Post-Market Surveillance, Adverse Event Reporting, and Compliance

Founders who treat FDA clearance as the finish line are setting themselves up for the most dangerous phase of regulatory exposure. Once a device is on the market, the company enters a continuous compliance environment governed by post-market surveillance obligations, adverse event reporting requirements, complaint handling procedures, and the ever-present possibility of an FDA inspection. Companies that manage these obligations systematically build durable regulatory credibility. Companies that treat them as administrative overhead eventually generate the kind of inspection findings that result in warning letters, import alerts, or consent decrees.

The Medical Device Reporting regulation — 21 CFR Part 803 — requires manufacturers to report to FDA when they become aware that a device may have caused or contributed to a serious injury or death, or when a device has malfunctioned in a way that would be likely to cause or contribute to serious injury or death if the malfunction were to recur. These reports are called MDRs — Medical Device Reports. The reporting timelines are specific and non-negotiable: thirty days for deaths, serious injuries, and most malfunctions; five days for events requiring remedial action to prevent an unreasonable risk of substantial harm. Getting the timeline wrong — even by a day — is a reportable compliance failure in an inspection.

Complaint handling is the upstream system that feeds MDR reporting. Under 21 CFR Part 820, manufacturers must establish and maintain procedures for receiving, reviewing, and evaluating complaints. Every complaint must be evaluated to determine whether it represents an MDR-reportable event. A company that does not have a documented complaint handling process — or that has one on paper but does not follow it — is unable to demonstrate MDR compliance, because there is no systematic mechanism for identifying events that require reporting. The complaint file is one of the first things FDA investigators examine in a device inspection.

CAPA — Corrective and Preventive Action — is the quality system mechanism for identifying the root causes of quality problems and implementing systematic fixes before those problems recur or before potential problems materialize. Corrective action addresses existing nonconformances. Preventive action addresses potential nonconformances identified through trend analysis, complaints, audit findings, or post-market surveillance data. CAPA is not a paperwork exercise. A CAPA system that generates investigation records without actually changing processes is one of the most common Form 483 observations FDA investigators issue, and a history of closed-but-ineffective CAPAs is a significant red flag in an inspection.

Post-market surveillance is the broader system of ongoing data collection and analysis that informs a manufacturer's understanding of real-world device performance. It encompasses complaint data, MDR data, literature monitoring, registry participation, and — for some PMA devices — FDA-required post-approval studies. Post-market surveillance is not just a regulatory obligation. It is the primary source of signal for product safety issues that were not detectable in pre-market testing, and companies that analyze that data systematically are better positioned to identify problems before they become enforcement actions.

A recall is not always what founders imagine. In regulatory terms, a recall is any action to remove or correct a marketed product that FDA considers to violate a law it administers. This includes field corrections — where a company sends a letter to customers instructing them to change how a device is used — not just physical product retrievals. Class I recalls involve products where there is a reasonable probability of serious adverse health consequences or death. Class II recalls involve products that may cause temporary or medically reversible adverse health consequences. Class III recalls involve products that are unlikely to cause adverse health consequences but violate FDA regulations. Companies discover they are in a recall situation much more often than they expect, and having documented procedures for recall execution and FDA notification in advance is a quality system requirement under 21 CFR Part 806.

An FDA inspection — conducted by an investigator from the Office of Regulatory Affairs — is a formal examination of a manufacturing facility and quality system. The investigator issues a Form 483 at the close of the inspection listing observations of conditions that appear to violate FDA regulations. A 483 is not a final enforcement action — it is an opportunity to respond. A warning letter, which is posted publicly on FDA's website, is issued when FDA concludes that a company's response to a 483 was inadequate or when violations are serious enough to warrant immediate public notice. A warning letter materially affects the company's ability to file new submissions, obtain financing, and complete acquisitions. Managing the inspection process — including how to respond to 483 observations — is a skill that should be developed well before the first inspection arrives.