Complaint Handling and MDR Reporting Under QMSR: Building a System That Holds Up
Complaint handling has been among the most frequently cited areas in FDA device inspections for years, and the Quality Management System Regulation (QMSR) did not make it easier. It changed the structure. The old 21 CFR 820.198 is gone; its substance now lives in ISO 13485:2016 clauses 8.2.2 and 8.2.3, supplemented by FDA-specific record content requirements in 21 CFR 820.35(a). Meanwhile, Medical Device Reporting (MDR) under 21 CFR Part 803 and corrections and removals under Part 806 remain unchanged and must be integrated into the complaint process.
For regulatory affairs and quality teams, the practical question is how to build a complaint handling process that satisfies ISO 13485, meets FDA's specific record requirements, makes timely and defensible reportability decisions, and feeds risk management and CAPA. This article walks through each element.
The New Regulatory Structure
ISO 13485 clause 8.2.2: Complaint handling
ISO 13485 requires documented procedures for timely complaint handling in accordance with applicable regulatory requirements. The procedures must include, at a minimum, requirements and responsibilities for:
receiving and recording information;
evaluating information to determine whether the feedback constitutes a complaint;
investigating complaints;
determining the need to report the information to the appropriate regulatory authorities;
handling of complaint-related product; and
determining the need to initiate corrections or corrective actions.
Where a complaint is not investigated, the justification must be documented. Any correction or corrective action resulting from the process must be documented. If an investigation determines that activities outside the organization contributed to the complaint, relevant information must be exchanged with the external party involved. Records of complaint handling must be maintained.
ISO 13485 defines a complaint as a written, electronic or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, usability, safety or performance of a medical device that has been released from the organization's control, or related to a service that affects the performance of such devices. The QMSR adopts this definition.
ISO 13485 clause 8.2.3: Reporting to regulatory authorities
If applicable regulatory requirements require notification of complaints that meet specified reporting criteria for adverse events or the issuance of advisory notices, the organization must document procedures for providing notification to the appropriate regulatory authorities and maintain records of reporting.
21 CFR 820.35(a): FDA-specific complaint record content
FDA retained specific requirements for what complaint records must contain. In addition to the ISO 13485 requirements, records of complaints must include, as applicable:
the name of the device;
the date the complaint was received;
the unique device identifier (UDI) or universal product code (UPC), and any other device identification and control numbers used;
the name, address and phone number of the complainant;
the nature and details of the complaint;
the dates and results of the investigation;
any corrective action taken; and
any reply to the complainant.
For complaints that the manufacturer determines must be reported to FDA under Part 803, the record must also include whether the device failed to meet specifications, whether the device was being used for treatment or diagnosis, and the relationship, if any, of the device to the reported incident or adverse event.
Inspection access to records
Under the old QSR, some quality records were shielded from routine FDA inspection. Under the QMSR, FDA can review management review records, internal audit reports and supplier audit reports. Complaint records were always inspectable, but investigators can now follow complaint data into management review and internal audits in a way they could not before.
Medical Device Reporting: The Obligations That Did Not Change
Part 803 remains in force without change. For manufacturers, the key requirements are:
30-calendar-day reports (Form FDA 3500A, submitted electronically) when the manufacturer becomes aware of information that reasonably suggests a marketed device may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.
5-work-day reports when the manufacturer becomes aware that a reportable event necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health, or when FDA has requested a 5-day report for a particular type of event.
Supplemental reports within 30 calendar days of obtaining information that was not known or available at the time of the initial report.
Electronic submission through FDA's eMDR system, mandatory since August 2015.
MDR event files for each reportable and non-reportable adverse event, with documentation of deliberations and decision-making processes used to determine whether an event was reportable, retained for two years or the expected life of the device, whichever is longer.
Written MDR procedures under 803.17 covering timely and effective identification, communication and evaluation of events; a standardized review process for determining reportability; and timely transmission of complete reports.
FDA's Voluntary Malfunction Summary Reporting (VMSR) Program allows manufacturers of devices in eligible product codes to submit certain malfunction reports in quarterly summary format rather than individual 30-day reports, subject to conditions. Deaths, serious injuries and 5-day reportable events remain individually reportable.
The "becomes aware" date is critical. Under 803.3, a manufacturer becomes aware when any employee becomes aware of information that reasonably suggests a reportable event occurred, not when the complaint unit logs the event or completes its investigation. Delays in routing information from sales, service or field clinical staff to complaint handling are a frequent source of late MDRs.
Corrections and Removals
When a complaint investigation leads to a correction or removal initiated to reduce a risk to health posed by the device, or to remedy a violation of the FD&C Act caused by the device that may present a risk to health, 21 CFR Part 806 requires a written report to FDA within 10 working days of initiating the action. Corrections and removals not required to be reported must still be documented. The link between complaint investigations, CAPA and the Part 806 decision must be visible in the records.
Where Complaint Systems Commonly Fail
1. Complaints hidden in other channels
Service tickets, customer support calls, returned goods authorizations, social media, sales representative notes and clinical field reports often contain complaint information that never reaches the complaint unit. Investigators routinely sample service records and returns and cross-check them against the complaint log. Every feedback channel should have a documented screening step against the complaint definition.
2. Undocumented decisions not to investigate
ISO 13485 allows a decision not to investigate, but requires a documented justification. Blanket justifications ("similar complaint previously investigated") need a reference to the specific prior investigation and evidence that the new event is truly the same.
3. Reportability decisions made too late
Some systems defer the MDR decision until the investigation is complete. But the reporting clock starts when the manufacturer becomes aware of information that reasonably suggests a reportable event. The initial reportability assessment should happen at intake, based on available information, with the decision revisited as the investigation proceeds.
4. Malfunction reportability underestimated
Manufacturers often conclude a malfunction is not reportable because no patient was harmed. The test is whether the malfunction would be likely to cause or contribute to death or serious injury if it recurred. FDA's MDR guidance explains how to apply this test, including the presumption that a malfunction is reportable where it caused or contributed to a death or serious injury in the past.
5. Weak trending
Complaint trending that only counts complaints by product rarely reveals emerging problems. Effective trending segments by failure mode, hazardous situation, lot, component supplier, use environment and customer, and compares rates against the probability estimates in the risk file.
6. No link to risk management
Complaint investigations should identify the relevant hazardous situation in the risk management file. Without that link, manufacturers cannot demonstrate that post-production information is being used to verify risk estimates, which is required by ISO 13485 clause 8.2.1 and ISO 14971.
Designing a Complaint Process That Holds Up
A robust process typically follows these stages, each with defined responsibilities and records.
Intake and screening. Capture all feedback, screen against the complaint definition, and record the date any employee first became aware of the information.
Initial reportability assessment. Within one business day, assess whether the event may be reportable in each market where the device is sold (for example, FDA MDR, EU MDR vigilance under Articles 87–92, Health Canada mandatory problem reporting). Record the decision, the criteria applied and the assessor.
Investigation. Scale the depth of investigation to the risk. For events involving death, serious injury or a potentially reportable malfunction, include device evaluation where available, review of device history records, and assessment against the risk file.
Final reportability decision and submission. Confirm or revise the initial decision based on investigation findings, submit reports within the applicable timelines, and file supplemental reports as information develops.
Correction and corrective action. Determine whether correction, corrective action, or a field action is needed, and whether a Part 806 report is required.
Closure and trending. Close the complaint with a documented reply to the complainant where appropriate, and include the data in trend analysis.
Management review. Present complaint trends, reportable events, late reports and resulting actions as inputs to management review under ISO 13485 clause 5.6.2.
Metrics Worth Tracking
Median time from awareness to complaint entry.
Median time from complaint entry to initial reportability decision.
Percentage of MDRs submitted on time, and root causes of late reports.
Percentage of complaints closed within target, by risk level.
Number of complaints identified retrospectively from non-complaint channels (a sign of screening gaps).
Number of risk file updates triggered by complaint data.
Reportability in Practice: Four Scenarios
The reportability standards are easier to apply with concrete examples. The following scenarios illustrate common decision points for a manufacturer selling in the U.S., EU and Canada. They are illustrative, not a substitute for jurisdiction-specific analysis.
Scenario 1: Malfunction with no harm
A glucose meter displays an incorrect high reading, which the patient notices and confirms with a second meter before dosing insulin. No harm occurred. For FDA, the question is whether the malfunction would be likely to cause or contribute to a serious injury if it recurred; an incorrect glucose reading that could lead to an inappropriate insulin dose likely meets that threshold, making it a 30-day malfunction report (or eligible for VMSR if the product code qualifies). In the EU, the event may not be a serious incident because no serious deterioration in health occurred, but it must be recorded and included in trend reporting, and could become reportable under Article 88 trend reporting if the frequency increases significantly.
Scenario 2: User error with injury
A clinician misconnects a tubing set, resulting in an air embolism that requires intervention. The investigation finds that the device performed as designed. A device need not malfunction to be reportable: FDA MDR reporting applies where the device may have caused or contributed to a serious injury, and use error related to device design or labeling is within scope. The event should also prompt a review of the usability engineering file and risk controls for misconnection.
Scenario 3: Death with unclear device involvement
A hospital reports that a patient died while connected to the device, with no specific allegation of malfunction. Under FDA's standard, the manufacturer must report if the information reasonably suggests the device may have caused or contributed to the death. Where information is incomplete, FDA's MDR guidance advises reporting and investigating rather than waiting for certainty; the decision not to report must be documented in the MDR event file with the rationale.
Scenario 4: Complaint received through a distributor
A distributor in Canada forwards a complaint two weeks after receiving it. For Health Canada, the manufacturer and importer both have mandatory problem reporting obligations, and the timeline runs from when the manufacturer or importer becomes aware. Contracts with distributors should specify how quickly complaint information must be forwarded, and the manufacturer should monitor compliance with those terms.
Aligning Multiple Jurisdictions
For manufacturers selling globally, the complaint system is also the intake point for vigilance obligations in every market. Key differences to build into the process include:
EU MDR: serious incidents must be reported immediately after establishing a causal relationship (or reasonable possibility of one), and no later than 15 days after awareness; 2 days for serious public health threats; 10 days for death or unanticipated serious deterioration in health. Field safety corrective actions must be reported before they are undertaken, except in urgent cases.
Health Canada: 10 days for incidents leading to death or serious deterioration in health, and 30 days for incidents that could lead to such outcomes if they recurred.
FDA: 30 calendar days and 5 work days as described above, plus Part 806 reports within 10 working days.
A single intake form that captures the information needed for all jurisdictions, and a reportability worksheet that walks through each market's criteria, reduces the risk that one market's obligation is missed while another is met.
The Bottom Line
The QMSR moved complaint handling into the ISO 13485 framework, but FDA's specific record content and reporting obligations remain, and investigators can now follow complaint data further into the QMS than before. The strongest complaint systems start the reportability clock at the moment of awareness, decide early and revisit often, link every investigation to the risk file, and make trends visible to management. For regulatory affairs professionals, owning the reportability decision process across all markets is the highest-value contribution to a complaint system that will withstand inspection.
Sources
21 CFR Part 820 (QMSR), including 820.35 Control of records
21 CFR Part 803, Medical Device Reporting; FDA guidance "Medical Device Reporting for Manufacturers" (2016)
21 CFR Part 806, Medical Devices; Reports of Corrections and Removals
ISO 13485:2016, clauses 5.6, 8.2.1, 8.2.2 and 8.2.3
FDA, Voluntary Malfunction Summary Reporting (VMSR) Program
Regulation (EU) 2017/745, Articles 87–92 (vigilance)
Comments