How to Build a Complaint Handling and Vigilance System That Satisfies EU and FDA Requirements

Complaint handling and vigilance activities are foundational elements of a mature medical device Quality Management System. Under both the EU MDR/IVDR and U.S. FDA regulations, manufacturers must demonstrate structured evaluation, timely reporting, risk-based investigation, and lifecycle feedback. Yet many organisations struggle with fragmented processes, inconsistent triage decisions, and gaps in post-market integration—all of which result in audit findings, warning letters, or prolonged Notified Body assessments.

A compliant, high-performing system must unify complaint intake, medical evaluation, regulatory reporting, risk management updates, and CAPA execution into a single, disciplined workflow. This article outlines the required structure and operational practices to satisfy both EU and FDA expectations.

1. Core Regulatory Expectations for Complaint Handling

While the EU and FDA operate under different legislative frameworks, their expectations for complaint handling share common principles:

Template for this step: the complaint handling SOP and PMS plan are in the ISO 13485 Complaint Handling, PMS & Vigilance Kit ($99).

• Immediate capture and documentation of any allegation related to safety, performance, or device quality.
• Structured triage to determine whether the event constitutes a complaint, reportable adverse event, or trend requiring investigation.
• Evidence-based investigations proportional to risk, severity, and recurrence potential.
• Traceability to risk management, CAPA, and PMS systems.
• Regulatory reporting within specified timelines, with documented justification for non-reportability decisions.

Both authorities expect complaint handling to act as the operational backbone of the manufacturer’s vigilance and improvement systems.

2. EU MDR/IVDR Requirements for Vigilance and PMS

Under EU MDR and IVDR, complaint handling is a critical input to:

• Vigilance reporting (serious incidents, FSCA)
• Post-Market Surveillance (PMS) analysis
• Periodic Safety Update Reports (PSUR)
• Post-Market Clinical Follow-up (PMCF) or Post-Market Performance Follow-up (PMPF)

EU systems must demonstrate a lifecycle-driven approach in which complaints meaningfully update:

• Risk management files
• Clinical evaluation reports
• Trend analyses
• Design and process controls
• Labelling and IFU content

Notified Bodies increasingly scrutinise complaint trending, the rationale for non-reportability, and evidence of systematic feedback into PMS documentation.

3. FDA Requirements for Complaint Handling and MDR Reporting

The FDA imposes detailed and prescriptive requirements under 21 CFR 820 and 21 CFR 803, including:

• A formal complaint file for every complaint—regardless of perceived severity.
• Evaluation for Medical Device Report (MDR) reportability.
• Documented reasoning when a complaint is deemed non-reportable.
• Timely and complete complaint investigations.
• Evidence of linkages between complaints, CAPA, risk files, and production controls.

FDA investigators expect a clear audit trail showing how the organisation reached its decisions and how those decisions influenced design, manufacturing, and risk control updates.

4. Designing an Integrated Complaint and Vigilance Workflow

4.1 Centralised Complaint Intake

A single intake channel ensures consistency and prevents data loss. Intake must capture:

• Reporter details
• Device identifiers and lot information
• Description of the event
• Outcome or potential harm
• Any device return or evidence available

Intake must be immediate, controlled, and logged in a validated or well-managed system.

4.2 Structured Triage and Reportability Assessment

Triage must determine whether the complaint is:

1. A standard complaint requiring investigation
2. A serious incident requiring EU vigilance reporting
3. An event requiring FDA MDR reporting
4. A trend requiring further analysis
5. A CAPA trigger

Triage decisions must be documented with clear medical rationale and regulatory references.

4.3 Risk-Proportionate Investigation

Investigations should include:

• Device history review (DHR)
• Return evaluation
• Process and production analysis
• Supplier defect assessment
• User scenario review and human-factors considerations

ISO 13485 requires that investigation scope align with actual risk, not administrative routine.

4.4 Documentation and Traceability

Complaint files must show end-to-end traceability to:

• CAPA investigations
• Risk-management updates
• Design changes
• Manufacturing controls
• Regulatory reporting actions

Both FDA and EU auditors consider traceability the strongest indicator of system maturity.

4.5 Vigilance Reporting Workflows

EU and FDA reporting triggers differ but must be integrated into a unified workflow. A robust system includes:

• Defined timelines (e.g., 2, 10, 15 days for reportable EU incidents)
• MDR evaluation and decision recording for FDA
• Regulatory submission tracking
• Follow-up and final reporting management

Evidence of timely reporting is a common focus of regulatory inspections.

4.6 PMS and Trend Analysis

Complaint data must feed into:

• PMS plans and reports
• PSUR updates
• PMCF/PMPF strategies

Statistical trend detection is essential. Many organisations receive findings for failing to establish thresholds or for not documenting trend-analysis logic.

5. What Regulators Typically Criticise

• Inconsistent triage and unclear reportability justifications
• Missing or incomplete investigations
• No evidence that complaints feed into risk management
• Insufficient trending or use of PMS data
• Complaint handling split across multiple uncontrolled systems
• Failure to document MDR or vigilance decisions
• Incomplete or inaccurate complaint files

Addressing these weaknesses significantly reduces compliance risk.

6. Building a High-Performance Complaint and Vigilance System

A mature system demonstrates:

• Clear regulatory decision logic
• Consistent risk-based prioritisation
• Strong integration with CAPA, PMS, and design controls
• High-quality medical, engineering, and regulatory documentation
• Controlled, validated tools for complaint data management
• Competent personnel with documented training in EU and FDA requirements

When these elements function cohesively, complaint handling becomes a powerful driver of regulatory confidence and operational improvement—not merely a compliance obligation.

Conclusion

A complaint handling and vigilance system that satisfies both EU and FDA expectations requires structural discipline, risk integration, and evidence-driven decision-making. Manufacturers that embed these principles achieve faster regulatory approvals, stronger audit performance, and a more resilient post-market surveillance system. Properly implemented, this system not only protects patient safety but builds organisational reliability and long-term regulatory trust.