rule 89 of MDR 2017.
- Import licence holders (Authorised Agents) must stop despatch and marketing of an affected device in India immediately (Rule 38(1)(iii)).
🏥 Active Surveillance and the Nodal Officer Model
Beyond passive reporting, the guidance asks hospitals to build organisational capacity:
- Appoint a nodal officer or establish a Medical Device Adverse Event Monitoring Centre (MDMC) where applicable.
- Maintain records of device-related incidents, preventive maintenance, and calibration.
- Conduct a structured root cause analysis (RCA) for all significant or recurrent adverse events.
- Implement corrective and preventive actions (CAPA), then monitor those actions for effectiveness.
- Run regular training for clinical, nursing, and biomedical engineering teams.
- Apply active surveillance to critical and life-saving devices used in intensive care, cardiology, neurosurgery, oncology, and emergency settings.
- Display monitored device lists in the relevant clinical departments, with designated personnel accountable for monitoring and reporting.
The emphasis on active surveillance for high-risk devices is the practical heart of the guidance. Passive reporting systems systematically under-capture events in exactly the settings where failure is most dangerous.
📱 How to File a Report: The MDAE Form and MvPI Channels
All parties use the same Medical Device Adverse Event (MDAE) reporting form, published on both the CDSCO and IPC websites. Manufacturers, importers, distributors, healthcare professionals, and patients can all submit reports.
The form captures fields that matter for traceability:
- The device’s Indian risk class (A to D)
- Model number
- Lot or serial number
- Software version
- A description of the event and the patient outcome
- The manufacturer’s assessment
Completed forms go to the nearest MDMC or directly to NCC-MvPI. IPC also operates a toll-free helpline, 1800-180-3024, and accepts reports by email. Digital reporting runs through IPC’s Adverse Drug Reactions Monitoring System (ADRMS).
The detail worth flagging for buyers: software version is an explicit field. As hospitals adopt connected devices, implants, in-vitro diagnostics, AI-enabled tools, and software as a medical device (SaMD), firmware and model-software combinations become a genuine traceability axis — and a frequent source of mismatch between what a hospital thinks it deployed and what a supplier actually shipped.
🔍 What This Means for Importers and International Buyers
If you buy Indian-manufactured devices — or import devices into India — this framework creates documentation you should be able to request and verify. The reporting duty sits with the licence holder, but the underlying evidence sits with the manufacturer.
- Ask for the vigilance SOP, not just the certificate. A WHO-GMP or ISO 13485 certificate proves a quality system exists. It does not show how adverse events are captured, triaged, and reported within 15 days.
- Confirm who files. For Indian-manufactured devices, that is the licence holder under Rule 26(ii). For imports, it is the Authorised Agent under Rule 38(1)(ii) — who must also report foreign regulatory actions (withdrawals, restrictions, cancellations, not-of-standard-quality declarations) within 15 days.
- Check the recall pathway. Rule 89 requires immediate withdrawal and notification. Ask a supplier to describe their last FSCA end-to-end: decision, notification, customer contact, and effectiveness check.
- Verify lot-level traceability. The MDAE form asks for lot or serial number and software version. If a manufacturer cannot resolve a complaint to a specific lot and software revision, their vigilance system is nominal rather than functional.
- Review PSUR obligations where relevant. Devices approved without a predicate (Form MD-27 permission) require PSURs every 6 months for two years, then annually for two more years, due 30 days after each period ends.
- Source through verified intermediaries. Counterfeit and grey-market devices defeat vigilance entirely, because nobody can trace an event back to a legitimate batch. For a list of verified and reliable pharmaceutical distributors, refer to the IMSDA’s verified member directory.
✅ A Practical Buyer’s Checklist
- ✅ Manufacturing licence number obtained and cross-checked with the issuing State or Central Licensing Authority
- ✅ Device risk class (A/B/C/D) confirmed in writing and matched to the licence scope
- ✅ Named vigilance contact supplied, with an escalation path beyond the sales contact
- ✅ Written confirmation that serious adverse events are reported within 15 days
- ✅ Recall and FSCA procedure supplied, with a recent worked example
- ✅ Lot/serial number and software version recorded on every shipment
- ✅ Complaint handling records available for review on request
- ✅ For imported devices: Authorised Agent identified and their Rule 38 obligations acknowledged
- ✅ PSUR schedule confirmed for no-predicate devices
- ✅ Distributor legitimacy verified
⚠ Common Misconceptions to Avoid
- “We have ISO 13485, so we are covered.” Certification audits sample the vigilance process; they do not guarantee every reportable event reaches the regulator inside 15 days.
- “No causal link means no report.” The guidance explicitly asks hospitals to report suspected events and to report when uncertain. Requiring proof of causation before filing suppresses exactly the signals the system exists to catch.
- “Vigilance is the hospital’s problem.” For licence holders, the 15-day duty under Rule 26(ii) and Rule 38(1)(ii) is a legal obligation attached to the licence, not a courtesy to the hospital.
- “Reporting to MvPI discharges all duties.” MvPI reporting does not replace obligations under MDR 2017. A licence holder can satisfy one channel and still be non-compliant overall.
💡 Final Thoughts
India’s device-safety architecture is maturing along the same trajectory as its pharmaceutical quality regime: from documentation that exists on paper to documentation that reflects what actually happened. Version 1.3 of the MvPI hospital guidance is a meaningful step, because it lowers the threshold for reporting, sets enforceable clocks, and pushes active surveillance into the highest-risk clinical areas.
For buyers, the practical takeaway is straightforward. A supplier’s vigilance system is a leading indicator of how they will behave when something goes wrong. Ask for it before you place the order, not after the first recall.
For more information, contact IMSDA at contact@indiamedicine.org.