21 CFR Part 803 is the FDA regulation that establishes mandatory medical device reporting (MDR) requirements for manufacturers, importers, and device user facilities. The regulation requires these entities to report certain adverse events involving medical devices to FDA, creating a post-market surveillance signal that the agency uses to identify device safety issues, take corrective action, and protect patients.

According to the FDA’s MDR guidance, Part 803 contains mandatory requirements for reporting when a device may have caused or contributed to a death or serious injury, and when a device malfunctions in a way that would likely cause or contribute to death or serious injury if it were to recur. The regulation covers the full post-market lifecycle of a device from the point of distribution through the end of its commercial life.

Part 803 works alongside other post-market requirements. Manufacturers subject to Part 803 are also typically subject to 21 CFR Part 806, which covers corrections and removals (recalls), and to the quality system requirements of 21 CFR Part 820. Together these regulations form the post-market compliance framework that FDA inspects during Quality System inspections.

Who must comply with 21 CFR Part 803?

Part 803 applies to three distinct categories of entities, each with different reporting obligations.

Device manufacturers are the primary regulated entity under Part 803. A manufacturer for MDR purposes includes any person who designs, manufactures, fabricates, assembles, or processes a finished device, as well as any person who remanufactures, relabels, or reprocesses a device. Manufacturers have the broadest reporting obligations under the regulation.

Device importers are companies that import devices manufactured outside the U.S. and distribute them in domestic commerce. Importers have reporting obligations for deaths and serious injuries, though their obligations are narrower than those of manufacturers.

Device user facilities are hospitals, ambulatory surgical facilities, nursing homes, outpatient diagnostic facilities, and outpatient treatment facilities that use devices in the care of patients. User facilities must report device-related deaths to both FDA and the manufacturer, and device-related serious injuries to the manufacturer.

What events must be reported under Part 803?

Manufacturers must report to FDA when they receive or become aware of information that reasonably suggests a marketed device may have caused or contributed to a death or serious injury, or when a device has malfunctioned and that device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.

The threshold for reporting is intentionally broad. FDA does not require certainty that the device caused the adverse event. The regulation uses the phrase “reasonably suggests,” meaning that if the available information indicates a plausible relationship between the device and the adverse outcome, reporting is required. Waiting to confirm causation before reporting is one of the most common MDR compliance errors FDA cites during inspections.

Serious injury under Part 803 means an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, necessitates medical or surgical intervention to preclude permanent impairment of a body function or permanent damage to a body structure, requires in-patient hospitalization for more than 24 hours, or causes birth defects.

Malfunctions are reportable when the device did not perform as designed, intended, or expected, and that malfunction would be likely to cause or contribute to death or serious injury if it recurred. This means quality teams must evaluate each malfunction not just for what actually happened but for what could happen if the same failure recurred in a different clinical context.

What are the MDR reporting timelines?

Part 803 sets specific deadlines that manufacturers must meet. Missing these deadlines is itself a violation of the regulation, separate from any issue with the substantive content of the report.

For deaths and serious injuries, manufacturers must submit an MDR to FDA no later than 30 calendar days after the day they become aware of the reportable event. The 30-day clock starts when the company first receives or becomes aware of information that reasonably suggests a reportable event occurred, even if the investigation is not yet complete. A preliminary report is acceptable if the full investigation is ongoing.

For malfunctions, manufacturers must also submit within 30 calendar days of becoming aware of the reportable malfunction, with the same preliminary report option available.

For events that require remedial action to prevent an unreasonable risk of substantial harm to the public health, a 5-day report is required. These are urgent situations where FDA needs to know about the event immediately so it can take action. Five-day reports are rare but apply in situations such as device failures discovered during a public health emergency or failures that could affect a large patient population if not addressed immediately.

Annual or baseline reports were historically required for certain device categories but the current regulation as updated by FDA has moved primarily to a eMDR electronic submission system. All MDR submissions must now be submitted electronically through FDA’s MedWatch Plus system unless FDA has granted an exception.

How should MDR investigations be conducted?

Every potential MDR event should trigger a documented investigation in the quality management system. The investigation serves two purposes: it provides the information needed to complete the MDR submission accurately, and it feeds the CAPA system to determine whether a systemic corrective action is needed.

A well-structured MDR investigation starts with gathering all available information about the event. This includes the complaint record, device identification, lot or serial number, patient information as available, clinical outcome, and any physical evidence from the device if it was returned. The investigation should document the sequence of events, the device’s performance history, and any relevant manufacturing or distribution records.

The investigation must evaluate whether the event meets the reportability criteria. This evaluation must be documented, with a clear rationale for the reportability decision. FDA investigators will review this documentation during inspections and will cite companies whose reportability decisions are not supported by documented analysis. The adverse event investigation record is a core MDR compliance document.

If the event is determined to be reportable, the MDR submission must be completed within the applicable deadline. If the event is determined not to be reportable, the basis for that determination must be documented and retained. FDA reviews non-reportability decisions during inspections and can cite companies that have a pattern of under-reporting.

What are the most common MDR compliance failures FDA cites?

FDA’s MDR-related inspection observations follow consistent patterns. Failure to report within the required timeframe is the most straightforward violation. Companies that receive complaint information, begin an investigation, and then allow the 30-day clock to expire without submitting a preliminary report are cited under 803.50.

Failure to report at all, because the company incorrectly determined the event was not reportable, is harder to detect during inspections but appears when FDA auditors compare complaint records to MDR submission records and find gaps. Companies with high complaint volumes but low MDR submission volumes draw scrutiny.

Incomplete MDR reports are cited when submitted reports lack required fields or contain insufficient information. Part 803 specifies the information that must be included in each report, and submissions that are missing device identification, patient outcome, or event description details can be rejected by FDA and must be resubmitted.

Inadequate MDR procedures are a systemic citation. Part 803.17 requires manufacturers to develop, maintain, and implement written MDR procedures. If an investigator finds that a company’s procedures do not address all the required elements of the regulation, or that employees responsible for MDR decisions are not following the procedures, this becomes an observation under 803.17.

How does a QMS support 21 CFR Part 803 compliance?

MDR compliance depends on the quality management system being able to capture complaint information, trigger investigations, track reporting deadlines, and maintain complete records in a single connected workflow. When complaint handling and adverse event investigation live in disconnected spreadsheets or paper files, deadlines are missed, reportability decisions are inconsistently documented, and the investigation records needed to complete an MDR submission are scattered across multiple systems.

Cloudtheapp provides an integrated cloud QMS with 60+ applications, including complaint management, adverse event investigation, CAPA, and audit trail capabilities built for the full 21 CFR Part 803 workflow. When a complaint is received, the system assigns it to the appropriate investigation workflow and starts tracking the regulatory deadline automatically. The investigation record captures all required elements in a structured format that maps directly to the MDR submission requirements.

The 21 CFR Part 11-compliant audit trail in Cloudtheapp ensures that every investigation entry, reportability decision, and submission record carries a timestamped, immutable record of who created it and when. During FDA inspections, investigators can be shown complete MDR investigation records in seconds, including the documented rationale for reportability decisions and the submission confirmation for each reported event.

Quality teams at medical device manufacturers use Cloudtheapp to manage their full post-market surveillance program, from complaint intake through MDR submission, CAPA closure, and trend analysis. The real-time dashboard view of open complaints, pending MDR deadlines, and complaint trend data gives quality directors the visibility they need to prevent MDR violations before they occur.

To see how Cloudtheapp supports 21 CFR Part 803 compliance in a medical device quality environment, schedule a demo.

How do MDR requirements interact with EU MDR vigilance reporting?

Medical device manufacturers who sell in both the U.S. and EU markets must manage two post-market reporting frameworks simultaneously. The EU Medical Device Regulation (EU MDR 2017/745) requires manufacturers to report serious incidents and field safety corrective actions to national competent authorities in EU member states. The timelines and definitions under EU MDR differ from those in 21 CFR Part 803.

Under EU MDR, serious incidents must be reported immediately, and no later than 15 days after awareness, when the incident poses an imminent risk to public health, 10 days for death or serious deterioration of health, and 30 days for all other serious incidents. These timelines are generally shorter than the standard 30-day MDR deadline under Part 803, and the “serious incident” definition under EU MDR has some differences from the “serious injury” definition in Part 803.

Companies with dual U.S. and EU obligations benefit significantly from a QMS that can manage both reporting frameworks in a single workflow. When the investigation record, the reportability analysis, and the submission tracking are all in one system, the quality team can complete both an FDA MDR and an EU serious incident report from the same underlying investigation without duplicating effort. The risk register and post-market surveillance program should document how the company manages dual-reporting obligations and how discrepancies between the two frameworks are resolved.

This post created by and appeared first on Cloudtheapp

Adverse event management is a core regulatory obligation for pharma, biotech, and medical device companies. FDA MDR requirements (21 CFR Part 803) mandate 30-day and 5-day reporting windows. EU MDR Article 87 requires serious incident reports within 15 days. ICH E6(R3) GCP governs clinical trial adverse event reporting globally. Manual tracking through spreadsheets and email chains exposes organizations to missed deadlines, inconsistent documentation, and regulatory action. Purpose-built adverse event management software automates intake, routes investigations, links CAPAs, and surfaces trend signals before they become compliance failures.

What Is Adverse Event Management?

Adverse events are any undesirable medical occurrence associated with the use of a drug, biologic, vaccine, or medical device in a patient or clinical trial participant. The event does not require a confirmed causal relationship to trigger a reporting obligation, awareness of a potential connection is sufficient.

Adverse event management is the systematic process of capturing, assessing, documenting, investigating, and reporting these events to the appropriate regulatory authorities within prescribed timelines. It spans the full product lifecycle, from clinical trials through post-market surveillance, and cuts across pharmacovigilance, quality assurance, regulatory affairs, and medical affairs functions.

For life sciences organizations operating across multiple markets, adverse event management is not a single workflow. It is a layered compliance obligation governed by overlapping frameworks, each with distinct definitions, thresholds, and deadlines.

The Regulatory Landscape for Adverse Event Reporting in 2026

FDA MedWatch and the New AEMS Platform

In March 2026, the FDA launched the Adverse Event Monitoring System (AEMS), a unified platform designed to consolidate multiple legacy reporting systems across all FDA-regulated product categories. According to the FDA press release from March 11, 2026, AEMS introduces standardized submission protocols, AI-assisted case processing, and cross-product safety surveillance capabilities.

FDA MDR (21 CFR Part 803): Timelines for Medical Device Manufacturers

For medical device manufacturers, the Medical Device Reporting regulation under 21 CFR Part 803 sets mandatory reporting requirements. According to FDA guidance on MDR requirements, manufacturers must submit reports electronically via eMDR for three categories of events:

• 30-day MDR: Required when a device may have caused or contributed to a death or serious injury, or when a malfunction would be likely to cause or contribute to a death or serious injury if it recurred.
• 5-day MDR: Required when the manufacturer becomes aware of information that reasonably suggests a reportable event that requires remedial action to prevent an unreasonable risk of substantial harm.
• Baseline reports: Required for devices subject to automatic reporting requirements.

The clock starts when the manufacturer first receives or becomes aware of information suggesting a reportable event, not when the investigation is complete. Organizations that rely on manual intake processes routinely misidentify the awareness date, exposing themselves to late submission findings.

EU MDR Article 87: European Vigilance Requirements

Under Regulation (EU) 2017/745, Article 87 requires medical device manufacturers to report serious incidents and field safety corrective actions to the relevant competent authorities. Reporting timelines include:

• Immediate notification: Required for incidents involving an imminent risk of death or serious deterioration in health.
• 15 days: The standard deadline for serious incidents once the manufacturer becomes aware of the event.
• Trend reporting: Required under Article 88 for statistically significant increases in non-serious incidents or expected side-effects.

ICH E6(R3) GCP: Clinical Trial Adverse Event Standards

ICH E6(R3), finalized in January 2025 and adopted by the EMA for effect on July 23, 2025, places greater emphasis on quality by design, risk-based approaches to trial monitoring, and the use of technology to support data integrity and real-time safety surveillance. Sponsors operating under E6(R3) need systems capable of aggregating adverse event data across investigational sites, flagging SUSARs for expedited submission, and maintaining complete audit trails throughout the study lifecycle.

Types of Adverse Events Life Sciences Teams Must Track

Serious Adverse Event (SAE): Any event that results in death, life-threatening condition, inpatient hospitalization or prolongation, persistent or significant disability, congenital anomaly, or requires medical intervention to prevent one of the above outcomes.

Adverse Drug Reaction (ADR): An unintended, harmful response to a medicinal product at a dose normally used for prophylaxis, diagnosis, or therapy.

Suspected Unexpected Serious Adverse Reaction (SUSAR): A serious adverse reaction that is both unexpected and assessed as possibly related to the investigational product. SUSARs require expedited reporting to regulators and ethics committees under ICH E6(R3).

Medical Device Adverse Event / Malfunction: Under 21 CFR Part 803, device-related events include deaths or serious injuries potentially caused by a device, and malfunctions that would likely cause or contribute to a serious outcome if they recurred.

Product Complaint: A report received from an external source alleging a deficiency in the quality, safety, or performance of a marketed product. Not all complaints meet adverse event thresholds, but all must be evaluated for reportability.

Reporting Timelines: A Quick Reference

Why Manual Tracking Falls Short

Spreadsheets, email inboxes, and shared drives remain the dominant tools for adverse event management at many small-to-mid-size life sciences companies. They persist because they are familiar, flexible, and free. They fail because they are fragile, unvalidated, and invisible to regulators.

Manual tracking cannot reliably deliver timestamped intake records (regulatory deadline clocks start at awareness, not at investigation completion), routing accountability, cross-functional visibility, CAPA integration, trend detection for EU MDR Article 88 reporting obligations, or validated systems meeting 21 CFR Part 11 requirements.

What to Look for in Adverse Event Management Software

Automated Workflow Routing

The software should automatically route incoming events to the correct team based on product type, event severity, and reportability assessment.

Configurable Reporting Timelines

The system should allow quality and regulatory teams to configure deadline rules per jurisdiction and per event classification, and it should send automated escalation alerts as deadlines approach.

21 CFR Part 11 Compliance

Any system used to manage adverse event records in the United States must comply with 21 CFR Part 11 requirements for electronic records and signatures.

CAPA Linkage and Root Cause Investigation

Adverse event investigation should flow seamlessly into corrective and preventive action workflows. When an investigation identifies a systemic root cause, the system should allow the team to initiate a CAPA directly from the adverse event record, maintaining a documented chain from event to correction.

Trend Analysis and Signal Detection

Post-market safety surveillance requires the ability to identify patterns across individual case records. Look for built-in analytics that track event frequency by product, event type, and reporting period, and that can flag statistically significant increases consistent with EU MDR Article 88 trend reporting obligations.

Validated Platform with Full Audit Trail

Every action in the system must be captured in a time-stamped, user-attributed audit trail. The platform itself must be validated per FDA Computer System Validation (CSV) guidelines, with a validation package available for regulatory review.

How Cloudtheapp Supports Adverse Event Management

Cloudtheapp's AI-powered QMS platform provides life sciences organizations with a fully validated, configurable environment for managing adverse events across the product lifecycle.

The Complaints app serves as the primary intake point for external adverse event reports, allowing teams to capture, classify, and evaluate incoming reports against reportability thresholds with automated routing and deadline tracking. The Incidents app handles internal adverse events and near-miss records.

Both apps link directly to Corrective and Preventive Actions (CAPA) and Deviations workflows, so the chain from event intake to root cause to corrective action remains fully documented and auditable.

Cloudtheapp's built-in analytics provide real-time dashboards across all adverse event and complaint records, enabling quality and pharmacovigilance teams to monitor event frequency, track open investigations against deadlines, and identify trend signals consistent with post-market surveillance requirements.

The entire platform is validated per FDA Computer System Validation guidelines and fully compliant with 21 CFR Part 11. Every platform update ships with a complete validation package, so customers do not carry the burden of revalidation.

The Bottom Line

Adverse event management in 2026 is more complex than it has ever been. FDA's consolidation of reporting systems under AEMS, the full implementation of EU MDR Article 87, and the updated ICH E6(R3) GCP standard all raise expectations for the quality, timeliness, and traceability of adverse event records. Manual tracking cannot meet those expectations reliably.

Purpose-built adverse event management software gives pharmacovigilance, quality, and regulatory affairs teams the tools to meet every deadline, complete every investigation, and demonstrate compliance under audit.

Ready to see how Cloudtheapp handles adverse event management, complaint intake, and CAPA in a single validated platform? Request a Demo at cloudtheapp.com.

This post created by and appeared first on Cloudtheapp