mdi Consultants, IncShort answer: Since February 2, 2026, complaint handling under 21 CFR Part 820 is governed by ISO 13485:2016 Clause 8.2.2 together with FDA’s supplemental record requirements in § 820.35. Medical Device Reporting under 21 CFR Part 803 did not change: manufacturers must report a death, serious injury, or reportable malfunction within 30 calendar days of becoming aware of it, and within 5 working days when the event requires remedial action to prevent unreasonable risk of substantial harm. What has changed is how the requirement is tested. Investigators no longer read your complaint procedure and compare it to the regulation. They pick one complaint and follow it until the trail breaks.
The shift nobody prepared for
Companies spent 2024 and 2025 rewriting procedures to match ISO 13485 language. That was necessary, and it was not sufficient.
In the QMSR inspections mdi has participated in this year — in the United States and abroad — the pattern has been consistent. The investigator spends very little time on the quality manual. They ask for the complaint log, choose a small number of entries, and then ask the same question repeatedly: show me what happened next.
Procedure compliance is a document review. Trail compliance is an evidence review. The second one is much harder to pass, and it is the one being run.
Intake: the classification trap
The most common failure mdi sees is not a mishandled complaint. It is a complaint that was never logged as one.
ISO 13485 defines a complaint broadly — communication alleging deficiencies in identity, quality, durability, reliability, usability, safety, or performance of a device that has been released. That definition captures a great deal of traffic that companies habitually route elsewhere:
- A field service ticket describing a device that “wouldn’t hold calibration”
- A distributor email asking whether an alarm behavior is “normal”
- A sales rep’s trip report noting that two hospitals have stopped using an accessory
- A social media comment or online review describing a device failure
- A returned-goods authorization with a reason code of “not working right”
Each of those is a complaint. Routing them to service, sales, or customer care without a complaint record creates the single most damaging finding available to an investigator: evidence that your surveillance system has a channel it does not see.
What good looks like: one intake point, mandatory for every function, with a documented decision on the record for anything determined not to be a complaint. “Not a complaint” is an acceptable conclusion. An undocumented one is not.
The MDR decision — and who is allowed to make it
Once a communication is a complaint, the next question is whether it is reportable under Part 803. Three things go wrong here more than anything else.
First, the decision is made by the wrong person. A service technician deciding that a malfunction “couldn’t really hurt anyone” is making a regulatory determination without authority or training. The MDR decision belongs to a defined, trained role with documented criteria.
Second, the malfunction test is misapplied. The standard is not whether the malfunction did cause harm. It is whether the device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. Companies routinely close reportable malfunctions on the grounds that the specific patient was unharmed. That is the wrong test.
Third, “we couldn’t confirm it” is treated as “not reportable.” Inability to obtain the device, reproduce the failure, or get information from the user does not suspend the obligation. Part 803 anticipates incomplete information: you report what you know, and you supplement.
The clock starts at awareness
This is the finding that costs companies the most, and it is almost always a records problem rather than a judgement problem.
The 30-day clock starts when your firm becomes aware of information reasonably suggesting a reportable event — not when the investigation concludes, not when engineering confirms root cause, and not when the complaint file is opened in the system.
If a distributor emailed your regional manager on the 3rd and the complaint was entered into the QMS on the 24th, an investigator will date awareness to the 3rd. If you cannot show when each function first learned of the event, awareness will be dated to the earliest evidence in the file, and it will not be dated in your favor.
Practical control: capture and record a date of awareness separately from a date of entry, and reconcile them. A gap is not automatically a violation — an unexplained gap is.
What § 820.35 added
QMSR did not simply hand complaint handling to ISO 13485. Subpart B retains supplemental FDA requirements, and § 820.35 (Control of records) is the one that bites in post-market files. Records must include:
- The information required by 21 CFR Part 803 in complaint and servicing records
- The documentation needed to satisfy Unique Device Identification requirements under 21 CFR Part 830 — the UDI recorded for each device or batch
- Provisions on confidentiality of records sent to and received by FDA
The practical consequence: a complaint record that would have satisfied ISO 13485 alone can still be deficient under QMSR if it lacks the Part 803 data elements or the UDI. If your complaint form was rewritten to match the standard and nothing was added back, check it this week.
The five complaint-file failures mdi sees most
- The orphan channel — service, sales, or social media reports that never reach the complaint system.
- The undated awareness — no record of when the firm first learned of the event.
- The unauthorized MDR call — reportability decided outside the trained, defined role.
- The recurrence test skipped — malfunctions closed because this patient was unharmed.
- The stripped record — ISO-compliant form missing Part 803 elements or UDI under § 820.35.
None of these is a sophisticated compliance failure. All five are visible in under an hour to an investigator who knows to look.
What to do before your next inspection
Pull three closed complaints from the last twelve months — ideally ones that were not reported — and trace each one end to end. Can you show the date of awareness? The reportability rationale and who made it? The UDI? The link to CAPA, or a documented reason there was none? The effectiveness of whatever action followed?
If the trail breaks on any of the three, it will break in front of an investigator.
