How to Review a Supplier's CAPA and Complaint File After QMSR: Why 21 CFR 820.100 and 820.198 Are Reserved, What ISO 13485 Clauses 8.2.2 / 8.3 / 8.5.2 / 8.5.3 and 21 CFR 820.35 Require, What Compliance Program 7382.850 Inspects, and Why an MDR Report Is Not the Complaint File

Are 21 CFR 820.100 and 820.198 Still the Law, or Are They Reserved, and Why Do FDA's Own CAPA PDF and Cornell LII Still Rank?

For thirty years—spanning from the promulgation of the 1996 Quality System Regulation (QSReg) until 2 February 2026—two federal regulatory citations formed the bedrock of post-market quality assurance in the American medical device industry: 21 CFR 820.100 for Corrective and Preventive Action (CAPA) and 21 CFR 820.198 for Complaint Files. Hospital procurement questionnaires, international distributor tenders, and OEM supplier audits routinely demanded: 'Submit your written CAPA procedure compliant with 21 CFR 820.100 and demonstrate your complaint handling unit per 21 CFR 820.198.'

As of 2 February 2026, that legal framework has been completely superseded. Under the FDA Quality Management System Regulation (QMSR) final rule published in the Federal Register (89 FR 7523, document 2024-01709),⁴ Subparts C through O of 21 CFR Part 820 were entirely removed and formally designated as [Reserved].¹ Subpart J, which housed section 820.100, and Subpart M, which housed section 820.198, no longer contain operative legal shall-text.¹ In fact, navigating directly to the Electronic Code of Federal Regulations (eCFR) section endpoints for section-820.100 or section-820.198 returns an immediate HTTP 404 error.¹

Despite this regulatory rewrite, a citation discrepancy still dominates public search results and vendor quality files. In audits of foreign contract manufacturers and Chinese sterile consumable suppliers, buyers frequently encounter supplier questionnaires that still cite sections 820.100 and 820.198 as active law. This confusion is actively sustained by four search engine failure modes captured in September 2026 SERP research:

• FDA's Legacy QSIT Training PDF Ranks #1: On Google organic search for '21 CFR 820.100 CAPA', position 1 is occupied by an archival FDA guidance document titled 'CORRECTIVE AND PREVENTIVE ACTION SUBSYSTEM' (media/142009).¹⁴ This document still teaches 21 CFR 820.100(a)(1)–(7) as active 'Regulatory Requirements Under 21 CFR 820', leading unsuspecting quality managers to believe the 1996 text remains in force.
• Cornell Law School LII Serves Repealed Shall-Text: Ranking at organic position 2, Cornell's Legal Information Institute (LII) continues to host the repealed 1996 text under its historical URL for § 820.100.¹⁵ Paradoxically, Cornell's main Part 820 Table of Contents has already been updated to QMSR with Subparts C–O marked reserved, but the individual section page still serves obsolete law.
• Google's AI Overview Cites Repealed Law: On 2 September 2026, Google's AI Overview for '21 CFR 820.100 CAPA' explicitly stated that 21 CFR 820.100 is the FDA regulation requiring medical device manufacturers to establish and maintain a formal CAPA system, advising users to read the full legal text at Cornell.
• Consultancies Selling Outdated Transition Roadmaps: Prominent regulatory advisory blogs (including The FDA Group in January 2026 and Assyro in ranking copy dated May 2026) still describe QMSR compliance as 'pairing ISO 13485 with 21 CFR 820.100', failing to recognize that 820.100 is no longer operative federal text.

For an international distributor or OEM buyer qualifying a sterile single-use device, submitting an audit questionnaire that asks for 21 CFR 820.100 or 820.198 compliance—or accepting a supplier's quality manual that cites them—is an immediate red flag. It proves that neither party has transitioned their documentation to the QMSR baseline. As explored in our companion guide on how the purchasing file and the complaint/CAPA file are different QMSR inspection areas, FDA compliance is no longer evaluated against legacy QSReg section numbers.

What ISO 13485 Clauses Actually Carry Complaint Handling, Nonconforming Product, Corrective Action and Preventive Action After QMSR?

Rather than rewriting bespoke federal regulations for complaint handling and corrective action, the FDA enacted the QMSR through incorporation by reference (IBR) under 21 CFR 820.7.¹ Under 21 CFR 820.10, a manufacturer of a finished device must establish and maintain a quality management system that complies with the applicable requirements of ISO 13485:2016.¹,²

Under this harmonized structure, the regulatory duties formerly clustered under legacy 820.100 and 820.198 are mapped across distinct, rigorous clauses within ISO 13485 Clause 8 ('Measurement, analysis and improvement'):

• Clause 8.2.1 (Feedback): CP 7382.850 Attachment A page 74 maps the Feedback inspection element to Clause 8.2.1.⁷ This article does not reproduce the paywalled ISO 13485 clause body; the inspection map and the QMSR bridges below are the public tests used here.
• Clause 8.2.2 (Complaint Handling) and Clause 8.2.3 (Reporting to regulatory authorities): Attachment A maps Complaint Handling to Clauses 8.2.2 and 8.2.3 together with 21 CFR 820.10(b)(3)–(4) and 21 CFR 820.35.⁷ Under 820.10(b)(3), the manufacturer must notify FDA of complaints that meet part 803.²
• Clause 8.3 (Control of nonconforming product): Attachment A maps this element to Clauses 8.3.1–8.3.4 and 21 CFR 820.10(b)(4).⁷ Under 820.10(b)(4), advisory notices under Clauses 7.2.3, 8.2.3 and 8.3.3 shall be handled in accordance with part 806.²
• Clause 8.4 (Analysis of data): Attachment A maps Analysis of Data to Clause 8.4 as the element that turns complaint, process, product and supplier data into inspectable trending.⁷
• Clause 8.5.2 (Corrective action) and Clause 8.5.3 (Preventive action): Attachment A maps these as separate elements, not one combined CAPA subsystem.⁷ Federal Register Comments 20 and 29 state that ISO 13485 has one clause for corrective action and another for preventive action, and that FDA incorporated both by reference rather than combining them.⁴

A pivotal structural change under QMSR is FDA's explicit refusal to collapse Corrective Action and Preventive Action into a single 'CAPA' concept. During the notice-and-comment rulemaking, several industry participants requested that FDA clarify whether one combined CAPA procedure was acceptable. In the Federal Register preamble response to Comment 20, FDA stated:

FDA agrees with the portion of the comment that notes that ISO 13485 has one Clause outlining expectations regarding corrective action (Clause 8.5.2) and has another Clause outlining the expectations regarding preventive action (Clause 8.5.3). FDA has incorporated the corrective action and preventive action requirements of ISO 13485 by reference into the QMSR and disagrees that it has combined the two subjects in the manner the commenter describes.— Federal Register 89 FR 7523, document 2024-01709, Comment 20 response

This distinction is critical for file reviewers. A supplier quality dossier that presents a single 'CAPA SOP' that only reacts to post-market failures and contains zero documented preventive action investigations violates Clause 8.5.3. In addition, file reviewers must strictly distinguish between a correction (immediate containment, quarantine, or batch rework under Clause 8.3) and a corrective action (systemic root-cause remediation under Clause 8.5.2).

What 21 CFR 820.35 Adds on Top of Clause 8.2.2 — Seven Complaint-Record Fields, Similar-Complaint Justification, UDI, and 'Correction' Versus 'Corrective Action'

While ISO 13485:2016 establishes the baseline QMS requirements, the FDA concluded during rulemaking that Clause 8.2.2 lacked several critical, enforceable recordkeeping elements that US investigators have historically relied upon to safeguard public health. Consequently, FDA established 21 CFR 820.35 ('Control of records') as a mandatory US-specific supplement.³

Under 21 CFR 820.35(a), finished device manufacturers must maintain records of the review, evaluation, and investigation of any complaint involving the possible failure of a device, labeling, or packaging to meet any of its specifications.³ The regulation establishes a strict investigation rule:

In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the manufacturer shall maintain records of the review, evaluation, and investigation for any complaints involving the possible failure of a device, labeling, or packaging to meet any of its specifications. If an investigation has already been performed for a similar complaint, another investigation is not necessary, and the manufacturer shall maintain records documenting justification for not performing such investigation.— 21 CFR 820.35(a), Electronic Code of Federal Regulations

This creates a clear evidentiary threshold for file audits. A manufacturer cannot dismiss a clinical complaint with a generic note like 'known user technique error' or 'isolated incident'. If the complaint alleges that a sterile barrier seal was open, an optical fiber fractured, or a circumcision device failed to detach, an investigation is legally mandatory unless the manufacturer points to a previous, documented investigation of an identical failure mode and provides a written justification explaining why further testing is superfluous.³

Furthermore, for any complaint that (1) represents an event that must be reported under 21 CFR Part 803 (MDR), (2) that the manufacturer determines must be investigated, or (3) that is actually investigated, 21 CFR 820.35(a)(1)–(7) mandates seven explicit fields:³

Notice Field 6: In the proposed QMSR rule, 820.35(a)(6) originally required recording 'any corrective action taken'. During the public comment period, industry stakeholders noted that under ISO 13485, immediate batch containment or product replacement is a 'correction', whereas 'corrective action' refers to systemic root cause remediation. In Federal Register Comment 57, FDA agreed and explicitly revised the regulatory text to mandate: 'any correction or corrective action taken'.⁴

Beyond complaint handling, section 820.35 incorporates additional subsections: 820.35(b) mandates specific record fields for servicing activities (device name, UDI or other identification, date, technician identity, service performed, and test and inspection data); 820.35(c) mandates recording the UDI for each device or batch; and 820.35(d) allows records deemed confidential by the manufacturer to be marked to aid FDA in determining whether information may be disclosed under the public information regulation in 21 CFR part 20.³

Finally, buyers must be aware of the 4 December 2025 Technical Amendments (90 FR 55978).⁵ Under the legacy QSReg, 162 Class I device classification regulations were designated as 'CGMP-exempt', but retained non-exempt status for 820.180 (records) and 820.198 (complaints). With the repeal of Part 820 Subparts C–O, FDA amended all 162 Class I regulations to explicitly cite 21 CFR 820.35.⁵ FDA's official QMSR landing page underscores that 'exemption from CGMP requirements does not exempt manufacturers of finished devices from keeping complaint files or general records required by 21 CFR 820.35.'⁶

What Compliance Program 7382.850 Tells Investigators to Open in the Measurement, Analysis, and Improvement QMS Area

On 2 February 2026, FDA officially retired the Quality System Inspection Technique (QSIT, Compliance Program 7382.845) and its specialized foreign inspection counterpart CP 7383.001.⁶ All FDA inspections of medical device establishments—domestic and foreign—are now conducted exclusively under Compliance Program 7382.850 ('Inspection of Medical Device Manufacturers').⁷

Under Inspection Model 1 of CP 7382.850, investigators select at least one element in each of six QMS areas, including Measurement, Analysis, and Improvement (MAI).⁷ Attachment A Page 74 of CP 7382.850 outlines the purpose and regulatory element mapping for that area:

Purpose: To ensure monitoring, measurement, analysis, and improvement activities are effective in identifying and reducing risks that impact the product and/or the QMS.— FDA Compliance Program 7382.850, Attachment A, Page 74 of 78

When an FDA investigator executes an inspection under CP 7382.850, they do not review complaint handling in isolation. They trace an interconnected thread: from customer feedback (Clause 8.2.1) and complaints (Clause 8.2.2 / 820.35), into nonconformance logs (Clause 8.3), through data trending (Clause 8.4), and directly into corrective action (Clause 8.5.2) and the living ISO 14971 risk management file.

Named FDA officials, speaking at MedCon about inspections between 2 February and 31 March 2026, reported about 100 QMSR inspections in that early window, with the most Form 483s in risk management, followed by outsourcing and purchasing.¹⁹ That ranking is secondary conference reporting of named officials; it is not a published FDA 483 table, not incidence, and not a claim that Measurement, Analysis, and Improvement was the leading observation area. This page is justified by the reserved 820.100/820.198 SERP and the inspectable MAI map in CP 7382.850, not by a 483-leader argument.

Does an ISO 13485 Certificate, a Form 3500A, a MAUDE Row, a Recall Letter, or an FDA Listing Token That Still Prints 820.198 Close the File?

In international B2B device qualification, suppliers frequently attempt to satisfy complaint and CAPA audit requirements by submitting one of five static proxies: an ISO 13485 certificate, a submitted FDA Form 3500A, a clean MAUDE database search, a completed recall closure letter, or an FDA establishment registration screenshot. For a qualified buyer, none of these documents closes the complaint and CAPA file.

First, holding an ISO 13485:2016 certificate or an MDSAP certificate certifies only that an Auditing Organization assessed the company's general QMS. As detailed in our guide on how to verify an ISO 13485 certificate before asking for the complaint file, FDA stated in the QMSR final rule that ISO 13485 certification is neither required by FDA nor does it exempt a facility from FDA inspection.⁴,⁶ A certificate on the wall proves a quality management system was certified; it does not prove that the specific batch of circumcision rings, laser fibers, or NPWT dressings has documented 21 CFR 820.35 complaint records or verified CAPA effectiveness. The FDA-hosted MDSAP AU P0002.009 still prints leftover 'FDA: 21 CFR 820.100' and '820.198' column cites; the current MDSAP AU P0002.011 (version date 3 August 2026) points complaint-record tasks at 21 CFR 820.35. Neither document replaces CP 7382.850 as the QMSR inspection map.¹¹,¹⁸

Second, providing a copy of a submitted FDA Form 3500A (MDR report) does not demonstrate complaint handling compliance. Under 21 CFR 803.18(e), FDA explicitly mandates that an MDR report does not comply with regulatory requirements unless the underlying incident is evaluated under the quality management system requirements of Part 820.⁵,⁹ A Form 3500A is merely the outward transmission form sent to the agency; it is not the internal complaint investigation, it does not satisfy the seven fields of 820.35(a), and it does not demonstrate root cause containment under Clause 8.5.2.

Third, a public MAUDE adverse event record—or the complete absence thereof—is equally uninformative. As established across VEMERIX post-market analyses, MAUDE is a passive-surveillance reporting repository containing unvetted voluntary reports and mandatory filings. A clean MAUDE query does not establish that a device is free of field complaints, while a recorded report does not establish clinical incidence, device malfunction rates, or manufacturer liability. Passive surveillance data cannot substitute for internal complaint review.

Fourth, a recall notice or termination letter proves that a field correction or removal occurred, but as explored in why a public recall row is a targeting instruction, not the complaint file, public enforcement rows are starting points for an audit, not proof of QMS control. A recall closure letter from FDA means the immediate field retrieval concluded; it does not prove that the underlying CAPA root-cause fix was validated or sustained.

Fifth, suppliers often point to their openFDA establishment registration, showing a listed establishment type: 'Complaint File Establishment per 21 CFR 820.198'. This token is an administrative legacy from the 1996 QSReg that still appears in public FDA databases.

An independent analysis of the FDA establishment registration and device listing bulk export (snapshot export date 22 July 2026; 419,651 listing rows; 25,405 unique non-empty FEIs) confirms that 3,198 unique non-empty FEIs worldwide still carry this leftover 820.198 token string.²⁰ A geographic distribution of those FEIs is a directory fact about the form leftover, not proof that a living 820.35 file exists:

Furthermore, within this dataset, 1,927 unique FEIs have registration listings where every recorded establishment-type string is complaint-file-like, and 891 unique non-empty FEIs (representing 19,040 listing rows) feature this token as their sole listed activity.²⁰ As noted in how a listing token that still prints 820.198 differs from a living complaint file, this token is a registrant-selected directory checkbox. It proves that a facility registered an address with FDA; it provides no evidence that the facility operates a complaint intake unit, logs the seven fields of 820.35, or performs CAPA investigations under the incorporated ISO 13485 clauses.

How Do 21 CFR 803 MDR Clocks Differ by User Facility, Importer and Manufacturer, and Why Is the US Agent of a Foreign Manufacturer a 'Manufacturer'?

A critical compliance boundary often misunderstood by international suppliers is the independence of Medical Device Reporting (MDR) under 21 CFR Part 803. Part 803 was not repealed or folded into ISO 13485 by the QMSR; it remains a separate regulation in Title 21 enforcing mandatory post-market reporting.⁸

Under 21 CFR 820.10(b)(3), the QMSR creates an explicit legal bridge between ISO 13485 Clause 8.2.3 ('Reporting to regulatory authorities') and Part 803: 'the manufacturer must notify FDA of complaints that meet the reporting criteria of part 803 of this chapter.'² Part 803 establishes distinct reporting clocks based on the entity's supply chain role:

• User Facilities (21 CFR 803.30): Hospitals, ambulatory surgical centers, and clinics must report a device-related death to both the FDA and the manufacturer within 10 work days of becoming aware. Device-related serious injuries must be reported to the manufacturer (or to FDA if the manufacturer is unknown) within 10 work days.⁸
• Importers (21 CFR 803.40): A person who imports a device into the United States and furthers its marketing must report device-related deaths and serious injuries to both the FDA and the foreign manufacturer within 30 calendar days of becoming aware. Reportable device malfunctions must be reported to the manufacturer within 30 calendar days.⁸
• Manufacturers (21 CFR 803.50): Finished device legal manufacturers, specification developers, and relabelers must submit an MDR report to the FDA within 30 calendar days of becoming aware of information that reasonably suggests that a marketed device may have caused or contributed to a death or serious injury, or malfunctioned in a manner that would likely cause or contribute to death or serious injury if the malfunction were to recur.⁸
• Five-Day Remedial Action Reports (21 CFR 803.53): Under section 803.53, manufacturers must report an event within 5 work days of becoming aware if the MDR reportable event necessitates remedial action to prevent an unreasonable risk of substantial harm to the public health, or if FDA makes a written request for 5-day reports.⁸

A major liability trap in international device supply chains is 21 CFR 803.3(l)(4). Under the Part 803 definition of manufacturer, the term includes any person who 'is the U.S. agent of a foreign manufacturer.'⁹ A signed Quality Agreement can operationalize who prepares the eMDR, but it cannot waive the reporting duties that attach to a person who meets the Part 803 definition of manufacturer or importer. As explored in how MDSAP Chapter 3 measurement and Chapter 4 adverse-event reporting differ from a QMSR inspection of the same file, an MDSAP audit model is also not a substitute for those clocks.

Furthermore, 21 CFR 803.18(e) establishes that MDR files may be integrated into the general complaint file only if they are prominently identified, and that an MDR report does not comply with Part 803 unless the incident was formally evaluated under the quality management system requirements of Part 820.⁹ As emphasized in our analysis of why a 510(k) or an exemption does not replace 803 reporting, regulatory clearance provides zero relief from ongoing vigilance obligations.

When Is 21 CFR 806 a 10-Working-Day Correction/Removal Report Rather Than a CAPA Record, and When Does 806.10(f) Defer to an Already-Submitted 803 Report?

In addition to MDR reporting, the QMSR explicitly bridges ISO 13485 post-delivery advisory notices to 21 CFR Part 806 ('Medical Devices; Reports of Corrections and Removals').² Under 21 CFR 820.10(b)(4), advisory notices issued in accordance with ISO 13485 Clauses 7.2.3, 8.2.3, and 8.3.3 must be handled in accordance with Part 806.²

A fundamental audit distinction exists between an internal CAPA correction and a statutory 806 report. An internal correction under Clause 8.3 addresses nonconforming inventory within manufacturer control. In contrast, 21 CFR 806.10 is triggered whenever a manufacturer or importer initiates a correction or removal of distributed product in commercial channels:¹⁰

• Health Risk Trigger: Initiated to reduce a risk to health posed by the device; or
• Act Violation Trigger: Initiated to remedy a violation of the Federal Food, Drug, and Cosmetic Act caused by the device which may present a risk to health.

When triggered, 21 CFR 806.10 mandates that the manufacturer or importer submit a written report to the FDA within 10 working days of initiating the correction or removal.¹⁰ The submission must detail the device's brand name, model, UDI/lot numbers, manufacturer identity, the specific defect or malfunction, risk evaluation, and the exact corrective action strategy.

Importantly, 21 CFR 806.10(f) provides a statutory exemption to prevent duplicate reporting: a manufacturer is exempt from submitting an 806 report if the identical reporting information has already been provided to the FDA under 21 CFR Part 803 (MDR) or Part 1004.¹⁰ However, if an event involves field correction of multiple distributed lots without an individual patient MDR event, the 10-working-day clock under 806.10 applies strictly.

For non-reportable field actions (e.g., market withdrawals for minor cosmetic defects that present zero health risk), manufacturers cannot simply close the file informally. Under 21 CFR 806.20, the manufacturer must maintain a formal 'Record of Correction or Removal Not Required to Be Reported', documenting the detailed justification, risk assessment, and disposition for at least two years beyond the expected life of the device.¹⁰

What MDR Article 87 and NMPA Article 25 Add for an EU or China File, and Why Those Clocks Must Not Be Copied onto a US MDR Form

When evaluating an international sterile consumable manufacturer whose products are distributed across North America, the European Union, and China, file reviewers frequently uncover Quality Agreements that attempt to harmonize all post-market reporting under a single internal timeline (such as 'all reportable incidents forwarded within 30 days'). Conflating international vigilance clocks onto a single form or procedure guarantees a regulatory noncompliance.

Under the European Union Medical Device Regulation (Regulation (EU) 2017/745, MDR), vigilance reporting is governed by Article 87.¹² The European framework establishes rigid, tiered reporting deadlines:

• Serious Public Health Threat: Reported immediately, and not later than 2 calendar days after becoming aware of the threat.¹²
• Death or Unanticipated Serious Deterioration: In the event of death or an unanticipated serious deterioration in a person's state of health, reported immediately, and not later than 10 calendar days after becoming aware.¹²
• Standard Serious Incident: Any serious incident must be reported immediately, and not later than 15 calendar days after becoming aware of the incident, once a causal relationship is established or reasonably possible.¹²
• Field Safety Corrective Actions (FSCA): Under Article 87(8), any field action must be notified in advance to competent authorities, accompanied by a Field Safety Notice (FSN).

In parallel, in the People's Republic of China, post-market vigilance is enforced by the National Medical Products Administration (NMPA) under the 'Provisions for Medical Device Adverse Event Monitoring and Re-evaluation'.¹³ China establishes distinct statutory clocks under Article 25 and Article 29:

• Death Events (Article 25): Marketing Authorization Holders (MAHs) must report adverse events leading to death within 7 calendar days of becoming aware.¹³
• Severe Injury or Potential Death (Article 25): Events causing severe injury, or that may lead to severe injury or death, must be reported within 20 calendar days.¹³
• Subsequent Evaluation Reports (Article 29): The MAH must submit a complete subsequent technical evaluation report within 30 calendar days for death events, and within 45 calendar days for severe injury events.¹³
• Overseas Adverse Events on Imported Devices (Article 27): For adverse events causing or possibly causing severe injuries or death that occurred abroad, designated agents of overseas MAHs and MAHs of domestically produced devices shall report within 30 calendar days of identification or notification.¹³

Reviewers must also account for Great Britain, where the MHRA enforces PMS incident clocks under Part 4A of the Medical Devices Regulations (15 days for serious incidents, 10 days for death/deterioration, 2 days for public health threats), as detailed in our guide on why GB Part 4A incident clocks are not US 21 CFR 803 clocks.

Attempting to copy European or Chinese clocks onto US reporting forms, or using a US 30-day timeline for European serious incidents, represents a catastrophic failure of regulatory oversight. An international supplier's complaint handling SOP must contain a multi-jurisdiction decision matrix that routes complaints into the correct statutory channel based on where the specific unit was distributed.

Worked Examples: A CE-Marked Circumcision Ring with Contract EO, an NMPA-Only Laser Fiber, and an NPWT Dressing Kit

To understand how the QMSR complaint and CAPA architecture operates across real-world sterile consumables, consider three practical audit scenarios drawn from international contract manufacturing and distribution.

Worked Example 1: CE-Marked Circumcision Device with Contract Ethylene Oxide Sterilization

A European medical device distributor qualifies a disposable, self-detaching circumcision device (NMPA Class II, CE marked, EO sterilized).¹⁶ Six months after launch, a urology clinic submits a complaint alleging that in two pediatric patients, the inner ring failed to detach at postoperative day 14, requiring manual clinic excision. Simultaneously, incoming inspection at the distributor warehouse flags five cartons with micro-punctures along the sterile blister pack tyvek-seal margin.

In a compliant QMSR/ISO 13485 audit file, the manufacturer must demonstrate distinct, parallel workflows:

• Intake and complaint logging: Both clinical events are logged immediately under Clause 8.2.2. If the finished device is imported or offered for import into the United States, 820.35(a) also requires records of review, evaluation and investigation (or a documented similar-complaint justification) plus the seven fields for reportable or investigated complaints. For EU placement, the same events are evaluated against MDR Article 87 clocks, which are not 803 clocks.
• Nonconformance Containment (Clause 8.3): The five punctured blister cartons are quarantined as nonconforming product under Clause 8.3. The manufacturer traces the defect back to the heat-sealing parameters and packaging transit validation per ISO 11607 sterile barrier validation, issuing immediate corrections.
• Outsourced Sterilization Investigation: Because ring detachment kinetics depend on polymer degradation, the manufacturer reviews the outsourced sterilization batch records. As detailed in our guide on how an EO nonconformance should appear in records, the manufacturer audits the contract sterilizer's ISO 11135 cycle parameters and ISO 10993-7 ethylene oxide residual certificates to confirm that excessive aeration or gas dwell did not embrittle or alter the polymer ligature.
• Corrective Action (Clause 8.5.2): A formal CAPA is opened. Root cause analysis identifies a raw material lot variation in polymer elasticity from the moulding subcontractor (governed under purchasing controls). The tooling specification is tightened, a supplier corrective action request (SCAR) is executed, and subsequent lots are placed on 100% pull-force verification.
• Vigilance Routing & Risk Feedback: Evaluated under EU MDR Article 87. Because the event involved medical intervention without permanent impairment, it is classified and trended under the PMS plan (Article 83). Crucially, the incident metrics are fed directly into the living ISO 14971 Risk Management File to re-evaluate hazardous situation occurrence probabilities.

Worked Example 2: NMPA-Registered Disposable Medical Laser Fiber (Vascular Consumable)

A hospital vascular surgery department uses single-use medical laser fibers (NMPA Class II registered, 1470 nm endovenous ablation) paired with an external diode laser source.¹⁷ (Note: The partner-supplied NOVACURE diode laser console is not manufactured by Medison). During an endovenous saphenous vein closure, the operating surgeon experiences sudden optical power drop and discovers that the silica fiber tip fractured inside the introducer sheath, requiring fluoroscopic retrieval.

The complaint and CAPA file review must establish:

• Mandatory Investigation Threshold: Because the incident involves the possible failure of a device to meet its optical transmission and tensile specifications, an investigation record is required under the jurisdictions where the finished device is placed. If the fiber is imported or offered for import into the United States, 21 CFR 820.35(a) makes that investigation record mandatory for a possible specification failure. An NMPA-only placement without US import does not by itself create an 820.35 file.
• China NMPA Adverse Event Filing: Because the device holds NMPA registration and the incident required fluoroscopic retrieval (qualifying as an event causing or potentially causing severe injury), the MAH must file an initial report with the NMPA National Center for Adverse Event Monitoring within 20 calendar days per Article 25.¹³ A comprehensive subsequent technical evaluation report must be submitted within 45 calendar days per Article 29.¹³
• Failure Mode Analysis: Engineering tests examine the returned fiber's fracture surface and connector interface against the labelled optical and tensile specifications. Do not treat a partner-supplied laser console as the fiber manufacturer's capital system.
• Change Control Linkage: If the investigation leads to an increased cladding thickness or a revised minimum bend radius warning in the Instructions for Use (IFU), the resulting modifications must proceed through formal design change control per our design transfer and change control guide.

Worked Example 3: Disposable Negative Pressure Wound Therapy (NPWT) Dressing Kit

A home-care nursing provider reports that across three wound care patients using sterile polyurethane (PU) NPWT drainage dressing kits, the adhesive sealing drape repeatedly lifted at the wound margin within 6 hours of application, causing the portable vacuum pump to alarm continuously and leak exudate.

The supplier's complaint and CAPA dossier must document:

• Complaint logging: If the finished dressing kit is imported or offered for import into the United States, log the seven 820.35(a) fields for reportable or investigated complaints, including lot numbers of the drape and suction connector. An NMPA-only or EU-only placement still needs the local complaint file; it does not automatically create a US 820.35 record.
• Immediate Containment (Clause 8.3): Retained warehouse samples of the affected drape batch undergo peel-adhesion testing and coat-weight analysis. If coat weight is within specification, the investigation broadens to shipping conditions.
• Preventive Action Execution (Clause 8.5.3): While individual lots met release criteria, trend analysis under Clause 8.4 reveals a cluster of drape-lifting complaints during high-humidity summer months. Quality engineering initiates a Preventive Action under Clause 8.5.3 to re-evaluate the acrylic adhesive moisture-vapor transmission rate (MVTR) and introduces accelerated environmental aging tests (ASTM D4169 / ISO 11607) to prevent future seasonal adhesion failures.

A Seven-Point Incoming Checklist, Red Flags, and the Pack to Request Before the First Commercial Lot

Before releasing commercial lots or approving a contract manufacturing agreement, procurement quality teams and distributor regulatory affairs managers must evaluate the supplier's complaint and CAPA dossier against a rigorous, seven-point verification protocol.

1. Verify Modern Regulatory Citation Alignment: Confirm that the supplier's quality manual, vendor questionnaires, and standard operating procedures (SOPs) have completely expunged repealed citations to 21 CFR 820.100 and 820.198. Ensure procedures cite ISO 13485:2016 Clauses 8.2.2, 8.3, 8.5.2, and 8.5.3, supplemented explicitly by 21 CFR 820.35.
2. Audit 21 CFR 820.35(a) Complaint Record Integrity: Inspect sample complaint records for the quoted SKU. Confirm that all seven mandated fields (device name, receipt date, UDI/lot, complainant contact details, complaint nature, correction/corrective action, and reply) are recorded. Verify that any non-investigated complaint contains a documented justification referencing an identical prior investigation.
3. Enforce Structural Separation of CA (8.5.2) and PA (8.5.3): Ensure the manufacturer maintains distinct procedures and separate logs for Corrective Action (eliminating root causes of existing failures) and Preventive Action (proactively eliminating causes of potential nonconformities). Reject quality files where 'preventive action' is merely a dormant section within a CAPA SOP.
4. Map Procedures to CP 7382.850 Attachment A Page 74: Verify that the supplier's QMS architecture reflects the Measurement, Analysis, and Improvement inspection model. Confirm that feedback, process monitoring (8.2.5), product monitoring (8.2.6), and data analysis (8.4) systematically feed corrective action and management review.
5. Delineate Multi-Jurisdiction Vigilance Clocks: Audit the supplier's reporting procedures to ensure that US MDR clocks (21 CFR Part 803: 10-day, 30-day, 5-day), US advisory notice clocks (21 CFR Part 806: 10-day), European incident clocks (EU MDR Article 87: 15-day, 10-day, 2-day), and Chinese AE clocks (NMPA Article 25: 7-day, 20-day) are governed by distinct, jurisdictional decision trees.
6. Validate MDR 803.18(e) Evaluation Linkage: Require proof that any submitted FDA Form 3500A or European vigilance report is backed by an internal Part 820 quality investigation. Verify that MDR event files within the complaint log are prominently identified.
7. Confirm Closed-Loop ISO 14971 Risk Integration: Verify that post-market complaint rates, failure modes, and CAPA outcomes are systematically reviewed during periodic risk reviews and update the device Risk Management File (RMF), Hazard Analysis, and Clinical Evaluation Report (CER).

Red Flag Dossier Defects: When to Send the File Back

• The Obsolete Law Trap: The supplier submits a Quality Manual or completed questionnaire explicitly stating compliance with '21 CFR 820.100 CAPA' or '21 CFR 820.198 Complaint Handling'.
• The Archival Guidance Defense: The supplier provides FDA's pre-QMSR QSIT training PDF (media/142009) or a Cornell LII printout as proof of current US CAPA requirements.
• The Form 3500A Substitute: The supplier provides an FDA Form 3500A copy and claims that transmitting the form fulfills complaint investigation duties, without a Part 820 evaluation file.
• The Empty Listing Screenshot: The supplier provides an FDA establishment listing screenshot showing the 'Complaint File Establishment per 21 CFR 820.198' token as evidence of an approved complaint system.
• The Absent Preventive Action Log: The supplier's quality system has closed dozens of CAPAs over three years but cannot produce a single documented preventive action record under Clause 8.5.3.
• The Unjustified Investigation Skip: Complaint logs reveal clinical failures marked 'closed—no investigation required' without documented reference to a prior similar investigation.
• The Missing UDI/Contact Fields: Complaint records fail to document the device UDI, lot numbers, or complainant contact details required under 21 CFR 820.35(a)(3) and (4).

The Document Pack to Request Before Commercial Lot Release

To ensure compliance without exposing proprietary manufacturing know-how, request the following specific dossier elements prior to commercial shipment:

• 1. Controlled Complaint Handling SOP: Demonstrating alignment with ISO 13485:2016 Clause 8.2.2 and 21 CFR 820.35.
• 2. Redacted Complaint Investigation Records: A sample of 2–3 closed complaint investigations for the quoted product family, confirming capture of the seven mandated fields.
• 3. Controlled Corrective Action & Preventive Action SOPs: Two distinct procedures governing Clause 8.5.2 (CA) and Clause 8.5.3 (PA).
• 4. Redacted CAPA Sample File: Demonstrating root cause analysis (Ishikawa, 5-Why), containment, corrective implementation, and verified effectiveness.
• 5. Medical Device Vigilance & Reporting SOP: Defining distinct operational clocks for 21 CFR Part 803, 21 CFR Part 806, EU MDR Article 87, and NMPA Article 25.
• 6. Executed Quality Agreement: Specifically establishing customer complaint notification windows (e.g., reporting death/serious injury within 24–48 hours) and defining who holds legal reporting duties per legal manufacturer accountability guidelines.

Where VEMERIX Fits—and Where Due Diligence Still Begins

VEMERIX is the international brand of Weihai Medison Medical Equipment Co., Ltd., positioned as a Minimally Invasive Surgery Total Solution Platform serving urology, vascular surgery and perioperative care.

Across our core product pillars, VEMERIX structures its manufacturing and quality documentation to support international distributor enablement and OEM/ODM private-label partnerships:

• Urology and Surgical Consumables: Disposable circumcision devices (self-detaching rings and surgical stapler kits), postoperative protective dressings, and surgical consumables manufactured under certified ISO 13485 quality systems.
• Vascular Laser Energy: Medison's NMPA-registered single-use medical laser fiber (Lu Mech Reg. 20192010517), with multiple tip geometries for vein work, designed for pairing with compatible diode laser sources (such as the partner-supplied NOVACURE console; note that VEMERIX does not manufacture capital laser generators).
• Perioperative Care: Disposable negative pressure wound therapy (NPWT) dressing kits, drainage pumps, polyurethane/PVA foam sets, medical adhesives, and hypochlorous acid (HOCl) disinfectant solutions.

However, VEMERIX maintains strict commercial and regulatory boundaries: commercial partnership does not replace buyer due diligence. VEMERIX does not claim pre-existing US FDA QMSR inspection classifications or unearned foreign clearances where product registrations remain in progress. We support distributor and OEM qualification by providing complete technical dossiers, batch inspection records (CoAs), ISO 13485 QMS documentation, and clear quality agreements defining complaint reporting workflows.

Qualified distributors, hospital procurement engineers, and private-label partners are invited to review our quality systems and request technical evaluation packs through VEMERIX Quality & Compliance, explore our full product portfolio at VEMERIX Products, or initiate a supplier technical review via VEMERIX Contact & Enquiries.

Frequently Asked Questions (FAQ)

Are 21 CFR 820.100 and 820.198 still in force after 2 February 2026?

No. Under the FDA Quality Management System Regulation (QMSR) effective 2 February 2026, Subparts C through O of 21 CFR Part 820 were formally removed and designated as [Reserved]. Sections 820.100 and 820.198 are no longer operative federal law, and eCFR section URLs return HTTP 404. CAPA and complaint handling requirements are now governed by ISO 13485:2016 (Clauses 8.2.2, 8.3, 8.5.2, and 8.5.3) incorporated by reference via 21 CFR 820.7 and 820.10, supplemented by 21 CFR 820.35.

Does an ISO 13485 certificate prove complaint handling and CAPA for the SKU I am buying?

No. An ISO 13485 certificate demonstrates that an accredited registrar audited the organization's overarching quality system. FDA explicitly confirmed in the QMSR final rule that holding an ISO 13485 certificate is not required by FDA and does not exempt a manufacturer from FDA inspection. A certificate on the wall does not prove that the specific finished device SKU has compliant 820.35 complaint records, documented investigation justifications, or effective CAPA closures.

Is a submitted FDA MDR (Form 3500A) the same thing as a complaint file?

No. FDA Form 3500A is an external regulatory reporting transmission document submitted under 21 CFR Part 803. Under 21 CFR 803.18(e), an MDR submission does not comply with regulatory requirements unless the incident was formally evaluated under the quality management system requirements of Part 820. Form 3500A is not an investigation, does not satisfy the seven mandated record fields of 21 CFR 820.35(a), and does not eliminate root causes under ISO 13485 Clause 8.5.2.

Does an FDA establishment listing that says 'Complaint File Establishment per 21 CFR 820.198' prove the supplier has a living complaint file?

No. In the FDA establishment registration snapshot of 22 July 2026, 3,198 unique non-empty FEIs still carry this leftover token string among 25,405 unique non-empty FEIs.²⁰ The token is a form leftover from the 1996 QS regulation. It proves only that an establishment selected that classification during electronic registration; it provides no evidence that the firm operates an active complaint unit, records the seven fields of 820.35, or complies with QMSR requirements.

If we use a US agent or a US importer for a China-made sterile device, who holds the 803 reporting duty?

Both hold reporting duties under Part 803. Under 21 CFR 803.40, the US importer must report deaths and serious injuries to FDA and the foreign manufacturer within 30 calendar days, and report malfunctions to the manufacturer. Under 21 CFR 803.3(l)(4), the US agent of a foreign manufacturer is defined as a manufacturer and can be held accountable for manufacturer MDR obligations. A Quality Agreement can assign who prepares the submission; it cannot waive those duties.⁸,⁹

Does QMSR still allow one combined CAPA procedure, or must corrective action and preventive action be separate?

While an organization may house both within a unified quality manual section, the procedural mechanics and execution must remain distinct. In Federal Register Comment 20, FDA stated that ISO 13485 has one clause for corrective action (8.5.2) and another for preventive action (8.5.3), and that FDA incorporated both by reference rather than combining them.⁴ An audit file that only reacts to historical failures with zero preventive action records fails the Clause 8.5.3 inspection element on CP 7382.850 Attachment A page 74.

Are CGMP-exempt Class I devices exempt from complaint files?

No. On 4 December 2025, FDA published technical amendments (90 FR 55978, effective 2 February 2026) amending 162 Class I classification regulations that were historically CGMP-exempt to explicitly cite 21 CFR 820.35. Finished device manufacturers of CGMP-exempt Class I devices are legally required to maintain complaint files and general records under 21 CFR 820.35.

Does VEMERIX already have an FDA-inspected complaint and CAPA file for these SKUs?

VEMERIX does not market a QMSR inspection outcome or substitute a marketing statement for a regulatory audit. The company can provide ISO 13485 QMS documentation and a current technical pack for buyer qualification. The buyer's complaint-file and CAPA review still has to be done.