Complaint handling is still a top FDA finding
In FY2025, § 820.198(a) complaint handling was the second most-cited device observation, with 211 citations (GMP Insiders). Under the new QMSR, it remains near the top: in the first ~100 inspections, FDA ranked risk management first, outsourcing second and “inadequate complaint handling” third (RAPS).
For how to investigate, assess and trend complaints, see Medical Device Complaint Investigation, Assessment and Trending: A Practical Guide for 2026. For what complaint management systems and software must do, see Complaint Management Systems and Software for Regulated Companies: Requirements, AI and Selection.
What QMSR requires for complaint records
Since February 2, 2026, complaint handling follows ISO 13485:2016 clause 8.2.2 plus FDA’s § 820.35. In addition to clause 8.2.2, manufacturers “shall maintain records of the review, evaluation, and investigation” of complaints involving the possible failure of a device, labeling or packaging to meet specifications (eCFR). Required content includes:
- Device name and date the complaint was received
- “Any unique device identifier (UDI) or universal product code (UPC)”
- Complainant name, address and phone
- “The nature and details of the complaint”
- Any correction or corrective action taken
- Any reply to the complainant
- Justification when an investigation is not performed
Even firms exempt from CGMP must keep complaint files (FDA).
MDR reportability: the rules that matter
| Rule | Requirement (21 CFR Part 803) |
|---|---|
| Become aware | When you have “acquired information that reasonably suggests a reportable adverse event has occurred” (§ 803.3) |
| 30-day report | Within “30 calendar days” when a device “may have caused or contributed to a death or serious injury,” or malfunctioned and would be likely to do so if the malfunction recurred (§ 803.50) |
| 5-day report | Within “5 work days” when an event “necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health,” or when FDA requests (§ 803.53) |
| Serious injury | Life-threatening, permanent impairment or damage, or “necessitates medical or surgical intervention” to prevent it (§ 803.3) |
| Format | Reports submitted “in an electronic format” (§ 803.12) |
Source: eCFR Part 803. Eligible malfunctions may instead be reported quarterly under FDA’s Voluntary Malfunction Summary Reporting program (FDA).
2026 trends
- Under-reporting draws attention. One industry analysis reports that “FDA has opened for cause inspections solely on the basis that a firm reported zero MDRs” (MedDeviceOnline, the author’s claim).
- Complaints must feed risk. FDA said investigators “may also evaluate how complaints, as part of the feedback process, are used as an input to risk management” (FDA transcript).
- New adverse event system. FDA launched its Adverse Event Monitoring System (AEMS) in March 2026, with plans to replace MAUDE for devices (RAPS). Check FDA’s site for the current device cutover status.
Complaint handling checklist
Intake
- All channels captured: sales, service, field staff, social media, distributors
- Clear definition of a complaint; feedback that is not a complaint is still logged as feedback
- Required § 820.35 fields enforced, including UDI or UPC
- “Become aware” date recorded at intake
Evaluation and MDR decision
- Every complaint assessed for MDR reportability, with a documented rationale
- Death, serious injury and malfunction criteria applied as defined in § 803.3
- 30-day and 5-work-day clocks tracked from the become-aware date
- Corrections and removals assessed under Part 806 when field action is considered
Investigation
- Investigation performed for complaints involving possible failure to meet specifications, or justification recorded
- Returned product analysis, DHR/batch record review and similar complaint search done
- Root cause documented with evidence
Closure and feedback
- Reply to complainant recorded
- Complaints linked to CAPA when a systemic issue is found
- Complaint data fed into the risk management file and design review
- Complaint trending reviewed at defined intervals and in management review
A quick MDR reportability guide
| Question | If yes |
|---|---|
| Did the device cause or contribute to a death or serious injury, or may it have? | File a 30-day MDR |
| Did the device malfunction, and would recurrence likely cause or contribute to death or serious injury? | File a 30-day MDR (or VMSR summary if eligible) |
| Does the event require remedial action to prevent unreasonable risk of substantial harm? | File a 5-day report |
| None of the above | Document the rationale for not reporting |
This summary is not a substitute for Part 803 or legal advice; document each decision against the regulation text.
Check your complaint procedures against QMSR
Many complaint findings trace to procedures that predate QMSR: missing UDI fields, no documented MDR rationale, or no link to the risk file. AI document assessment can read your complaint and MDR SOPs against § 820.35, Part 803 and ISO 13485 clause 8.2.2, flag missing elements and cite the passage behind every finding.
Run a sample regulatory document assessment on your complaint handling SOP. AskDona shows the evidence; your team decides.
FAQ
What must a complaint record contain under QMSR? Device name, date received, UDI or UPC, complainant contact details, nature and details of the complaint, corrective action and reply to the complainant (eCFR § 820.35).
When is an MDR due? Within 30 calendar days of becoming aware of a reportable death, serious injury or malfunction; within 5 work days if remedial action is needed to prevent unreasonable risk (eCFR Part 803).
Do we have to investigate every complaint? Complaints involving possible failure to meet specifications must be investigated unless a similar investigation was already done, with the justification documented.
How do complaints link to risk management? FDA investigators may evaluate how complaints are used as an input to risk management (FDA transcript).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| eCFR: 21 CFR Part 820 | Regulation text | Current | § 820.35 complaint records |
| eCFR: 21 CFR Part 803 | Regulation text | Current | MDR definitions and timelines |
| FDA: QMSR | Regulator | Feb 2, 2026 | Complaint files for exempt firms |
| FDA: Voluntary Malfunction Summary Reporting | Regulator | Mar 2025 | VMSR |
| FDA: QMSR webinar transcript | Regulator | Apr 1, 2026 | Complaints as risk input |
| GMP Insiders: FY2025 observations | Industry analysis | Jan 5, 2026 | 211 complaint citations |
| RAPS: Top QMSR observations | Trade press | May 14, 2026 | Complaint handling #3 |
| MedDeviceOnline: Risk Is the Spine | Expert column | May 29, 2026 | Zero-MDR for-cause claim |
| RAPS: FDA consolidates adverse event systems | Trade press | Mar 11, 2026 | AEMS |