21 CFR Part 803: medical device reporting rules, deadlines, and what FDA cites

21 CFR Part 803 is the FDA regulation that requires device manufacturers, importers and user facilities to report device-related deaths, serious injuries and certain malfunctions, and to keep written procedures and files that show how each reporting decision was made. FDA calls these reports medical device reports, or MDRs.

This guide walks through Part 803 section by section, then shows how its failures appear on inspection records: 2,231 of 10,321 medical device Form 483s in the Atlas database cite Part 803 (release of August 15, 2026, covering February 2013 to July 2026, counted in November 2026).

Key facts

• A manufacturer must report a device-related death, serious injury or reportable malfunction within 30 calendar days of becoming aware of it, under 21 CFR 803.50(a).
• A manufacturer must file a 5-day report within 5 work days when an event needs remedial action to prevent an unreasonable risk of substantial harm, or when FDA asks for 5-day reports in writing (21 CFR 803.53).
• User facilities report deaths to FDA and the manufacturer, and serious injuries to the manufacturer, within 10 work days (21 CFR 803.30), plus an annual report on Form FDA 3419 by January 1.
• Manufacturers and importers must submit MDRs to FDA electronically (21 CFR 803.12(a)).
• In Atlas, 21 CFR 803.17, written MDR procedures, appears on 1,594 device Form 483s, 71% of all forms that cite Part 803.
• The share of device Form 483s citing Part 803 fell from 24.8% in 2016 to 17.3% in 2025, in Atlas data.

What does 21 CFR Part 803 require?

21 CFR Part 803 requires three kinds of reporters to tell FDA, or the manufacturer, about device-related deaths, serious injuries and certain malfunctions within fixed deadlines, and to keep the procedures and records behind each decision. The regulation runs from 803.1 to 803.58 in five subparts:

Distributors that do not import sit outside the reporting duty. Under 803.18(d) they still keep device complaint records, filed by device name. Part 803 also exempts licensed practitioners who make devices only for their own patients, people who make devices only for their own research or teaching, and dental and optical laboratories (803.19(a)).

FDA rewrote Part 803 in a final rule published February 14, 2014 (79 FR 8846), which moved manufacturer and importer reporting to electronic submission. The same rule stayed 803.58, the US agent provision for foreign manufacturers, indefinitely, so foreign manufacturers report under 803.50 directly.

Who must report under 21 CFR Part 803?

Manufacturers, importers and device user facilities must report under 21 CFR Part 803; each has its own trigger, recipient and deadline. A user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility or outpatient treatment facility that is not a physician's office (803.3).

The manufacturer carries the heaviest duty. Under 803.50(b), it must report everything "reasonably known" to it, which includes anything it can learn by contacting the user facility or by testing the device, and it must investigate each event and evaluate the cause. When it learns new facts after the first report, it files a supplemental report within 30 calendar days (803.56).

Importers report deaths and serious injuries to FDA and the manufacturer, and reportable malfunctions to the manufacturer only, all within 30 calendar days (803.40). User facilities do not report malfunctions at all; they report deaths and serious injuries, and they summarize the year's reports on Form FDA 3419 by January 1 (803.33).

What is an MDR reportable event?

An MDR reportable event is information that reasonably suggests a device may have caused or contributed to a death or serious injury, or, for manufacturers and importers, that their device malfunctioned in a way that would likely cause or contribute to a death or serious injury if it happened again (803.3). Four definitions in 803.3 decide most cases:

• Become aware: for a manufacturer, the day any employee learns of a reportable event. For a user facility, the day its medical personnel do. The deadline counts from this date, not from the date a complaint reaches the quality unit.
• Caused or contributed: the device was or may have been a factor, including through failure, malfunction, design, manufacture, labeling or user error.
• Serious injury: an injury or illness that is life-threatening, causes permanent impairment or damage, or needs medical or surgical intervention to prevent permanent impairment or damage.
• Malfunction: the device failed to meet its performance specifications, which include every claim in its labeling, or failed to perform as intended.

Two situations need no report under 803.22: information that turns out to be wrong because no device-related event occurred, and events involving a device the firm did not make or import, which it forwards to FDA with a cover letter. One report can cover several sources describing the same patient and the same event. Under 803.16, filing a report is not an admission that the device or the firm caused the event.

30-day vs 5-day reports: what is the difference?

A 30-day report is the standard manufacturer MDR, due 30 calendar days after the firm becomes aware of a reportable event; a 5-day report is the urgent version, due in 5 work days, and only in the two situations 803.53 names.

Remedial action under 803.3 means any action beyond routine maintenance or servicing that is needed to prevent the event from happening again. A manufacturer can learn that remedial action is needed from trend analysis as well as from a single event, so a complaint trend review can start a 5-day clock.

How do you submit an MDR to FDA?

Manufacturers and importers submit MDRs to FDA electronically under 803.12(a), in the eMDR format that carries Form FDA 3500A content, either through FDA's Electronic Submissions Gateway or FDA's eSubmitter tool. User facilities may still file Form 3500A on paper, and health professionals, patients and consumers report voluntarily on Form FDA 3500 through MedWatch.

1. Collect the 803.52 data elements: patient, event, device (including the UDI where known), manufacturer, and the results of your evaluation.
2. Code the event with the adverse event codes FDA publishes for Form 3500A (803.21).
3. Submit electronically and keep FDA's electronic acknowledgment in the MDR event file (803.18(b)(1)(iii)).
4. File a supplemental report within 30 calendar days of receiving new information (803.56).
5. Write in English (803.13).

FDA can also change the reporting format. Under 803.19, a manufacturer can request an exemption, variance or alternative, and FDA can grant quarterly or summary reporting. FDA's Voluntary Malfunction Summary Reporting program, an alternative granted under this section in August 2018, lets manufacturers of eligible device types report most malfunctions in quarterly summaries.

Which Part 803 sections does FDA cite most on Form 483s?

FDA investigators cite 21 CFR 803.17, written MDR procedures, more than any other Part 803 section: it appears on 1,594 of the 2,231 medical device Form 483s in Atlas that cite Part 803. Late or missing manufacturer reports under 803.50 come second, on 658 forms. Every other section is rare.

Investigators test the MDR system by reading the written procedure first; 1,496 forms cite 803.17 as their only Part 803 section, which means the procedure gap was found without a missed report. When they do find a missed report, it is more often a malfunction (803.50(a)(2), 397 forms) than a death or serious injury (803.50(a)(1), 284 forms). Malfunction reportability turns on a judgment about whether a recurrence would likely cause harm, which is the call 803.17(a)(2) asks firms to standardize.

Most forms that cite Part 803 also cite complaint handling: 1,271 of the 2,231 also cite 21 CFR 820.198, complaint files, because a late MDR usually starts as a complaint nobody screened for reportability. Our guide to the FDA MAUDE database breaks those complaint citations down.

Four records from the FDA Form 483 database show the range:

• Karl Storz Endoscopy America, Auburn, February 15, 2024: an importer citation, 803.40(a) on reports of deaths and serious injuries, next to 820.100(b) on CAPA documentation.
• Biowave Corporation, Westport, May 26, 2026: 803.50(a)(2) on individual malfunction reports, cited in the QMSR period alongside ISO 13485:2016 clauses 6.1(a) and 7.4.3.
• Magnatone Hearing Aid, Casselberry, July 14, 2025: 14 observations, including 803.17(a)(2), no system for determining MDR events, with 820.198(a) complaint procedures and 820.100(a) CAPA procedures.
• Hologic, San Diego, October 14, 2022: 803.50(a)(1) on a death or serious injury report, with 820.198(e) complaint investigation records and two design control sections.

Atlas holds the same detail for your own facilities and suppliers, including the investigators who wrote each form and the sections they cite most often.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

How often does FDA cite Part 803 on device 483s?

FDA cited Part 803 on 17.3% of device Form 483s in 2025, down from a peak of 24.8% in 2016. From 2013 to 2021 the share held between 22.3% and 24.8% every year; it has stayed at or below 19.8% since 2022.

The counts cannot tell you whether firms report better than they did; a lower share can also mean investigators spent their observations elsewhere. Atlas holds fewer device Form 483s per year since 2020, 807 in 2025 against 1,071 in 2017. Part 803 itself did not change when FDA's Quality Management System Regulation took effect on February 2, 2026, and our 21 CFR Part 820 guide covers what the QMSR did change, and our roundup of recent FDA medical device regulations sets it beside the 510(k) and SaMD updates. The 2026 figure covers forms issued through July 17, 2026.

What should written MDR procedures under 803.17 cover?

Written MDR procedures under 21 CFR 803.17 must cover three internal systems and four documentation duties. An investigator reads the procedure against this list, then samples complaints to see whether the procedure was followed.

1. Identification, communication and evaluation of events that may be reportable, on time (803.17(a)(1)). Name every intake route: complaints, service records, field staff, literature, social media and user facility reports.
2. A standardized review for deciding whether an event is reportable (803.17(a)(2)). This is the clause Magnatone's form cites. Write the decision criteria from the 803.3 definitions and name who decides.
3. Timely transmission of complete reports to FDA or the manufacturer (803.17(a)(3)), including how the 5-day trigger is recognized.
4. Documentation of the information evaluated for each decision (803.17(b)(1)).
5. Copies of all reports and information submitted (803.17(b)(2)).
6. Information evaluated for annual reports, where they apply (803.17(b)(3)).
7. Systems that give FDA timely access for follow-up and inspection (803.17(b)(4)).

The MDR event file under 803.18 is where the procedure leaves its evidence: the reasoning for every reportability decision, copies of reports and FDA acknowledgments. Manufacturers and importers keep each file for 2 years from the event or the expected life of the device, whichever is longer, even after the device leaves the market. Late reports usually also need a corrective action; our CAPA guide covers how FDA expects that to be documented, and what a Form 483 is explains how the observation itself is issued.

The Atlas digest sends new device Form 483s and warning letters as FDA releases them, so you can see which Part 803 sections investigators cite this month.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe