What is 21 CFR Part 803?

21 CFR Part 803 is the FDA regulation that establishes mandatory medical device reporting (MDR) requirements for manufacturers, importers, and device user facilities. The regulation requires these entities to report certain adverse events involving medical devices to FDA, creating a post-market surveillance signal that the agency uses to identify device safety issues, take corrective action, and protect patients.

According to the FDA’s MDR guidance, Part 803 contains mandatory requirements for reporting when a device may have caused or contributed to a death or serious injury, and when a device malfunctions in a way that would likely cause or contribute to death or serious injury if it were to recur. The regulation covers the full post-market lifecycle of a device from the point of distribution through the end of its commercial life.

Part 803 works alongside other post-market requirements. Manufacturers subject to Part 803 are also typically subject to 21 CFR Part 806, which covers corrections and removals (recalls), and to the quality system requirements of 21 CFR Part 820. Together these regulations form the post-market compliance framework that FDA inspects during Quality System inspections.

Who must comply with 21 CFR Part 803?

Part 803 applies to three distinct categories of entities, each with different reporting obligations.

Device manufacturers are the primary regulated entity under Part 803. A manufacturer for MDR purposes includes any person who designs, manufactures, fabricates, assembles, or processes a finished device, as well as any person who remanufactures, relabels, or reprocesses a device. Manufacturers have the broadest reporting obligations under the regulation.

Device importers are companies that import devices manufactured outside the U.S. and distribute them in domestic commerce. Importers have reporting obligations for deaths and serious injuries, though their obligations are narrower than those of manufacturers.

Device user facilities are hospitals, ambulatory surgical facilities, nursing homes, outpatient diagnostic facilities, and outpatient treatment facilities that use devices in the care of patients. User facilities must report device-related deaths to both FDA and the manufacturer, and device-related serious injuries to the manufacturer.

What events must be reported under Part 803?

Manufacturers must report to FDA when they receive or become aware of information that reasonably suggests a marketed device may have caused or contributed to a death or serious injury, or when a device has malfunctioned and that device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.

The threshold for reporting is intentionally broad. FDA does not require certainty that the device caused the adverse event. The regulation uses the phrase “reasonably suggests,” meaning that if the available information indicates a plausible relationship between the device and the adverse outcome, reporting is required. Waiting to confirm causation before reporting is one of the most common MDR compliance errors FDA cites during inspections.

Serious injury under Part 803 means an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure, requires in-patient hospitalization for more than 24 hours, or causes birth defects.

Malfunctions are reportable when the device did not perform as designed, intended, or expected, and that malfunction would be likely to cause or contribute to death or serious injury if it recurred. This means quality teams must evaluate each malfunction not just for what actually happened but for what could happen if the same failure recurred in a different clinical context.

What are the MDR reporting timelines?

Part 803 sets specific deadlines that manufacturers must meet. Missing these deadlines is itself a violation of the regulation, separate from any issue with the substantive content of the report.

For deaths and serious injuries, manufacturers must submit an MDR to FDA no later than 30 calendar days after the day they become aware of the reportable event. The 30-day clock starts when the company first receives or becomes aware of information that reasonably suggests a reportable event occurred, even if the investigation is not yet complete. A preliminary report is acceptable if the full investigation is ongoing.

For malfunctions, manufacturers must also submit within 30 calendar days of becoming aware of the reportable malfunction, with the same preliminary report option available.

For events that require remedial action to prevent an unreasonable risk of substantial harm to the public health, a 5-day report is required. These are urgent situations where FDA needs to know about the event immediately so it can take action. Five-day reports are rare but apply in situations such as device failures discovered during a public health emergency or failures that could affect a large patient population if not addressed immediately.

Annual or baseline reports were historically required for certain device categories but the current regulation as updated by FDA has moved primarily to a eMDR electronic submission system. All MDR submissions must now be submitted electronically through FDA’s MedWatch Plus system unless FDA has granted an exception.

How should MDR investigations be conducted?

Every potential MDR event should trigger a documented investigation in the quality management system. The investigation serves two purposes: it provides the information needed to complete the MDR submission accurately, and it feeds the CAPA system to determine whether a systemic corrective action is needed.

A well-structured MDR investigation starts with gathering all available information about the event. This includes the complaint record, device identification, lot or serial number, patient information as available, clinical outcome, and any physical evidence from the device if it was returned. The investigation should document the sequence of events, the device’s performance history, and any relevant manufacturing or distribution records.

The investigation must evaluate whether the event meets the reportability criteria. This evaluation must be documented, with a clear rationale for the reportability decision. FDA investigators will review this documentation during inspections and will cite companies whose reportability decisions are not supported by documented analysis. The adverse event investigation record is a core MDR compliance document.

If the event is determined to be reportable, the MDR submission must be completed within the applicable deadline. If the event is determined not to be reportable, the basis for that determination must be documented and retained. FDA reviews non-reportability decisions during inspections and can cite companies that have a pattern of under-reporting.

What are the most common MDR compliance failures FDA cites?

FDA’s MDR-related inspection observations follow consistent patterns. Failure to report within the required timeframe is the most straightforward violation. Companies that receive complaint information, begin an investigation, and then allow the 30-day clock to expire without submitting a preliminary report are cited under 803.50.

Failure to report at all, because the company incorrectly determined the event was not reportable, is harder to detect during inspections but appears when FDA auditors compare complaint records to MDR submission records and find gaps. Companies with high complaint volumes but low MDR submission volumes draw scrutiny.

Incomplete MDR reports are cited when submitted reports lack required fields or contain insufficient information. Part 803 specifies the information that must be included in each report, and submissions that are missing device identification, patient outcome, or event description details can be rejected by FDA and must be resubmitted.

Inadequate MDR procedures are a systemic citation. Part 803.17 requires manufacturers to develop, maintain, and implement written MDR procedures. If an investigator finds that a company’s procedures do not address all the required elements of the regulation, or that employees responsible for MDR decisions are not following the procedures, this becomes an observation under 803.17.

How does a QMS support 21 CFR Part 803 compliance?

MDR compliance depends on the quality management system being able to capture complaint information, trigger investigations, track reporting deadlines, and maintain complete records in a single connected workflow. When complaint handling and adverse event investigation live in disconnected spreadsheets or paper files, deadlines are missed, reportability decisions are inconsistently documented, and the investigation records needed to complete an MDR submission are scattered across multiple systems.

Cloudtheapp provides an integrated cloud QMS with 60+ applications, including complaint management, adverse event investigation, CAPA, and audit trail capabilities built for the full 21 CFR Part 803 workflow. When a complaint is received, the system assigns it to the appropriate investigation workflow and starts tracking the regulatory deadline automatically. The investigation record captures all required elements in a structured format that maps directly to the MDR submission requirements.

The 21 CFR Part 11-compliant audit trail in Cloudtheapp ensures that every investigation entry, reportability decision, and submission record carries a timestamped, immutable record of who created it and when. During FDA inspections, investigators can be shown complete MDR investigation records in seconds, including the documented rationale for reportability decisions and the submission confirmation for each reported event.

Quality teams at medical device manufacturers use Cloudtheapp to manage their full post-market surveillance program, from complaint intake through MDR submission, CAPA closure, and trend analysis. The real-time dashboard view of open complaints, pending MDR deadlines, and complaint trend data gives quality directors the visibility they need to prevent MDR violations before they occur.

To see how Cloudtheapp supports 21 CFR Part 803 compliance in a medical device quality environment, schedule a demo.

How do MDR requirements interact with EU MDR vigilance reporting?

Medical device manufacturers who sell in both the U.S. and EU markets must manage two post-market reporting frameworks simultaneously. The EU Medical Device Regulation (EU MDR 2017/745) requires manufacturers to report serious incidents and field safety corrective actions to national competent authorities in EU member states. The timelines and definitions under EU MDR differ from those in 21 CFR Part 803.

Under EU MDR, serious incidents must be reported immediately, and no later than 15 days after awareness, when the incident poses an imminent risk to public health, 10 days for death or serious deterioration of health, and 30 days for all other serious incidents. These timelines are generally shorter than the standard 30-day MDR deadline under Part 803, and the “serious incident” definition under EU MDR has some differences from the “serious injury” definition in Part 803.

Companies with dual U.S. and EU obligations benefit significantly from a QMS that can manage both reporting frameworks in a single workflow. When the investigation record, the reportability analysis, and the submission tracking are all in one system, the quality team can complete both an FDA MDR and an EU serious incident report from the same underlying investigation without duplicating effort. The risk register and post-market surveillance program should document how the company manages dual-reporting obligations and how discrepancies between the two frameworks are resolved.