FDA Product Recall Guide: 21 CFR Part 7 and 806

GUIDES: Pharmaceutical and Medical Device Compliance

Handling an FDA Product Recall:
A Complete Step-by-Step Guide

Covers 21 CFR Part 7 (pharmaceuticals) and 21 CFR Part 806 (medical devices): recall classification, strategy development, FDA notification, effectiveness checks, and CAPA closure.

Recall Classes

FDA assigns Class I, II, or III based on the probability and severity of adverse health consequences from a violative product.

FDA, 21 CFR Part 7.3

Working Days

Medical device manufacturers must submit a written report to FDA within 10 working days of initiating a correction or removal under 21 CFR 806.10.

FDA, 21 CFR Part 806.10

Effectiveness Levels

FDA assigns Levels A through D for effectiveness checks, ranging from 100% consignee audit (Level A) to 2% audit (Level D), based on recall class and depth.

FDA, 21 CFR 7.49

An FDA product recall requires a manufacturer to remove or correct a violative product before it reaches or continues to harm patients. Under 21 CFR Part 7 for pharmaceuticals and 21 CFR Part 806 for medical devices, the process runs from internal risk assessment through FDA notification, customer communication, product retrieval, effectiveness checks, and CAPA closure. This guide covers each step with documentation requirements and reporting timeframes that pharmaceutical and medical device firms must meet.

Recalls are not optional responses to complaints. FDA expects firms to identify violative conditions through their quality system, determine whether a recall is warranted, and initiate one proactively. Waiting for FDA to request action is a corrective posture, not a compliant one. The firms with the cleanest recall records are those with documented recall procedures embedded in their quality management system before any problem arises.

This guide applies to pharmaceutical manufacturers regulated under 21 CFR Parts 210 and 211, and medical device manufacturers regulated under 21 CFR Parts 820 and 806. Where procedures differ between the two regulated product types, the distinction is noted in each section.

Why FDA Recall Management Is a Core GMP Obligation

Product recalls are not standalone crisis events. They are the downstream consequence of quality system failures. Under the current Good Manufacturing Practice (cGMP) framework, pharmaceutical firms operating under 21 CFR Parts 210 and 211 and medical device firms under 21 CFR Part 820 are required to have procedures for receiving, evaluating, and handling complaints and deviations that may require a recall. The absence of a written recall procedure is itself a cGMP violation.

FDA distinguishes between three types of market actions that affect distributed products. Understanding which applies to your situation determines the regulatory pathway, the required notifications, and the scope of your obligations.

Recall

Removal or correction of a distributed product that is in violation of laws administered by FDA. A recall addresses products already in commerce. It is the most common and most scrutinised market action. Recall information is publicly posted on FDA’s recall database.

21 CFR 7.3(g)

Market Withdrawal

Removal or correction of a distributed product that involves a minor violation that would not be subject to legal action by FDA, or that involves no violation (for example, normal stock rotation). Market withdrawals are not publicly listed by FDA as recalls and do not require formal recall reporting.

21 CFR 7.3(j)

Medical Device Safety Alert

A communication issued when a medical device may present an unreasonable risk of substantial harm, but where the product is not being removed from commerce. Safety alerts are used in parallel with recalls when immediate advisory communication is needed, particularly for implanted or life-critical devices.

FDA, Medical Device Recalls

Key Distinction: A firm that removes a product citing a “quality concern” but fails to classify the action as a recall when regulatory criteria are met may face an FDA enforcement action for failing to report. When in doubt, contact your FDA recall coordinator before characterising the action as a market withdrawal.

Recall Classifications: Class I, II, and III

FDA assigns every recall a class designation based on the relative degree of health hazard presented by the product being recalled. The manufacturer proposes a classification, but FDA makes the final determination. Do not assume your proposed class will be accepted: FDA may upgrade it based on their assessment.

Class

Definition

Examples

Class I

Reasonable probability that use of or exposure to the product will cause serious adverse health consequences or death.

Contaminated injectables, implant failure risk, mislabelled high-hazard drug products, critical device software errors.

Class II

Use of or exposure to the product may cause temporary adverse health consequences, or where the probability of serious adverse health consequences is remote.

Sub-potent products with limited health impact, labelling errors for non-critical information, non-sterile products in low-risk applications.

Class III

Use of or exposure to the product is not likely to cause any adverse health consequences, but the product violates FDA regulations.

Minor labelling defects, tamper-evident packaging violations, minor GMP record-keeping deviations with no product quality impact.

FDA, 21 CFR 7.3(m)(1)(2)(3)

For medical devices, FDA uses the same Class I, II, and III designations, but the assessment framework also considers whether the device was already implanted or in active use at the time of recall initiation. Explanted or in-use devices require a different communication approach and may require coordination with healthcare providers rather than distributors only.

Correction versus removal is also a meaningful distinction for medical devices under 21 CFR Part 806. A correction addresses a device problem at the device’s current location (such as a software update or label correction). A removal takes the device out of service and returns it to the manufacturer. Both are reportable events. Corrections that address serious risks are treated with the same urgency as removals.

Before You Begin: Prerequisites and Recall Readiness

A recall should never be the first time your quality team encounters the process. The following elements must be in place before a recall situation arises. FDA inspectors reviewing your recall response will assess whether these systems existed and functioned correctly before the problem was identified.

Written Recall Procedure (SOP)

Your quality system must include a written procedure that defines how your organisation identifies, evaluates, initiates, and executes a recall. This SOP should cover roles and responsibilities, decision criteria for initiating a recall, escalation paths, and documentation requirements. Absence of a written recall SOP is a cGMP observation under 21 CFR 211.198 for drugs and 21 CFR 820.100 for devices.

Distribution Records

You must be able to identify all consignees who received a recalled lot within the time required by your recall strategy. Drug distribution records must be retained under 21 CFR 211.196. Device distribution records must meet the requirements of 21 CFR 820.160 and 820.181. If your distribution records cannot support a complete consignee list within 24 hours, your recall will be delayed and your effectiveness checks will be unreliable.

Recall Contact List

Maintain a current list of your FDA district recall coordinator, your legal counsel, your public relations contact, and your key customer contacts by product line. FDA district offices are listed on the FDA website. For pharmaceutical products, the recall coordinator at the relevant FDA district office is your primary contact. For devices, the Office of Regulatory Affairs coordinates recall management at the national level.

Health Hazard Evaluation Capability

FDA expects that you have access to medical or toxicological expertise to assess whether a product defect poses a health hazard. For small firms, this may require a consulting relationship with a medical affairs professional or toxicologist. The health hazard evaluation is one of the first documents FDA will request when you notify them of a recall, and it drives the classification decision.

The Seven-Step FDA Recall Management Process

The following process applies to voluntary recalls initiated by the firm. Each step is required for a compliant recall under 21 CFR Part 7 (pharmaceuticals) and 21 CFR Part 806 (medical devices), with regulatory distinctions noted where the two pathways differ.

Step 1: Conduct an Internal Investigation and Risk Assessment

The recall process begins when your quality system identifies a potential product defect, a complaint cluster, a stability failure, a supplier deviation, or another quality signal that suggests a distributed product may be violative or harmful.

Convene a cross-functional recall team immediately. This team typically includes Quality, Regulatory Affairs, Medical Affairs, Legal, and Operations. The team’s first task is to assess the nature of the defect, the lots affected, the distribution scope, and the health hazard potential.

Key Documents to Prepare at Step 1

Health hazard evaluation (written assessment of health risk posed by the defect)
Lot or batch list with manufacturing and distribution dates
Complaint and deviation records related to the issue
Root cause hypothesis (preliminary, to be confirmed during CAPA)
Recall decision memo documenting the rationale for initiating a recall

Step 2: Notify the FDA

Notification timing and format differ for pharmaceuticals and medical devices.

Pharmaceuticals (21 CFR Part 7): Contact the FDA district office in your geographical area and inform them of the recall initiation. There is no fixed statutory deadline for voluntary pharmaceutical recalls, but FDA expects notification promptly upon the decision to recall. FDA will assign a recall number and may request your recall strategy, health hazard evaluation, and press release for review before public communication.

Medical Devices (21 CFR Part 806): Submit a written report to FDA within 10 working days of initiating a correction or removal. The report must be submitted to the FDA district office responsible for your facility and must include the elements listed at 21 CFR 806.10(c). For devices with MedWatch or MDR implications, coordinate with your MDR reporting obligations simultaneously.

Pharmaceuticals (21 CFR Part 7)

Medical Devices (21 CFR Part 806)

Contact FDA district recall coordinator promptly upon recall decision

Written report within 10 working days of initiating correction/removal

No fixed statutory deadline for voluntary recalls, but prompt notification expected

Report must include elements defined at 21 CFR 806.10(c)

FDA may request recall strategy, press release, and HHE before public announcement

Exemptions from reporting may apply if correction/removal poses no risk (21 CFR 806.1(b))

21 CFR Part 7 | 21 CFR Part 806

Step 3: Develop Your Recall Strategy

The recall strategy is a written plan defining how the recall will be conducted. Under 21 CFR 7.46, the strategy must address the following elements. FDA will review and may comment on or request revisions to your strategy before approving it.

Recall Strategy Components (21 CFR 7.46)

Depth of Recall Consumer / User Level

Class I recalls typically extend to the consumer or patient level. Class II and III may stop at wholesale or retail depending on the risk assessment.

Communication Method Written Notice Required

Recall communications must be in writing. Phone or verbal notification is supplementary only. The written notice must include the recall class, reason, lot numbers, and instructions for return or disposal.

Effectiveness Check Level Level A to D

The strategy must state the level of effectiveness check to be conducted. FDA assigns the level based on class and risk. Class I recalls typically require Level A (100% of consignees contacted and audited).

Disposition Plan Destroy / Recondition / Return

Recalled product must be held under quarantine until FDA authorises the disposition method. Destruction requires FDA witnessing or certification in many cases. Reconditioning requires a separate application and FDA approval.

FDA, 21 CFR 7.46

Step 4: Issue Recall Communications to Consignees

Recall communications must go to all consignees at the depth specified in your recall strategy. A consignee is any person or firm that received the recalled product directly from you or from a sub-distributor. The communication must reach them in writing, and you must document proof of receipt.

Under 21 CFR 7.49, the recall communication must:

Identify the product, including lot or serial numbers
State the recall reason clearly and without minimising the risk
Specify whether the product should be returned, destroyed, or corrected
Provide instructions for returning or disposing of the product
Request confirmation of receipt and a response within a specified timeframe
Identify your recall contact and their direct contact information

For consumer-level recalls, a press release or public notice may be required. FDA will indicate whether a press release is required based on the class and consumer exposure risk. For Class I recalls with wide consumer distribution, a press release is standard. FDA must review and approve the press release before it is issued.

Step 5: Execute the Recall and Track Returns

Once communications have been issued, your recall team must track the return of recalled product against the complete consignee list. Assign a unique recall reference number to every consignee response. Log the date of communication, the quantity recalled, the quantity returned or confirmed destroyed, and any consignees who have not responded.

Maintain a running reconciliation spreadsheet that shows, for each consignee: quantity shipped, quantity returned or disposed, and outstanding balance. This reconciliation is the primary document FDA will review during the recall audit. It must be current and accurate at all times during the recall.

Recalled product must be physically segregated from compliant product at all receiving locations, including your facility. Place recalled product under quarantine hold in your inventory management system. Do not release quarantined product for any purpose until FDA confirms the disposition method.

Step 6: Conduct Effectiveness Checks

Effectiveness checks verify that the recall communication reached its intended recipients and that they took the appropriate action. The level of effectiveness checking required is stated in your recall strategy and assigned or confirmed by FDA.

Level A

100% of Consignees

Contact and audit every consignee. Typical for Class I recalls with high health hazard probability.

Level B

A Selected Percentage

Contact a statistically representative sample. FDA specifies the percentage in the approved recall strategy.

Level C

10% of Consignees

Contact 10% of the total consignee population. Typical for Class II or Class III recalls with lower health risk.

Level D

2% of Consignees

Minimal audit of 2% of consignees. Used for Class III recalls or market withdrawals where risk is negligible.

FDA, 21 CFR 7.49 (effectiveness check levels)

Document each effectiveness check contact: date, consignee name, method of contact, confirmation of receipt, and quantity confirmed returned or disposed. Submit effectiveness check results to FDA with each status report as required under 21 CFR 7.53.

Step 7: Close the Recall and Implement CAPA

A recall is formally terminated when FDA determines that the company has taken all reasonable efforts to remove or correct the violative product. To support termination, submit a final status report to FDA showing the complete reconciliation of recalled product, the results of all effectiveness checks, and the disposition records for all returned product.

Recall closure is not the end of your obligations. A corrective and preventive action (CAPA) addressing the root cause of the recall must be initiated and tracked to completion. FDA will request evidence of the CAPA and its effectiveness during any subsequent inspection. For medical devices, the CAPA must be documented in your quality management system under 21 CFR 820.100 and may be subject to review as part of your next Quality System inspection.

The recall file, including all communications, consignee responses, effectiveness check records, product disposition records, and CAPA documentation, must be retained per your applicable regulatory requirements. For pharmaceuticals, this is typically three years under 21 CFR 211.180. For medical devices, the Device History Record and associated quality records must be retained under 21 CFR 820.180.

Recall Management Compliance Checklist

Use the following three-phase checklist to manage your recall from initiation to closure. Each item corresponds to a documented obligation under 21 CFR Part 7 or Part 806. Record the completion date and responsible party for every item.

Phase 1: Immediate Actions (Days 1-3)

Convene the recall team and assign the recall manager
Identify all affected lot/serial numbers
Quarantine remaining on-hand stock of affected product
Complete the health hazard evaluation (written)
Pull distribution records for all affected lots
Prepare the consignee master list
Notify FDA (pharmaceutical: district office; device: written report initiated)
Initiate root cause investigation

Phase 2: Active Recall (Days 4-30+)

Submit FDA-reviewed recall strategy (if required)
Issue written recall communications to all consignees
Issue press release (if FDA-required for Class I)
Log all consignee responses in recall reconciliation
Begin and document effectiveness checks
Submit status reports to FDA at required intervals
Receive and quarantine all returned product
Follow up with non-responsive consignees

Phase 3: Closure (After Reconciliation Complete)

Final reconciliation: 100% of recalled product accounted for
Complete and document all effectiveness checks
Obtain FDA disposition authorisation for recalled product
Execute destruction or reconditioning with documentation
Submit recall termination request to FDA
Receive FDA recall termination letter
Initiate or confirm status of CAPA addressing root cause
File complete recall record per retention requirements

Common Recall Management Failures and How to Avoid Them

Most recall management failures are not failures of intent. They are failures of preparation: incomplete distribution records, untested SOPs, and health hazard evaluations completed under pressure with no scientific support. The following failures most commonly result in FDA observations, Warning Letters, or consent decrees related to recall management.

Incomplete Distribution Records

Firms that cannot produce a complete consignee list within 24 to 48 hours of initiating a recall cannot execute an effective recall. This is the single most common recall management deficiency cited during FDA inspections. Distribution records must be accurate, current, and retrievable by lot number without manual reconstruction.

Delayed FDA Notification

For medical devices, the 10 working day reporting requirement under 21 CFR 806.10 is a hard deadline, not a target. Notifications that arrive after this window, or that are submitted without the required content, result in 483 observations and may escalate to Warning Letters. For pharmaceuticals, delayed notification is treated as evidence of a poor quality culture during inspections.

Inadequate Effectiveness Checks

Submitting effectiveness check results that show low consignee response rates, missing audit documentation, or gap in reconciliation will cause FDA to question whether the recall was actually effective. FDA may extend the recall period, request a market expansion, or initiate their own audit of your consignee list if effectiveness check results are unsatisfactory.

CAPA Not Tied to Root Cause

A CAPA that addresses the symptom but not the root cause will not satisfy FDA. If your recall resulted from a supplier quality failure, your CAPA must address supplier qualification, incoming material testing, or both. A CAPA that only addresses the specific lot in question without addressing the systemic failure is a recurring inspection observation that signals a quality system that does not learn from failures.

Key Takeaways

Recall Readiness Is a Quality System Obligation

A written recall procedure, complete distribution records, and an accessible FDA contact list are not recall management tools: they are cGMP requirements. Firms that discover gaps in these elements during an actual recall face compounded compliance risk. Test your recall procedure with a mock recall at least annually.

Medical Device and Pharmaceutical Recall Timelines Differ

Medical device firms face a hard 10-working-day reporting deadline under 21 CFR 806.10. Pharmaceutical firms operate under a prompt-notification expectation without a fixed statutory deadline, but delayed notification reflects poorly on quality culture. Know which framework applies to each product line in your portfolio before a recall occurs.

Effectiveness Checks and CAPA Determine Whether the Recall Was Adequate

FDA evaluates recall effectiveness based on the completeness of your consignee contacts, the response rates documented in your effectiveness checks, and the reconciliation of recalled product quantities. A recall that retrieved 60% of affected units is not an effective recall for a Class I product. CAPA that addresses symptoms rather than root causes will surface as a repeat observation in your next inspection. Both must be thorough, documented, and verified.

Frequently Asked Questions

What is the difference between a voluntary recall and an FDA-requested recall?

A voluntary recall is initiated by the firm when it determines that a product is violative or poses a health risk, without a direct FDA request. An FDA-requested recall occurs when FDA formally requests that a firm take action after identifying a problem through inspection, adverse event reports, or other surveillance. In practice, most recalls are voluntary, and FDA expects firms to self-identify and act before being asked. A firm that waits for FDA to request a recall faces heightened scrutiny regarding the adequacy of its quality monitoring systems.

Does FDA publicly announce all product recalls?

Yes. FDA publishes all classified recalls on its Recalls, Market Withdrawals, and Safety Alerts database at fda.gov. The listing includes the product name, reason for recall, recall class, and firm. Market withdrawals are not listed in this database because they do not involve a regulatory violation. For firms, this means that a classified Class I recall is publicly visible and may generate media or customer inquiries that require a prepared communications response.

What content must be included in a medical device recall report under 21 CFR 806?

Under 21 CFR 806.10(c), the report must include: the product name and description, the manufacturing site, the reason for the action, the date the action was initiated, the number of devices subject to the action, the total number distributed and the distribution period, a copy of all communications sent to consignees, and the name and contact information of the responsible official. If the information required is not available when the initial report is submitted, a follow-up report must be submitted within the regulatory timeframe.

Can recalled pharmaceutical product be re-released to market after reconditioning?

Reconditioning is permitted under 21 CFR 7.3(k), but it requires a formal application to FDA and prior approval before any reconditioned product is released. The applicant must demonstrate that the reconditioning process will bring the product into compliance and that no additional risk to the public results. For most drug products, reconditioning is limited to relabelling or re-inspection. For medical devices, reconditioning procedures must meet the requirements of 21 CFR Part 820. FDA monitors the reconditioning process and may require on-site verification.

How long does an FDA recall remain open?

FDA terminates a recall when it determines that all reasonable efforts have been made to remove or correct the violative product. There is no fixed timeline. Simple recalls with limited distribution and high consignee response rates can close in weeks. Complex Class I recalls with broad consumer distribution and low response rates may remain open for years. Submit periodic status reports to FDA as required by 21 CFR 7.53, and request termination only when your reconciliation is complete and all effectiveness checks have been conducted and documented.

What is the difference between a device correction and a device removal under 21 CFR Part 806?

A correction addresses a problem with a device at the location where it is currently being used or stored, without physically moving the device. Common corrections include software updates, relabelling, and inspections. A removal takes a device out of distribution or use and physically returns it to the manufacturer or authorised representative. Both corrections and removals are reportable under 21 CFR 806.10 if they are initiated to reduce a risk to health posed by the device or to remedy a violation of the Federal Food, Drug, and Cosmetic Act.

What happens if we do not report a correction or removal to FDA when one was required?

Failure to report a required correction or removal under 21 CFR Part 806 is a prohibited act under the Federal Food, Drug, and Cosmetic Act and can result in a Warning Letter, seizure, injunction, or civil monetary penalties. FDA frequently discovers unreported corrections and removals during routine Quality System inspections when they review CAPA records, complaint files, and service reports. If you have initiated a correction or removal and are uncertain whether it is reportable, contact FDA or your regulatory counsel before concluding that reporting is not required.

How should a firm handle recalled product that is already implanted in patients?

For implanted devices, the recall communication must reach the healthcare providers who performed the implant, not only the distributors who received the product. The recall strategy must assess whether the risk posed by the defect outweighs the risk of explant surgery. In most cases, FDA and the firm work together to develop a physician notification letter that informs clinicians of the issue, outlines the risk, and provides guidance on patient monitoring or follow-up. Explantation is only recommended when the risk of leaving the device in place exceeds the surgical risk of removal.

Sources

Government and Regulatory Sources

FDA. 21 CFR Part 7: Enforcement Policy: The primary regulatory framework governing product recalls, market withdrawals, safety alerts, and recall strategy requirements for all FDA-regulated products.
FDA. 21 CFR Part 806: Medical Devices; Reports of Corrections and Removals: Establishes the 10-working-day reporting requirement for medical device corrections and removals and defines the required content of each report.
FDA. Recalls, Market Withdrawals, and Safety Alerts Database: Public-facing database of all classified FDA recalls, including class, product description, recall reason, and status.
FDA. Recalls, Corrections, and Removals (Devices): FDA guidance page for medical device recall procedures, including guidance documents and reporting templates.
FDA. 21 CFR Part 820: Quality System Regulation (Medical Devices): Sets CAPA, complaint handling, and distribution record requirements that underpin a compliant recall programme for device manufacturers.

Research and Industry Sources

FDA. Guidance for Industry: Product Recalls, Including Removals and Corrections: FDA’s guidance document outlining the agency’s expectations for voluntary recall procedures, recall strategy elements, and effectiveness check standards.
RAPS. FDA Product Recalls: What You Need to Know: Regulatory Affairs Professionals Society overview of recall classification, communication, and CAPA requirements for pharmaceutical and medical device manufacturers.

Handling an FDA Product Recall: A Complete Guide