Complaint Handling (MDR / MIR)

21 CFR §820.198 defines a complaint as 'any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it is released for distribution'. ISO 13485 §8.2.2 uses materially the same definition; EU MDR Article 87(1) widens it to include 'serious public health threats' and 'expected and foreseeable side-effects' even when not user-reported.

Every communication that meets the definition is a complaint and must be entered into the complaint file — regardless of whether the manufacturer thinks the allegation has merit. The triage of 'real defect vs user error vs misuse vs no fault found' happens inside the investigation, not at intake. Filtering at intake is the most-cited reason FDA cites §820.198 in 483s.

An event can — and frequently does — trigger all three regimes simultaneously. The complaint-handling SOP must run the decision tree in parallel: the EU 15-day clock does not wait for the US 30-day clock, and a delay on either is a stand-alone violation.

1. Intake — log every channel (phone, email, portal, sales, field service, social, regulator letter) into one complaint file with date/time of awareness. 'Awareness' is the moment any employee or representative becomes aware of the event, not when the complaint reaches the QA inbox.
2. Initial assessment — reportability decision per §803 and per MDR Article 87 must be made and documented within the first 48 hours. If the decision is 'not reportable' it still has to be justified in writing inside the complaint file; FDA inspectors routinely pull the not-reportable bucket and challenge the rationale.
3. Device traceability — pull the affected unit's DHR via serial / UDI-DI + UDI-PI. The DHR gives the build record, the operator, the validated process parameters at the time of manufacture, the material lots, and any in-process deviations or nonconformances on that unit.
4. Investigation — root cause analysis (5 Whys, fishbone, fault-tree). The depth must be proportional to risk; a Class III implantable death needs more than a Class I non-sterile accessory complaint. ISO 14971 risk file is updated if the investigation finds a previously unconsidered hazard.
5. Reporting — file MDR within the appropriate clock (30 / 5 / 2 days) and MIR within the appropriate clock (15 / 10 / 2 days). Track submissions and Competent Authority / FDA acknowledgements. Update the report with follow-up information as the investigation closes (MDR Supplemental, MIR Follow-up).
6. Corrective action — at the unit level (rework, replace, refund) and, if systemic, escalate to CAPA per §820.100 / §8.5.2. Not every complaint becomes a CAPA — recurrence rate, severity and risk drive the decision.
7. Closure — complaint file closed when the investigation, reporting, and corrective actions are complete. The file must contain enough detail that an inspector reading it 5 years later can reconstruct the decision-making.

EU MDR vigilance reports are filed via the EUDAMED Vigilance module using the Manufacturer Incident Report (MIR) form. The current template (v7.3.1 at time of writing, anchored in MDCG 2023-3) is published as both a PDF form and an XML schema. EUDAMED accepts the XML; the PDF is for the manufacturer's own file.

• Basic UDI-DI is mandatory — not the unit-level UDI-PI. First-time filers frequently submit the UDI-DI instead and have the report rejected.
• IMDRF Annex A/B/C/D/E/F/G codes are required for the device problem, evaluation result, health effect (clinical signs), health effect (impact), root cause, and component. The codes are hierarchical; using only the top-level code is acceptable but blunts the trend analysis.
• Single-patient vs multi-patient — periodic summary reporting is allowed only for 'similar' incidents with the same Basic UDI-DI and same IMDRF codes, agreed in advance with the coordinating Competent Authority.
• Follow-up reports are required when significant new information becomes available; the timer restarts for the new information, it does not extend the original clock.
• Final report is due within 30 days of the investigation conclusion or 6 months from initial report, whichever is earlier. The report is final only when root cause is established and corrective action is decided.

Vocabulary differs between FDA and EU and the difference matters in inspection.

• FSCA (EU) — any action taken by a manufacturer to reduce the risk of death or serious deterioration associated with a device already on the market. Covers recalls, retrofits, software updates, label changes, advisory notices.
• FSN (EU) — the Field Safety Notice is the customer-facing communication that accompanies an FSCA. Template is dictated by MDCG 2013-1 rev 4 / the MDR implementing regulation.
• Recall (US) — any correction or removal of a device initiated by the manufacturer to reduce a risk to health or to remedy a violation of the FD&C Act. Subject to 21 CFR Part 806 (reporting of corrections and removals) plus the Part 7 voluntary recall framework.
• Safety Alert / Market Withdrawal (US) — narrower categories that do not always reach the §806 reporting threshold but still require internal documentation.

A single field action commonly fires all four: an FSCA in the EU with an FSN to customers, plus a Part 806 correction report to FDA with the customer-facing letter classified as a Recall. The complaint-handling SOP must drive both regulatory tracks from the same investigation record.

QMSR (effective 2 February 2026) replaces §820.198 with ISO 13485 §8.2.2 by reference. The substance is unchanged but the inspector expectation tightens — §8.2.2 explicitly requires the complaint-handling procedures to include 'recording, investigating, reporting to regulatory authorities, and handling complaints'. The phrase 'reporting to regulatory authorities' brings MDR (§803) inside the §8.2.2 clause rather than treating it as a parallel requirement.

FDA investigators auditing under QMSR will still apply Part 803 timelines, but the procedural compliance audit shifts to the ISO clause. Manufacturers should refresh their SOPs to cite §8.2.2 and to explicitly cross-reference Part 803, Part 806, ISO 14971 (risk management feedback), and CAPA (§8.5.2). A complaint-handling SOP that only cites §820.198 will be cited as out-of-date after the QMSR effective date.