Complaint handling under ISO 13485 and the EU MDR: a working guide
How to receive, record, assess, investigate and trend medical device complaints under ISO 13485 clause 8.2.2, and when a complaint becomes an MDR vigilance report.
A distributor emails on a Friday afternoon: a nurse reports that the connector on one of your infusion sets cracked during use and the line leaked. Nobody was hurt, as far as they know. Before Monday someone has to decide whether this is a complaint, whether the reporting clock has started, and what happens to the returned set when it arrives. This article walks through complaint handling as ISO 13485:2016 clause 8.2.2 and the EU Medical Device Regulation expect it: what to record, how to decide reportability, how to investigate, when a complaint should open a CAPA, and how to trend complaints so that a slow rise does not go unnoticed.
What ISO 13485 clause 8.2.2 requires
ISO 13485:2016 defines a complaint (clause 3.4) as a written, electronic or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, usability, safety or performance of a medical device that has been released from the organisation's control, or related to a service that affects the performance of such devices. The definition is broad on purpose. A phone call counts. A sales representative's note from a hospital visit counts. The allegation does not have to be proven to be a complaint.
Clause 8.2.2 requires documented procedures for timely complaint handling in line with applicable regulatory requirements. As a minimum, the procedure covers requirements and responsibilities for:
- receiving and recording information;
- evaluating information to determine whether the feedback is a complaint;
- investigating complaints;
- determining the need to report to the appropriate regulatory authorities;
- handling complaint-related product;
- determining the need to initiate corrections or corrective actions.
If a complaint is not investigated, the justification has to be documented. Any correction or corrective action that results is documented. Where the investigation finds that activities outside your organisation contributed, such as a supplier or a distributor, relevant information is exchanged with that party. Clause 8.2.3 then covers reporting to regulatory authorities where the complaint meets the reporting criteria, with records kept. Complaints also feed clause 8.4 analysis of data and are an input to management review under clause 5.6.2.
Two points from that list cause most audit findings. The first is the evaluation step: feedback logged as an "enquiry" or "service request" when it alleges a deficiency is an unlogged complaint, and auditors look for it in service records, returns and sales notes. The second is the reportability decision. Every complaint needs one, recorded with its reasoning, including the ones where the answer is no.
Receiving and recording medical device complaints
Capture as much as you can at first contact, because the information gets harder to obtain every day after. A complaint record usually holds the following.
| Field | What to capture |
|---|---|
| Dates | Date received, and the date anyone in the company first learned of it |
| Source | Who reported it (user, distributor, healthcare facility, patient) and how to contact them |
| Device | Product, model, UDI, lot or serial number, quantity involved |
| Allegation | What happened, in the reporter's words where possible |
| Patient and user impact | Any injury, intervention, delay to treatment, or "unknown" |
| Device availability | Whether the device can be returned, and a request to keep it unaltered |
| Initial assessment | Is it a complaint? Is it a potential serious incident? Who decided, and when? |
The date that matters most is the second one. Under MDR Article 87 the reporting periods run from when the manufacturer becomes aware of the incident. The Medical Device Coordination Group's Q&A on vigilance terms, MDCG 2023-3, treats awareness as the date the first employee or representative of the manufacturer receives the information. So the clock starts when the distributor's email lands in a sales inbox on Friday, and QA reading it on Monday has already used three days. Train everyone who talks to customers to forward potential complaints the same day, and set the procedure up so the record shows both dates.
Deciding reportability under EU MDR vigilance
The MDR (Regulation (EU) 2017/745, available on EUR-Lex) uses two definitions in Article 2. An incident (2(64)) is any malfunction or deterioration in the characteristics or performance of a device on the market, including use error due to ergonomic features, any inadequacy in the information supplied by the manufacturer, and any undesirable side-effect. A serious incident (2(65)) is an incident that directly or indirectly led, might have led or might lead to the death of a patient, user or other person, the temporary or permanent serious deterioration of a person's state of health, or a serious public health threat.
"Might have led" is the phrase that catches people out. The cracked infusion connector in the opening example harmed no one, but a leaking line during an infusion could plausibly lead to a serious deterioration in health, depending on the therapy. The question to answer is whether the incident could have caused serious harm if circumstances had been less fortunate, and whether the device may have contributed. Article 10(13) requires manufacturers to have a system for recording and reporting incidents and field safety corrective actions, so this reasoning belongs in a documented decision, signed by someone with the authority to make it.
Article 87 sets the deadlines for serious incidents:
| Situation | Report no later than |
|---|---|
| Serious public health threat | 2 days after awareness (Article 87(4)) |
| Death or unanticipated serious deterioration in health | 10 days after awareness (Article 87(5)) |
| Any other serious incident | 15 days after awareness (Article 87(3)) |
Each of these is a backstop. The text says "immediately" after the manufacturer establishes a causal relationship, or that one is reasonably possible. Article 87(6) allows an incomplete initial report followed by a complete one, and Article 87(7) is explicit: if you are uncertain whether an incident is reportable, you report anyway within the deadline. A procedure that waits for the returned device to be analysed before deciding will miss deadlines.
Expected side-effects that are clearly documented in the product information and quantified in the technical documentation are excluded from individual reporting under Article 87(1). They fall under trend reporting instead, covered below.
If you also supply Great Britain, the Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024 came into force on 16 June 2025 and brought in the same 15, 10 and 2 day structure for reports to the MHRA. The MHRA's guidance on post-market surveillance requirements sets out the detail, and a complaint procedure covering both markets should route each decision against both sets of criteria.
Investigating the complaint
Once a serious incident is reported, Article 89(1) requires the manufacturer to perform the necessary investigations without delay, including a risk assessment of the incident and any field safety corrective action, and to cooperate with the competent authorities. It also says you should not carry out any investigation that alters the device or a sample of the batch in a way that could affect later evaluation of the causes without first informing the competent authority. Quarantine returned devices and record their condition before anyone opens them.
For any complaint, serious or not, the investigation usually covers the same ground: examination or testing of the returned device, review of the device history record or batch record for that lot, retained samples, the risk management file to see whether the failure mode was foreseen and how its probability was estimated, previous complaints for the same failure mode, and whether the device was used as labelled. Where the device is not returned, say what you did instead and why the conclusion still stands.
The investigation conclusion needs a root cause supported by evidence, or a documented explanation of why none could be confirmed. Methods for getting there are covered in root cause analysis for deviations and CAPA.
Not every complaint justifies a full investigation. A tenth report of a known, already corrected cosmetic defect may reasonably be closed by reference to the existing investigation. Clause 8.2.2 allows that, provided the justification is written down and someone accountable approved it.
Linking complaints to CAPA
Clause 8.2.2 asks you to determine the need for correction or corrective action; it does not say every complaint opens a CAPA. Set criteria in the procedure so the decision is consistent: a confirmed nonconformity with a cause inside your control, any serious incident, a failure mode not identified in the risk file, a trend crossing its threshold, or a repeat of a cause that an earlier CAPA was meant to remove. Record the CAPA number in the complaint, and the complaint number in the CAPA, so an auditor can follow the thread both ways.
Remember the risk file. If complaints show a failure mode happening more often than the risk analysis assumed, the risk estimate has to be updated, and that change can affect the benefit-risk conclusion and the clinical evaluation. For what clause 8.5.2 then requires of the corrective action, see CAPA under ISO 13485.
Complaint trending and MDR Article 88
Article 88 requires manufacturers to report any statistically significant increase in the frequency or severity of incidents that are not serious incidents, or that are expected undesirable side-effects, where the increase could have a significant impact on the benefit-risk analysis and has led or may lead to unacceptable risks. The comparison is against the foreseeable frequency or severity specified in the technical documentation and product information.
That last sentence is the practical point. You cannot detect a significant increase without a documented baseline, so the trending method has to be defined in the post-market surveillance plan before you need it. A workable approach has four parts. Code every complaint consistently by product, failure mode and harm, using a controlled list rather than free text. Normalise counts against units sold or used, because a rising count during a sales increase may be a stable rate. Set thresholds per failure mode based on the expected rates in the risk file, and say which statistical method you use to decide that a rise is significant. Review on a fixed schedule, monthly for higher-risk devices, and record each review even when nothing has moved.
Trending also catches what no single complaint reveals, such as a cluster from lots made after a supplier change.
Timelines to build into the procedure
Regulatory deadlines are the outer limit. Set internal targets well inside them: same-day logging of anything received by any employee, a documented reportability decision within a short fixed period after awareness, an escalation route to the person responsible for regulatory compliance for anything potentially serious, and a target for investigation closure proportionate to risk. Report the ageing of open complaints at management review.
The takeaway
Log every allegation on the day anyone hears it, record a reportability decision with its reasoning for every complaint, report when unsure, keep returned devices unaltered, and define your trend baseline before you need it. Then pick five closed complaints and check whether an auditor could follow each from first contact to CAPA without asking anyone.
Where a complaint investigation leads to corrective action, InnoQualis CAPA keeps the actions, owners and effectiveness review in one record with an append-only audit trail.
