21 CFR Part 803 · Medical Device Reporting

21 CFR 803.18

What are the requirements for establishing and maintaining MDR files or records that apply to me?

21 CFR 803.18 is the regulation titled “What are the requirements for establishing and maintaining MDR files or records that apply to me?” in 21 CFR Part 803, Medical Device Reporting. Since 2021, 21 FDA warning letters have cited it.

Letters citing it
21 since 2021
Jan 1 to Oct 30, 2026
2 against 6 on the same dates in 2025
Most often cited with
21 CFR 803.17, in 20 letters
Closed out
24% of these letters have a published close-out
See the 21 letters citing 21 CFR 803.18 →

Letters citing it, by year issued

All are medical device letters. 2026 runs to Oct 30, 2026. Pick a year to see its letters.

  1. 12021
  2. 12022
  3. 42023
  4. 72024
  5. 62025
  6. 22026

What FDA writes when it cites it

The finding headings that cite 21 CFR 803.18 most often, as written in the letters.

  • 1 letteryour firm was unable to provide the electronic acknowledgments for the following MDRs # 3004142400-2020-00018 (dated January 13, 2020), 3004142400-2020-00030 (dated February 14, 2020, yet not received by FDA),…

The regulation

Read the text of 21 CFR 803.18 (eCFR, as of Sep 1, 2026)

(a) If you are a user facility, importer, or manufacturer, you must establish and maintain MDR event files. You must clearly identify all MDR event files and maintain them to facilitate timely access.

(b)(1) For purposes of this part, “MDR event files” are written or electronic files maintained by user facilities, importers, and manufacturers. MDR event files may incorporate references to other information (e.g., medical records, patient files, engineering reports), in lieu of copying and maintaining duplicates in this file. Your MDR event files must contain:

(i) Information in your possession or references to information related to the adverse event, including all documentation of your deliberations and decision making processes used to determine if a device-related death, serious injury, or malfunction was or was not reportable under this part;

(ii) Copies of all reports submitted under this part (whether paper or electronic), and of all other information related to the event that you submitted to us or other entities such as an importer, distributor, or manufacturer; and

(iii) Copies of all electronic acknowledgments FDA sends you in response to electronic MDR submissions.

(2) If you are a user facility, importer, or manufacturer, you must permit any authorized FDA employee, at all reasonable times, to access, to copy, and to verify the records required by this part.

(c) If you are a user facility, you must retain an MDR event file relating to an adverse event for a period of 2 years from the date of the event. If you are a manufacturer or importer, you must retain an MDR event file relating to an adverse event for a period of 2 years from the date of the event or a period of time equivalent to the expected life of the device, whichever is greater. If the device is no longer distributed, you still must maintain MDR event files for the time periods described in this paragraph (c).

(d)(1) If you are a device distributor, you must establish and maintain device complaint records (files). Your records must contain any incident information, including any written, electronic, or oral communication, either received or generated by you, that alleges deficiencies related to the identity (e.g., labeling), quality, durability, reliability, safety, effectiveness, or performance of a device. You must also maintain information about your evaluation of the allegations, if any, in the incident record. You must clearly identify the records as device incident records and file these records by device name. You may maintain these records in written or electronic format. You must back up any file maintained in electronic format.

(2) You must retain copies of the required device incident records for a period of 2 years from the date of inclusion of the record in the file or for a period of time equivalent to the expected life of the device, whichever is greater. You must maintain copies of these records for this period even if you no longer distribute the device.

(3) You must maintain the device complaint files established under this section at your principal business establishment. If you are also a manufacturer, you may maintain the file at the same location as you maintain your complaint file under part 820 of this chapter. You must permit any authorized FDA employee, at all reasonable times, to access, to copy, and to verify the records required by this part.

(e) If you are a manufacturer, you may maintain MDR event files as part of your complaint file, under part 820 of this chapter, if you prominently identify these records as MDR reportable events. We will not consider your submitted MDR report to comply with this part unless you evaluate an event in accordance with the quality management system requirements described in part 820 of this chapter. You must document and maintain in your MDR event files an explanation of why you did not submit or could not obtain any information required by this part, as well as the results of your evaluation of each event.

[79 FR 8846, Feb. 14, 2014, as amended at 90 FR 55979, Dec. 4, 2025]

Text from eCFR as of Sep 1, 2026.

Cited alongside it

Regulations that appear in the same letters as 21 CFR 803.18.

Latest letters citing it

The 3 letters citing 21 CFR 803.18 that FDA posted most recently.

See the 21 letters citing 21 CFR 803.18 →
For regulated teams

Put this kind of reading to
work on your own records.

Botable builds and runs a custom AI layer around the software you already use, so your team can do the job you hired them for.

Counts include every citation in a letter, as the Letters filter does. How this database is built.

Every letter by dateHow this database is built

FDA Warning Letter Alerts

Share this view

Send the same filters, search and view to a colleague.

You choose what to post or send. Sharing a link does not change access to this site.