21 CFR 803Medical Device Reporting

21 CFR Part 803 is the FDA's Medical Device Reporting (MDR) regulation. It requires manufacturers, importers and device user facilities to report certain device-related adverse events and product problems to FDA. The rule is what gives FDA's MAUDE database its content; it is the primary post-market signal FDA uses to detect emerging safety problems with devices already on the market.

MDR is the device equivalent of pharmacovigilance for drugs (21 CFR 314.80 for NDAs, 600.80 for biologics). It does not replace recall reporting (21 CFR Part 806), correction-and-removal reporting (also Part 806), or the broader post-market surveillance obligations under section 522 of the FD&C Act. A single event can trigger reports under several of these rules simultaneously.

Manufacturers have the broadest obligations and the strictest deadlines. User facilities have a more limited reporting scope (deaths only to FDA, serious injuries to the manufacturer). Importers act as a relay between user facilities/health professionals and the manufacturer, with their own reporting deadlines.

A manufacturer must submit an MDR to FDA no later than 30 calendar days after the day it becomes aware of information that reasonably suggests one of its marketed devices may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device marketed by the manufacturer would likely cause or contribute to a death or serious injury if the malfunction were to recur. The clock starts on the day any employee with management or scientific responsibility for the device becomes aware — not the day QA opens the complaint, not the day the complaint is investigated, and not the day the cause is confirmed.

'Reasonably suggests' is the standard — not 'proven', not even 'likely'. The reporter does not have to determine causation before reporting; the report itself is the mechanism FDA uses to detect signals. Under-reporting because 'we weren't sure the device was the cause' is the single most common MDR enforcement theme.

A 5-day report is required when a manufacturer becomes aware of an MDR-reportable event that necessitates remedial action to prevent an unreasonable risk of substantial harm to public health, or when FDA has made a written request for a 5-day report on an event. The 5-day clock starts on the day the manufacturer becomes aware that remedial action is necessary. 5-day reports are submitted via the same eMDR channel as 30-day reports but with the higher-urgency flag.

Remedial action that triggers the 5-day clock includes any action other than routine maintenance or service. A field correction (Part 806), a removal, an information notice to users, a software patch pushed to address a safety issue, and a change in labelling for safety reasons are all examples. The 5-day report does not replace the Part-806 correction-or-removal report; both are required.

A malfunction is reportable when the device or a similar device marketed by the manufacturer would likely cause or contribute to a death or serious injury if the malfunction were to recur. 'Similar device' is read broadly — same model line, same product family, same critical components. A single malfunction that did not cause harm this time can still be reportable if a recurrence would likely cause harm.

The 2014 final rule streamlined certain malfunction reports through eMDR's summary-report option for high-volume, well-characterised malfunctions where FDA has granted an exemption. The exemptions are listed on the FDA MDR Reporting page and are device-class-specific; most manufacturers must continue with individual reports.

Since August 2015, all MDRs must be submitted electronically through the eMDR system in the FDA Electronic Submissions Gateway (ESG), using either the HL7 ICSR Release 2 format or the eSubmitter tool for low-volume reporters. Paper MDRs are no longer accepted from manufacturers, importers or user facilities (except in narrowly defined ESG-down scenarios documented in §803.12(b)).

Manufacturers operating at scale typically integrate their complaint-handling system directly with eMDR through ICSR Release 2 messaging, eliminating the manual eSubmitter step. The integration validates the report content against the FDA schema before submission and tracks the FDA acknowledgement message that closes the reporting loop.

User facilities — defined in §803.3 as a hospital, ambulatory surgical facility, nursing home or outpatient treatment or diagnostic facility — have a narrower reporting scope than manufacturers. Deaths must be reported to FDA and to the manufacturer no later than 10 working days. Serious injuries must be reported to the manufacturer (only) within 10 working days; the manufacturer then assesses for §803.50 reportability. User facilities also submit an annual report on Form FDA 3419 listing all reports made during the year.

User facility reports are an important detection mechanism because user facilities see device performance in the real environment, not on the bench. Many catheter, infusion-pump and home-use-device MDRs originate as user-facility reports.

1. §803.50 — Late reports (filed more than 30 days after the manufacturer became aware), with no documented justification for the delay.
2. §803.50 — Under-reporting: complaints meeting the reportability criteria are investigated but no MDR is filed because causation 'was not confirmed'.
3. §803.17 — Written MDR procedures are absent, out of date, or do not assign clear responsibility for reportability assessment.
4. §803.18 — Records of complaints and the reportability assessment are incomplete; the reasoning for non-reporting is not documented.
5. §803.53 — 5-day report obligation not recognised when remedial action was taken; only a 30-day individual report is filed.
6. §803.56 — Supplemental and follow-up reports not filed when new information becomes available about a previously reported event.
7. §803.12 — eMDR transmission failures not tracked; reports believed to be filed are not actually acknowledged by FDA ESG.
8. §820.198 (the cGMP complaint rule, cited alongside Part 803) — Complaint files lack the MDR reportability assessment.

• Complaint intake captures the §803.3(b)(2) awareness date — the day the company first learned of the event, not the day the file was opened — and starts the 30-day clock automatically.
• Reportability assessment is a structured decision record with the §803.50/§803.53 criteria, the assessor's signature, the date, and the reasoning; non-report decisions are evidenced.
• 5-day vs 30-day classification is driven by whether the case is linked to a remedial action (field correction, removal, patch); the higher-urgency case automatically flips the clock.
• eMDR generation produces an HL7 ICSR Release 2 message validated against the FDA schema before submission; FDA ESG acknowledgements are tracked and surfaced.
• Supplemental and follow-up reports are linked to the parent MDR so the audit trail of the case is one record, not a folder of separate filings.
• Trend analysis aggregates complaints and MDRs by failure mode and device family; emerging trends surface in the PMS dashboard for CAPA evaluation per §820.100.