Medical Device Recalls and Field Safety Corrective Actions: FDA and EU MDR Guide

Every manufacturer hopes never to run a recall, but every manufacturer needs a process ready for one. When a device problem reaches the field, the quality of your response is judged on speed, clarity and documentation: how quickly you assessed the risk, how well you reached affected customers, and whether you told the regulator on time. This guide explains how recalls and field safety corrective actions work in the United States and the EU, how they connect to complaint handling and CAPA, and how to build a process that holds up under pressure.

Recall, correction, removal and FSCA: the vocabulary

The terms differ by region, and mixing them up causes reporting mistakes.

• United States: under 21 CFR Part 806, a correction is the repair, modification, adjustment, relabeling, destruction or inspection of a device without its physical removal from the point of use. A removal is the physical removal of a device from where it is used or sold. FDA’s recall policy in 21 CFR Part 7 uses the broader term recall for a firm’s removal or correction of a marketed product that FDA considers to be in violation of the law.
• European Union: the MDR uses field safety corrective action (FSCA), meaning corrective action taken by a manufacturer for technical or medical reasons to prevent or reduce the risk of a serious incident, together with a field safety notice (FSN) sent to users.

Starting point: how problems reach the recall decision

Recalls rarely begin with a recall. They begin with a complaint, an adverse event, an out-of-specification result, a supplier notification, an audit finding or a trend. Your complaint handling and CAPA process should contain an explicit decision point: does this problem require a field action? That decision should be made by a cross-functional group including quality, regulatory, clinical or medical, engineering and, where appropriate, legal, and it should be documented, even when the answer is no.

Health hazard evaluation

The core analytical step is a health hazard evaluation (HHE): what is the harm, how likely is it, how severe, who is exposed and for how long, and what is the risk if no action is taken? Use the same logic as your ISO 14971 risk management process: the HHE should be consistent with your risk file, and a recall often reveals that a hazard was underestimated or a risk control did not work. Feed the findings back into the risk management file.

United States: what the rules require

FDA recall classification

Class	Definition (summarised)
Class I	A reasonable probability that using or being exposed to the product will cause serious adverse health consequences or death
Class II	Use may cause temporary or medically reversible adverse health consequences, or the probability of serious consequences is remote
Class III	Use is not likely to cause adverse health consequences

FDA assigns the classification, but your own initial assessment drives the strategy, so prepare your rationale before you contact the agency.

Reports of corrections and removals (21 CFR Part 806)

A manufacturer or importer must report to FDA a correction or removal initiated to reduce a risk to health posed by the device or to remedy a violation of the FD&C Act that may present a risk to health. The report is due within 10 working days of initiating the correction or removal. Corrections and removals that are not reportable still require records, kept so FDA can review your decision. A correction or removal that is already reported under the Medical Device Reporting regulation (21 CFR Part 803) generally does not need a separate Part 806 report.

Medical Device Reporting (21 CFR Part 803)

Separately, manufacturers must report deaths, serious injuries and certain malfunctions. The general timeframe is 30 calendar days from becoming aware, with a shorter 5 work day timeframe for events requiring remedial action to prevent an unreasonable risk of substantial harm to public health. Recalls and MDR reports often travel together, so coordinate the two.

Recall strategy and effectiveness checks

FDA expects a recall strategy covering the depth of the recall (consumer, user or wholesale level), the need for public warning and the method of effectiveness checks. Under 21 CFR Part 7, firms are expected to communicate clearly with consignees, request a response, and verify that consignees received and acted on the notice. Keep a record of every consignee contacted and every response received.

Quality system link

Since the QMSR took effect on 2 February 2026, FDA incorporates ISO 13485:2016, whose clause 8.3.3 requires procedures for actions in response to nonconforming product detected after delivery, including issuing advisory notices. Your procedure should define who can authorise a notice and how it is documented and communicated.

European Union: serious incidents and FSCAs

Under the MDR, manufacturers must report serious incidents and FSCAs (Article 87) and process the corresponding investigations (Article 89). Key points:

• Serious incidents must be reported immediately after the causal relationship is established or reasonably suspected, and no later than 15 days after becoming aware. Shorter limits apply to serious public health threats (2 days) and to death or unanticipated serious deterioration in health (10 days).
• FSCAs must be reported through the EU vigilance system before the action is taken, except in urgent cases, and the FSN is sent to affected users and published through the system.
• The manufacturer investigates, including a risk assessment and corrective action, and reports its findings to the competent authority, with the notified body involved where it issued a certificate.
• The PMS system, PSUR or PMS report and the clinical evaluation must be updated to reflect the event.

The MDR also sets expectations for trend reporting of non-serious incidents and expected side effects. For the wider picture of how vigilance fits with post-market duties, see our guide to post-market surveillance.

Building a recall-ready process

1. Write the procedure now. Define triggers, decision makers, the HHE method, regulatory reporting steps, communication templates and record requirements.
2. Make traceability work. You must be able to identify which lots or serial numbers are affected and where they went. UDI and distribution records make this faster.
3. Prepare templates. Draft notice letters, response forms, FSN templates and regulator submission checklists in advance.
4. Define roles and a 24/7 contact path. A recall team with named alternates avoids delay when key people are away.
5. Run a mock recall. Test whether you can trace a lot, list consignees and produce a reconciliation within a target time.
6. Close the loop. After a recall, run a root cause investigation, implement CAPA, check effectiveness and update the risk file, design and process controls.

Common mistakes

• Waiting for certainty before assessing reportability, when the clock may already be running.
• Treating a field action as a quality issue only, without involving regulatory and clinical input.
• Poor distribution records that make it impossible to identify consignees.
• Issuing a notice that does not clearly state the hazard, the affected product and what the user must do.
• Closing the recall without checking effectiveness or updating the risk management file.
• Inconsistent decisions between US and EU, where the same issue is handled as a recall in one region and ignored in the other.

Frequently asked questions

Is every correction a recall that must be reported to FDA?

No. Only corrections and removals initiated to reduce a risk to health or to remedy a violation that may present a risk to health are reportable under Part 806. Other corrections, such as routine servicing or minor cosmetic fixes, are not reportable but should be documented.

How fast must I decide whether to start a field action?

There is no single decision deadline, but the reporting clocks start when you become aware of the information or initiate the action, so you should assess promptly and document the reasoning. Delay is itself a common inspection finding.

What is the difference between a field safety notice and a recall letter?

They serve the same purpose of telling users about a problem and what to do. The FSN is the EU term and follows the format in the vigilance guidance, while US recall letters follow FDA recall policy and are tailored to the recall strategy agreed with the agency.

Do software fixes count as corrections?

They can. A software update that remedies a safety issue is generally a correction, and may be reportable. Assess whether the update was initiated to reduce a risk to health, and document the conclusion either way.

Reporting timelines and definitions are set by regulation and guidance that change over time. Confirm current requirements with the regulator and your legal and regulatory advisers before acting on a specific event.

Related reading

• CAPA and complaint handling: the process that detects the problem and drives root cause.
• Post-market surveillance: PMS plan, PSUR and vigilance in the EU.
• PMS, vigilance and complaint handling interview questions: reportability case studies.
• Real-world ISO 14971 case studies: how risk files respond to field data.

Talk to the AptSkill team

Want training in vigilance, complaint handling or post-market surveillance? Send us your role and goal.