21 CFR 803Medical Device Reporting

21 CFR Part 803 is FDA’s Medical Device Reporting (MDR) regulation, implementing section 519 of the Federal Food, Drug, and Cosmetic Act. It creates a uniform process for postmarket reporting when a device may have caused or contributed to a death or serious injury, or when a malfunction would likely cause or contribute to such outcomes if it recurred. The rule is central to FDA’s postmarket surveillance program and a core patient-safety safeguard.

The regulation assigns distinct responsibilities to manufacturers, importers, and device user facilities, and it prescribes strict timelines. Manufacturers generally have 30 calendar days from becoming aware of a reportable event to file a Medical Device Report, with a 5-day clock when immediate remedial action is needed to prevent an unreasonable risk of substantial harm. Importers and user facilities have parallel duties tailored to their roles in the supply and care pathways.

MDR has evolved to require electronic submissions, enabling faster detection, triage, and trend analysis across the national device ecosystem. eMDR minimizes transmission errors, standardizes data structures, and supports more efficient signal detection. The reporting discipline it enforces—complaint intake, investigation, and timely, standardized reporting—also strengthens manufacturers’ broader quality systems.

In practice, MDR intersects with the fundamentals of device lifecycle oversight. Classification, indications for use, and technological characteristics influence event profiles and reportability thresholds, so teams should align MDR procedures with device risk categories and controls established during development. Early-stage planning that ties reportability logic to your risk management and complaint-handling processes will reduce last-minute decisions and missed deadlines.

If your portfolio spans legacy and newly introduced devices, maintain device-specific MDR decision trees that incorporate known failure modes and clinical contexts. This approach keeps reporting criteria clear and repeatable as your products evolve, and it anticipates where new signals might surface following design changes, field actions, or broader shifts in clinical practice.

For teams navigating portfolio expansion or technology transitions, reference points in product strategy—such as class, controls, and predicate performance—should feed directly into MDR procedures. Resources on device risk stratification and design stages, including medical device classification and medical device development phases, are helpful orientation aids when tailoring reporting logic.

21 CFR 803 applies to U.S. device manufacturers, specification developers, repackagers, relabelers, and remanufacturers; to importers bringing devices into U.S. commerce; and to device user facilities, including hospitals, nursing homes, and ambulatory surgical facilities. Distributors that are not importers have separate complaint-handling obligations but are not MDR reporters under this part unless they also fall into one of the defined roles.

Manufacturers must investigate each complaint that may be an MDR reportable event and submit electronic reports to FDA within the specified timeframes. Importers must submit to FDA reports of deaths and serious injuries and must forward malfunction complaints to the manufacturer. Device user facilities must report device-related deaths to FDA and the manufacturer, and serious injuries to the manufacturer, within ten work days, or to FDA if the manufacturer is unknown.

Combination products are covered through role-based requirements, with reporting coordination governed by 21 CFR Part 4. When the primary mode of action is device-led, device MDR obligations predominate; when drug- or biologic-led, reporting coordination must still ensure that device-related events reach the appropriate center using device MDR pathways when required.

Global firms should delineate U.S.-specific MDR duties from other jurisdictions’ vigilance rules and document the handoffs between affiliates, importers, and authorized representatives. Clear contracts and procedures should specify who triages complaints, who determines reportability for U.S. MDR, who files, and how evidence is shared across borders without delaying U.S. submissions.

Because the regulation binds multiple actors, each organization should map its operational triggers: when a field service note becomes a complaint, when a hospital letter becomes an MDR event, and which team owns timeline control. Practical flowcharts and role matrices prevent errors when staff rotate or when escalation occurs outside normal business hours.

When in doubt about role assignment, revert to the regulation’s definitions. A specification developer that directs design and controls labeling is a manufacturer for MDR purposes, even if contract sites perform fabrication. Similarly, an importer that initially receives a device in the United States is responsible for its importer MDR duties, regardless of later distribution arrangements.

Mapping these requirements to your internal structure ensures a single source of truth for reporting accountability. If multiple entities could qualify for a role, document the rationale for the final assignment and train staff accordingly to keep reportability decisions consistent and defensible.

For mixed-product portfolios, align combination product reporting using 21 CFR Part 4 to avoid gaps or duplications. Well-structured agreements between constituent-part manufacturers can prevent delays when shared investigations and coordinated narratives are necessary.

Reportability depends on precise MDR definitions. An event is reportable when information reasonably suggests that a device may have caused or contributed to a death or serious injury, or when a device malfunction would likely cause or contribute to a death or serious injury if it were to recur. Serious injury generally means an injury or illness that is life-threatening, results in permanent impairment or damage, or necessitates medical or surgical intervention to preclude such permanent impairment or damage.

Causality does not require certainty. The threshold is whether the information reasonably suggests device involvement or a malfunction with foreseeable severe outcomes. Manufacturers must investigate complaints to determine whether they meet MDR criteria. If evidence subsequently clarifies non-reportability, that conclusion should be documented in the complaint file with a clear rationale and supporting data.

The 5-day report is triggered when remedial action is required to address an unreasonable risk of substantial harm to public health, or when FDA specifically requests 5-day reporting for a class of events or an ongoing situation. The 30-day report applies to all other reportable events. Supplemental reports are required when significant new information becomes available after an initial submission.

Malfunctions that are corrected before harm occurs may still be reportable if the failure mode, under similar circumstances, would likely lead to a death or serious injury should it recur. Conversely, events driven solely by user error may be non-reportable if no device failure was involved; however, distinguishing design-use interface issues from isolated misuse requires careful analysis and sound human factors evidence.

When uncertainty persists, document the decision logic and consider conservative reporting to avoid late submissions. Where an event evolves—for example, an initially non-serious injury progressing to a serious outcome—file promptly once the threshold is met and follow with supplements as necessary.

If investigation indicates a broader safety signal, initiate appropriate field actions and ensure consistency between MDR narratives and any recall strategy, classification, and effectiveness checks documented under FDA’s recall framework. Cross-functional alignment between complaint handling, MDR, and recall classification reduces contradictions that inspectors often flag.

Effective MDR programs start with complaint intake. Every plausible device-related communication—phone call, service note, online post, distributor email, or literature reference—must be captured promptly and assessed for potential reportability. Intake forms should solicit clinical outcome, device identification (including UDI), lot or serial number, and a clear event narrative.

Triage and evaluation determine whether the event meets MDR thresholds. A structured decision tree speeds consistent outcomes: did a death or serious injury occur, and if not, would the described malfunction likely cause such an outcome if it recurred? Engineering, clinical, and regulatory staff should collaborate quickly, and the team should document both the determination and its basis.

For reportable events, FDA requires electronic submissions through its Electronic Submissions Gateway using the eMDR format. Submissions include standard data elements aligned to the Form 3500A structure: patient and device problem codes, device identifiers, model and lot details, manufacturer narrative, and corrective or remedial actions taken. After transmission, firms should monitor acknowledgments to verify acceptance and address any rejects without delay.

Supplemental reports follow when new, material information emerges after an initial filing, such as confirmed device analysis, additional clinical outcomes, or revised root cause. Ensure your process explicitly links supplemental submissions to the original report and that internal stakeholders can see a single, coherent case file.

Modern quality systems embed MDR within complaint management so evidence, samples, photos, service logs, and risk assessment are preserved with strong data integrity controls. Align digital records with device histories and lot genealogy to simplify follow-up analysis and to support escalation to field action when necessary.

Teams that rely on structured data models and standardized code sets reduce corrections and speed release. Integrating device history and UDI into the MDR workflow also strengthens production-to-postmarket traceability, which is especially valuable for distributed or configurable platforms.

Electronic device histories and postmarket case files can be unified so the MDR narrative precisely reflects the technical and clinical facts. Capabilities like eBMR/eDHR and traceability make it easier to reconstruct the sequence of events and substantiate conclusions during inspections.

Timeliness is the core compliance risk in MDR. Manufacturers must file within 30 calendar days of becoming aware of a reportable event, and within 5 work days when remedial action is required to address an unreasonable risk of substantial harm to public health or when FDA so requests. Importers and user facilities have distinct timelines and destinations for their reports that must be reflected in procedures and role matrices.

FDA requires electronic submissions via the Electronic Submissions Gateway. Manufacturers and importers transmit eMDR packages that reflect the fields of Form 3500A, while user facilities still use distinct reporting channels for their role. After submission, firms must monitor acknowledgments to confirm acceptance and address any data issues immediately.

Supplemental reports are required when new, material information becomes available. Firms should track open supplements and tie them to the original submission to maintain a coherent regulatory record. Where the investigation extends beyond initial deadlines, file on time with the available facts and follow with supplements rather than waiting for complete root cause confirmation.

Because date calculations can be subtle across weekends, holidays, and time zones, automate deadline control, reminders, and escalation to ensure timely submission. Integrating alerts with case milestones keeps reports moving when handoffs occur between engineering, clinical, and regulatory teams. Tools that provide configurable notifications are useful for sustaining on-time performance.

Finally, verify that your submission credentials, contact details, and technical configurations stay current. Lapses in gateway certificates, changes in company names, or outdated contacts can delay acceptance and push otherwise compliant investigations into late-submission territory.

Two procedural pillars support MDR compliance. First, 21 CFR 803.17 requires written procedures for complaint intake, evaluation, reportability determination, and submission, including how to obtain and evaluate device and patient information and how to ensure timely reporting. Second, 803.18 mandates records that are complete, legible, and readily retrievable, covering investigations, decisions, and communications with FDA, importers, and user facilities.

Retention expectations are specific: firms must maintain MDR files for the longer of two years from the date of the event or the expected life of the device. Records must allow FDA to reconstruct the decision-making process, including who performed evaluations, what evidence was considered, and the rationale for reportability or non-reportability. Keep complaint files and MDR files cross-referenced to avoid gaps.

While MDR focuses on individual case reporting, trend vigilance is a quality-system imperative. Complaint trending informs risk management and corrective actions. Patterns of malfunctions that are individually non-reportable may still demand design changes or field corrections. Integrate MDR case data with your Corrective and Preventive Action system to ensure systemic issues are resolved and verified effectively.

The ongoing transition to FDA’s Quality Management System Regulation aligns device quality expectations more closely with ISO 13485. Harmonizing complaint handling, CAPA, and MDR procedures now will minimize rework during inspections and help demonstrate effective postmarket surveillance under both current 21 CFR 820 and the evolving framework.

Ensure your SOPs address training, role-based access, and periodic effectiveness checks. Auditors will expect to see that procedures are not only current and controlled but also used in practice, with metrics showing timely submissions, supplement closure discipline, and effective escalation into CAPA when indicated.

Linking MDR case management to quality planning reduces friction when regulators probe cross-functional coherence. For current expectations and the trajectory toward ISO 13485 alignment, see FDA’s QMSR initiative and remain conversant with legacy 21 CFR 820 while monitoring the FDA QMSR transition. Embedding MDR feedback into CAPA with automated routing, such as audits and CAPA auto-routing, closes the loop.

MDR errors tend to cluster around intake discipline, decision logic, and documentation sufficiency. The root cause often lies in uneven training, ambiguous procedures, and handoffs that disconnect engineering findings from regulatory timelines. The consequences are predictable: late submissions, incomplete narratives, and inconsistent statements across complaint files, MDRs, and recall documentation.

A second risk area is the failure to integrate device identification and traceability into the MDR record. Without reliable UDI, model, and lot data, investigations stall and subsequent supplements proliferate. Similarly, omitting the manufacturer’s evaluation or corrective actions leaves reviewers without the context needed to interpret the event or to connect it to broader trends.

Finally, many firms underestimate the operational significance of the 5-day report. If your triage process does not quickly flag remedial actions intended to address substantial public health risks, day-zero can pass without the necessary escalation, pushing the report outside the compressed window.

• Treat all plausible safety signals as complaints on receipt, not after technical review. Build a fast triage path for potential MDRs.
• Document non-reportability rationales with objective evidence. Inspectors will look for clear logic, not conclusions without data.
• Capture device identifiers, UDI, and lot details up front. Missing identifiers lead to rejected submissions and investigation delays.
• Do not conflate field corrections with MDR timing. File on time with current facts, then supplement as evidence matures.
• Use standard device and patient problem codes. Free-text only narratives increase rejection and slow data analysis.
• Train for 5-day triggers and FDA-requested 5-day reports. Create visible flags for remedial actions to start the shorter clock.
• Align MDR narratives with CAPA and recall records. Inconsistencies across files are frequent 483 observations during inspections.

Embedding checklists into intake and MDR drafting reduces omissions, while routine case audits catch errors before submission. If an observation occurs, apply a disciplined response strategy to shore up procedures, retrain, and update historical cases where necessary. For structured approaches to remediation and communication with FDA, consult resources on effective FDA 483 responses.

MDR sits within a broader postmarket ecosystem. In the United States, complaint handling and CAPA requirements under device quality regulations provide the foundation for consistent evidence gathering and systemic remediation. MDR reports should reflect and reinforce those processes rather than operate as an isolated regulatory function.

Internationally, MDR coexists with other vigilance frameworks. In the European Union, manufacturers submit Manufacturer Incident Reports and field safety notices under the EU Medical Device Regulation. As EUDAMED moves toward broader deployment, firms should ensure consistency between U.S. MDR narratives and EU submissions to avoid conflicting statements regarding root cause and risk.

Software and connected devices raise adjacent duties. Cybersecurity vulnerabilities that could lead to patient harm may involve both premarket risk management and postmarket vigilance. Coordinate MDR with your security incident processes so that exploitable failure modes, even if not yet realized clinically, are assessed for reportability when harm is likely on recurrence.

Electronic records used to generate, approve, and archive MDR submissions must meet integrity expectations. Align system controls, audit trails, and electronic signatures to the regulatory expectations for trustworthy records. Synchronize metadata and timestamps across systems so submission timing and authorship are clear and defensible during inspections.

Where postmarket signals escalate into field actions, coordinate MDR content with recall classification, strategy, and effectiveness checks. Consistency across disclosures and corrective steps both supports patient safety and streamlines interactions with regulators in multiple jurisdictions.

If you market in the EU, track the timeline and information model for device incident submissions as EUDAMED capabilities expand. Preparing a common core dataset and harmonized narratives will reduce rework and discrepancies when reporting similar events to multiple authorities. See also the milestone on MDR EUDAMED mandatory 2026 for planning context.

During inspections, FDA evaluates whether your MDR system is written, trained, and used. Investigators typically sample complaints to verify timely, accurate reportability decisions and trace reports through to electronic submission acknowledgments. They check that procedures describe intake, evaluation, and submission, and that records support each step with dates, signatures, and objective evidence.

Frequent observation themes include missing or outdated procedures, failure to report within timelines, incomplete 3500A-equivalent data elements, and inconsistent statements across complaint and CAPA files. Gaps in device identification, absent UDI, or narratives that lack clinical detail are common deficiencies that trigger follow-up requests or formal observations.

If inspectional observations are issued, corrective action plans should address root causes, not just specific examples. This usually requires clarifying intake criteria, retraining, adding decision-tree controls, and enhancing system validations for electronic records. Where late submissions occurred, firms should include a retrospective review and remediation plan for similar cases.

Enforcement can escalate beyond Form 483s. Warning letters, civil money penalties, and, in rare cases, seizures or injunctions may follow if MDR deficiencies indicate systemic risk to public health. Firms with chronic late reporting or failure to submit 5-day reports are at particular risk. Maintaining robust metrics, management reviews, and internal audits helps demonstrate ongoing control.

To prepare, simulate the inspector’s path: select a recent case, retrieve the complaint, show the reportability evaluation and dates, open the electronic report and acknowledgments, and display any supplements. Be ready to explain role assignments, escalation criteria, and how your systems maintain record integrity and timely routing under real-world conditions.

MDR compliance is a coordination exercise across service, engineering, clinical, and regulatory functions. V5 Ultimate consolidates complaint intake, device identification, lot genealogy, and investigation evidence into a single case record, making reportability determinations faster and more consistent. Timelines and responsibilities are embedded in the workflow so the correct clock starts immediately upon awareness.

Case templates mirror MDR data elements, including patient and device problem codes, UDI capture, narrative prompts, corrective action linkages, and supplement tracking. Automated deadline controls surface 5-day versus 30-day pathways and trigger escalations if milestones slip. Role-based access and complete audit trails preserve data integrity for electronic records and signatures.

Submission readiness benefits from structured exports and validations that check for missing identifiers, inconsistent dates, or narrative gaps before transmission. Post-submission, acknowledgment tracking and dashboards give teams visibility on acceptances and rejections, and they anchor management reviews with on-time performance metrics, aging cases, and supplement closures.

Because MDR does not exist in isolation, V5 links events to CAPA and to potential field actions. This keeps narratives, corrective steps, and risk evaluations coherent across the quality system and streamlines responses during inspections. Where action escalates to a field correction or recall, MDR content remains synchronized with the operational plan.