Regulatory Reporting

ISO 13485: §8.2.3 Reporting to regulatory authorities

Regulatory reporting procedures must be documented as a standalone QMS process — not embedded in complaint handling — because the reportability determination is a distinct legal obligation with defined timeframes and accountability that complaint intake alone does not capture. FDA MDR requirements under 21 CFR Part 803 impose 30-day and 5-day reporting timelines from the date the manufacturer becomes aware of information reasonably suggesting a reportable event; a procedure that does not name a responsible role, define criteria, and establish the timeline triggers creates conditions for late or missed reports — regulatory violations with potentially severe consequences. The requirement to document reportability assessments for events determined not to be reportable is equally important: it demonstrates that the evaluation was made deliberately, not omitted, and provides a record that survives inspector review of the event file. The inclusion of advisory notices (field safety corrective actions) within the regulatory reporting obligation reflects the full scope of manufacturer reporting duties: adverse event reporting and field corrective action reporting are both regulatory obligations, and a QMS that documents only MDR criteria will lack procedures for the advisory notice component. Multi-jurisdiction reporting obligations — EU MDR 2017/745 serious incident reporting, Health Canada problem reports, and other national competent authority notifications — must be addressed wherever the device is marketed, making the procedure scope a function of the device's geographic distribution, not just the US regulatory context.

Part 820 addressed regulatory reporting primarily through the complaint handling requirements of 820.198, which required evaluation of each complaint for MDR reportability under 21 CFR Part 803. The specific reporting requirements were defined outside Part 820, in Parts 803 (MDR), 806 (reports of corrections and removals), and 810 (recall authority). ISO 13485 clause 8.2.3 is conditional: if applicable regulatory requirements require notification of complaints that meet specified reporting criteria of adverse events or issuance of advisory notices, the organization shall document procedures for providing notification to the appropriate regulatory authorities and maintain records of reporting.

The structural change is significant: regulatory reporting is now explicitly a QMS process, not just an adjunct to complaint handling. Clause 8.2.3 does not itself name jurisdictions or reporting timelines; they come from the applicable regulatory requirements. In practice, an organization subject to MDR reporting (21 CFR Part 803), corrections and removals reporting (21 CFR Part 806), or, if applicable, EU vigilance reporting under MDR 2017/745 and other national authority reporting requirements would document its procedure for providing notification under each of them.

The QMSR also introduces explicit requirements for when regulatory reporting applies and how it integrates with the broader feedback and complaint systems. Under the legacy QSR, the linkage between complaint investigation and MDR determination was procedural but not structurally formalized as a standalone QMS process. Under ISO 13485, regulatory reporting has its own clause, its own procedure requirements, and its own record requirements, creating a more auditable and traceable process.

The FDA preamble noted that regulatory reporting obligations under 21 CFR Parts 803 and 806 remain unchanged by the QMSR; the change is in how these obligations are integrated into the QMS framework.