Medical Device Complaint and CAPA Record Template

What requires or shapes this record

In the United States the Quality Management System Regulation, 21 CFR Part 820 as amended and in force since 2 February 2026, incorporates ISO 13485:2016 by reference and adds what certain complaint records must hold (section 820.35(a)). Section 820.10(b)(3) ties the standard's clause on reporting to regulatory authorities to FDA's medical device reporting rule, 21 CFR Part 803, which sets the reporting periods and asks for a file of every reportability decision; Part 806 covers corrections and removals. In the EU, Regulation (EU) 2017/745 asks a manufacturer to report serious incidents and field safety corrective actions within the periods in Article 87 and to investigate them under Article 89. None of the texts read for this page prescribes a complaint form. This one has not been reviewed, validated or accepted by FDA, a competent authority, a notified body or ISO; it records the decisions and does not make them, and whether an event is reportable is a judgment made under your own procedures. Not read for this page on 21 October 2026: the rules of other countries, in-vitro diagnostic devices under Regulation (EU) 2017/746, FDA's guidance documents on medical device reporting, the EU's vigilance guidance and reporting forms, and 21 CFR Part 11 on electronic records and signatures. This is general information, not legal or regulatory advice.

• 21 CFR 820.1(b), 820.10 and 820.35 (Quality Management System Regulation; eCFR text up to date as of 19 October 2026, opened 21 October 2026), with FDA's QMSR page (content current as of 2 February 2026)

  Section 820.35 adds to ISO 13485 clause 4.2.5 (Control of records) and, for complaints, to clause 8.2.2 (Complaint handling). Paragraph (a) asks the manufacturer to keep records of the review, evaluation and investigation of every complaint that involves a possible failure of a device, its labeling or its packaging to meet a specification. A new investigation is not needed where a similar complaint has already been investigated, but the justification for not investigating is recorded. For complaints that must be reported under Part 803, complaints the manufacturer decides to investigate because it must, and complaints it investigated anyway, the record holds seven items: the device name, the date received, any UDI or UPC and other identification, the complainant's name, address and phone number, the nature and details, a correction or corrective action if one was taken, and the reply if one was sent. Paragraph (c) asks for the UDI of each device or batch to be recorded, and (d) lets records be marked confidential. Section 820.10(b)(3) says that, for clause 8.2.3 (Reporting to regulatory authorities), the manufacturer notifies FDA of complaints that meet the Part 803 criteria, and 820.10(b)(4) sends advisory notices to Part 806. Section 820.1(b) says that the Federal Food, Drug, and Cosmetic Act and its regulations control where an ISO 13485 clause conflicts with them. FDA's QMSR page (https://www.fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr) says the rule took effect on 2 February 2026, and that a device exempt from the good manufacturing practice requirements is still not exempt from keeping complaint files or from the record requirements of 820.35.

• 21 CFR 803.3, 803.17, 803.18, 803.20, 803.50, 803.53 and 803.56 (medical device reporting; eCFR text up to date as of 19 October 2026, opened 21 October 2026), with FDA's mandatory reporting page (content current as of 27 March 2025)

  A manufacturer reports to FDA no later than 30 calendar days after it becomes aware of information that reasonably suggests that a device it markets may have caused or contributed to a death or serious injury, or has malfunctioned and would be likely to cause or contribute to one if the malfunction recurred (803.50(a)). A 5-day report is due within 5 work days when an event needs remedial action to prevent an unreasonable risk of substantial harm to public health, or when FDA has asked for one in writing (803.53), and information that was not in the first report goes in a supplemental report within 30 calendar days of receiving it (803.56). Section 803.3 defines becoming aware, malfunction, serious injury and work day (Monday to Friday, federal holidays excepted). No report is needed where a person qualified to make a medical judgment, such as a physician, nurse, risk manager or biomedical engineer, would reasonably conclude that the device did not cause or contribute to a death or serious injury, or that a malfunction would not be likely to do so if it recurred; the information that person used is kept (803.20(c)(2)). The written MDR procedures include a standard review for deciding reportability (803.17). The MDR event file holds the deliberations and the decision for each event, reported or not, the reports sent and FDA's electronic acknowledgments; it may sit in the complaint file if it is prominently identified, and it is kept for 2 years from the event or for the expected life of the device, whichever is longer (803.18). Section 803.50(b)(3) makes the manufacturer responsible for investigating each event and evaluating its cause. FDA's mandatory reporting page (https://www.fda.gov/medical-devices/postmarket-requirements-devices/mandatory-reporting-requirements-manufacturers-importers-and-device-user-facilities) says complaint files are linked to MDR event files because each complaint has to be evaluated for reportability, and that complaints found to be reportable should be kept in a separate part of the complaint file or otherwise clearly identified. Importers and user facilities have their own periods (803.10), which this form does not cover.

• 21 CFR 806.10 and 806.20 (reports and records of corrections and removals; eCFR text up to date as of 19 October 2026, opened 21 October 2026)

  A manufacturer or importer that starts a correction or removal of a device to reduce a risk to health, or to remedy a violation of the Act caused by the device that may present a risk to health, reports it to FDA in writing within 10 working days of starting it, unless the information has already been given or an exemption in 806.1(b) applies (806.10(a) and (b)). The report includes the device's UDI or other identification with its lot or serial number, the events that gave rise to the action, and the actions taken and planned (806.10(c)). A correction or removal that does not have to be reported is still recorded, with the justification for not reporting it reviewed and evaluated by a designated person and copies of the communications, and the record is kept for 2 years beyond the expected life of the device (806.20).

• Regulation (EU) 2017/745 on medical devices, Articles 2(64) to 2(69), 10(13), 87, 88 and 89 (consolidated text of 19 July 2026, read on 21 October 2026)

  Article 10(13) asks manufacturers for a system for recording and reporting incidents and field safety corrective actions. Under Article 87(1) they report to the competent authorities, through the electronic system of Article 92, every serious incident involving a device made available on the Union market, except expected side-effects that are clearly documented in the product information, quantified in the technical documentation and subject to trend reporting under Article 88, and every field safety corrective action. A serious incident is reported immediately once the manufacturer has established a causal relationship with its device, or that one is reasonably possible, and not later than 15 days after it becomes aware of the incident (87(3)); not later than 10 days for a death or an unanticipated serious deterioration in a person's state of health (87(5)); and not later than 2 days for a serious public health threat (87(4)). An incomplete first report may be followed by a complete one (87(6)), a manufacturer that is unsure whether an incident is reportable still reports within these periods (87(7)), and a field safety corrective action is reported before it is undertaken, except in urgent cases (87(8)). Article 89 asks the manufacturer to investigate without delay, including a risk assessment; not to alter the device or a sample of the batch in a way that may affect later evaluation of the cause before informing the competent authorities; to send a final report with its conclusions; and to tell users through a field safety notice that identifies the device, including its UDIs. Article 2 defines incident, serious incident, serious public health threat, corrective action, field safety corrective action and field safety notice. EUR-Lex answered with an automated-access check on 21 October 2026, so the consolidated text came from the EU Publications Office instead, whose records showed it as the latest consolidated version and listed no act amending the Regulation later than Delegated Regulations (EU) 2026/1359 and 2026/1451.

• ISO 13485:2016, clauses 4.2.5, 8.2.2, 8.2.3 and 8.5.2 (clause numbers, titles and subjects only)

  The clause titles are Control of records (4.2.5), Complaint handling (8.2.2) and Reporting to regulatory authorities (8.2.3); clause 8.5.2 covers corrective action and clause 8.5.3 preventive action. Because the standard is paid, the three titles were taken from 21 CFR 820.10 and 820.35, the subjects of 8.5.2 and 8.5.3 from the preamble of FDA's QMSR final rule (Federal Register, 2 February 2024, document 2024-01709, opened 21 October 2026), and the standard's text is not reproduced. ISO's catalogue page, opened 21 October 2026, lists ISO 13485:2016 (edition 3) as published, last reviewed and confirmed in 2025 and therefore current; 21 CFR 820.7 incorporates this edition by reference. For a product that is not a medical device, the nonconformance report template follows the nonconformity and corrective action clause of ISO 9001 instead.

Each source checked on 21 October 2026. Not legal advice; check the text in force for your site.

Field by field

One record covers one complaint. It keeps what was reported apart from what the investigation found, and each decision (is it a complaint, investigate or not, report or not) has its own box with the reason and the person who made it. Section 6 prints the reporting periods stated in 21 CFR Parts 803 and 806 and in Article 87 of the EU MDR, as read on 21 October 2026; it gives none for other countries and does not answer the reportability questions for you. The wording, tick boxes and categories are ours: keep them the same from one complaint to the next so that complaints can be trended.

Complaint number and date received

Why: Section 820.35(a)(2) asks for the date the complaint was received. For a 30-day report a manufacturer is considered aware when any of its employees becomes aware of a reportable event (21 CFR 803.3(b)(2)), so the date that counts is the day the information first reached anyone in the organisation.

Common mistake: Dating the complaint from the day the complaint unit logged it, after it had waited a week in a sales representative's inbox.

How received and received by

Why: FDA's reporting page describes complaints as written, electronic or oral. Recording the channel shows which routes (service visits, distributors, returned devices) deliver information late and who needs to know how to pass it on.

Common mistake: Counting only written complaints, so a remark to a service engineer never reaches the complaint file.

Complainant name, address and phone

Why: Section 820.35(a)(4) lists the complainant's name, address and phone number. They are needed for follow-up questions and for the reply that 820.35(a)(7) records.

Common mistake: Writing only the distributor's name when the clinic that saw the event is known, so nobody can ask what happened.

Country and date of the event

Why: The country shows which markets' rules section 6 has to check. The event date, which can be weeks before the complaint, is what the investigation and any report describe.

Common mistake: Leaving the event date blank and using the date received, which hides how long the information took to arrive.

Device name, model and software version

Why: Section 820.35(a)(1) asks for the name of the device. The model and the software or firmware version tie the complaint to a design and are what a search for similar complaints uses.

Common mistake: Using an internal nickname for the product, so a search by brand or common name misses the complaint.

UDI or UPC, lot and serial number

Why: Section 820.35(a)(3) asks for any UDI or UPC and other identification, and 820.35(c) for the UDI of each device or batch. The lot and serial number show which other devices may share the problem and where they went.

Common mistake: Recording the device identifier without the production identifiers, so the lot cannot be traced.

Device or sample returned and held

Why: A returned device is often the best evidence of the cause. After a serious incident has been reported in the EU, Article 89(1) rules out investigations that alter the device or a batch sample in a way that may affect later evaluation of the cause before the competent authorities are informed.

Common mistake: Repairing or scrapping the returned unit before anyone has evaluated it.

Nature and details of the complaint

Why: Section 820.35(a)(5) asks for the nature and details. Writing down what was reported, apart from what the investigation later finds, keeps the record clear about what was known on day 0.

Common mistake: Rewriting the complaint as a conclusion ("user error") before any investigation.

Outcome for the patient or user

Why: Death and serious injury drive the US questions in 803.50, and death, serious deterioration of health and serious public health threats drive the EU ones in Article 87. Unknown is an answer that calls for follow-up, not a no.

Common mistake: Ticking No injury because the complainant did not mention one, without asking.

Is it a complaint?

Why: FDA's reporting page describes a complaint as a communication alleging a deficiency in a device's identity, quality, durability, reliability, safety, effectiveness or performance after release for distribution. Under the QMSR the definitions in ISO 13485 apply (21 CFR 820.3), so the test is the standard's definition as your procedure sets it out. A No needs a reason and a note of where the matter went.

Common mistake: Filing a complaint as a service request because the device was repaired, so it never enters the complaint file or the trend.

Possible failure to meet a specification

Why: Section 820.35(a) asks for records of the review, evaluation and investigation of every complaint that involves a possible failure of the device, its labeling or its packaging to meet a specification.

Common mistake: Answering No because the specification is silent on the failure, without asking whether it should cover it.

Investigation decision and rationale

Why: Under 820.35(a) a new investigation is not needed where a similar complaint has already been investigated, but the justification is recorded. The form asks for the earlier complaint or CAPA number and why that investigation covers this device, lot and failure.

Common mistake: Writing "known issue" with no reference, or pointing to an investigation of a different lot or failure mode.

Investigation and findings

Why: The device evaluation, the batch record, the labeling and the similar complaints are the usual evidence, and the risk management file shows whether the hazard was foreseen. Section 803.50(b)(3) makes the manufacturer responsible for investigating each event and evaluating its cause.

Common mistake: Concluding "could not reproduce" after testing one unit, and closing without looking at the rest of the lot.

Date of awareness

Why: The US medical device reports and the EU serious incident reports run from awareness: 21 CFR 803.3(b) says when a manufacturer is considered to have become aware, and Article 87 counts from when the manufacturer becomes aware. A supplemental report runs from receipt of the new information, a US correction or removal from the day it starts, and an EU field safety corrective action is reported before it starts. Writing day 0 once, with the due dates worked out from it, keeps the deadlines visible.

Common mistake: Starting the clock on the day the investigation concluded that the event was reportable.

US reportability (21 CFR 803)

Why: Deaths, serious injuries and malfunctions that would be likely to cause or contribute to one if they recurred are reported within 30 calendar days, and a 5-day report is due where remedial action is needed to prevent an unreasonable risk of substantial harm or FDA has asked in writing. A decision not to report under 803.20(c)(2) keeps the information the qualified person used, and every decision goes in the MDR event file (803.18).

Common mistake: Deciding not to report because the device was not proven to be the cause, when 803.50 asks whether information reasonably suggests that it may have caused or contributed to the event.

US correction or removal (21 CFR 806)

Why: A correction or removal started to reduce a risk to health is reported to FDA within 10 working days of starting it (806.10(b)). One that is not reportable is still recorded, with a justification reviewed by a designated person (806.20).

Common mistake: Replacing units in the field without recording whether Part 806 applies, so neither a report nor a record exists.

EU reportability (MDR Articles 87 and 89)

Why: A serious incident is reported immediately once a causal relationship is established or reasonably possible, and not later than 15 days after awareness; 10 days for a death or an unanticipated serious deterioration of health; 2 days for a serious public health threat. A manufacturer that is unsure still reports within the period (Article 87(7)), and a field safety corrective action is reported before it is undertaken, except in urgent cases (Article 87(8)).

Common mistake: Waiting for the investigation to confirm the cause before reporting, when the periods run from awareness and Article 87(6) allows an incomplete first report.

CAPA and NCR link

Why: The complaint record holds the complaint, the reportability decisions and the reply; the containment, disposition and why-chain sit in the nonconformance report and the CAPA, which ISO 13485 covers in clause 8.5.2 on corrective action. Linking them by number avoids two versions of the same analysis.

Common mistake: Opening a new CAPA for every complaint about the same failure instead of linking them to one, which splits the trend.

Root cause

Why: One or two sentences that a reader of the complaint file alone can follow, with the reference to the full analysis. The cause category lets complaints be counted by design, manufacturing, supplier, labeling, packaging or use.

Common mistake: Naming use error as the cause when nobody asked whether the design or the instructions invited the error.

Corrections and corrective actions

Why: Section 820.35(a)(6) asks for any correction or corrective action taken. The type column separates fixing this unit or lot from removing the cause, and a field action is checked against Part 806 and Article 87(1)(b).

Common mistake: Listing "customer retrained" as the only action for a complaint that the investigation confirmed.

Effectiveness check

Why: The criterion is fixed before anyone looks at the data, so the check is able to fail. When it fails, the CAPA is reopened and the complaint stays open; the method box says which data (complaint trend, tests, audits) was used.

Common mistake: Checking that the actions were done rather than that the failure stopped.

Reply to the complainant

Why: Section 820.35(a)(7) asks for any reply to the complainant. The date, the channel and a summary show what the complainant was told and when; where there is no reply, the reason is recorded.

Common mistake: Promising a fix in the reply before the CAPA has shown that it works.

Closure and sign-off

Why: Four roles sign: the complaint handler, the investigator, a regulatory reviewer for the reportability decisions and a quality approver. Section 803.18(e) allows the MDR event file to sit in the complaint file if it is prominently identified. The two retention periods printed are the US ones the texts state.

Common mistake: Closing the complaint while a supplemental report or an EU final report is still due.

Worked example

IllustrativeCuff closure failure on an upper-arm blood pressure monitor (invented manufacturer, device, clinic, numbers and decisions)

Everything in this example is invented: the company, device, clinic, lot numbers, dates and the reportability conclusions. The conclusions show how a decision and its reason are written down; they are not guidance on whether a real event is reportable, which depends on the facts and on the qualified person's judgment under your own procedures. The complaint names the earlier lots it was compared with, so a later complaint about the same failure can point to this investigation instead of repeating it.

When a spreadsheet stops being enough

Paper or a spreadsheet is enough for a maker with one product family and a handful of complaints a month. It falls short when the reporting deadlines have to be watched from the day of awareness in more than one market, when the same failure has to be found across lots and countries, when an inspector asks for a complaint with its MDR event file, CAPA and reply together, and when a decision not to investigate has to point to the investigation it relies on.

A complaint system keeps each complaint with its device identifiers, a reportability decision per market with its due date, links to the NCR and CAPA, and the reply. In a demo, ask to see a complaint closed without investigation because a similar one was investigated, a reportability decision for two markets with different periods, and a report sent to FDA or an EU authority from the record; ask separately how the system controls electronic records and signatures, which this page does not cover. The list below applies the rule used by the complaint management guide. That rule does not test for medical device reporting, UDI fields or any regulation, so try the products with a few of your own complaints.

Same rule for every product: tagged “Complaint Management”, “Quality Management” or “CAPA Management”, with a sourced complaint handling capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

• Effivity · Customer complaint lifecycle · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• SimplerQMS · Connected quality-event intake · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• 1factory · NCR, CAPA, SCAR and complaint workflows · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• Greenlight Guru · CAPA, nonconformance and complaint workflows · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• isoTracker · Non-conformance and complaints · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• qmsWrapper · Complaints, supplier and training records · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• Scilife · Quality events and investigations · Documented

  Product scope and boundaries

  Vendor source · Profile checked 10 October 2026

• AssurX · Regulated complaint triage and reporting rules · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 11 October 2026

• Dot Compliance · Complaint intake to CAPA · Documented

  Product scope and boundaries

  Vendor source · Profile checked 10 October 2026

• MasterControl · Customer complaint intake and resolution · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• Octave Reliance · CAPA and structured root-cause analysis · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 12 October 2026

• TrackWise Digital (Honeywell) · Complaint triage and reportability workflow · Documented

  Product scope and boundaries

  Vendor source · Profile checked 11 October 2026

• Veeva Quality Cloud · Delivered QMS lifecycles and audit trails · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 11 October 2026

• Tekmon · Complaint intake, routing and linked actions · Documented

  Product scope and boundaries

  Vendor source · Profile checked 28 September 2026

• HSI Donesafe · Quality and supplier management · Documented

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

• BizzMine · Audit, complaint, deviation, supplier, calibration and recall modules · Conditional

  Product scope and boundaries

  Vendor source · Profile checked 14 October 2026

All 16 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.