In the US, three sets of rules govern a medical device recall: FDA's recall policy in 21 CFR Part 7 (June 1978), the mandatory recall authority in Part 810 (final rule of 20 November 1996), and the reporting of corrections and removals in Part 806 (final rule of 19 May 1997). In the EU, the MDR handles the same events through field safety corrective actions (FSCAs) and field safety notices (FSNs).
The two systems use different tests. A single software fix can be a reportable correction in the US and an FSCA in the EU at the same time. This article explains the definitions, FDA's recall classes, Part 806 reports, the FSCA route under the MDR, and how to assess both before a release.
The terms on each side
| US term | Meaning | Closest EU term |
|---|---|---|
| Recall (21 CFR 7.3) | A firm's removal or correction of a marketed product that FDA considers in violation of the laws it administers and against which it would take legal action. Excludes market withdrawals and stock recoveries | Recall (MDR Art. 2(62)) |
| Market withdrawal (21 CFR 7.3) | Removal or correction for a minor violation that would not lead to FDA legal action, or no violation at all | Withdrawal (MDR Art. 2(63)) |
| Correction (21 CFR 806.2) | Repair, modification, adjustment, relabelling, destruction or inspection, including patient monitoring, without physical removal | Field safety corrective action (MDR Art. 2(68)) |
| Removal (21 CFR 806.2) | Physical removal of a device from its point of use to another location for those purposes | Field safety corrective action (MDR Art. 2(68)) |
| Recall letter | Firm's communication to consignees under the recall strategy | Field safety notice (MDR Art. 2(69)) |
Sources: 21 CFR Parts 7 and 806; FDA, Recalls, Corrections and Removals (Devices); MDR Article 2.
The tests differ. In the US, a recall depends on a violation, and a Part 806 report depends on a risk to health. In the EU, an FSCA is corrective action taken for technical or medical reasons to prevent or reduce the risk of a serious incident in relation to a device made available on the market (Art. 2(68)).
In our view, run the US test and the EU test separately for every action, even when the same defect triggers both.
FDA recall classes
FDA classifies a recall after a health hazard evaluation (21 CFR 7.41). The classes in 21 CFR 7.3(m) are:
| Class | Definition |
|---|---|
| I | A reasonable probability that use of, or exposure to, the violative product will cause serious adverse health consequences or death |
| II | Use of, or exposure to, the violative product may cause temporary or medically reversible adverse health consequences, or the probability of serious adverse health consequences is remote |
| III | Use of, or exposure to, the violative product is not likely to cause adverse health consequences |
Source: 21 CFR 7.3(m); FDA.
Recall class is not device class. A Class II device can be in a Class I recall if the defect creates that hazard. Our article on medical device classification at FDA explains device classes.
FDA's Medical Device Recalls database lists recalls classified since November 2002. Since January 2017, it may also include actions a firm started before FDA reviewed them, so a recent entry may not yet have a class. The database can be filtered by root cause, including several software categories.
Part 806: reporting corrections and removals
Under Part 806, manufacturers and importers must report a correction or removal initiated to reduce a risk to health posed by the device, or to remedy a violation caused by the device that may present a risk to health.
| Situation | Duty | Source |
|---|---|---|
| Correction or removal involving a risk to health | Report to FDA within 10 working days of initiating it | 21 CFR 806.10(a), (b) |
| Same action extended to more lots or batches | Amend the report within 10 working days | 21 CFR 806.10(d) |
| Already reported under Part 803 or Part 1004 | No Part 806 report needed | 21 CFR 806.10(f) |
| No risk to health (Class III level) | Keep records, no report | 21 CFR 806.20; FDA |
| Records | Keep for 2 years beyond the expected life of the device | 21 CFR 806.20 |
Sources: 21 CFR Part 806; FDA.
According to FDA, "risk to health" under Part 806 tracks the definitions of Class I and Class II recalls. Market withdrawals, routine servicing, stock recoveries and actions that only improve performance or quality are exempt from reporting. FDA recommends sending reports by e-mail to the Division Recall Coordinator, using Form FDA 5072, or through eSubmitter. A foreign manufacturer contacts the coordinator for the region where its US agent is located.
Our article on FDA adverse event reporting covers the separate Part 803 route.
Running a voluntary recall with FDA
Most device recalls are voluntary under 21 CFR Part 7. FDA describes the sequence:
Notify the Division Recall Coordinator when the firm believes its product is violative.
Provide information: product identity, reason, risk evaluation, quantities, distribution, the recall communication and the proposed strategy.
Start the action. The firm does not have to wait for FDA's review.
Set the recall strategy under 21 CFR 7.42: depth of recall, need for a public warning, and effectiveness checks at Levels A (all consignees) to E (none).
Send status reports. FDA sets the interval, generally between 2 and 4 weeks (21 CFR 7.53).
Request termination in writing, with the latest status report (21 CFR 7.55).
FDA publishes recalls in its weekly Enforcement Report.
Part 810 is different. Under 21 CFR 810.10, if FDA finds a reasonable probability that a device would cause serious adverse health consequences or death, it can order the firm to cease distribution, notify health professionals and user facilities, and tell them to stop using the device. FDA can later amend the order to require a recall.
In our view, distribution records and consignee lists decide how fast a recall can run. They should exist before launch, not after the first serious complaint.
The EU route: FSCAs and field safety notices
The MDR has no separate recall procedure. Under Article 10(12), manufacturers must take corrective action when a device is not in conformity, including withdrawal or recall where appropriate. Importers (Art. 13(6)) and distributors (Art. 14(5)) must keep a register of complaints, non-conforming devices, recalls and withdrawals. Our article on the medical device distributor covers those duties.
When an FSCA is needed, the main duties are:
| Duty | Source |
|---|---|
| Report the FSCA to the competent authorities, including an FSCA in a third country if the same device is legally made available in the EU and the reason is not limited to the third country | Art. 87(1)(b) |
| Inform users without delay through a field safety notice | Art. 89(8) |
| Except in cases of urgency, submit the draft FSN to the evaluating competent authority for comments | Art. 89(8) |
| Keep the FSN content consistent in all Member States, unless duly justified | Art. 89(8); MDCG 2023-3 Rev.2 |
| Identify the devices, including the UDI and SRN, explain the reasons and risks, and state the actions users must take | Art. 89(8) |
Sources: MDR; MDCG 2023-3 Rev.2, January 2025.
According to MDCG 2023-3 Rev.2 (Q17), FSCAs include changes of software or firmware related to a safety issue, such as a version update or a rollback. Under Q20, the competent authority in the Member State where the manufacturer or its authorised representative has its registered place of business must always be informed of the FSCA. For manufacturers outside the EU, that is where the authorised representative is based. MedQAIR's Digital AR service covers that role.
FSCAs only work if every economic operator has the right version of the documentation. MDIS gives manufacturers, importers and distributors shared access to current device documentation and supports vigilance reporting. Our article on post-market surveillance explains how FSCAs fit into the wider system.
A hypothetical example
Hypothetical example: a Dutch company sells diagnostic-support software in the EU and the US. A defect in one release leads it to push a corrective update to installed users.
US: the update is a correction under 21 CFR 806.2. If it was initiated to reduce a risk to health, a Part 806 report is due within 10 working days, and the company contacts the Division Recall Coordinator. FDA classifies the action after its health hazard evaluation.
EU: the update is a safety-related software change, so it is an FSCA under MDCG 2023-3 Rev.2 Q17. The company reports it to the competent authorities, submits the draft FSN to the evaluating competent authority, and then sends the FSN to users.
Evidence for both: release and build identifiers, installed versions by site, consignee and distributor lists, and the risk rationale for the change.
The example does not decide the recall class. That depends on facts the company has to establish for its own device. Our article on IEC 62304 covers the software change process behind such a release.
Conclusion
A US recall depends on a violation, a Part 806 report on a risk to health, and an EU FSCA on the risk of a serious incident. One corrective action can meet all three tests.
In our view, test every safety-related release against both Part 806 and the MDR FSCA rules before it ships, while the release is still reversible. Then the notices, recipients and timing follow from whichever test applies.
If you need help with FSCAs, field safety notices or vigilance reporting, our vigilance support team can help, or contact MedQAIR.
Frequently asked questions
What are the FDA recall classes?
Class I, II and III, from highest to lowest hazard. FDA assigns the class after a health hazard evaluation (21 CFR 7.3(m) and 7.41).
When is a Part 806 report due?
Within 10 working days of initiating a correction or removal that involves a risk to health (21 CFR 806.10(b)).
Who submits a Part 806 report?
The manufacturer or importer that initiates the correction or removal.
Is a software update an FSCA under the MDR?
It can be. According to MDCG 2023-3 Rev.2, changes of software or firmware related to a safety issue are FSCAs.
Must the draft field safety notice go to the authority first?
Yes, except in cases of urgency. Under Article 89(8), the draft FSN goes to the evaluating competent authority for comments.
Can FDA order a recall?
Yes. Under Part 810, FDA can order a firm to cease distribution and notify users, and can later amend the order to require a recall.
