Medical Device Reporting (MDR) is the FDA’s mandatory system, set out in 21 CFR Part 803, that requires manufacturers, importers, and device user facilities to tell the FDA when a marketed device may have caused or contributed to a death or serious injury, or has malfunctioned in a way that could do so if it recurred.
What is Medical Device Reporting (MDR)?
Medical Device Reporting (MDR) is a postmarket surveillance obligation under section 519 of the Federal Food, Drug, and Cosmetic Act, codified at 21 CFR Part 803. It turns awareness of a device problem into a documented decision and a time-bound submission to the FDA. The acronym is a common source of confusion: in the US, MDR means Medical Device Reporting, while in the European Union, MDR means the Medical Device Regulation (EU 2017/745), an entire regulatory framework. This article covers the FDA reporting process.
MDR sits at the heart of the device lifecycle after launch. Reports feed the FDA’s MAUDE database, support signal detection, and can trigger recalls, safety communications, or labeling changes.
Why Medical Device Reporting (MDR) matters in medical device development
The FDA uses MDR data as an early-warning radar for devices already in the field. A pattern of malfunction reports can reveal a design or manufacturing defect long before a formal complaint trend does. For the manufacturer, the stakes are concrete. Late, missing, or inconsistent reports are among the most common findings in FDA inspections and frequently appear in Form 483 observations and warning letters. Failure to report can carry civil penalties and, in serious cases, criminal exposure.
There is a quality-system dimension too. The FDA will not treat a submitted MDR as compliant unless the underlying event was evaluated under the quality management system requirements in 21 CFR Part 820. Reportability decisions, investigations, and CAPA all have to hang together. An inspector comparing your internal complaints against what you actually reported is looking for gaps, and those are expensive to defend.
How Medical Device Reporting (MDR) works
MDR runs as a governed workflow: intake, reportability assessment, investigation, submission, and follow-up. The core obligations break down by who you are:
- Manufacturers report device-related deaths, serious injuries, and reportable malfunctions to the FDA within 30 calendar days of becoming aware of the event. When an event requires remedial action to prevent an unreasonable risk of substantial harm to public health, or when the FDA requests it, a 5-day report applies.
- Importers report deaths and serious injuries to both the FDA and the manufacturer within 30 calendar days, and malfunctions to the manufacturer within the same window.
- Device user facilities (hospitals, nursing homes, outpatient treatment centers) report a device-related death to the FDA and the manufacturer within 10 work days, and a serious injury to the manufacturer, or to the FDA if the manufacturer is unknown. User facilities also file an annual summary.
The reportability threshold is deliberately low. You do not need proof that the device caused harm; you report when information reasonably suggests device involvement. Mandatory reports use Form FDA 3500A, and voluntary reports use Form FDA 3500. Since 2015, manufacturers and importers must submit electronically through the eMDR system on the FDA’s Electronic Submissions Gateway. Supplemental reports follow when new information surfaces, and MDR event files are retained for at least two years from the event date, or the expected life of the device if longer.
Several standards and regulations interlock here: 21 CFR Part 820 for the quality system and complaint handling, ISO 13485 for the QMS, and ISO 14971 for risk management, since reportable events feed back into the device risk file.
Common challenges and best practices
The recurring failure is the reportability decision itself. Teams either over-report out of caution, which buries real signals, or apply the threshold inconsistently across reviewers, which an auditor will spot immediately. Write a clear reportability procedure, train against it, and document the rationale for every decision not to report.
Timeliness is the second trap. The clock starts when any employee becomes aware of the event, not when the regulatory team opens the file. Build intake routes from sales, service, and complaints straight into the MDR process. Link complaints, MDR decisions, CAPA, and device genealogy so the story is traceable end to end. Treat the 5-day trigger as a real escalation path, not a theoretical one.
How SJML helps with Medical Device Reporting (MDR)
SJML delivers post-market surveillance and vigilance as part of its Compliance-as-a-Service offering. The QARA team supports complaint intake, adverse-event reporting, and reportability assessment, along with root cause analysis and CAPA, so events move from awareness to submission without losing the audit trail. SJML also helps maintain MDR procedures and event files within an ISO 13485 quality system and aligns post-market processes with FDA 21 CFR Part 820 and risk management under ISO 14971. Support scales from startups standing up a first reporting process to global OEMs managing high complaint volumes.
Frequently asked questions
They share an acronym but are unrelated. FDA MDR is Medical Device Reporting, a single postmarket reporting process under 21 CFR Part 803. EU MDR is the Medical Device Regulation (EU 2017/745), the complete regulatory framework for CE-marked devices in Europe. The EU equivalent of the FDA MDR is vigilance reporting, which uses incident and serious incident terminology rather than adverse event.
Three groups carry mandatory obligations: manufacturers, importers, and device user facilities such as hospitals and nursing homes. Manufacturers and importers report deaths, serious injuries, and certain malfunctions to the FDA. User facilities report device-related deaths and serious injuries within shorter timelines. Healthcare practitioners and patients can also report voluntarily through the MedWatch program, but they are not required to.
Manufacturers and importers generally have 30 calendar days from becoming aware of a reportable death, serious injury, or malfunction. A 5-day report applies when an event needs remedial action to prevent substantial harm to public health, or when the FDA requests one. Device user facilities report deaths and serious injuries within 10 work days and file an annual summary report.
Often, yes. A malfunction is reportable when it would be likely to cause or contribute to a death or serious injury if it were to recur, even if the current event harmed no one. This makes malfunction reporting an early-warning mechanism, which is why consistent reportability assessment matters so much.
Related terms
- Adverse Event
- Post-Market Surveillance (PMS)
- CAPA (Corrective and Preventive Action)
- Complaint Handling
- EU MDR (Medical Device Regulation 2017/745)
