ISO 13485 from zero, episode seven: complaints, vigilance and post-market surveillance.

Why are these processes examined so closely?

This is episode seven of ISO 13485 from zero. Once a device is on the market, the quality system has to listen. This episode covers how feedback, complaints, regulatory reporting and post-market surveillance fit together, and why they are some of the most closely examined processes in any medical device audit.

What counts as feedback?

ISO 13485 expects a documented process for gathering and monitoring information from production and post-production activities. That includes complaints, but also service reports, returns, user feedback, sales conversations, published literature about similar devices and information from distributors. The purpose is early warning. Feedback is an input to risk management and, where appropriate, to improvement.

Template for this step: the complaint handling SOP and PMS plan are in the ISO 13485 Complaint Handling, PMS & Vigilance Kit ($99).

How should the complaint process work?

A complaint is any communication that alleges a problem with the identity, quality, durability, reliability, usability, safety or performance of a device after it has been released. Train everyone who talks to customers, including sales and service, to recognise one and pass it on. The process must cover receiving and recording, evaluating whether the information is a complaint, investigating, deciding on the need to report to regulators, handling the product involved, and deciding on correction or corrective action. If you decide not to investigate, record the reason and who made the decision.

How do you make reporting decisions?

Where regulations require adverse events or certain incidents to be reported, ISO 13485 requires documented procedures for notifying the regulator. Time limits are often short. Every complaint should carry a recorded reportability decision, with the reasoning, even when the answer is no.

What is post-market surveillance?

The proactive side. Rather than waiting for complaints, you plan how you will gather and analyse information about the device's performance and safety in use. Trend complaints by type and device, review service data, search literature and public databases for similar devices, and compare what you find with the estimates in the risk file. Feed conclusions into management review and, when they reveal new risks, into design and risk management.

What about advisory notices and recalls?

ISO 13485 expects a documented procedure for issuing advisory notices and for any field action. Decide in advance who has authority, how affected devices are identified using your traceability records, how customers and regulators are informed, and how effectiveness is checked. Rehearse it.

The ISO 13485 Complaint Handling, PMS and Vigilance Kit covers the whole path from the first customer call to a regulator report. Previously: production and process validation. Next episode: CAPA.