ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 13485 complaint handling is the documented process for receiving, evaluating, investigating and acting on feedback that says a device may not meet its requirements. Clause 8.2.2 sets the rules, and regulators treat complaint files as one of the clearest views into how a manufacturer behaves.
This guide covers the six required elements, when to investigate, when to report to authorities and what a clean complaint record looks like. It links directly to CAPA and post-market data.
Free gap assessment
How much of ISO 13485 could you evidence today?
Score clauses 4 to 8, free, with the FDA QMSR and EU MDR duties kept separate so you can see what is the standard and what is the regulator.
Run the free ISO 13485 gap assessment → or View premium report sample
Clause 8.2.2 requires a documented procedure for timely complaint handling in accordance with applicable regulatory requirements. The procedure must cover receiving and recording information, evaluating whether it constitutes a complaint, investigating, determining the need to report, handling complaint-related product and deciding on corrections or corrective action.
Records of complaint handling must be maintained. Read the wording in the ISO 13485:2016 page on iso.org and mirror its structure.
The clause sits inside the feedback and monitoring requirements of clause 8.2.1.
Your procedure should define a complaint broadly, as any written, electronic or oral communication alleging deficiencies in identity, quality, durability, reliability, usability, safety or performance of a device after release.
Evaluation step matters. Not every call is a complaint, but you must record the decision and the reason.
Train sales, support and service staff to recognize and forward complaints the same day. Late forwarding is a typical gap.
Complaints come through email, phone, service reports, distributors, social media, trade shows and returned product. List every channel in the procedure and give each an owner.
Distributors and importers are a common blind spot. Your agreements should require them to pass information to you quickly and keep their own records.
Test the channels by sending a mock complaint and measuring how long it takes to reach quality. Keep this in mind for every ISO 13485 complaint handling.
The intake record should capture who reported, when, device identification such as lot or serial number, a description of the problem, patient involvement and any injury or harm alleged.
Collect as much as possible at intake. Missing lot numbers and vague descriptions delay investigations and complicate reporting decisions.
Use a standard form with required fields. Assign a unique complaint number and record the date you became aware.
The standard says complaints must be investigated, and that if an investigation is not carried out, the justification must be documented. Any complaint not followed by corrective action also needs a documented reason.
Investigate proportionately. A cosmetic issue may need a record review, while a possible safety issue needs engineering analysis, returned product testing and a look at similar lots.
Document findings, root cause where determined, and conclusions. Share information with suppliers if activities outside your organization contributed. This is where a ISO 13485 complaint handling is won or lost.
The standard says timely, in line with regulatory requirements, and does not fix a number of days. Define internal targets by risk, such as acknowledging within one business day and completing investigation within a stated period.
Reporting clocks start from awareness, so speed at intake matters. Record the dates carefully.
Track average time to closure and report it in management review.
| Required element | Clause | Record to keep |
|---|---|---|
| Receive and record information | 8.2.2 a | Complaint intake form |
| Evaluate if it is a complaint | 8.2.2 b | Evaluation decision and reason |
| Investigate | 8.2.2 c | Investigation report or justification |
| Determine need to report | 8.2.2 d | Reportability assessment |
| Handle complaint-related product | 8.2.2 e | Returned product log |
| Decide on correction or corrective action | 8.2.2 f | CAPA reference or justification |
Clause 8.2.3 requires a documented procedure for notifying regulators of complaints that meet reporting criteria for adverse events, and for issuing advisory notices, according to applicable requirements.
In the US, medical device reporting rules in 21 CFR Part 803 set time limits for reporting deaths, serious injuries and certain malfunctions. In the EU, MDR serious incident reporting has its own deadlines. Check current rules for each market.
See MDR serious incident reporting for the European detail. Auditors judge your ISO 13485 complaint handling on exactly this point.
For each complaint, record a reportability assessment: did the event involve death or serious injury, and could a recurrence do so? Record the reasoning even when the answer is no.
Have a trained person, often the regulatory lead, make or approve the decision. Escalation to top management for borderline cases is wise.
Auditors regularly test this by sampling complaints that mention harm and asking where the assessment is.
Returned devices are evidence. Receive them under a documented process, quarantine them, record condition and handle biohazards safely.
Keep returned product traceable to its complaint number and retain it until the investigation closes. Document disposal once finished.
Where a customer does not return the device, document efforts to obtain it or the reason it is unavailable. Treat it as a standing rule for your ISO 13485 complaint handling.
Complaints are a defined input to corrective action in clause 8.5.2. Trends often show up only when several complaints are read together, so analyze by device, lot, failure mode and time.
Feed trends into the risk management file. Risk estimates should change if real-world occurrence is higher than assumed.
Our guide on ISO 13485 risk management explains how post-production data returns to the risk file.
Clause 8.4 requires data analysis, including feedback. Build a monthly or quarterly complaint dashboard with counts by device, by category and by severity.
Compare with sales volume to avoid misleading raw numbers. A rising count may simply follow rising sales.
Present trends in management review with actions for any adverse movement.
Common mistakes are classifying complaints as inquiries to avoid investigation, late intake, missing reportability records and closing without justification. Another is investigating only the single unit instead of the lot.
A further mistake is failing to record the complaint when the customer withdraws it. If you were told, you record it.
These errors are easy to spot in a sample, so test them yourself in an internal audit.
The FDA Quality Management System Regulation, effective 2 February 2026, incorporates ISO 13485:2016, so clauses 8.2.2 and 8.2.3 form the core of US complaint expectations alongside the medical device reporting rules.
Compare the frameworks in QMSR vs ISO 13485 and check how your procedure aligns.
Keep records retrievable, since FDA investigators typically ask to see them early in an inspection. See QMSR inspections.
A complaint form, evaluation checklist, investigation report, reportability worksheet and log cover the process. The ISO 13485 Toolkit includes a complaint procedure and records aligned to clauses 8.2.2 and 8.2.3.
Adapt the forms to your products and markets. Include the regulatory rules for each country where you sell.
If you use software to manage complaints, validate it as described in ISO 13485 software validation.
Auditors sample complaints at nearly every visit, so make sure a few closed files show the full path. The certification timeline shows when records must exist.
If you have no marketed product yet, a procedure and trained staff still count, and you can test the process with a mock complaint.
The implementation guide shows where it sits among other processes.
Name a complaint coordinator, an investigator and a reportability decision-maker. In a small company one person may hold two roles, but the decision-maker should have regulatory training.
Train sales, support and distributors on what to forward and how quickly. Keep training records, since clause 6.2 requires evidence of competence.
Refresh training when rules change or after any missed complaint.
A user reports that a glucose meter displayed a wrong reading, and a patient later felt unwell. Intake records lot, software version and symptoms, and the reportability assessment flags possible serious injury.
The regulatory lead decides within the timeline, files the required report if criteria are met and starts an investigation using the returned meter and retained samples.
The investigation finds a firmware fault, which triggers a CAPA and a risk file update. Each step is recorded and cross-referenced, which is the pattern auditors want to see.
Track time to acknowledge, time to close, percentage with documented reportability decisions and percentage linked to CAPA where needed.
Review the numbers monthly. Slow closure usually reflects weak intake or missing information, not slow engineers.
Strong metrics make your ISO 13485 complaint handling process visible to management and calm during audits.
Complaints must be investigated unless you document a justification for not doing so. Record the reason every time.
It depends on the market and the event type, and clocks usually run from awareness. Check the current rules for each jurisdiction you sell in.
Not always. Evaluate each communication, and record the decision and the reason it was or was not a complaint.
At least for the lifetime of the device as you define it, and not less than two years from release, unless regulations require longer.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026