GUIDE: FDA Medical Device Reporting, 21 CFR Part 803
MDR Reporting Requirements: A Complete Guide for
Manufacturers, Importers, and Device User Facilities
Manufacturers, Importers, and Device User Facilities
The medical device reporting requirements at 21 CFR Part 803 require manufacturers, importers, and device user facilities to report certain device-related adverse events within defined timelines, 30 calendar days for most reports, 5 working days when remedial action is needed to prevent unreasonable risk. Each of the three reporting groups has a distinct set of obligations and a distinct set of recipients for those reports. Misunderstanding which group you belong to, what triggers a reportable event, or who the report must go to is one of the most common compliance failures the FDA identifies during inspections. This guide covers all three groups, their timelines, their report routing, and the procedural requirements that underpin the whole system.
15M+
Reports in MAUDE Since 1991
The FDA’s MAUDE database received approximately 15 million MDR reports from 1991 through late 2022, with more than 2.5 million submitted in just the first 10 months of 2022 alone. The reporting volume is growing at an increasing rate.
Global Clinical Engineering Journal, 2023
96%
Reports Filed by Manufacturers
Of all MAUDE reports are submitted by manufacturers, reflecting the heaviest MDR obligation in the system. Device user facilities and importers collectively account for the remaining 4% of mandatory reports submitted.
Global Clinical Engineering Journal, 2023
30 / 10 / 5
MDR Timeline Triggers (Days)
30 calendar days for manufacturers and importers reporting death or serious injury. 10 working days for device user facilities. 5 working days for manufacturers facing events requiring remedial action to prevent unreasonable public health risk.
21 CFR Part 803
Overview: Why MDR Compliance Matters
Medical Device Reporting under 21 CFR Part 803 is the FDA’s primary mechanism for post-market device surveillance. It requires manufacturers, importers, and device user facilities to report adverse events and malfunctions that meet defined thresholds, creating a system through which the FDA monitors whether marketed devices continue to perform safely and as intended after they reach patients.
The regulation is not voluntary. Failure to report a qualifying event, failure to report within the applicable timeline, or failure to maintain required MDR procedures and event files are all citable violations. The FDA verifies MDR compliance during facility inspections, investigators review MDR procedures under 21 CFR 803.17, check whether complaint files have been assessed for reportability under 803.18, and audit whether reports were submitted to the correct recipient within the required time. About 20% of MAUDE-reported events have led to recalls or other corrective actions, which illustrates why accurate and timely reporting is a patient safety obligation as well as a regulatory one.
The three-group structure: why your reporting role determines everything
21 CFR Part 803 divides reporting obligations by entity type: manufacturers (Subpart E), importers (Subpart F), and device user facilities (Subpart C). Each group has different triggering events, different reporting timelines, and different recipients for the reports they generate. A device user facility that treats its MDR obligations as if it were a manufacturer will over-report to the wrong parties; a manufacturer that treats its obligations as if it were a user facility will systematically under-report. Getting the entity classification right is the prerequisite for every other compliance decision in Part 803.
Prerequisites: What You Need Before Building an MDR Programme
Entity classification
Before writing MDR procedures, confirm which Part 803 entity type applies to your organisation. A single organisation can hold more than one role simultaneously, a company that manufactures and also imports devices it did not manufacture must comply with both Subpart E and Subpart F obligations. The definitions at 21 CFR 803.3 are the binding reference for these determinations.
Complaint handling system
MDR compliance is downstream from complaint handling. Under 21 CFR 820.198 (current QSR) or ISO 13485, organisations must have a complaint handling process that captures, documents, and evaluates device-related events. The MDR programme then applies a reportability assessment to complaints that meet the adverse event criteria. An MDR programme without an upstream complaint system is incomplete by design.
Understanding the reporting threshold
The MDR threshold is not based on certainty that the device caused harm. The operative standard under 21 CFR Part 803 is whether the information received “reasonably suggests” that the device may have caused or contributed to a death or serious injury, or whether a malfunction “would be likely to cause or contribute” to serious harm if it recurred. Reporters who wait for proof of causation before reporting are systematically under-reporting.
Access to FDA Form 3500A and eMDR system
Manufacturers and importers are required to submit MDRs electronically via the FDA’s Electronic Submissions Gateway (ESG) using the eMDR format. Device user facilities may use Form FDA 3500A or the MedWatch Safety Reporting Portal. Confirming access to the correct submission system before the first reportable event occurs, not during the 30-day or 10-day reporting window, is a basic programme readiness requirement.
Medical Device Reporting Requirements by Reporting Group
Manufacturers, 21 CFR Part 803 Subpart E
Manufacturers carry the most comprehensive MDR obligations under Part 803. They report to the FDA directly and must cover three triggering event types: death, serious injury, and malfunction.
Device User Facilities, 21 CFR Part 803 Subpart C
Device user facilities are hospitals, ambulatory surgical facilities, nursing homes, outpatient diagnostic facilities, and outpatient treatment facilities. They report adverse events involving devices they use in treating patients, but their reporting obligations are significantly more limited than manufacturers in scope, routing, and what they must report.
Death: report to FDA AND manufacturer, 10 working days
When a device user facility believes a device may have caused or contributed to the death of a patient, it must submit a report to the FDA and to the device manufacturer within 10 working days of becoming aware of the event. The report goes to both parties simultaneously, not to the manufacturer first and the FDA second. Source: 21 CFR 803.30
Serious injury: report to manufacturer only, 10 working days
When a device user facility believes a device may have caused or contributed to a serious injury, it reports only to the manufacturer within 10 working days. If the manufacturer is unknown, the report goes to the FDA instead. This routing rule is a common source of compliance errors: facilities that route all serious injury reports to the FDA, mirroring what they know about manufacturer obligations, are not compliant with Subpart C. Source: 21 CFR 803.32
Annual summary report to FDA, by January 1 each year
Device user facilities must submit an annual summary report to the FDA by January 1 of each year, summarising the reports submitted during the previous calendar year. This requirement applies even if the facility submitted no individual MDRs during the year, in that case, a report stating that no reportable events occurred must still be filed. Facilities that treat the annual report as optional because they had no individual reports are not compliant. Source: 21 CFR 803.33
Importers, 21 CFR Part 803 Subpart F
Importers are the initial distributors of foreign-manufactured devices in the US. Their MDR obligations sit between user facilities and manufacturers in scope and complexity.
Death or serious injury: FDA and manufacturer, 30 calendar days
When an importer becomes aware that a device may have caused or contributed to a death or serious injury, it must report to both the FDA and the device manufacturer within 30 calendar days. The importer’s report supplements but does not replace the manufacturer’s obligation. Both reports are required. Source: 21 CFR 803.40(a)
Malfunction: manufacturer only, 30 calendar days
When an importer becomes aware that a device has malfunctioned and that malfunction would be likely to cause or contribute to death or serious injury if it recurred, the report goes to the manufacturer only, not to the FDA. This is a key distinction from the manufacturer’s own obligation: importers route malfunction reports to the manufacturer, who then carries the reporting obligation to the FDA. Source: 21 CFR 803.40(b)
MDR Compliance Checklist
Procedures, 21 CFR 803.17
Written MDR procedures established and current
Internal reporting channels identify events to QA within required window
Reportability assessment criteria documented and applied consistently
Procedures reviewed and updated after regulatory changes
MDR Event Files, 21 CFR 803.18
MDR event file maintained for every event evaluated for reportability
Non-reportable event determinations documented with rationale
Event files retained for 2 years from the date of the event (manufacturers and importers) or 5 years (some device types)
Event files available to FDA upon inspection request
Submission Mechanics
Manufacturers and importers submit via FDA ESG using eMDR format
MedWatch Form FDA 3500A completed accurately and completely
Supplemental reports submitted when additional information becomes available
Date of awareness (clock-start) documented in complaint record
User Facility Specific
Death reports routed to both FDA and manufacturer simultaneously
Serious injury reports routed to manufacturer only (FDA if manufacturer unknown)
Annual summary report to FDA submitted by January 1 each year
Annual report filed even in years with no individual MDR submissions
Key Takeaways
The reporting threshold is “reasonably suggests”, not proof of causation
The most common reason organisations under-report under 21 CFR Part 803 is waiting for a determination that the device caused the harm before filing. Part 803’s threshold is lower: whether the information reasonably suggests the device may have caused or contributed. If investigation later establishes no device involvement, a supplemental report can reflect that, but the initial report must still be filed within the window.
Report routing differs by entity type and event type, errors in routing are compliance failures
A device user facility that routes a serious injury report to the FDA instead of the manufacturer is not compliant, even if the FDA receives the information. An importer that routes a malfunction report to the FDA instead of the manufacturer is not compliant. Correct routing is a distinct compliance requirement from filing the report at all. Routing errors are cited separately from untimely reporting during FDA inspections.
MDR event files must exist even for events determined not to be reportable
Under 21 CFR 803.18, organisations must maintain MDR event files for all events evaluated for reportability, including events where the determination was that no report was required. An FDA inspector reviewing MDR compliance will ask for event files on non-reportable determinations as well as filed reports. An organisation that only documents reportable events is not compliant with 803.18, even if every required report was filed on time. The event file is the evidence that a proper assessment occurred.
Frequently Asked Questions
What is Medical Device Reporting (MDR) under 21 CFR Part 803?
21 CFR Part 803 is the FDA’s mandatory medical device adverse event reporting regulation. It requires manufacturers, importers, and device user facilities to report device-related deaths, serious injuries, and certain malfunctions to the FDA within defined timelines. Reports are submitted to the FDA’s MAUDE database, which is publicly searchable and is used by the FDA for post-market surveillance and signal detection. MDR reporting is a post-market safety obligation, failure to comply is citable during FDA inspections and can result in Warning Letters, injunctions, or consent decrees.
What is the difference between a 30-day report and a 5-day report?
A 30-day report covers most manufacturer and importer MDR submissions: deaths, serious injuries, and malfunctions that would likely cause or contribute to serious harm if they recurred. A 5-day report, required under 21 CFR 803.53, is triggered when a manufacturer becomes aware of an event that requires remedial action to prevent an unreasonable risk of substantial harm to public health, or when FDA specifically requests a 5-day report. The 5-day timeline runs in working days, not calendar days.
When does a device user facility need to report to the FDA versus the manufacturer?
Death events require reports to both the FDA and the manufacturer simultaneously, within 10 working days. Serious injury events require a report to the manufacturer only (or to the FDA if the manufacturer is unknown), within 10 working days. Device user facilities do not file malfunction reports independently, only deaths and serious injuries are within their reporting scope. The annual summary report goes to the FDA regardless of whether any individual reports were filed during the year.
What does it mean for a malfunction to be “likely to cause or contribute” to harm?
Under 21 CFR 803.3, a malfunction is reportable when it would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. This is a prospective risk assessment applied to the specific malfunction type, not a determination of what the actual event caused. A device failure that caused no patient injury but that poses a real risk of serious harm if it recurs must be reported. The FDA’s guidance recommends considering whether the device’s design, labelling, or intended use would allow a recurrence to result in serious patient impact.
How long must MDR event files be retained?
Under 21 CFR 803.18, manufacturers and importers must retain MDR event files for 2 years from the date of the event or the date of the report, whichever is later. For certain implantable devices, longer retention periods may apply under device-specific regulations. Device user facilities must retain event files for 2 years from the date of the adverse event. Files must include the information used to determine whether a report was required, meaning non-reportable assessments must also be documented and retained.
Can organisations request exemptions from MDR reporting requirements?
Yes. Under 21 CFR 803.19, manufacturers, importers, and device user facilities may request an exemption or variance from MDR reporting requirements by submitting a written request to CDRH at MDRPolicy@fda.hhs.gov. The request must identify the organisation and device, describe the specific exemption or variance requested, and explain the justification. The FDA also operates a Voluntary Malfunction Summary Reporting Program that allows eligible manufacturers to submit quarterly summary reports for certain malfunction types rather than individual 30-day reports.
What happens if an organisation submits an MDR late?
Late MDR submission is a citable violation under 21 CFR Part 803. During FDA inspections, investigators review MDR event files and assess whether the date of awareness documented in complaint records is consistent with the date the report was filed. Systematic late reporting, particularly patterns where multiple reports were filed after the applicable deadline, is treated as a serious compliance gap and can support Warning Letter issuance, injunction, or consent decree. Late reports should still be filed with an explanation for the delay; filing late is always preferable to not filing at all.
Sources
Government and Regulatory Sources
- 21 CFR Part 803: Medical Device Reporting (eCFR): the authoritative current text of the MDR regulation, including Subpart C (device user facilities), Subpart E (manufacturers), and Subpart F (importers), with all section-level obligations and timelines.
- FDA: Mandatory Reporting Requirements, Manufacturers, Importers, and Device User Facilities: FDA’s official summary of MDR obligations for each reporting group, including links to Form 3500A, eMDR instructions, and the MAUDE database.
- FDA: Medical Device Reporting (MDR): How to Report Medical Device Problems: FDA guidance on what constitutes a reportable event, the MedWatch Form 3500A, and access to the MAUDE database.
- FDA Inspection Guide: Medical Device Reporting: the FDA’s own inspector guidance for verifying MDR compliance, identifies the specific procedures, files, and records investigators review during facility inspections.
Research and Industry Sources
- Global Clinical Engineering Journal: Analysis of Adverse Event Reports in FDA’s MAUDE Database (2023): peer-reviewed analysis of MAUDE data from 1991 to November 2022, source for 15 million total reports, 2.5 million in first 10 months of 2022, 96% manufacturer-submitted, 20% leading to recalls or corrective actions.
- SG Systems Global: 21 CFR Part 803 MDR Reference: compliance reference for reporting timelines, event types, and entity-specific obligations under 21 CFR Part 803, updated December 2025.
Related VelSafe Articles
Insights
EU MDR 2017/745: What Articles 1 and 2 Mean for Compliance
Evidence-based analysis of EU MDR scope, Notified Body capacity gap, and what Articles 1 and 2 require for manufacturers, importers, and authorised representatives in the EU market.
Tips
VelSafe Tips: Compliance and Regulatory Guidance
Actionable compliance tips for regulated industry practitioners, covering FDA, OSHA, and healthcare regulatory requirements.
Insights
VelSafe Insights: FDA Inspections and Regulatory Analysis
Evidence-led analysis of FDA inspection trends, enforcement activity, and compliance programme implications across the medical device and pharmaceutical sectors.
FDA MEDICAL DEVICE COMPLIANCE LIBRARY
Building Your MDR Compliance Programme?
Explore VelSafe’s FDA compliance library, guides, insights, and regulatory analysis covering 21 CFR Part 803, Part 820, and the full device post-market lifecycle.
Explore All Guides
