21 CFR 803 medical device reporting duties and FDA deadlines
21 CFR 803 sets FDA medical device reporting duties. Check reportable events, who receives reports, and the 30-calendar-day and five-work-day deadlines.
21 CFR 803 medical device reporting rules and deadlines
21 CFR 803, or 21 CFR Part 803, is the FDA's Medical Device Reporting (MDR) regulation for specified device-related deaths, serious injuries and, for manufacturers and importers, qualifying malfunctions. Reports are due on 30-calendar-day, five-work-day or 10-work-day clocks, and not every report goes to FDA. Section 803.10
Ordinary manufacturer and importer reports are due no later than 30 calendar days after the day of awareness. Certain manufacturer events require a report no later than five work days. User facilities have 10-work-day duties, and some of those reports go to the manufacturer rather than FDA. §803.50, §803.53, §803.30
This guide reflects official sources checked on November 1, 2026. It covers US FDA medical device reporting, not the EU MDR or UK vigilance rules.
What makes an event MDR reportable?
For manufacturers, the threshold is information from any source that reasonably suggests a marketed device may have caused or contributed to a death or serious injury. You don't need proof of causation before the duty arises. A submitted report is not necessarily an admission that the device, or the reporter or its employees, caused or contributed to the reportable event. §803.50, §803.16
A serious injury is an injury or illness that is life-threatening, results in permanent impairment of a body function or permanent damage to a body structure, or necessitates medical or surgical intervention to prevent that permanent impairment or damage. Permanent means irreversible impairment or damage, and it excludes trivial impairment or damage. "Caused or contributed" includes failure, malfunction, improper or inadequate design, manufacture, labeling or user error. Do not drop an event from the assessment just because user error looks like the cause. §803.3
A malfunction is a failure to meet performance specifications or otherwise perform as intended. Performance specifications include the claims made in the labeling. For a manufacturer, the reportable question is whether that device, or a similar device the manufacturer markets, would be likely to cause or contribute to death or serious injury if the malfunction recurred. A malfunction can be reportable even when nobody was injured. But not every malfunction meets the test. §803.3, §803.50
An importer uses the same recurrence test, measured against a similar device the importer markets. That malfunction report goes to the manufacturer, not routinely to FDA. §803.40
Who reports, to whom and by when?
Use the table for the ordinary requirements. An FDA exemption, variance or alternative reporting arrangement can change them. §803.19
| Reporter and event | Deadline after the day of awareness | Recipient |
|---|---|---|
| Manufacturer: death, serious injury or qualifying malfunction | No later than 30 calendar days | FDA |
| Importer: death or serious injury | As soon as practicable, no later than 30 calendar days | FDA, with a copy to the manufacturer |
| Importer: qualifying malfunction | As soon as practicable, no later than 30 calendar days | Manufacturer, not routinely FDA |
| User facility: death of a patient of the facility | As soon as practicable, no more than 10 work days for the FDA report | FDA and the manufacturer, if known |
| User facility: serious injury to a patient of the facility | No later than 10 work days | Manufacturer; FDA instead if the manufacturer is unknown |
Sources: manufacturer requirements, §803.50, importer requirements, §803.40, user-facility requirements, §803.30.
A device user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility or outpatient treatment facility. A physician's office is not a device user facility. School nurse offices and employee health units are not either. §803.3
User-facility death and serious-injury reports cover a patient of the facility. That includes an employee or affiliate who, in the course of their duties, suffers a device-related death or serious injury from a device used at the facility. User facilities have no mandatory malfunction-only duty. Section 803.20 treats a malfunction as an MDR-reportable event only for manufacturers and importers. §803.30, §803.3, §803.20, FDA mandatory reporting overview
Keep calendar days and work days apart. A work day is Monday through Friday, excluding federal holidays. Reporting clocks run from awareness, which may or may not occur on the incident date, and the clock does not wait until the investigation is finished. For a manufacturer, awareness by any employee starts the ordinary 30-day clock and the clock on an FDA-requested five-day report. For an importer, awareness by any employee starts the 30-day clock. §803.3
A user facility becomes aware when medical personnel who are employed by, or otherwise formally affiliated with, the facility obtain the information. Medical personnel means a person licensed, registered or certified by a State, territory or other governing body to administer health care. It also means a person with a diploma or degree in a professional or scientific discipline, an employee responsible for receiving medical complaints or adverse event reports, or a supervisor of those people. One awareness rule for every role will start some clocks too early and others too late. Passing the file to a reporting specialist later does not restart a clock that has already started. §803.3
When does the five-work-day rule apply?
Medical device reporting for manufacturers has two expedited triggers. Submit the report to FDA no later than five work days after the day the manufacturer becomes aware that:
- An MDR-reportable event necessitates remedial action to prevent an unreasonable risk of substantial harm to public health.
- FDA has made a written request for a five-day report.
Trend analysis can show the need for that remedial action. §803.53
After a written request, later events of the same nature that involve substantially similar devices also need five-day reports. The duty runs for the period FDA specifies, without further requests. FDA may extend that period. §803.53
Remedial action means action needed to prevent recurrence of a reportable event. It excludes routine maintenance or servicing. Do not treat every correction as a five-day report. The substantial-harm test still has to be met. §803.3
The remedial-action clock does not start with every employee. It starts when an employee who manages or supervises people with regulatory, scientific or technical duties, or whose own duties include collecting and reporting adverse events, becomes aware that remedial action is needed. For an FDA written request, awareness by any employee counts. §803.3, §803.53
How to submit a mandatory medical device report
Manufacturers and importers must submit initial reports, and any supplemental or follow-up reports, to FDA electronically unless FDA grants an exemption. An electronic mandatory report has to contain the applicable Form FDA 3500A information. User facilities may use paper Form FDA 3500A or an acceptable electronic report. An importer's report to the manufacturer may be paper or electronic. FDA's eMDR instructions cover the electronic route. §803.11, §803.12
Form FDA 3500 is the voluntary form. It does not replace a mandatory report. §803.20
Missing information does not erase a duty that has already been triggered. Manufacturers must investigate each event, report what is reasonably known, and explain what is missing and what they did to get it. Don't wait for every investigation detail before sending a report that is already due. If required information was not available for the initial report, the manufacturer must submit a supplemental report within 30 calendar days of the day it receives that information. §803.50, §803.56
Document the decision and keep the records
Manufacturers, importers and user facilities must develop, maintain and implement written MDR procedures. Those procedures cover identification, communication and evaluation of events, a set way to decide reportability, timely transmission to the right recipient, and a record of what was reviewed. §803.17
MDR files must document the event, the decision that it was or was not reportable, the reports that were submitted, and FDA's electronic acknowledgment where that applies. A decision not to report still needs a written basis. §803.18
User facilities keep MDR files for two years from the event date. Manufacturers and importers keep them for two years from the event date or for the device's expected life, whichever is longer. Retention continues after distribution ends. This retention period runs from the event date. The reporting clock does not. §803.18
User facilities also submit annual Form FDA 3419 by January 1. No annual report is required if the facility submitted no MDRs to manufacturers or FDA during the reporting period. Keep that annual duty separate from the 10-work-day event reports. §803.33
Use the current text of §803.18, not older quality-system wording. Technical amendments published on December 4, 2025, and effective February 2, 2026, revised the complaint-file and event-evaluation language in §803.18(e) to match Part 820. FDA described the changes as editorial and non-substantive. They did not change the deadlines above. QMSR technical amendments, current §803.18
You can read the RegAffairs AI answer on when device problems must be reported next to these sections. For a live event, check any FDA exemption or alternative reporting arrangement before you apply the ordinary table. §803.19