Medical Device Recalls: Complete Medical Device FDA Compliance Guide
- Beng Ee Lim
- 4 hours ago
- 13 min read
A medical device recall is a firm's removal or correction of a marketed device that violates FDA law or poses a health risk. FDA classifies recalls by severity: Class I (reasonable probability of serious adverse health consequences or death), Class II (temporary or medically reversible adverse health consequences), Class III (unlikely to cause adverse health consequences). Recalls are governed by 21 CFR Part 7, while corrections and removals reporting falls under 21 CFR Part 806. Manufacturers must report corrections/removals to FDA within 10 working days if actions reduce health risk or remedy violations. Recall costs vary widely based on scope, distribution, and required customer notifications.
This guide covers FDA recall classifications, the difference between recalls and 21 CFR Part 806 corrections and removals, when and how to report to FDA within the 10-working-day window, how to run an effective recall strategy, and the common compliance mistakes that trigger enforcement.
What Is a Medical Device Recall?
A medical device recall is a firm’s removal or correction of a marketed medical device that FDA considers violative of the laws it administers, or that presents a risk of injury or gross deception. Most recalls are conducted voluntarily by firms, but FDA can request a recall, and in rare cases can order a mandatory recall under its authority.
Recall vs Market Withdrawal vs Stock Recovery
These terms get confused constantly, and FDA treats them differently.
Recall:
A recall is used when a firm corrects or removes a marketed device to address a problem that is violative, or poses a health risk.
Market withdrawal:
A market withdrawal is a removal or correction for a minor violation that would not be subject to legal action, or for no violation, such as normal stock rotation or routine adjustments.
Stock recovery:
A stock recovery is a correction or removal of a product that has not been marketed, or has not left the firm’s direct control.
Recall actions: Correction vs Removal
FDA uses “recall” as the umbrella term, and most recall strategies are executed through one of these actions.
Correction: Repair, modification, adjustment, relabeling, destruction, or inspection of a device without physically removing it from its point of use.
Examples
Software update shipped to hospitals to fix a defect
Labeling correction or updated Instructions for Use
Inspection and adjustment performed on-site
Removal:
Physical removal of a device from its point of use to another location for repair, modification, adjustment, relabeling, destruction, or inspection.
Examples
Pulling defective devices from hospitals or distributors
Retrieving mislabeled kits from clinics
Collecting contaminated product lots
Voluntary vs FDA-requested vs mandatory recalls
Voluntary recalls:
Most recalls are conducted voluntarily by firms once a problem is identified. FDA monitors the strategy and effectiveness, and may request changes to scope or communications.
FDA-requested recalls:
FDA may request that a firm initiate a recall based on inspections, testing, complaints, or adverse event reports.
Mandatory recalls:
Mandatory recalls are rare. FDA can order a recall under FD&C Act Section 518(e), implemented in 21 CFR Part 810, when legal criteria are met and a serious health risk is not being adequately addressed voluntarily.
When a recall is typically initiated
Firms typically initiate recall actions when a device may be violative or presents a risk to health, such as:
Design issues
Manufacturing deviations
Labeling deficiencies
Software defects
Contamination or sterility failures
Critical component failures
When 21 CFR Part 806 reporting is triggered
If a firm initiates a correction or removal to reduce a risk to health, or to remedy a violation that may present a risk to health, it may need to submit a report to FDA within 10 working days of initiating the action, unless an exemption applies.
Key takeaway
Think of recall as the umbrella term. The operational actions are usually a correction or a removal, and Part 806 determines whether your correction or removal is reportable and time-bound.
Recall Classification: Class I, Class II, and Class III
FDA classifies recalls by health hazard, the classification reflects the probability and severity of adverse health consequences if the device is used or exposure occurs.
Important: Classification informs recall strategy and urgency, but FDA oversight and specific execution requirements are case-specific and depend on the hazard and distribution.
Class I recall (most serious)
Definition (21 CFR 7.3): A situation where there is a reasonable probability that use of, or exposure to, a violative product will cause serious adverse health consequences or death.
Common characteristics:
Potential for life-threatening outcomes or irreversible harm
Often requires fast field action and strong effectiveness verification
Typical examples (illustrative):
Life-supporting device failure mode that could cause death or serious injury
Dose-delivery or therapy-control error that could cause severe harm
Recall strategy impact: Class I recalls often require deeper notification and stronger effectiveness checks, and FDA may issue public warnings depending on scope and hazard.
Class II recall (moderate hazard)
Definition (21 CFR 7.3): Use of, or exposure to, a violative product may cause temporary or medically reversible adverse health consequences, or where the probability of serious adverse health consequences is remote.
Common characteristics:
Harm is possible, but outcomes are often reversible
Recall strategy often focuses on rapid facility notification, correction, or targeted retrieval
Class III recall (least serious)
Definition (21 CFR 7.3): Use of, or exposure to, a violative product is not likely to cause adverse health consequences.
Common characteristics:
Often involves low-risk labeling or administrative issues
Recall strategy may be limited to consignee-level notifications and controlled disposition
Who determines recall classification?
FDA assigns the recall classification after conducting a Health Hazard Evaluation (HHE). FDA considers factors such as the population exposed, severity of potential injury, likelihood of occurrence, and whether the hazard can be detected before use.
Firms can propose a classification based on their internal risk assessment, but FDA makes the final classification decision and may revise it based on additional information.
How classification affects recall execution
Classification influences the recall strategy elements FDA evaluates, including:
Depth of recall (consumer or user, retail, wholesale)
Whether a public warning is needed
The method and level of effectiveness checks (A–E)
The cadence and content of status reporting, set case-by-case (often every 2–4 weeks)
21 CFR Part 7: FDA Recall Regulations
21 CFR Part 7 (Subpart C) sets FDA’s recall policy and provides guidance on how firms should plan, communicate, and execute recalls. Recall is generally a voluntary action, but FDA monitors recalls, assigns classifications, and may request that a firm initiate a recall in urgent situations.
Important: Mandatory medical device recall authority is separate from Part 7. Part 7 covers voluntary and FDA-requested recalls, while FDA’s mandatory recall process is tied to statutory authority and separate regulations and procedures.
Recall initiation
1) Firm identifies a problem
Common triggers include complaints, MDR signal review, CAPA investigations, internal quality monitoring, inspections, or FDA outreach. The firm performs a documented risk assessment and determines whether the action is a market withdrawal, stock recovery, or a potential recall.
2) Notify FDA immediately
If a firm removes or corrects a distributed product because it believes the product is violative, FDA requests that the firm notify immediately the appropriate FDA office and provide key recall information. FDA also states that a firm does not need to delay initiating a removal or correction while FDA reviews the recall strategy.
What FDA expects you to provide (high level)
Product identity and device identifiers (brand, model, catalog, lot, serial, or codes, and other identifiers needed for accurate identification)
Reason the deficiency was discovered, and the risk evaluation
Quantity produced and estimated quantity in distribution
Distribution information and direct accounts where needed
Proposed recall communication and recall strategy
Recall strategy and recall depth
Under 21 CFR 7.42, the recall strategy addresses three core elements: depth of recall, whether a public warning is needed, and the method and level of effectiveness checks.
Recall depth (how far the recall must reach)
Part 7 defines three depth levels:
Consumer or user level (often includes user facilities for devices)
Retail level
Wholesale level
For many medical devices, the “user level” is a hospital, clinic, or physician office, and the recall communication may require the facility to identify impacted inventory and, where relevant, evaluate patient impact.
Recall communications (21 CFR 7.49)
The recalling firm is responsible for promptly notifying its affected direct accounts. The format and content should be commensurate with the hazard and the recall strategy.
A recall communication should generally:
Clearly identify the affected product and identifiers (lot, serial, codes)
Explain the reason for the recall and the hazard involved
Provide specific instructions on what recipients should do
Provide a way for recipients to report back whether they have the product
Public warning and public notification
Public warning is addressed in the recall strategy section, and FDA ordinarily issues such publicity in consultation with the firm when needed. FDA also publishes recall listings in the weekly FDA Enforcement Report.
Effectiveness checks (21 CFR 7.42)
Effectiveness checks verify that consignees at the specified recall depth received notification and took appropriate action.
Effectiveness check levels (CFR-defined):
Level A: 100% of consignees
Level B: case-by-case, more than 10% and less than 100%
Level C: 10%
Level D: 2%
Level E: no effectiveness checks
Recall status reports (21 CFR 7.53)
FDA requests periodic recall status reports so the agency can assess progress. The reporting interval is set case-by-case, generally every 2 to 4 weeks.
Status reports typically include:
Number of consignees notified and method/date of notification
Number of consignees responding and quantity on hand
Quantity returned or corrected, and quantity accounted for
Results of effectiveness checks
Estimated time frames for completion
Recall termination (21 CFR 7.55)
FDA terminates a recall when it determines that all reasonable efforts were made to remove or correct the product according to the recall strategy, and it is reasonable to assume the product was removed and properly dispositioned commensurate with the degree of hazard. FDA issues written notification when the recall is terminated.
21 CFR Part 806: Reports of Corrections and Removals
21 CFR Part 806 requires medical device manufacturers and importers to report certain corrections and removals to FDA. Part 806 is separate from 21 CFR Part 7 (recall policy and execution), but it often overlaps in practice because many reportable corrections and removals are also handled as recalls.
What requires Part 806 reporting?
You must submit a Part 806 report within 10 working days of initiating a correction or removal if the action was initiated to:
Reduce a risk to health posed by the device, or
Remedy a violation of the FD&C Act caused by the device that may present a risk to health
Key point: Reporting can be required even if no adverse events have occurred yet, the trigger is the intent of the action and the risk rationale.
Examples that may be reportable (depending on risk rationale):
A software update to correct an algorithm error that could lead to incorrect clinical decisions
Relabeling to add a missing warning related to safe use
Removing a lot with an out-of-spec component to prevent failures
What does NOT require Part 806 reporting?
Part 806 does not apply to certain categories, including:
Stock recoveries: product correction/removal before it has been marketed or distributed beyond the firm’s control
Market withdrawals: corrections/removals for a minor violation not subject to legal action, or no violation at all
Routine servicing: planned maintenance performed as part of normal service schedules, not to correct a violative condition or reduce a risk to health
When to submit a Part 806 report
Deadline: Within 10 working days of initiating the correction or removal.
What “initiation” means in practice: when you first begin implementing the action, for example first notification to consignees or first correction/removal activity.
How to submit: Follow FDA’s current submission instructions for Part 806 reports. Do not confuse Part 806 reporting with eMDR, which is for 21 CFR Part 803 MDR submissions.
What information is required in an 806 report?
Under 21 CFR 806.10, reports include device identification, the reason for the action, risk evaluation, dates, distribution, and details of the correction or removal, including communications to consignees where applicable.
Relationship between Part 806 and Part 7
Part 806 is the reporting requirement for certain corrections and removals.
Part 7 provides FDA’s recall policy and the framework for recall strategy, communications, effectiveness checks, and status reports.
Many actions end up involving both, but FDA expectations depend on hazard, scope, and distribution level.
Best practice: If you’re unsure whether an action is reportable under Part 806, document your rationale and seek regulatory counsel or discuss with FDA. Underreporting can create inspection risk.
Recall Costs: What to Budget
Recall costs vary widely. The biggest drivers are how many units are affected, how far the device has spread through the distribution chain, whether patients must be contacted, and whether a field correction or replacement is required. FDA does not publish standard cost ranges by recall class, so budgeting is best done by modeling cost drivers rather than relying on generic averages.
The main recall cost drivers
Direct costs (usually unavoidable):
Customer and patient notification (when required by recall strategy)
Product correction, retrieval, replacement, or field service
Logistics and returns handling (freight, warehousing, disposition)
Scrap and rework (inventory, work-in-process, components)
Engineering and remediation work (software fixes, design changes, revalidation)
Indirect costs (often underestimated):
Regulatory operations (risk assessment, documentation, FDA interactions, recall management)
Legal review (communications, liability assessment, contract exposure)
Customer support and communications (call centers, field reps, distributor coordination)
Lost sales, backorders, and channel disruption
Brand impact and procurement delays
How recall class affects cost (without fake precision)
FDA recall class reflects risk severity, not cost. Class I recalls tend to be expensive because they often require rapid action and may involve patient-level outreach or urgent risk mitigation. Class II and Class III recalls can still be expensive if the affected population is large or widely distributed.
Budgeting model (illustrative, not universal)
If you want concrete planning numbers, use a simple model:
Total recall cost ≈
(Notification cost × affected accounts or patients)
(Field/service cost × sites)
(Replacement/repair cost × units)
(Disposition cost × units)
(Engineering remediation + validation)
(Internal and external regulatory + legal + comms support)
Illustrative example: A software correction deployed across hundreds of hospitals can be driven primarily by site coordination, verification, and remediation validation rather than unit replacement.
FDA reporting and oversight costs (what’s actually required)
FDA may request periodic status reports to assess progress, and the reporting interval is set case-by-case, commonly every 2 to 4 weeks, not by recall class.
Cost reduction strategies that are defensible
Early detection
Finding an issue before broad distribution can materially reduce scope and cost, because fewer consignees and fewer units are involved.
Strong CAPA and root cause discipline
A robust corrective action reduces repeat events and prevents “recall churn,” where the same underlying issue resurfaces.
Supplier controls
Supplier changes and out-of-spec components are a common trigger for field issues. Qualification, incoming controls, and supplier monitoring reduce risk.
Design and software risk management
Design verification, validation, and risk management reduce the likelihood of high-impact failures reaching the field.
High-quality recall strategy execution
Firms that propose a clear strategy, communicate effectively, and verify effectiveness often reduce operational drag and uncertainty during FDA oversight.
How to Prevent Medical Device Recalls
Recalls are expensive, disruptive, and can damage customer trust. The most reliable way to reduce recall risk is to strengthen three systems: complaint handling, CAPA, and risk-based design and supplier controls.
Strengthen complaint handling and trend detection
A common contributor to recalls is delayed signal detection, teams see early complaints but fail to connect them into a pattern until distribution is already wide.
What to do:
Trend complaints, do not just log them. Use control charts, Pareto analysis, and periodic trending to catch shifts early.
Link complaints to CAPA. Define clear triggers for escalation, especially for repeat issues tied to the same failure mode.
Treat high-severity complaints as immediate investigations. Build a standard “rapid response” path for complaints involving serious injury or potential serious harm.
Train customer-facing teams. Sales, field service, and customer support often receive the earliest signals. Train them on complete intake, escalation, and when to involve quality and regulatory.
Implement CAPA that fixes root causes, not symptoms
A weak CAPA closes the immediate issue but allows the same underlying failure mode to reappear, often as a second recall.
What to do:
Use structured root cause analysis. 5 Whys, Fishbone, and fault-tree methods help you get past “operator error” to systemic causes.
Implement systemic corrections. If a defect exists in one line, module, supplier process, or work instruction, check for similar patterns elsewhere.
Verify effectiveness over time. Build effectiveness checks into CAPA closure, and monitor recurrence risk before closing high-risk CAPAs.
Ensure management oversight. Management review should prioritize high-risk CAPAs, CAPAs with long timelines, and CAPAs tied to field signals.
Strengthen design controls and risk management
Design and software issues can drive severe field events because they affect every unit built to the same design. Strong design controls reduce the probability of systemic defects reaching the market.
What to do:
Run risk-based FMEAs early and update them. Focus on high-severity failure modes and make risk controls traceable to design outputs and verification tests.
Verify under worst-case conditions. Include environmental extremes, component tolerances, and foreseeable user error, not just nominal performance.
Validate use-related safety when it matters. For devices where the user interface, workflow, or use environment affects safety, conduct human factors validation and realistic-use validation before commercialization.
Use independent design review. Independent reviewers catch assumptions and failure modes that core teams miss.
Strengthen supplier controls and change management
Supplier changes and quality drift can introduce defects without obvious warning signs unless you have robust controls.
What to do:
Qualify critical suppliers. Audit and assess their process controls, change controls, and validation maturity for critical components.
Risk-based incoming inspection. Use sampling or 100% inspection based on component criticality and failure impact.
Ongoing supplier monitoring. Review defect rates, delivery performance, complaint linkage, and audit outcomes.
Contractual change control. Require notification and approval for material, process, sub-supplier, or design changes that could impact device performance.
The Fastest Path to Market
FAQ
What’s the difference between recall, correction, and removal?
A recall is FDA’s umbrella term for a firm’s correction or removal of a marketed device that violates FDA law or presents a risk. A correction fixes the device where it is used, a removal physically takes it back.
How is a market withdrawal different?
A market withdrawal is a removal or correction for a minor violation not subject to legal action, or for no violation at all, like stock rotation or routine adjustments.
Who decides whether a recall is Class I, II, or III?
FDA assigns the recall classification after a Health Hazard Evaluation (HHE). Firms can propose a classification and provide data, but FDA makes the final classification decision.
Do all corrections and removals require a Part 806 report?
No. A report is required when a correction or removal is initiated to reduce a risk to health or to remedy a violation that may present a risk to health, unless an exemption applies. Stock recoveries and market withdrawals are excluded.
How long do recalls take?
There is no standard duration. Timeline depends on recall depth, number of consignees, whether patients must be contacted, how fast the correction can be implemented, and how quickly effectiveness can be verified. FDA also commonly requests recall status reports on a cadence set case-by-case, generally every 2–4 weeks.
Can a company keep selling during a recall?
Sometimes. If the recall is limited to certain lots or configurations, unaffected product may continue to ship. If the issue affects the design or all production, firms often pause distribution until corrective actions are implemented. This is scope-specific and should be coordinated with FDA.
Are recalls public?
Yes. FDA lists classified recalls in the weekly Enforcement Report, but not every recall has a press release.
How do recalls relate to MDR (21 CFR Part 803)?
They are separate. MDR covers adverse event and malfunction reporting, and MDR signals can contribute to recall decisions, but MDR obligations continue during and after a recall.