Do we need a separate MDR system, or can complaint handling cover it?

Complaint handling and MDR reportability determination are related but distinct obligations, and Section 803.17 requires a written, maintained, and implemented MDR procedure regardless of how your complaint system is built. In practice, the MDR procedure is usually layered on top of complaint handling (QMSR Clause 8.2.2): every complaint that could involve a death, serious injury, or malfunction gets an explicit MDR reportability screen at intake and again at investigation close, with the decision — reportable or not — documented and dated. A complaint procedure that closes complaints without ever asking the MDR question, or that only documents the events that were reported and drops the ones that were not, does not satisfy Section 803.17. The written procedure and the event-by-event records are two different deliverables, and an auditor checks both.

What's the difference between an MDR report (Part 803) and a corrections-and-removals report (Part 806)?

An MDR report tells FDA that a specific adverse event — a death, serious injury, or malfunction — already happened with your device in the field. A Part 806 report tells FDA that you, the manufacturer, are taking action — a correction or a removal — to reduce a risk to health the device poses, whether or not that risk has caused an event yet. They can both apply to the same underlying problem: a defect that has already hurt someone triggers an MDR report under the event-reporting rules, and if you then correct the field population, that correction can trigger a separate Section 806.10 report. Section 806.10(a)(2) does carve out one overlap: no Part 806 report is required for a correction that remedies a violation-driven health risk if you've already reported the same information under Part 803 — but that carve-out does not reach corrections initiated to reduce a risk to health under 806.10(a)(1), which still requires its own report even after an MDR has been filed for the same defect.

Does a routine product improvement need a Part 806 report?

No, if it stays inside the Section 806.1(b) exemptions: actions that improve performance or quality but do not reduce a risk to health or remedy a violation, market withdrawals, routine servicing, and stock recovery are all outside Part 806's reporting obligation — and because they are not a “correction or removal” under the part at all, they also do not need a Section 806.20 non-reportable record. The judgment call is whether the change is reducing a risk to health the device already poses. A firmware update that adds a feature is a quality improvement; a firmware update that fixes a dosing calculation error is a risk-reducing correction, even if your engineering team calls both a “patch.” Document the reasoning behind that call — an auditor who finds a field action with no reporting determination on file will assume it should have been evaluated, not that it was correctly exempt.

What happens to an active surveillance study if we stop selling the device?

The obligation does not end automatically. Section 822.28 requires you to keep conducting surveillance in accordance with your approved plan even after you stop marketing the device. You can ask FDA to terminate or modify the study on the grounds that you're no longer marketing it, but FDA decides case by case — there's no self-executing right to stop. Until FDA notifies you in writing that you may stop, the data collection, investigator oversight, and interim reports keep running on the original schedule.

What if our company is acquired, or we close, while a Section 522 order is active?

Three separate 30-day clocks can apply, plus one 10-working-day clock, and they run from different trigger dates. Section 822.26 requires FDA notification within 30 days of an ownership change, and the surveillance obligation generally transfers to the new owner unless both parties agree the seller will keep conducting it — in which case FDA still has to be told about the ownership change itself. Section 822.27 requires notification within 30 days of the decision to close the business, not the closure date, and the notification has to identify who will hold the surveillance records afterward. Section 822.34 is the tightest: if the study sponsor or an investigator changes, all records must be transferred to the replacement and FDA notified within 10 working days of the effective date, with certification that the transfer happened. Build these into M&A due diligence and wind-down checklists before the transaction, not during it.

What does FDA's cease distribution and notification order actually require us to do?

Immediately: stop distributing the device, notify health professionals and device user facilities using a verified written channel with a conspicuous urgent marking, and instruct them to stop using it. Section 810.10 gives FDA this authority when it finds a reasonable probability that the device would cause serious adverse health consequences or death. The obligation to submit a formal recall strategy is not automatic on day one — it attaches once FDA modifies the order under a regulatory hearing or written-review process, or escalates it to a mandatory recall order under Section 810.13. Either way, effectiveness checks confirming that every consignee, health professional, and device user facility was actually notified are required, and periodic status reports go to FDA on the schedule the order specifies. A company with no pre-built consignee tracking and no notification templates is trying to assemble all of this for the first time under an active order — that is the scenario the recall-readiness audit finding below is describing.

How does MDR reporting connect to our CAPA process?

An MDR reportability determination and a CAPA are different decisions that share the same investigation. Reportability under Section 803.50 asks whether a specific event meets the death/serious-injury/malfunction thresholds and has to go to FDA within 30 (or 5) days. CAPA under QMSR Clause 8.5.2 asks whether the underlying cause needs to be corrected so the event doesn't recur. An MDR-reportable event usually opens or feeds a CAPA, but the reverse isn't automatic — you can have a valid CAPA with no reportable MDR event behind it, and (less often) a reportable MDR event whose root cause turns out not to need a new CAPA because an existing one already covers it. Keep the MDR event file (Section 803.18) and the CAPA record linked, but don't treat one as a substitute for the other's own documentation.

What records does an FDA investigator ask for during a postmarket inspection?

For MDR: the event files for both reportable and non-reportable determinations (Section 803.18), including the deliberation and rationale for events you decided not to report — the absence of non-reportable records reads as a gap, not as evidence nothing happened. For corrections and removals: the Part 806 report log plus the Section 806.20 records for actions you judged did not require reporting, each with a designated-person review on file. For recalls: your Part 810 recall procedure, consignee distribution records, and any prior effectiveness-check results. For an active Section 522 study: the study master file — the FDA order, the approved plan, investigator agreements, interim reports, and correspondence — which Section 822.36 gives FDA the right to inspect and copy, with required information due within 72 hours of the inspection's start. Organize all four before an inspection starts, not during one.

We've never received a Section 522 order. Do we still need a postmarket surveillance program?

Yes, but it's a different program than Part 822 describes, and the two get confused constantly because they share a name. QMSR Clause 8.2.1 (Feedback) requires every manufacturer to actively collect and review production and post-production information — complaints, field data, service records, literature — regardless of device class and regardless of whether FDA has ever ordered a formal Section 522 study. Part 822 is a specific, FDA-initiated study mechanism with its own plan, approval, and reporting structure that applies to a small subset of Class II/III devices meeting one of four named criteria. If your QMS documentation uses “postmarket surveillance” to mean your routine Clause 8.2.1 feedback loop, say so explicitly and don't let the phrase imply you're operating under an active FDA order you don't actually have.

FDA Postmarket Regulations: What You Must Have in Place

WHAT IT COVERS

FDA postmarket obligations after first sale — medical device reporting (Part 803), corrections and removals (Part 806), recall authority (Part 810), and postmarket surveillance studies (Part 822).

KEY DEADLINES

30-day and 5-day MDR reports, 10-working-day corrections and removals reports, 30-day postmarket surveillance plan submission, 10-working-day sponsor or investigator change notice.

WHO NEEDS IT

Every manufacturer, importer, and device user facility with a marketed device — Part 822 narrows further to Class II and III devices meeting one of four FDA-ordered surveillance criteria.

Design controls and risk management get most of the attention in a small device company’s quality system, because they run before first sale and they gate a submission. What happens after first sale is a different set of obligations, governed by a different part of Title 21, and it is where a lean quality team most often discovers a gap only when FDA is already asking about it.

Four regulations cover what a manufacturer must do once a device is on the market: Part 803 (medical device reporting), Part 806 (corrections and removals), Part 810 (medical device recall authority), and Part 822 (postmarket surveillance studies). None of them route through ISO 13485 the way design controls do — QMSR incorporates ISO 13485:2016 by reference at 820.10, but these four parts sit alongside that incorporation as their own binding federal requirements, each with its own reporting clock.

This guide covers what each part actually requires, what evidence to hold, what an FDA investigator asks for during a postmarket inspection, and how these obligations connect to the QMSR/ISO 13485 clauses your quality system is already built around.

Is this guide for you?

All four parts can apply to the same small device company at different points in a product’s life — they are triggered by different events, not by company size or device class alone (Part 822 is the one exception, discussed below). Use this to orient yourself before reading the detail sections.

WHICH OF THESE FOUR APPLIES RIGHT NOW? · PICK THE CLOSEST

You have a complaint or adverse event to evaluatePart 803 applies to every manufacturer: a written MDR procedure and a reportability determination on every event, reportable or not.

You're planning a proactive correction or a removalPart 806 applies if the action reduces a risk to health the device poses — report within 10 working days, or keep a non-reportable record.

FDA has ordered you to stop distribution or recall the devicePart 810 governs the order itself — immediate cessation, notification, and (if escalated) a mandatory recall strategy and status reports.

Your device is Class II or III and FDA has sent a surveillance orderPart 822 applies only after FDA issues a Section 522 order — it is not a program you build proactively without one.

The four regulations at a glance

Part 803 — Medical Device Reporting. Reactive, event-driven, and universal: every manufacturer, importer, and device user facility must report deaths, serious injuries, and certain malfunctions to FDA on a 30-day or 5-day clock, and must keep a written procedure and an event file for every determination.

Part 806 — Corrections and Removals.Proactive: you initiate the action. If a correction or removal reduces a risk to health the device poses, FDA requires a report within 10 working days; actions that don’t require reporting still require a documented, reviewed record.

Part 810 — Medical Device Recall Authority.FDA-initiated: gives FDA the power to order a company to cease distribution and, if escalated, to conduct a mandatory recall — distinct from a company’s own voluntary recall, which most small device companies handle informally without ever touching Part 810.

Part 822 — Postmarket Surveillance Studies.FDA-initiated and narrow: applies only to Class II/III devices meeting specific criteria, only after FDA issues a formal order, and it is a study obligation — a plan, an approval, and a reporting schedule — not a general feedback-monitoring requirement.

Part 803: Medical Device Reporting

Section 803.10 sets the general obligation: manufacturers must report deaths, serious injuries, and malfunctions that would likely cause or contribute to a death or serious injury if they recurred. Manufacturers report within 30 calendar days of becoming aware; user facilities report deaths within 10 work days to both FDA and the manufacturer, and serious injuries within 10 work days to the manufacturer. Manufacturers and importers must submit these reports electronically, in a format FDA can process, review, and archive (Section 803.12(a)) — the eMDR submission, built on the Form FDA 3500A data elements.

The 30-day report and the 5-day report

The 30-day report (Section 803.50) is the default clock: it starts when the manufacturer — any employee, not only the quality department — becomes aware of information reasonably suggesting a reportable event. “Reasonably known” information includes anything obtainable by contacting the user facility, importer, or other initial reporter, anything already in your possession, and anything obtainable through analysis or testing of the device. Manufacturers are responsible for completing information that a user facility or importer report left incomplete, not just for passing along what arrived.

The 5-day report (Section 803.53) is triggered by a different test: an event necessitating remedial action to prevent an unreasonable risk of substantial harm to public health, from any information source including trend analysis, or a written FDA request. Once FDA sends a written request for 5-day reports of a particular type, every subsequent substantially similar event during the specified period requires a 5-day report without a fresh request each time. A company with no periodic trending of complaint data by device type and failure mode has no mechanism for noticing when the 5-day threshold has been crossed by pattern rather than by a single severe event.

Written MDR procedures — Section 803.17

Section 803.17 requires a written MDR procedure that is developed, maintained, and implemented — not filed and forgotten. The procedure must cover: internal systems for timely identification, communication, and evaluation of potentially reportable events; a standardized review process for determining when an event meets the reporting criteria; timely transmission of complete reports; documentation of everything evaluated for reportability, including events that were not reported; and systems that keep information accessible for FDA inspection.

MDR event files and retention — Section 803.18

Every event evaluated — reportable or not — needs an MDR event file documenting the deliberation and decision-making behind the determination, copies of any report submitted, and FDA’s electronic acknowledgment for anything submitted electronically. Manufacturers and importers retain these files for 2 years from the event date or the device’s expected life, whichever is longer.

Supplemental and followup reports — Section 803.56

When new information required under Part 803 arrives after the initial report — because it wasn’t known or available at submission — a supplemental or followup report is due within 30 calendar days of receiving it. The supplemental report references the original report’s identification numbers and carries only the new or changed information, not a full re-submission. An initial report that was incomplete because information genuinely wasn’t available yet is acceptable under Section 803.50(b)(3) only if the report itself explains what was missing and what steps were taken to get it; the supplemental report is how that gap gets closed once the information exists.

Part 806: Corrections and Removals

Part 806 is the one postmarket obligation your company initiates rather than reacts to. Section 806.10 requires a written report to FDA of any correction or removal initiated to reduce a risk to health the device poses, or to remedy a violation of the FD&C Act that may present a risk to health — within 10 working days of initiating the action.

What counts as a reportable correction or removal

Section 806.1(b) exempts four categories from Part 806 reporting entirely: actions that improve performance or quality but do not reduce a risk to health or remedy a violation; market withdrawals; routine servicing; and stock recovery. Because these fall outside the part’s definition of a correction or removal, they need neither a Section 806.10 report nor a Section 806.20 non-reportable record. The judgment call that matters is whether the action reduces a risk to health the device already poses — a labeling clarification is a quality improvement; a labeling change that corrects a dosing instruction after a use-error pattern is a risk-reducing correction, whatever your engineering team calls it internally.

One overlap is worth naming precisely: Section 806.10(a)(2) does not require a Part 806 report for a violation-remedying correction if the same information was already reported under Part 803 (or Part 1004). That carve-out is narrow — it applies to the violation-remedy basis in 806.10(a)(2), not to the separate health-risk-reduction basis in 806.10(a)(1). A correction that reduces a risk to health still needs its own Section 806 report even after an MDR has been filed for the same underlying defect.

Records for actions you don’t report

Section 806.20 requires a record for every correction or removal that falls inside Part 806 but does not require an FDA report — device identification, a description of the triggering event and the action taken, and a justification for not reporting that a designated person has reviewed. These records are retained for 2 years beyond the device’s expected life and must transfer to any new manufacturer or importer of the device.

FDA access to your records

Section 806.30 requires that anyone in custody of corrections-and-removals records — not only the quality owner — permit FDA access, copying, and verification at all reasonable times, covering both reported and non-reportable records. Records kept in a system that can’t be retrieved quickly by device and date are the same problem as records that don’t exist, from an inspection standpoint.

Part 810: Medical Device Recall Authority

Part 810 gives FDA mandatory recall powers that don’t depend on your consent. Most small device companies never see this part in practice — voluntary recalls happen under your own CAPA and field-action procedures — but Part 810 is what happens when FDA decides voluntary action isn’t enough or isn’t happening.

Cease distribution and notification orders

Section 810.10 lets FDA issue a cease distribution and notification order when it finds a reasonable probability that a device would cause serious adverse health consequences or death. The named person must immediately cease distribution, notify health professionals and device user facilities through a verified written channel with a conspicuous urgent marking, and instruct them to stop using the device. Effectiveness checks confirming that every consignee, health professional, and facility was actually reached are required, and periodic status reports go to FDA on the order’s schedule.

Mandatory recall orders, strategy, and status reports

If a cease distribution order is modified through a regulatory hearing or written review, or FDA escalates directly to a mandatory recall order under Section 810.13, the named person must submit a proposed recall strategy addressing the distribution level the recall reaches, notification requirements, public warning needs, and effectiveness-check methods. FDA reviews and may modify the strategy within 7 working days. Section 810.13(c) bars FDA from ordering a recall from individuals, and from device user facilities where FDA determines the recall poses a greater health risk than leaving the device in place — so a compliant strategy has to build that limitation in, not just notify everyone indiscriminately. Periodic status reports continue until FDA terminates the order.

Part 822: Postmarket Surveillance

Part 822 is the narrowest of the four and the one most often confused with a company’s general feedback and monitoring activity. It governs FDA-ordered postmarket surveillance studies under Section 522 of the FD&C Act — a specific, FDA-initiated mechanism, not the routine collection and review of production and post-production information that QMSR Clause 8.2.1 (Feedback) already requires of every manufacturer regardless of device class.

Does Part 822 apply to your device?

Section 822.4 limits FDA’s authority to Class II and Class III devices meeting at least one of four criteria: failure would be reasonably likely to have serious adverse health consequences; the device is intended to be implanted for more than a year; it is life-supporting or life-sustaining and used outside a user facility; or it is expected to have significant use in pediatric populations. None of that matters unless FDA actually sends the order (Section 822.5) — there is no self-initiated path into Part 822.

Submitting and building the surveillance plan

Once notified, the manufacturer has 30 days to submit a surveillance plan and must commence surveillance no later than 15 months after the order was issued (Section 822.24). Section 822.10 defines what the plan must include: objectives that address each surveillance question in the order, the study subject, variables and endpoints, methodology and sample size, data sources, a data collection plan, and the content and timing of reports. FDA may order prospective surveillance for up to 36 months; longer periods require the manufacturer’s agreement. Failure to submit a plan, have it approved, or conduct surveillance according to the approved plan constitutes misbranding under FD&C Act Section 502(t)(3) — this is not a soft deadline.

What the study file has to produce within 72 hours

The study master file holds FDA correspondence, investigator agreements, the approved plan with any deviation documentation, all data and analyses, and consent or IRB records where applicable, retained for 2 years after FDA accepts the final report. Section 822.36 gives FDA the right to inspect and copy these records, including records held by contractors or investigators, and requires that information be produced within 72 hours of the inspection’s start — a shorter window than most other postmarket records requests in this guide, and one that an unorganized study file cannot meet.

When the sponsor changes or the device leaves the market

An active Section 522 study doesn’t pause for corporate events. If ownership of the company changes, Section 822.26 requires FDA notification within 30 days, and the surveillance obligation generally transfers to the new owner unless both parties agree the seller will continue it. If the company closes, Section 822.27 requires notification within 30 days of the decision to close — not the closure date — identifying who will hold the study records afterward. If the device stops being marketed, Section 822.28 still requires surveillance to continue under the approved plan until FDA specifically authorizes stopping; FDA evaluates any termination request case by case. If the study sponsor or an investigator changes, Section 822.34 requires records to be fully transferred and FDA notified within 10 working days of the change — the tightest of these four clocks.

Connecting postmarket obligations to your QMS

None of these four regulations replace your ISO 13485-based quality system — they layer on top of it. The table below maps each obligation to the QMSR/ISO 13485:2016 clause your existing procedures already touch, so a postmarket event routes through the same document-control and CAPA infrastructure you use for everything else.

CFR SECTION	WHAT IT REQUIRES	QMSR / ISO 13485 CLAUSE
§803.10	General MDR reporting obligations for device user facilities, manufacturers, and importers	ISO 13485:2016 Clause 8.2.3 (Reporting to regulatory authorities)
§803.17	Written, maintained, and implemented MDR procedures	ISO 13485:2016 Clause 8.2.3 (Reporting to regulatory authorities) and Clause 8.2.2 (Complaint handling)
§803.18	MDR event files documenting every reportability determination, retained 2 years past the event or the device's expected life	ISO 13485:2016 Clause 8.2.3 (Reporting to regulatory authorities); records under ISO 13485:2016 Clause 4.2.5 (Control of records)
§803.50	Manufacturer investigation and the 30-calendar-day report	ISO 13485:2016 Clause 8.2.3 and Clause 8.2.2 (Complaint handling)
§803.53	The 5-work-day expedited report for remedial-action-triggering events	ISO 13485:2016 Clause 8.2.3
§803.56	Supplemental or followup reports when new required information arrives	ISO 13485:2016 Clause 8.2.3
§806.10	Reports of corrections and removals initiated to reduce a risk to health	ISO 13485:2016 Clause 8.5.2 (Corrective action) and Clause 8.3 (Control of nonconforming product)
§806.1(b) / §806.20	Exemptions from reporting, and the recordkeeping obligation for corrections and removals you do not report	ISO 13485:2016 Clause 8.5.2 and Clause 4.2.5 (Control of records)
§806.30	FDA access to, and the right to copy, corrections and removals records	ISO 13485:2016 Clause 4.2.5 (Control of records)
§810.10	Cease distribution and notification order — immediate cessation, notification, and effectiveness checks	ISO 13485:2016 Clause 8.3 (Control of nonconforming product) and Clause 8.5.2 (Corrective action)
§810.13 / §810.14 / §810.16	Mandatory recall order, recall strategy, and periodic status reports	ISO 13485:2016 Clause 8.3 and Clause 8.5.2
§822.4 / §822.24	Applicability criteria for an FDA-ordered postmarket surveillance study, and the 30-day plan-submission deadline	No ISO 13485 counterpart — a Part 822 obligation exists only under an FDA order (Section 522)
§822.10 / §822.31	Surveillance plan content requirements, and study records and reporting	No ISO 13485 counterpart for the study itself; study records under ISO 13485:2016 Clause 4.2.5 (Control of records)
§822.26 / §822.27 / §822.28 / §822.34	Notification of FDA on ownership change, business closure, market withdrawal, or a sponsor/investigator change during an active study	No ISO 13485 counterpart — a Part 822 obligation exists only under an FDA order (Section 522)

The pattern across Parts 803, 806, and 810 starts with ISO 13485:2016 Clause 8.2.1 (Feedback), the intake where field information first enters your quality system. Part 822 is the exception: a postmarket surveillance study exists only because FDA ordered one, and no ISO 13485 clause stands in for that order.

ISO 13485:2016 Clause 8.2.2 (Complaint handling) is where an individual event gets investigated, and ISO 13485:2016 Clause 8.2.3 (Reporting to regulatory authorities) is the obligation that Parts 803, 806, and 810 each specialize into a concrete FDA deadline.

ISO 13485:2016 Clause 8.3 (Control of nonconforming product) governs the product disposition side of a correction, removal, or recall, and ISO 13485:2016 Clause 8.5.2 (Corrective action) is where the root-cause work lives, whether or not the event also triggered an FDA report.

What an FDA investigator asks for

A postmarket-focused establishment inspection typically works through the same four buckets in order:

Complaint and MDR files. Every complaint file the investigator pulls will have an MDR reportability determination attached, whether the answer was yes or no. Expect a sample of events that were determined non-reportable, specifically to check whether that determination is documented and dated, not just the reportable ones.

Corrections and removals log. The full Part 806 log, including actions you judged exempt or non-reportable, each with a designated-person review. An investigator who finds a field action with no entry in either the reportable or non-reportable log will ask where the reporting determination happened.

Recall readiness.Your recall procedure, consignee distribution records, and evidence of any prior effectiveness checks — whether or not you have ever received a Part 810 order. This is assessed as a capability, not just a history.

Active Section 522 studies, if any. The full study master file, tested against the 72-hour production requirement in practice, not just on paper.

Common audit findings

Non-reportable events with no documented rationale (Section 803.18).The complaint file shows reported events well-documented and non-reportable events closed with no record of why. The fix is procedural, not retroactive: every event gets an MDR determination entry regardless of outcome, at the time it’s made.

Product improvements reclassified after the fact (Section 806.1(b)).A change that reduced a real risk to health gets logged internally as a “quality improvement” with no Section 806 evaluation on file. The reporting determination needs to happen when the change is initiated, with a documented basis — not inferred later from how engineering happened to describe it.

No recall infrastructure until a recall is needed (Part 810). Consignee tracking, notification templates, and effectiveness-check protocols built for the first time during an actual field action, rather than maintained and periodically exercised in advance.

Part 822 applicability never assessed at launch (Section 822.4).For a Class II or III device that plausibly meets one of the four surveillance criteria, no documented assessment exists in the design history file or technical file explaining whether Part 822 could apply — leaving the company unable to answer the question quickly if FDA raises it during review.

Frequently asked questions

Do we need a separate MDR system, or can complaint handling cover it?: Complaint handling and MDR reportability determination are related but distinct obligations, and Section 803.17 requires a written, maintained, and implemented MDR procedure regardless of how your complaint system is built. In practice, the MDR procedure is usually layered on top of complaint handling (QMSR Clause 8.2.2): every complaint that could involve a death, serious injury, or malfunction gets an explicit MDR reportability screen at intake and again at investigation close, with the decision — reportable or not — documented and dated. A complaint procedure that closes complaints without ever asking the MDR question, or that only documents the events that were reported and drops the ones that were not, does not satisfy Section 803.17. The written procedure and the event-by-event records are two different deliverables, and an auditor checks both.
What's the difference between an MDR report (Part 803) and a corrections-and-removals report (Part 806)?: An MDR report tells FDA that a specific adverse event — a death, serious injury, or malfunction — already happened with your device in the field. A Part 806 report tells FDA that you, the manufacturer, are taking action — a correction or a removal — to reduce a risk to health the device poses, whether or not that risk has caused an event yet. They can both apply to the same underlying problem: a defect that has already hurt someone triggers an MDR report under the event-reporting rules, and if you then correct the field population, that correction can trigger a separate Section 806.10 report. Section 806.10(a)(2) does carve out one overlap: no Part 806 report is required for a correction that remedies a violation-driven health risk if you've already reported the same information under Part 803 — but that carve-out does not reach corrections initiated to reduce a risk to health under 806.10(a)(1), which still requires its own report even after an MDR has been filed for the same defect.
Does a routine product improvement need a Part 806 report?: No, if it stays inside the Section 806.1(b) exemptions: actions that improve performance or quality but do not reduce a risk to health or remedy a violation, market withdrawals, routine servicing, and stock recovery are all outside Part 806's reporting obligation — and because they are not a “correction or removal” under the part at all, they also do not need a Section 806.20 non-reportable record. The judgment call is whether the change is reducing a risk to health the device already poses. A firmware update that adds a feature is a quality improvement; a firmware update that fixes a dosing calculation error is a risk-reducing correction, even if your engineering team calls both a “patch.” Document the reasoning behind that call — an auditor who finds a field action with no reporting determination on file will assume it should have been evaluated, not that it was correctly exempt.
When does postmarket surveillance under Part 822 (a Section 522 order) apply to us?: Only when FDA has actually sent you a postmarket surveillance order — Part 822 is not something you opt into or self-assess your way into. Section 822.4 limits the authority to Class II or Class III devices that meet at least one of four criteria: failure would be reasonably likely to cause serious adverse health consequences; the device is implanted for more than a year; it's life-supporting or life-sustaining and used outside a user facility; or it's expected to see significant pediatric use. Most small device companies never receive a 522 order. Don't confuse this with the general postmarket feedback and surveillance activity every QMS runs under QMSR Clause 8.2.1 — that's a standing requirement for every device, on every company, independent of whether FDA has ever issued a Part 822 order for anything you make.
What happens to an active surveillance study if we stop selling the device?: The obligation does not end automatically. Section 822.28 requires you to keep conducting surveillance in accordance with your approved plan even after you stop marketing the device. You can ask FDA to terminate or modify the study on the grounds that you're no longer marketing it, but FDA decides case by case — there's no self-executing right to stop. Until FDA notifies you in writing that you may stop, the data collection, investigator oversight, and interim reports keep running on the original schedule.
What if our company is acquired, or we close, while a Section 522 order is active?: Three separate 30-day clocks can apply, plus one 10-working-day clock, and they run from different trigger dates. Section 822.26 requires FDA notification within 30 days of an ownership change, and the surveillance obligation generally transfers to the new owner unless both parties agree the seller will keep conducting it — in which case FDA still has to be told about the ownership change itself. Section 822.27 requires notification within 30 days of the decision to close the business, not the closure date, and the notification has to identify who will hold the surveillance records afterward. Section 822.34 is the tightest: if the study sponsor or an investigator changes, all records must be transferred to the replacement and FDA notified within 10 working days of the effective date, with certification that the transfer happened. Build these into M&A due diligence and wind-down checklists before the transaction, not during it.
What does FDA's cease distribution and notification order actually require us to do?: Immediately: stop distributing the device, notify health professionals and device user facilities using a verified written channel with a conspicuous urgent marking, and instruct them to stop using it. Section 810.10 gives FDA this authority when it finds a reasonable probability that the device would cause serious adverse health consequences or death. The obligation to submit a formal recall strategy is not automatic on day one — it attaches once FDA modifies the order under a regulatory hearing or written-review process, or escalates it to a mandatory recall order under Section 810.13. Either way, effectiveness checks confirming that every consignee, health professional, and device user facility was actually notified are required, and periodic status reports go to FDA on the schedule the order specifies. A company with no pre-built consignee tracking and no notification templates is trying to assemble all of this for the first time under an active order — that is the scenario the recall-readiness audit finding below is describing.
How does MDR reporting connect to our CAPA process?: An MDR reportability determination and a CAPA are different decisions that share the same investigation. Reportability under Section 803.50 asks whether a specific event meets the death/serious-injury/malfunction thresholds and has to go to FDA within 30 (or 5) days. CAPA under QMSR Clause 8.5.2 asks whether the underlying cause needs to be corrected so the event doesn't recur. An MDR-reportable event usually opens or feeds a CAPA, but the reverse isn't automatic — you can have a valid CAPA with no reportable MDR event behind it, and (less often) a reportable MDR event whose root cause turns out not to need a new CAPA because an existing one already covers it. Keep the MDR event file (Section 803.18) and the CAPA record linked, but don't treat one as a substitute for the other's own documentation.
What records does an FDA investigator ask for during a postmarket inspection?: For MDR: the event files for both reportable and non-reportable determinations (Section 803.18), including the deliberation and rationale for events you decided not to report — the absence of non-reportable records reads as a gap, not as evidence nothing happened. For corrections and removals: the Part 806 report log plus the Section 806.20 records for actions you judged did not require reporting, each with a designated-person review on file. For recalls: your Part 810 recall procedure, consignee distribution records, and any prior effectiveness-check results. For an active Section 522 study: the study master file — the FDA order, the approved plan, investigator agreements, interim reports, and correspondence — which Section 822.36 gives FDA the right to inspect and copy, with required information due within 72 hours of the inspection's start. Organize all four before an inspection starts, not during one.
We've never received a Section 522 order. Do we still need a postmarket surveillance program?: Yes, but it's a different program than Part 822 describes, and the two get confused constantly because they share a name. QMSR Clause 8.2.1 (Feedback) requires every manufacturer to actively collect and review production and post-production information — complaints, field data, service records, literature — regardless of device class and regardless of whether FDA has ever ordered a formal Section 522 study. Part 822 is a specific, FDA-initiated study mechanism with its own plan, approval, and reporting structure that applies to a small subset of Class II/III devices meeting one of four named criteria. If your QMS documentation uses “postmarket surveillance” to mean your routine Clause 8.2.1 feedback loop, say so explicitly and don't let the phrase imply you're operating under an active FDA order you don't actually have.