Under 21 CFR Part 803, a manufacturer must report a device-related death, serious injury or reportable malfunction to FDA within 30 calendar days of becoming aware of it. If the event needs remedial action to prevent an unreasonable risk of substantial harm to public health, the deadline is 5 work days.
Key takeaways
- Manufacturers have 30 calendar days for most reports, and 5 work days when remedial action is needed to prevent an unreasonable risk of substantial harm.
- User facilities have 10 work days and importers 30 calendar days. Every report must be in English, and manufacturers and importers must file electronically.
- FDA presumes that a malfunction will recur, so you do not assess that likelihood yourself.
- In 2025, FDA received 2.89 million device reports. Manufacturers filed 92.9% of them, and 13,294 involved a death.
- Events outside the US can be reportable. FDA's guidance says so when the device, or a similar one, is cleared in the US and also sold abroad.
What is FDA medical device reporting?
Medical device reporting, or MDR, is FDA's system for collecting reports of adverse events and malfunctions from manufacturers, importers and device user facilities such as hospitals. The rules are in 21 CFR Part 803 [1].
This is not the EU MDR. The EU Medical Device Regulation shares the acronym but is a different law, with its own vigilance rules. If you hold a CE mark, our guide to CE marking versus the FDA 510(k) explains how the two systems differ.
Reporting is not optional for manufacturers and importers, and it does not end at clearance. Our MDR reporting overview summarizes the essentials, and our post-market path covers everything else that follows clearance.
What are the MDR reporting deadlines?
The deadline depends on who you are and what happened. Note which clocks count calendar days and which count work days.
| Who reports | What | To whom | Deadline | Rule |
|---|---|---|---|---|
| Manufacturer | Death, serious injury or reportable malfunction | FDA | 30 calendar days | 803.50 |
| Manufacturer | Event needing remedial action to prevent an unreasonable risk of substantial harm, or when FDA asks in writing | FDA | 5 work days | 803.53 |
| Manufacturer | New information after an initial report | FDA | 30 calendar days | 803.56 |
| Importer | Death or serious injury | FDA, with a copy to the manufacturer | 30 calendar days | 803.40(a) |
| Importer | Malfunction | Manufacturer | 30 calendar days | 803.40(b) |
| User facility | Death | FDA, and the manufacturer if known | 10 work days | 803.30(a)(1) |
| User facility | Serious injury | Manufacturer, or FDA if the manufacturer is unknown | 10 work days | 803.30(a)(2) |
| User facility | Annual report of its reports | FDA | By January 1 each year | 803.33 |
Source: 21 CFR Part 803 [1].
Work days follow the US calendar. FDA defines a work day as Monday to Friday, except US federal holidays [1]. Your local public holidays do not extend a 5-day or 10-day deadline.
For example, suppose you become aware of an event on Tuesday, December 22, 2026. A 30-day report is due by Thursday, January 21, 2027. A 5-day report is due by Wednesday, December 30, 2026, because Christmas Day, Friday, December 25, is a federal holiday [12].
The clock starts when you become aware. For a 30-day report, a manufacturer becomes aware when any of its employees becomes aware of a reportable event [1]. For a 5-day remedial-action report, it is when a manager over regulatory, scientific or technical staff, or someone responsible for adverse event reporting, becomes aware [1]. Neither clock waits for your investigation to finish.
How do you decide whether and when to report?
When a complaint arrives, work through these six steps in order. The definitions behind each step follow in the next section.
- Check for a death or serious injury. If the information reasonably suggests your device may have caused or contributed to one, report within 30 calendar days [1].
- If not, check for a malfunction. If the device failed to meet its specifications or perform as intended, assume the malfunction will recur [2]. If a recurrence would be likely to cause or contribute to a death or serious injury, report within 30 calendar days, or in a quarterly summary if your product code is eligible and the program's conditions allow it [1, 3].
- Check whether remedial action is needed. If the event needs remedial action to prevent an unreasonable risk of substantial harm to public health, the deadline is 5 work days [1].
- Check the exceptions. If the information is wrong, or a qualified person concludes the device did not cause or contribute, you need not report [1]. Record the decision in your MDR files either way.
- Submit through eMDR, in English, with the information you have [1]. Do not hold the report for a finished investigation.
- Follow up within 30 calendar days each time you obtain information you did not have when you reported [1].
What counts as a reportable event?
A reportable event is a death or a serious injury [1]. For manufacturers and importers, it also includes a malfunction that would be likely to cause or contribute to a death or serious injury if it happened again.
"Reasonably suggests" is a low bar. Any information, including professional, scientific or medical facts, observations or opinions, can reasonably suggest that a device caused or contributed to an event [1].
A serious injury has a legal definition. It is an injury or illness that is life-threatening, causes permanent impairment or damage, or needs medical or surgical intervention to prevent permanent impairment or damage [1].
"Caused or contributed" is broad. It covers events that result from device failure, malfunction, design, manufacture, labeling or user error [1]. A user error that leads to serious injury can still be reportable.
A malfunction includes failing a labeling claim. A malfunction is any failure to meet performance specifications or perform as intended, and performance specifications include every claim made in your labeling [1].
FDA presumes the malfunction will recur. FDA's guidance says you do not need to assess the likelihood of recurrence [2]. Once a malfunction has caused or contributed to a death or serious injury, you must keep reporting that malfunction [2]. To stop, FDA recommends valid data showing the risk is no longer likely, plus a notification to FDA with your rationale [2].
Some information does not need a report. You need not report if the information turns out to be wrong [1]. Nor must you report if a person qualified to make a medical judgment concludes the device did not cause or contribute to the event [1]. Keep the documentation either way. A report is also not an admission that your device caused the event [1].
How has FDA enforced these rules recently?
FDA's warning letters show how the definitions work in practice. In the first two examples below, FDA said the devices were misbranded under section 502(t)(2) of the FD&C Act, because the firms failed to furnish information that Part 803 requires [7, 8].
Infections after an implant were serious injuries. In a December 2024 warning letter, FDA cited the manufacturer of an implantable tissue marker [8]. Complaints described infections after implantation that needed antibiotics and, in some cases, surgical removal. FDA said those interventions were needed to prevent permanent impairment, so each event was a reportable serious injury. Nothing in the complaint records ruled out the device as a factor.
A known malfunction stayed reportable. In a November 2024 warning letter, FDA cited the maker of an automated medication dispensing system that rebooted unexpectedly during use [7]. An earlier report had tied the same malfunction to a serious injury, which FDA said established that the malfunction was likely to cause serious harm if it recurred. One later event reached FDA 595 days after the firm became aware of it, against a 30-day limit.
Draft procedures are not procedures. In a June 2025 warning letter, FDA cited a manufacturer whose written MDR procedure was an undated draft [9]. Every manufacturer, importer and user facility must develop, maintain and implement written MDR procedures [1].
When do you need a 5-day report?
A 5-day report is due within 5 work days in two situations [1]. The first is when a reportable event needs remedial action to prevent an unreasonable risk of substantial harm to public health. The second is when FDA asks you in writing for 5-day reports.
Trend analysis can trigger one. FDA's rule says you may learn of the need for remedial action from any information, including trend analysis [1]. That means a pattern across many reports can start the 5-day clock, even when no single report would.
You can search MAUDE yourself for free, as our guide to FDA's medical device databases shows. Complizen's Knowledge module goes further, classifying MAUDE reports by failure mode, which makes patterns across your device type easier to spot.
How do you submit an MDR?
Manufacturers and importers must submit reports to FDA electronically, in a format FDA can process [1]. Every report must be in English [1].
Your report follows FDA Form 3500A. As a manufacturer, you complete the blocks for the patient, the event, the device and the initial reporter, plus two blocks of manufacturer information [1, 2]. FDA's guidance explains each field. FDA's eMDR program explains how to enroll and submit [10].
Enroll before your first event. Start by choosing a route [10]. Low-volume submitters build each report in FDA's free eSubmitter tool and upload it through the ESG NextGen Unified Submission Portal, which replaced the old WebTrader interface on April 14, 2025. Test submissions are recommended but not required. High-volume submitters generate files from their own systems and submit through AS2 or an API, and must pass test submissions first. Either route starts with a portal account and ESG NextGen registration, and FDA says each person who submits should enroll individually.
Some malfunctions can be reported quarterly. Since August 17, 2018, FDA's Voluntary Malfunction Summary Reporting Program has let manufacturers report certain malfunctions in summary form each quarter [3]. You do not need to apply before using it for an eligible product code [3]. By our count, 5,379 of FDA's 7,093 product codes are eligible, and FDA received 5,421 summary reports in 2025 [4].
The program covers malfunction reports only. Deaths and serious injuries still need individual reports, and so do malfunctions that need a 5-day report [3]. You can check your product code's eligibility on its entry in FDA's classification database.
What does FDA's own reporting data show?
We ran a count of every device report FDA received in 2025, through openFDA on September 25, 2026: 2,888,003 in total [4].
| Report source, 2025 | Reports | Share |
|---|---|---|
| Manufacturers | 2,684,275 | 92.9% |
| Importers and distributors | 180,810 | 6.3% |
| Voluntary reporters | 17,449 | 0.6% |
| User facilities | 5,469 | 0.2% |
Malfunctions made up 59.9% of the reports, injuries 39.6%, and deaths 13,294, or 0.5% [4]. These counts show reporting volume, not risk. FDA says report data cannot be used to compare event rates across devices, as our databases guide explains.
Reports end up in FDA’s public MAUDE database; here is how to search MAUDE and what it cannot show.
What records and procedures do you need?
You need written MDR procedures, MDR event files, and complaint records that meet FDA's quality rule.
Written procedures must set up systems to identify and evaluate possible events in time, a standard process for deciding reportability, and timely submission [1]. They must also cover documentation and recordkeeping.
MDR event files must include your deliberations on whether each event was reportable, including decisions not to report [1]. Keep them for 2 years from the date of the event, or for the expected life of the device if that is longer, even after you stop selling the device [1].
Complaint records now fall under the Quality Management System Regulation. Beyond ISO 13485 clause 8.2.2, 21 CFR 820.35(a) requires specific records for complaints you must report under Part 803 [6]. They include the device name, the date received and any unique device identifier. Our QMSR guide covers the rest.
What do manufacturers outside the US need to know?
You report your own MDRs, wherever you are based. FDA's guidance states that manufacturers, including foreign manufacturers, must submit death, serious injury and malfunction reports [2].
Events in other countries can be reportable. FDA considers an event abroad reportable if it involves a device cleared or approved in the US, or a similar device you market [2]. The device must also be lawfully sold in that country. Small changes made to meet another country's standards do not remove the duty, unless they substantially alter the device's performance [2].
Your importer can file for both of you, with FDA's agreement. To have your US importer submit reports that meet both of your obligations, you request an exemption under 21 CFR 803.19(b) [2]. FDA recommends a joint request from you and the importer.
Your US agent does not report for you. FDA states that a US agent has no responsibility for adverse event reporting under Part 803 [11]. Two provisions point the other way on paper. 21 CFR 803.3 still lists a foreign manufacturer's US agent in its definition of manufacturer, and 21 CFR 803.58 would have given US agents reporting duties [1]. But FDA stayed 803.58 indefinitely on February 14, 2014, so FDA's stated position is the working rule.
Under 21 CFR 807.40, your US agent helps FDA communicate with you, answers questions about your imported devices and helps schedule inspections [5].
Time zones do not pause the clock. Plan for English-language reports, electronic filing and fast escalation from your distributors, who may hear of events before you do. Our US agent guide explains the role in full.
Complizen's US Agent service covers the duties 21 CFR 807.40 sets out. Like any US agent, it does not take over your adverse event reporting.
Frequently asked questions
What is an MDR report?
An MDR report is a medical device report sent to FDA under 21 CFR Part 803. It describes a death, serious injury or reportable malfunction that a device may have caused or contributed to. Manufacturers and importers file electronically, and all reports must be written in English.
What is the deadline for reporting an adverse event to FDA?
For manufacturers, 30 calendar days after becoming aware of information that reasonably suggests a reportable event. The deadline shortens to 5 work days when the event needs remedial action to prevent an unreasonable risk of substantial harm, or when FDA requests 5-day reports.
What is a 5-day MDR report?
A 5-day report is due within 5 work days when a reportable event needs remedial action to prevent an unreasonable risk of substantial harm to public health. It is also due when FDA asks for one in writing. Trend analysis across many reports can trigger it.
What counts as a serious injury for MDR purposes?
An injury or illness that is life-threatening, causes permanent impairment or damage to the body, or needs medical or surgical intervention to prevent permanent impairment or damage. FDA treated infections needing antibiotics or device removal as serious injuries in a December 2024 warning letter.
Do I have to report a malfunction that caused no harm?
Yes, if the malfunction would be likely to cause or contribute to a death or serious injury if it recurred. FDA presumes a malfunction will recur, so you do not assess that likelihood yourself. Malfunctions of eligible product codes may be reported in quarterly summaries.
Who has to file MDRs?
Manufacturers, importers and device user facilities such as hospitals and nursing homes. Some groups are exempt, including dental and optical laboratories and practitioners who make devices only for their own patients. Manufacturers, importers and user facilities can also request exemptions or variances.
Does my US agent file MDRs for me?
No. FDA states that a US agent has no responsibility for adverse event reporting under Part 803. The section that would have assigned that duty, 21 CFR 803.58, has been stayed since February 14, 2014. Your US agent handles communication with FDA, and you file your own reports.
How do I submit an MDR to FDA?
Manufacturers and importers must submit electronically through FDA's eMDR program, in English. User facilities may submit on paper or electronically. Every report must be in English. Enroll in eMDR before you need it, so your first reportable event does not wait on account setup.
What is voluntary malfunction summary reporting?
It is an FDA program, running since August 17, 2018, that lets manufacturers report certain malfunctions in quarterly summaries instead of individual reports. 5,379 of FDA's 7,093 product codes are eligible, and you do not need to apply before using it.
Do adverse events outside the US have to be reported to FDA?
Often, yes. FDA's guidance treats an event abroad as reportable if it involves a device cleared or approved in the US, or a similar device you market, that is also sold in that country. Small design differences between markets do not remove the duty unless they substantially change performance.
Is FDA MDR the same as EU MDR?
No. FDA medical device reporting, under 21 CFR Part 803, covers adverse event reporting in the US. The EU Medical Device Regulation is a separate law with its own vigilance rules. A manufacturer selling in both markets must meet both.
How long must I keep MDR records?
Manufacturers and importers must keep each MDR event file for 2 years from the date of the event, or for the device's expected life if that is longer. User facilities keep files for 2 years. The duty continues after you stop selling the device.
References
- eCFR. 21 CFR Part 803, Medical Device Reporting. Text current as of September 1, 2026.
- FDA. Medical Device Reporting for Manufacturers. Guidance issued November 8, 2016.
- Federal Register. Voluntary Malfunction Summary Reporting Program for Manufacturers, 83 FR 40973. Published August 17, 2018.
- openFDA. Device API: adverse event and classification endpoints. Checked September 25, 2026.
- eCFR. 21 CFR 807.40, Registration and listing of foreign establishments. Accessed September 25, 2026.
- eCFR. 21 CFR Part 820, Quality Management System Regulation (including § 820.35). Accessed September 25, 2026.
- FDA. Warning letter to Becton, Dickinson and Company / CareFusion 303, Inc. November 22, 2024.
- FDA. Warning letter to Hologic, Inc. December 18, 2024.
- FDA. Warning letter to Insightra Medical, Inc. June 3, 2025.
- FDA. eMDR, Electronic Medical Device Reporting. Accessed September 25, 2026.
- FDA. U.S. Agents. Content current as of December 23, 2017.
- U.S. Office of Personnel Management. Federal Holidays. 2026 schedule. Accessed September 25, 2026.