FDA 483 Citation 21 CFR 803.17: Written MDR Procedures

"Written MDR procedures have not been [developed] [maintained] [implemented]." FDA investigators cited 21 CFR 803.17 with that wording 63 times on system-generated Form FDA 483s in fiscal year 2025. Two citations about late reports followed close behind:

• "An MDR report was not submitted within 30 days of receiving or otherwise becoming aware of information that reasonably suggests that a marketed device has malfunctioned and would be likely to cause or contribute to a death or serious injury if the malfunction were to recur," cited 29 times under 803.50(a)(2)

• "An MDR report was not submitted within 30 days ... that reasonably suggests that a marketed device may have caused or contributed to a death or serious injury," cited 18 times under 803.50(a)(1)

MDR citations carry more weight than most procedural observations. A missed or late report means FDA did not receive safety information it was entitled to, and FDA treats that as a public health issue.

What the citations mean

Examples written after "Specifically" usually describe:

• No written MDR procedure, or a procedure that does not cover all required elements

• A procedure that exists but was not followed when complaints came in

• Complaints with no documented MDR reportability decision

• Reportability decisions made by people without clear criteria or training

• Reports submitted after the 30-calendar-day deadline

• Missing MDR event files or files without the evaluation behind the decision

What 21 CFR Part 803 requires

Part 803 was not changed by the Quality Management System Regulation, so these requirements apply today exactly as before.

803.17, Written MDR procedures. Manufacturers must develop, maintain and implement written MDR procedures for:

• Internal systems that provide for the timely and effective identification, communication and evaluation of events that may be subject to MDR requirements

• A standardized review process or procedure for determining when an event meets the criteria for reporting

• Timely transmission of complete medical device reports to FDA

• Documentation and recordkeeping requirements, including information that was evaluated to determine whether an event was reportable, all medical device reports and information submitted to FDA, and systems that ensure access to information that facilitates timely follow-up and inspection by FDA

803.50, Individual adverse event reports. Manufacturers must report to FDA no later than 30 calendar days after the day they receive or otherwise become aware of information, from any source, that reasonably suggests a marketed device may have caused or contributed to a death or serious injury, or has malfunctioned and the device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.

Other key sections:

• 803.53, 5-day reports, when an event requires remedial action to prevent an unreasonable risk of substantial harm to the public health, or when FDA requests a 5-day report

• 803.56, supplemental reports within 30 calendar days of obtaining information that was not known or available when the original report was submitted

• 803.12, which requires reports to be submitted electronically

• 803.18, MDR event files, which must be kept for 2 years from the date of the event or a period equal to the expected life of the device, whichever is greater

How MDR fits with QMSR and ISO 13485

QMSR incorporates ISO 13485:2016, which in clause 8.2.3 requires reporting to regulatory authorities when complaints meet reporting criteria, with documented procedures and records. In the United States, those criteria and timelines are the ones in Part 803. Complaint handling under ISO 13485 clause 8.2.2 must include determining the need to report, so your complaint procedure and MDR procedure must be connected.

How to respond to the 483

FDA generally considers responses received within 15 business days of the close of the inspection before deciding on further action. For MDR observations, some actions should not wait for the response.

Submit any missing reports now

If the observation identifies events that were reportable and not reported, or reported late, submit the reports now and state the dates in your response. Do not hold reports until the response is ready.

Review past complaints for reportability

Review every complaint over a defined period, often two years or more, against Part 803 criteria. Document the decision for each. Submit any additional reports you find, and report the totals to FDA.

Fix the MDR system

Typical system fixes include:

• A written MDR procedure covering every element of 803.17

• A reportability decision tree with clear definitions of death, serious injury, malfunction and "become aware," using the definitions in 803.3

• A requirement that every complaint receives a documented MDR decision

• Timelines that start from the date any employee becomes aware, not the date quality is told

• A process for 5-day and supplemental reports

• MDR event files with the evaluation, decision, submitted report and follow-up

• Electronic submission capability and backup users

Train everyone who can "become aware"

The 30-day clock starts when any employee becomes aware of reportable information. Train sales, service, customer support and clinical staff to forward potential events immediately, and train decision makers on the criteria.

What a compliant MDR procedure must contain

• Scope and responsibilities, including backups

• Definitions from 21 CFR 803.3

• How events are identified and communicated internally

• The standardized reportability review and decision criteria

• 30-day, 5-day and supplemental report timelines

• Electronic submission process

• MDR event file contents and retention

• Links to complaint handling, CAPA, and corrections and removals under Part 806

• Training requirements

Common mistakes in MDR responses

• Starting the 30-day clock when the complaint reaches quality, not when the company became aware

• Deciding a malfunction is not reportable because no one was hurt this time, without considering recurrence

• Keeping the decision in someone's head instead of the file

• Fixing the procedure but not reviewing past complaints

• Waiting for the 483 response to submit overdue reports

Example: how one response section might read

This illustrates structure only; your response must describe your own events and facts.

Observation 6: Written MDR procedures have not been implemented. Specifically, a complaint alleging a device fracture during a procedure that required surgical intervention was not evaluated for reporting.

Response:

• Correction: The event was evaluated and reported as a serious injury MDR on a stated date. The MDR number is provided.

• Root cause: The complaint form did not include a mandatory MDR decision, and the reviewer believed only deaths were reportable.

• Corrective action: The complaint form now requires an MDR decision with reference to the criteria in 21 CFR 803.3 and 803.50 before the complaint can proceed. The MDR procedure was revised to include a decision tree and examples.

• Retrospective review: All 312 complaints from the past three years were re-evaluated by two trained reviewers. Four additional reportable events were identified and reported on stated dates.

• Training: MDR decision makers completed training with a competency check; all customer-facing staff were trained on forwarding potential events the same day.

• Verification: Every MDR decision will receive second-person review for six months.

Frequently asked questions

When does the 30-day clock start?

Under the definition of "become aware" in 21 CFR 803.3, a manufacturer becomes aware of an event that must be reported within 30 calendar days when any of its employees becomes aware of it. A narrower definition, tied to employees with management or supervisory responsibilities, applies to 5-day reports for events that require remedial action. Either way, internal systems must move information to the MDR decision makers quickly.

Is a malfunction reportable if no one was hurt?

It can be. A malfunction is reportable if the device or a similar device would be likely to cause or contribute to a death or serious injury if the malfunction were to recur.

Did QMSR change MDR reporting?

No. Part 803 was not changed by QMSR, but ISO 13485 clause 8.2.3 now requires your quality system to document how reporting to regulators is handled.

How A.P. Lyon documents help

A.P. Lyon's Medical Device Reporting (MDR) Procedure for 21 CFR Part 803 covers internal identification of events, the reportability decision, timelines, electronic submission and MDR event files. It links to the Complaint Handling Procedure, and both are part of the Complaint Handling Procedures Bundle. If you also sell outside the United States, the Vigilance Procedure covers reporting to other regulators.

Documents are editable Word and Excel files and must be adapted to your devices and organization. Your staff must be trained, and reportability decisions remain the manufacturer's responsibility.

Next steps

• Submit any overdue or missing reports immediately

• Review past complaints for reportability and document every decision

• Revise the MDR procedure, decision criteria and training

• Respond within 15 business days with dates for each action

To build a complete set of procedures at a volume discount, use Build Your QMS. For help with a 483 response, see A.P. Lyon consulting services.

Not sure where your quality system stands? Take the free QMS gap check: about 20 questions, an instant report of your gaps by clause, and the procedures that close each one.