FDA 483 Citation 21 CFR 820.198: Complaint Handling Procedures

"Procedures for receiving, reviewing, and evaluating complaints by a formally designated unit have not been [adequately] established." In fiscal year 2025 FDA investigators wrote that sentence, citing 21 CFR 820.198(a), 211 times on system-generated Form FDA 483s. That made complaint handling the second most cited medical device observation, behind only CAPA. A second complaint citation, "Complaint files are not [adequately] maintained," appeared another 32 times.

Complaints get this much attention because they are the most direct evidence of how a device performs in the field. They are also the entry point for Medical Device Reporting (MDR). When complaint handling fails, FDA cannot be sure that reportable events were caught and reported on time.

What the citation means

The bracketed word "adequately" shows whether the investigator found no procedure or a procedure that falls short. The examples after "Specifically" usually describe one or more of these problems:

• No formally designated unit, or unclear responsibility for receiving and evaluating complaints

• Oral or emailed complaints that were never documented

• Complaints not evaluated to decide whether an MDR report was required

• Complaints closed without investigation and with no documented reason or name of the person who decided

• Complaint records missing required information such as the device identifier, the investigation results or the reply to the complainant

• Sales, service or customer support receiving complaints that never reached the complaint unit

• Similar complaints never linked or trended

What 21 CFR 820.198 required

Under the Quality System Regulation, section 820.198 required each manufacturer to maintain complaint files and establish procedures for receiving, reviewing and evaluating complaints by a formally designated unit. The procedures had to ensure that:

• All complaints are processed in a uniform and timely manner

• Oral complaints are documented upon receipt

• Complaints are evaluated to determine whether they represent an event that must be reported to FDA under 21 CFR Part 803

The section also required that each complaint be reviewed to decide whether an investigation is necessary. If no investigation was made, the record had to include the reason and the name of the person responsible for the decision. Complaints involving the possible failure of a device, its labeling or its packaging to meet specifications had to be reviewed, evaluated and investigated, unless an investigation had already been performed for a similar complaint.

Investigation records had to include the device name, the date the complaint was received, any device identifier and control number used, the name, address and phone number of the complainant, the nature and details of the complaint, the dates and results of the investigation, any corrective action taken and any reply to the complainant.

What changed under QMSR

Since February 2, 2026, the Quality Management System Regulation incorporates ISO 13485:2016 by reference. Complaint handling now rests mainly on:

• ISO 13485 clause 8.2.2, Complaint handling, which requires documented procedures for timely complaint handling covering receiving and recording information, evaluating whether the feedback is a complaint, investigating complaints, determining the need to report to regulatory authorities, handling complaint-related product and determining the need to initiate corrections or corrective actions. If a complaint is not investigated, the justification must be documented.

• ISO 13485 clause 8.2.3, Reporting to regulatory authorities, which links complaint handling to adverse event reporting. In the United States that reporting is still governed by 21 CFR Part 803, which QMSR did not change.

• 21 CFR 820.35, Control of records, where FDA kept specific requirements for what complaint records must contain, so the detailed record content requirements continue.

For most firms, the practical change is that the procedure must now cite ISO 13485 clauses and show the link to MDR reporting, CAPA and data analysis more explicitly.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action, such as a warning letter. Aim to respond within that window.

Correct the specific complaints cited

For every complaint listed in the observation, complete the missing steps. Document the investigation, record the reason if no investigation is needed, complete the MDR reportability decision and fill in any missing record fields. If the review shows an event was reportable and not reported, submit the MDR now and say so in your response.

Fix the complaint system

System fixes typically include:

• Naming the formally designated complaint unit and its responsibilities

• Defining what counts as a complaint, including feedback received by sales, service, distributors and social media

• Requiring every complaint to receive a documented MDR reportability decision, with the decision criteria written into the procedure

• Setting timelines for logging, evaluating and investigating complaints, with tighter timelines for potentially reportable events

• Adding a complaint form or electronic record that cannot be closed without the required fields

• Requiring trending of complaints by failure mode, product and lot, with defined thresholds that trigger CAPA

Review past complaints

Look back over a defined period, often two or three years, and review every complaint file against the revised procedure. Pay special attention to reportability decisions. Report the number reviewed, the gaps found and any late MDRs submitted as a result.

Train everyone who may receive a complaint

Complaints often enter through people outside quality: sales, customer service, field service and distributors. Training only the complaint unit is not enough. State who was trained and when.

Verify and report progress

Commit to an internal audit of the complaint system after the changes have run for a period, and give FDA dates for each action.

What a compliant complaint procedure must contain

• Definition of a complaint consistent with ISO 13485 and FDA usage

• The formally designated unit and its authority

• How complaints are received from every channel, including oral complaints

• Required record content, matching 21 CFR 820.35

• The MDR reportability decision for every complaint, with criteria and timelines

• Investigation requirements and the documented justification when no investigation is done

• Handling of returned or complaint-related product

• Links to CAPA, risk management and post-market surveillance

• Trending and data analysis

• Reply to the complainant

• Record retention

Common mistakes in complaint responses

• Retraining the complaint unit but not the sales and service staff where complaints are lost

• Leaving the MDR decision to judgment without written criteria

• Closing complaints as "no problem found" without explaining what was tested

• Treating each complaint separately so recurring failures are never seen

• Promising a retrospective review without saying how far back it goes

Example: how one response section might read

This is an illustration of structure only. Your response must describe your own facts.

Observation 2: Procedures for receiving, reviewing and evaluating complaints have not been adequately established. Specifically, three complaints received by customer service by email were not entered in the complaint system and were not evaluated for MDR reportability.

Response:

• Correction: The three complaints were entered, investigated and evaluated for reportability on stated dates. One met the criteria for a malfunction report and was submitted on a stated date; the MDR number is provided.

• Root cause: The complaint procedure did not define email and phone feedback to customer service as complaint channels, and customer service staff had not been trained to forward them.

• Corrective action: The procedure was revised to define all intake channels, require logging within one business day and require a documented MDR decision for every complaint.

• Retrospective review: Customer service email and call logs for the past two years were searched for possible complaints; 27 were found, logged and evaluated, and two additional MDRs were submitted.

• Training: Customer service, sales and field service staff were trained; records attached.

• Verification: Complaint intake will be audited quarterly for the next year, with results reported in FDA updates.

The retrospective search of the channel where complaints were lost is what convinces FDA the gap is closed.

Frequently asked questions

What counts as a complaint?

ISO 13485 defines a complaint as written, electronic or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, usability, safety or performance of a medical device that has been released from the organization's control, or related to a service that affects the performance of such devices. Feedback that meets that definition is a complaint wherever it arrives.

Does every complaint need an investigation?

No, but every complaint needs a documented evaluation. If you decide not to investigate, ISO 13485 requires the justification to be documented, and FDA expects the record to show who made that decision.

Can sales or service staff close a complaint?

They can receive and record it, but the evaluation, investigation and MDR decision belong to the formally designated complaint unit defined in your procedure.

How A.P. Lyon documents help

A.P. Lyon's Complaint Handling Procedure for ISO 13485 and FDA QMSR covers receipt, evaluation, investigation, MDR reportability and record content, with the forms needed to document each complaint. The Complaint Trending Procedure adds the trending and thresholds FDA expects, and the Medical Device Reporting (MDR) Procedure covers the Part 803 requirements that complaint handling feeds. All three, with related documents, are available together in the Complaint Handling Procedures Bundle.

Documents are editable Word and Excel files. They must be adapted to your devices, complaint channels and organization, and your staff must be trained on them. FDA judges the system you run, not only the paperwork.

Next steps

• List every complaint and example cited on your 483

• Complete each record and make the MDR decision for each one

• Revise the procedure, train every complaint channel, and review past files

• Respond within 15 business days with dates for every action

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.