FDA Medical Device Reporting (MDR): 21 CFR Part 803 Timelines and Reportability

Medical Device Reporting (MDR) is the US system that tells FDA when a device may have caused or contributed to a death or serious injury, or has malfunctioned in a way that could do so. It is set out in 21 CFR Part 803 and applies to manufacturers, importers and device user facilities such as hospitals. Not to be confused with the EU Medical Device Regulation, which shares the abbreviation, US MDR is about adverse event reporting. This guide explains who reports what, the timelines, how to decide whether an event is reportable and how to keep the records an inspector will expect.

Who must report

Role	Reports	To whom, and when
Manufacturer	Death, serious injury, malfunction that would likely cause or contribute to death or serious injury if it recurred	FDA within 30 calendar days; 5 work days for events requiring remedial action
Importer	Death and serious injury; malfunctions	Death and serious injury to FDA and manufacturer within 30 days; malfunction to manufacturer only
User facility	Death; serious injury	Death to FDA and manufacturer, serious injury to manufacturer (or FDA if the manufacturer is unknown), within 10 work days; annual report

Distributors and clinicians are not required reporters under Part 803, but they can report voluntarily, and they are an important source of information for manufacturers.

Key concepts

• Becoming aware: the clock starts when any employee of the manufacturer, who is a person with a duty to report, receives or becomes aware of information that reasonably suggests a reportable event. Build awareness into your complaint intake so that the date is recorded.
• Reasonably suggests: information that a reasonable person would consider to indicate the device may have caused or contributed to the event, or has malfunctioned. You do not need to prove causation.
• Serious injury: an injury that is life-threatening, results in permanent impairment or damage to a body structure, or needs medical or surgical intervention to prevent such impairment.
• Malfunction: failure of a device to meet its performance specifications or to perform as intended. It is reportable when it would be likely to cause or contribute to a death or serious injury if it were to recur.

The reporting workflow

1. Intake. Record every complaint, including the date you became aware.
2. Triage. Decide whether it involves a death, serious injury or malfunction, and whether the device may have caused or contributed.
3. Investigate. Make a reasonable effort to obtain missing information, and document the efforts. If you cannot complete the investigation, you still report what you know.
4. Decide and document. Record your reportability decision and rationale, even when you decide not to report.
5. Submit the report electronically through FDA’s eMDR system, using the required form data, by the deadline.
6. Follow up. Submit supplemental reports when you obtain new information.
7. Feed the quality system. Link the event to CAPA and complaint handling, to the risk file and, where needed, to a recall or correction.

Records and procedures

• Manufacturers must have written MDR procedures that cover identification, evaluation, timely reporting and documentation.
• Keep an MDR event file for each event, including the information evaluated, the decision and any reports, for the period required by the regulation.
• Since the QMSR took effect on 2 February 2026, complaint and quality system requirements are aligned with ISO 13485. Your procedures should still show how MDR decisions fit within them. See the QMSR implementation checklist.
• Make sure complaint records show the reportability decision and the date of becoming aware. This is one of the first things inspectors check. See FDA inspections.

Reports, recalls and the EU

Part 803 reports and Part 806 correction and removal reports can arise from the same event, and FDA does not generally expect a separate Part 806 report when the action has already been reported under Part 803. Manufacturers selling in both markets must also meet EU vigilance duties, with different definitions and timelines. See post-market surveillance and PMS, vigilance and complaint handling interview questions.

Common mistakes

• Starting the clock only when the investigation ends, not when you become aware.
• Treating a user error as non-reportable without evaluating whether the device contributed.
• Not documenting a decision not to report.
• Failing to send supplemental reports.
• Letting complaints sit unreviewed because the complaint unit has no MDR training.
• Inconsistent decisions between US reporting and EU vigilance for the same event.

Frequently asked questions

Do I report a malfunction if nobody was hurt?

You do if the malfunction would be likely to cause or contribute to a death or serious injury if it recurred. The test looks at the potential, not only at the outcome in the individual case.

What if I do not have all the information?

Report within the deadline with what you have, state what is missing, and send supplemental reports as you learn more.

Is a complaint always an MDR?

No. Most complaints are not reportable, but each must be evaluated and the decision documented.

Do user facilities have to report to FDA?

They report deaths to FDA and the manufacturer, serious injuries to the manufacturer (or FDA if the manufacturer is unknown), and file an annual report.

Reporting definitions and timelines are set by 21 CFR Part 803 and FDA guidance, and they can change. Confirm current requirements with FDA and your regulatory advisers before acting on a specific event.

Related reading

• Recalls and field safety corrective actions: Part 806 and EU vigilance.
• CAPA and complaint handling: the process that feeds MDR decisions.
• Post-market surveillance: PMS in the EU and US.
• US FDA medical device regulations: what every manufacturer must do.

Talk to the AptSkill team

Need training in complaint handling, MDR reporting or post-market surveillance? Send us your role and goal.