LAW: Medical Device Quality and Regulatory Compliance
FDA Complaint Handling for Medical Device Manufacturers
What the QMSR and ISO 13485 Clause 8.2.2 Require
Complaint handling is one of the most inspected areas in FDA medical device audits. The Quality Management System Regulation (QMSR), effective February 2, 2026, replaced the legacy Quality System Regulation (QSR) and now governs complaint handling through 21 CFR Part 820 incorporating ISO 13485:2016 Clause 8.2.2 by reference, with additional FDA-specific requirements. This guide covers what changed, what is required, and what must be documented.
Feb 2
QMSR Effective Date
The FDA’s Quality Management System Regulation (QMSR) became effective February 2, 2026, replacing the legacy QSR. Old 820.198 complaint handling requirements no longer apply. ISO 13485:2016 Clause 8.2.2 now governs, with FDA-specific additions.
FDA, 21 CFR Part 820, QMSR Final Rule
30
Day MDR Deadline
Complaints involving death, serious injury, or malfunction that could cause or contribute to death or serious injury must be reported to FDA under 21 CFR Part 803 within 30 calendar days of becoming aware of the event.
FDA, 21 CFR Part 803
#1
Most Inspected QMS Area
Complaint handling is consistently among the most cited areas in FDA medical device facility inspections. Incomplete complaint files, missing investigation decisions, and absent MDR determinations are recurring Form 483 observations.
FDA 483 Enforcement Data
What Changed: QSR to QMSR
The old complaint handling requirement was 21 CFR 820.198 under the Quality System Regulation (QSR). It specified detailed requirements for complaint files, investigations, MDR determinations, and documentation in standalone regulatory text. That regulation was superseded on February 2, 2026, when FDA’s Quality Management System Regulation (QMSR) took effect.
Under the QMSR, complaint handling requirements now operate through a two-layer structure. The first layer is ISO 13485:2016 Clause 8.2.2, which the QMSR incorporates by reference into 21 CFR Part 820. The second layer is the FDA-specific additions in Part 820 that go beyond what ISO 13485 requires. Manufacturers must satisfy both layers simultaneously. ISO 13485 certification does not exempt a manufacturer from FDA inspection, and ISO compliance alone does not satisfy every QMSR requirement.
For manufacturers already operating under ISO 13485:2016, the transition to QMSR is relatively straightforward in concept but requires careful review of the FDA-specific additions. For manufacturers who had only ever complied with the QSR and never adopted ISO 13485, the QMSR represents a significant structural change requiring updates to the Quality Manual, complaint handling SOPs, and training programs.
Legal Disclaimer
This article provides educational information about FDA complaint handling requirements under the QMSR and 21 CFR Part 820. It is not legal or regulatory advice. Manufacturers should consult qualified regulatory affairs professionals and legal counsel to ensure their programs meet all applicable requirements. FDA regulatory requirements are subject to change through guidance documents, inspection observations, and rulemaking.
Key Regulatory Reference Points
21 CFR Part 820 (QMSR)
The Quality Management System Regulation, effective February 2, 2026. Replaces the QSR. Incorporates ISO 13485:2016 by reference and adds FDA-specific complaint handling requirements beyond what ISO 13485 Clause 8.2.2 requires.
FDA, US Food and Drug Administration
ISO 13485:2016 Clause 8.2.2
Complaint handling requirements incorporated by reference into 21 CFR Part 820 under the QMSR. Establishes the baseline complaint handling process including definition, documentation, investigation, and regulatory reporting obligations.
International Organization for Standardization
21 CFR Part 803
FDA’s Medical Device Reporting (MDR) regulation. Establishes mandatory reporting requirements for device-related deaths, serious injuries, and malfunctions. Complaint investigation decisions must evaluate and document MDR applicability for each reportable complaint.
FDA, Medical Device Reporting
FD&C Act Section 501(h)
A device that does not conform to applicable QMSR requirements is considered adulterated under the Federal Food, Drug, and Cosmetic Act. This classification can trigger import alerts, warning letters, consent decrees, and seizure actions.
US Federal Food, Drug, and Cosmetic Act
What Is a Complaint Under the QMSR?
The definition of a complaint under the QMSR follows ISO 13485:2016 and is deliberately broad. A complaint is any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it has been released for distribution.
This definition captures far more communications than manufacturers sometimes expect. A call from a physician reporting unexpected behavior of a device during a procedure is a complaint. An email from a distributor noting that a device did not perform as labeled is a complaint. A social media post from a patient describing an adverse experience with a device is a complaint if it comes to the manufacturer’s attention and meets the definition criteria. The fact that the communication did not use the word “complaint” is irrelevant. The content determines whether the communication is a complaint, not the label the sender applied to it.
Is a Complaint
Reports of device malfunction, performance failure, or unexpected behavior after release. Customer reports of injury, patient harm, or death connected to device use. Claims that a device does not meet its labeled specifications or indications. Reports of packaging defects or labeling errors discovered after distribution.
Not a Complaint
Requests for product information, pricing, or availability. Comments about packaging preference with no claim of deficiency. Internal nonconformances identified during manufacturing before release. Pre-distribution quality holds that never resulted in distribution.
Evaluate Carefully
Verbal communications reported secondhand. Social media mentions that reach manufacturer staff. Reports from competitors about device behavior in comparison contexts. Feedback during advisory board or clinical meetings that includes performance observations.
The Two-Layer Complaint Handling Framework
Under the QMSR, complaint handling is governed by both ISO 13485:2016 Clause 8.2.2 and additional FDA-specific requirements in 21 CFR Part 820. The FDA-specific requirements go beyond what ISO 13485 alone requires and represent the areas most likely to generate Form 483 observations during inspections.
Layer 1: ISO 13485:2016 Clause 8.2.2 Requirements
ISO 13485:2016 Clause 8.2.2 requires manufacturers to establish a documented procedure to handle complaints. The procedure must ensure that complaints are processed in a timely manner, evaluated and investigated as applicable, and reported to regulatory authorities in accordance with applicable regulatory requirements. Specifically, the ISO clause requires that complaint files include the information needed to properly investigate the complaint, and that the results of any investigation and any corrective action are documented.
ISO 13485:2016 Clause 8.2.2 Complaint File Requirements
Documented complaint handling procedure
A written SOP covering receipt, evaluation, investigation decision, investigation process, regulatory reporting determination, and closure must exist before any complaints are received.
Timely processing
Complaints must be processed in a timely manner. The SOP must define timelines for each stage (receipt acknowledgment, investigation initiation, MDR determination, investigation closure). ISO 13485 does not set specific day counts; FDA’s MDR deadlines (30 days for most reportable events) provide the binding timeline for the MDR determination step.
Evaluation and investigation as applicable
Not every complaint requires a formal investigation. However, the decision not to investigate must be documented with the rationale. Undocumented non-investigation decisions are a recurring Form 483 observation.
Reporting to regulatory authorities
The procedure must include a step for evaluating whether each complaint requires reporting under applicable regulations. For US market devices, this means evaluating MDR applicability under 21 CFR Part 803.
Source: ISO 13485:2016 Clause 8.2.2 | Incorporated by reference into 21 CFR Part 820 (QMSR)
Layer 2: FDA-Specific Additions in 21 CFR Part 820
The FDA’s QMSR adds requirements beyond ISO 13485 Clause 8.2.2 that specifically address the US regulatory context. These additions are where inspectors focus when the ISO 13485 baseline is met but FDA-specific gaps remain. The eCFR text of 21 CFR Part 820 specifies that in addition to Clause 8.2.2, manufacturers must maintain records of review, evaluation, and investigation for any complaints involving possible failure of a device, labeling, or packaging to meet specifications.
FDA-Specific Requirement
What Must Be Documented
Specification conformance review
For complaints involving possible failure of a device, labeling, or packaging to meet specifications: records of the review, evaluation, and investigation must be maintained. The evaluation must address whether the device met its specifications at the time of the complaint event.
Justification for not investigating similar complaints
If an investigation has already been performed for a similar complaint, a new investigation is not required. However, the manufacturer must maintain records documenting the justification for not performing the new investigation, and linking it to the prior investigation.
Required records for investigated complaints and MDR-reportable complaints
For complaints that must be reported under Part 803, complaints the manufacturer determines must be investigated, and complaints the manufacturer investigated regardless of those requirements, specific fields must be recorded. See the Required Record Fields table below.
UDI capture in complaint records
The QMSR requires complaint records to capture any Unique Device Identifier (UDI) or Universal Product Code (UPC), and any other device identification(s) associated with the complaint. This is a significant addition compared to the prior QSR.
Source: FDA | 21 CFR Part 820 (QMSR), effective February 2, 2026
Required Fields for Investigated and MDR-Reportable Complaint Records
The QMSR specifies the minimum data fields that must be captured for complaints that are investigated, complaints that must be reported under Part 803, and complaints the manufacturer investigated regardless of those requirements. Complaint management systems must be designed to capture all of these fields consistently.
Field
Notes
Device name
The name of the device as it appears in labeling or the QMS
Date the complaint was received
The date the manufacturer first became aware of the complaint, not the date it was entered into the system
Any unique device identifier (UDI) or UPC and other device identification(s)
New requirement under QMSR not present in the old QSR. Capture lot number, serial number, model/catalog number, UDI-DI, and UDI-PI as applicable
Name, address, and phone number of the complainant
Capture all available contact information; document if complainant declined to provide or if information is unavailable
Nature of the complaint
A complete description of the alleged deficiency as reported by the complainant, in the complainant’s words where possible
Date and outcome of investigation
The date the investigation was completed and a clear statement of the conclusion, including root cause determination where identified
Any device deficiency or malfunction identified
If a device deficiency is confirmed, document the specific failure mode and its connection to the complaint allegation
MDR determination
Document whether an MDR was submitted, and if not, the rationale for why the complaint does not meet Part 803 reporting thresholds
Any corrective action taken
If corrective action (CAPA) was initiated, reference the CAPA number and describe what action was taken or is pending
Source: FDA | 21 CFR Part 820 (QMSR) | ISO 13485:2016 Clause 8.2.2
Investigation Decision-Making: When You Must Investigate
One of the most commonly cited complaint handling failures is the failure to make and document the investigation decision consistently. Under both ISO 13485 and the QMSR, the decision to investigate or not investigate must be made for every complaint and documented with a rationale. Silence is not a decision.
Must Investigate
No Discretion
Any complaint that involves or could involve: death or serious injury to a patient or user; a device malfunction that, if it were to recur, could cause or contribute to death or serious injury; or a possible failure of the device to meet any of its specifications. For these complaints, investigation is mandatory, not discretionary.
May Decline to Investigate
Documented Justification Required
Where a prior investigation for a substantially similar complaint has already been completed and a new investigation would not provide additional information, a manufacturer may reference the prior investigation and document why a new investigation is not needed. The link to the prior investigation must be explicit.
Document Either Way
No Undecided Complaints
Every complaint must have an explicit investigation decision documented in the complaint record. A complaint file with no investigation decision is an incomplete file, and incompleteness is itself a Form 483 observation regardless of what the correct decision would have been.
MDR Determination: What Must Be Documented
Every complaint evaluation must include a documented MDR determination. This is separate from the investigation decision. Even if a complaint does not require investigation, the record must show that MDR applicability was evaluated and document the conclusion with the rationale.
Event Type
MDR Deadline
Who Must Report
Death
30 calendar days
Manufacturers, importers
Serious injury
30 calendar days
Manufacturers, importers
Malfunction that could cause death or serious injury if it recurs
30 calendar days
Manufacturers only (not importers or device user facilities)
Malfunction requiring remedial action to prevent unreasonable risk of serious injury
30 calendar days
Manufacturers only
Events requiring remedial action to prevent an unreasonable risk of substantial harm to the public health (5-day reports)
5 calendar days
Manufacturers, importers
Source: FDA | 21 CFR Part 803: Medical Device Reporting
Documentation Rule: When a complaint does NOT require an MDR, the complaint record must still document that the MDR determination was made and state the rationale for why the event does not meet Part 803 reporting thresholds. Absence of an MDR determination in a complaint file is a Form 483 observation even when no MDR was actually required.
Complaint Trending and Signal Detection
Both ISO 13485 and the QMSR require that complaint data be analyzed as part of the quality management system’s monitoring and measurement processes. Complaint trending is not just a best practice. It is a regulatory requirement under ISO 13485 Clause 8.4 (Analysis of Data) and connects directly to CAPA requirements.
A robust complaint trending program monitors complaint rates by device type and complaint category, flags statistically significant changes in complaint frequency or severity, feeds into the design review process when device design is implicated, and identifies systemic issues that no individual complaint may reveal on its own. FDA inspectors look for evidence that manufacturers are using complaint data to drive quality improvements, not simply filing individual complaints and closing them in isolation.
Monitor Rates, Not Just Counts
Raw complaint counts are misleading if sales volume changes. Track complaints per unit sold or per procedure performed. A complaint rate increase is a signal even if absolute complaint counts are flat.
Categorize Consistently
Inconsistent complaint categorization makes trend detection impossible. Define complaint categories in the SOP, train complaint handlers on consistent application, and audit categorization decisions periodically.
Connect Trends to CAPA
When a complaint trend is identified, it must be evaluated for whether CAPA is warranted. Document the analysis and the decision. A trend that was identified but not acted on, without documented rationale, is evidence of an inadequate CAPA system.
Common Form 483 Observations in Complaint Handling
Most Frequently Cited Complaint Handling Failures
No documented MDR determination
Most Common
Complaint records with no documentation showing that MDR applicability was evaluated. Even for complaints clearly below MDR threshold, the determination and rationale must be recorded.
No documented investigation decision for non-investigated complaints
Very Common
Complaints closed without a documented rationale for why investigation was not performed. Absence of an investigation decision is itself the violation, regardless of whether investigation was actually required.
Missing required data fields in complaint records
Common
Complaint files missing one or more required fields: date received, device identification, complainant contact information, nature of complaint, investigation outcome, or corrective action. Under the QMSR, UDI is now also a required field.
Failure to recognize complaints as complaints
Common
Customer service, sales, or field service teams receiving complaint-qualifying communications but not routing them into the complaint management system. Training and intake procedures must capture all channels through which complaints may arrive.
No complaint trending or inadequate data analysis
Moderate
Complaint data not being analyzed for trends, or trend analysis not connected to the CAPA system. Management review that does not include complaint trending data is also a compliance gap under ISO 13485 Clause 5.6.
Source: FDA 483 Enforcement Data | QMSR and ISO 13485:2016 Requirements
Key Takeaways
Old 820.198 No Longer Applies
The QSR section 820.198 that governed complaint handling for decades was replaced effective February 2, 2026. Complaint handling SOPs, training materials, and audit checklists that reference 820.198 must be updated to the QMSR framework and ISO 13485:2016 Clause 8.2.2 plus FDA-specific additions.
UDI Is Now a Required Field
The QMSR added UDI (and UPC) capture as a required field in complaint records for investigated complaints and MDR-reportable complaints. Complaint management systems that do not have a UDI field must be updated. This requirement did not exist under the old QSR.
Document Every Decision, Not Just Every Action
Both the investigation decision and the MDR determination must be documented for every complaint, regardless of the outcome. A complaint record that shows only the outcome (no investigation, no MDR) without the documented rationale for that outcome is an incomplete record.
ISO Certification Does Not Replace FDA Inspection
The QMSR does not change FDA’s inspection authority. ISO 13485 certification from a notified body does not exempt a manufacturer from FDA inspections or from meeting the FDA-specific additions in Part 820 that go beyond what ISO 13485 alone requires.
Frequently Asked Questions
Does the QMSR change the definition of a complaint?
The QMSR adopts the ISO 13485:2016 definition: any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, safety, effectiveness, or performance of a device after it has been released for distribution. This definition is substantively similar to the old QSR definition, but the ISO framing is broader in some respects. Manufacturers should review their complaint intake procedures against the ISO 13485 definition, not the old QSR text.
We already have ISO 13485 certification. Do we need to do anything differently under QMSR?
ISO 13485 certification is a strong foundation but does not fully satisfy QMSR. The FDA-specific additions in 21 CFR Part 820 go beyond ISO 13485 Clause 8.2.2 in several areas, including the UDI capture requirement, the justification-for-not-investigating requirement, and the specification conformance review requirement. Manufacturers with ISO 13485 certification should conduct a gap analysis against the full QMSR text, not just against ISO 13485.
How long must complaint records be retained?
Under the QMSR, complaint records must be retained for a period equivalent to the design and expected life of the device, but in no case less than two years from the date of release of the device for distribution, or as otherwise required under applicable regulations. For implantable devices and other long-life devices, the retention period may be substantially longer. Consult regulatory counsel for device-specific retention requirements.
What happens if FDA determines our complaint handling is deficient?
Deficient complaint handling can result in a Form 483 observation during an inspection. If the deficiency is serious or systemic, it may result in a Warning Letter. Continued failure to correct complaint handling deficiencies can result in consent decree actions, import alerts, or seizure of devices. Under FD&C Act Section 501(h), a device manufactured without meeting QMSR requirements is considered adulterated.
Government and Regulatory Sources
Industry References
Related VelSafe Articles
Build a Complaint Handling System That Survives Inspection
The QMSR transition changed the regulatory framework but not the inspection reality: complaint handling is one of the most scrutinized areas in every FDA device facility audit. A complaint system that documents every decision, captures all required fields, makes and records MDR determinations consistently, and feeds complaint data into trend analysis and CAPA processes is one that performs under inspection pressure. Update your SOPs, train your teams, and verify your complaint management system captures the new UDI requirement. Find more medical device compliance resources at velsafe.com.
