For medical devices, an FDA adverse event report is a Medical Device Report (MDR) under 21 CFR Part 803. The framework has shifted in three steps. FDA published the eMDR final rule on 14 February 2014, and from 14 August 2015 manufacturers and importers have had to submit MDRs electronically. On 17 August 2018 FDA granted the Voluntary Malfunction Summary Reporting (VMSR) alternative under 21 CFR 803.19, followed by final guidance on 29 August 2024. And since 2 February 2026, the Quality Management System Regulation requires manufacturers to notify FDA of complaints that meet the Part 803 reporting criteria (21 CFR 820.10(b)(3)).
That last point matters most for software manufacturers. A complaint can start an MDR clock before anyone inside the company has called it an "adverse event". This article covers who reports, what is reportable, the deadlines, how reports are filed and where they end up.
Background and scope
Device reporting runs on its own track. Drugs and biologics use different FDA systems; devices use Part 803, with its own triggers, forms and deadlines.
The trigger is information that reasonably suggests a reportable event, not proof. A malfunction can be reportable before any patient is harmed, if it would be likely to cause or contribute to a death or serious injury should it recur. For software, that means the right question is whether a complaint meets Part 803, not whether someone has labelled it an adverse event.
Under the QMSR, complaint handling and MDR reporting are one workflow. The complaint record, the reportability decision and the submission have to connect, and the complaint file has to show when the company became aware. Our overview of the QMSR and ISO 13485:2016 explains how the new quality system regulation is structured.
Who reports and what counts as reportable
Reporters
Part 803 places reporting duties on three groups: device user facilities, importers and manufacturers (21 CFR 803.10). A device user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility or outpatient treatment facility; a physician's office is not one (21 CFR 803.3(d)). Distributors must keep records of incidents, but they do not submit MDRs (21 CFR 803.1 and 803.18(d)).
The reporting duty sits with the legal reporter, not with whoever hears about the problem first. A distributor may learn about a field issue before anyone else, but the manufacturer remains responsible for the MDR.
The reportability test
For manufacturers, 21 CFR 803.50(a) requires a report when information reasonably suggests that a marketed device:
may have caused or contributed to a death or serious injury; or
has malfunctioned, and the device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction recurred.
"Become aware" means an employee has acquired information that reasonably suggests a reportable event has occurred (21 CFR 803.3(b)). A malfunction is a failure to meet performance specifications or otherwise perform as intended, and performance specifications include all claims made in the labelling (21 CFR 803.3(k)).
That last part is why software claims matter. If the labelling promises a clinical output, an alarm, a validated accuracy or an interoperability behaviour, a failure to deliver it can be a malfunction. A delayed result, a wrong output, a failed alarm or a faulty update may look minor in the support inbox and still meet the threshold.
A decision that an event is not reportable has to be documented as carefully as a submitted report. The MDR event file must contain the deliberations and decision-making process used to decide whether the event was or was not reportable (21 CFR 803.18(b)(1)(i)).
MDR deadlines by reporter and event type
| Reporter | Event | Report to | Deadline | Source |
|---|---|---|---|---|
| Manufacturer | Death, serious injury or reportable malfunction | FDA | 30 calendar days | 21 CFR 803.50 |
| Manufacturer | Event needing remedial action to prevent an unreasonable risk of substantial harm, or after an FDA written request | FDA | 5 work days | 21 CFR 803.53 |
| Manufacturer | Supplemental or follow-up information | FDA | 30 calendar days from receiving it | 21 CFR 803.56 |
| Importer | Death or serious injury | FDA and the manufacturer | 30 calendar days | 21 CFR 803.40 |
| Importer | Malfunction | Manufacturer only | 30 calendar days | 21 CFR 803.40 |
| User facility | Death | FDA and the manufacturer, if known | 10 work days | 21 CFR 803.30 |
| User facility | Serious injury | Manufacturer, or FDA if the manufacturer is unknown | 10 work days | 21 CFR 803.30 |
| User facility | Annual report on Form FDA 3419 | FDA | By 1 January each year | 21 CFR 803.33 |
Deadlines run from the day after the reporter becomes aware of the event. A work day is Monday to Friday, excluding Federal holidays (21 CFR 803.3(y)), so the 5-day and 10-day clocks are not internal business calendars. See FDA's mandatory reporting requirements for the agency's own summary.
Supplemental reports are a manufacturer obligation. When information that was not known or not available at the time of the initial report comes in, the manufacturer has 30 calendar days to submit it.
Filing through eMDR and MedWatch
Manufacturers and importers must submit initial and supplemental MDRs to FDA electronically (21 CFR 803.12(a)), using Form FDA 3500A data elements, unless FDA has granted an exemption under 803.19. Since 14 April 2025, the ESG NextGen Unified Submission Portal has replaced the legacy WebTrader interface for these submissions (FDA: eMDR). User facilities can report electronically but may still submit written reports.
An internal ticket, a spreadsheet or a quality memo does not meet the reporting duty. The report has to reach FDA through the required channel, and the complaint file has to support what was submitted.
Health professionals, patients and consumers can submit voluntary reports on Form FDA 3500 through MedWatch. Those reports help FDA spot problems, but they never replace a manufacturer's mandatory MDR.
MDR procedures, event files and public data
Procedures and event files
Manufacturers, importers and user facilities need written MDR procedures (21 CFR 803.17) and MDR event files (21 CFR 803.18). The event file holds the information about the event, the deliberations behind the reportability decision, copies of submitted reports and FDA's electronic acknowledgements. Manufacturers and importers must keep it for two years from the date of the event or for the expected life of the device, whichever is longer.
Audits often turn on small points: when awareness started, or why an event was judged not reportable. A file that holds only the final MDR has lost the reasoning behind it. Submitting an MDR is not an admission that the device caused or contributed to the event (21 CFR 803.16), so the file can be clear without being defensive.
Voluntary malfunction summary reporting
Under the VMSR program, manufacturers of devices in eligible product codes can report certain malfunctions in summary form every quarter, with a separate summary for each combination of brand name, device model and problem code. Deaths and serious injuries must still be reported individually.
MAUDE
FDA publishes MDRs in the MAUDE database, which contains the last ten years of MDR data and is updated monthly. FDA states that MDR data is not intended to evaluate adverse event rates or compare devices, and that a report does not necessarily show that the device caused the event. Use MAUDE for signal review, not for incidence claims.
Corrections and removals
A correction or removal made to reduce a risk to health must be reported to FDA within 10 working days under 21 CFR Part 806, unless the information has already been reported under Part 803. When a complaint leads to a field action, both parts need to be considered.
A hypothetical software example
Hypothetical example: a Dutch manufacturer markets a SaMD in the US. A US hospital reports that the software returned an incorrect result.
The complaint is logged in the complaint file under the QMSR. The first question is when the company became aware: the date an employee had information reasonably suggesting a reportable event (803.3(b)). Next, the team checks whether the incorrect result is a malfunction, meaning a failure against the labelled performance (803.3(k)), and whether recurrence would be likely to cause or contribute to a death or serious injury (803.50(a)(2)).
If both answers are yes, the manufacturer files an MDR within 30 calendar days, or within 5 work days if remedial action is needed to prevent an unreasonable risk of substantial harm (803.53). Either way, the MDR event file records the deliberation and the outcome. The file can end with "reportable" or "not reportable", but it cannot end without a decision.
Conclusion
An FDA adverse event file starts with the complaint, not with a late regulatory debate. The labelling and intended performance frame the malfunction question, the reportability test is "reasonably suggests", and the clock depends on who is reporting and what happened. Since February 2026, the QMSR ties complaint handling directly to Part 803. If quality and vigilance sit in separate teams with separate records, the gap will show in the first audit.
If you need help aligning complaint handling, MDR decision logic and submission workflows, our vigilance support team can help, or contact MedQAIR.
Frequently asked questions
Is FDA device reporting the same as drug reporting?
No. Medical device adverse events are reported as MDRs under 21 CFR Part 803. Drugs and biologics use different FDA reporting systems, with different triggers, forms and channels.
Can a software bug be a malfunction?
Yes. A malfunction is a failure to meet performance specifications, including labelling claims, or to perform as intended (21 CFR 803.3(k)). It is reportable if recurrence would be likely to cause or contribute to a death or serious injury.
When does the 30-day clock start?
When an employee of the manufacturer acquires information that reasonably suggests a reportable event (21 CFR 803.3(b)). The 30 calendar days run from the day after that, not from the end of the root-cause investigation.
What is a 5-day report?
A manufacturer report due within 5 work days when an event requires remedial action to prevent an unreasonable risk of substantial harm to public health, or when FDA has made a written request (21 CFR 803.53).
Do distributors submit MDRs?
No. Distributors must keep incident records (21 CFR 803.18(d)) but are not required to report. Manufacturers, importers and device user facilities carry the reporting duty.
Is MAUDE public?
Yes. MAUDE is FDA's public database of MDRs, covering the last ten years and updated monthly. FDA states it should not be used to evaluate adverse event rates or to establish that a device caused an event.
