CAPA & Deviations Module
Explore this topic in more depth to build a complete picture of your quality and compliance operations.
Explore
Glossary Term
Complaint Handling
The controlled process for receiving, evaluating, investigating, and responding to product quality and safety complaints — including the regulator notification obligations that come with them.
Complaints are post-market feedback the market sends you whether you want it or not. The question regulators ask isn't whether you got complaints — every firm does — but whether you recognized them, investigated them, reported the reportable ones on time, and let the trends drive action.
On this page
What complaint handling is
Complaint handling is the controlled process for receiving, evaluating, investigating, and responding to product quality and safety complaints received from outside the firm — customers, healthcare professionals, distributors, sales reps, regulators, and any other party who reports a perceived deficiency in the product after distribution.
It has three jobs that run in parallel. The first is the individual-complaint job: receive, log, evaluate, investigate, close. The second is the regulator-notification job: identify reportable events and submit them within the regulator's timeline. The third is the trending and feedback job: aggregate complaints to spot patterns, drive CAPA when warranted, and feed Management Review with post-market quality data.
The frameworks differ slightly between drugs and devices, but the discipline is the same. The first regulator question on any complaint program is whether the program reliably catches what it should catch — both the individual complaint that needs investigation and the broader pattern that needs systemic action.
Complaints are the market giving you feedback you can't ignore
Every regulated firm gets complaints. The question regulators ask isn't whether you got them — it's whether you recognized them, investigated them, reported the reportable ones on time, and let the trends actually drive change. Complaint volume isn't a quality signal; complaint handling discipline is.
Why complaint handling sits at the centre of post-market regulation
Regulators put substantial weight on complaint handling for one reason: it's the firm's primary post-market signal that something has gone wrong in the field. Pre-market controls (validation, GMP, design control) are about preventing problems. Complaint handling is about catching the ones that got through.
The reporting obligations attached to complaint handling — Medical Device Reports under 21 CFR Part 803, vigilance reporting under EU MDR Article 87, adverse drug reaction reporting under ICH E2 — carry firm timelines (30 calendar days, sometimes 5) and serious consequences for missed deadlines. The reporting clock starts at the firm's awareness, which means delayed complaint logging directly compromises the reporting timeline.
Complaint handling deficiencies are among the most common 483 themes for device firms and increasingly for drug firms. Patterns include failure to recognize reportable events, complaints conflated with inquiries to avoid reporting, investigations that close without root cause, and complaint trends that don't drive any visible change.
Inspector note: When I review complaint handling, I pull a sample of recent complaints and trace each one. Was it logged within a reasonable window? Was it classified correctly — complaint versus inquiry? If it was reportable, was the report submitted on time? Was the investigation thorough? Did it lead to CAPA when warranted? If the program holds together on a sample, I have confidence. If the sample reveals filtering or late reports, the conversation gets serious quickly.
The complaint handling and vigilance references
Complaint handling is anchored by complementary device and drug frameworks plus vigilance and pharmacovigilance regulations:
- 21 CFR Part 820 — QMSR (effective February 2, 2026): incorporates ISO 13485:2016 §8.2.2 (Complaint handling) by reference. §820.198 retained with device-specific complaint-file requirements: formally designated complaint unit, evaluation for need to investigate, reason captured if no investigation. The complaint definition formerly at §820.3(b) (QSR) is now reached through ISO 13485:2016 §3.4 and §8.2.2.
- 21 CFR Part 803 — MDR: 30-day standard; 5-day for events requiring remedial action
- 21 CFR §211.198: drug complaint files; QC unit owns records
- 21 CFR Part 314 + Part 600s: post-marketing adverse drug experience reporting
- EU GMP Chapter 8: complaints, quality defects, recalls; reporting to competent authorities
- EU MDR Article 87: serious incidents within 15 days; deaths within 10 days; immediate public health threats within 2 days
- EU MDR Articles 88-92: trend reporting, PSUR, PMS plan
- ISO 13485 §8.2.2 — Complaint handling: timely receipt and evaluation, investigation, reporting to regulators, identification of complaints needing CA, correction taken
- ISO 13485 §8.5.1: improvement; complaint data informs QMS
- ICH Q10 §3.1: customer complaint as input to PQS
- ICH E2A-E2F: pharmacovigilance standards
- EU Pharmacovigilance Directive 2010/84/EU: ADR reporting framework
The complaint flow from intake to closure
Each complaint moves through a structured workflow with controlled evidence at each stage:
- Intake. Promptly logged from any channel; complainant identity, date, channel, product, batch/lot/serial, verbatim description
- Initial classification (complaint vs inquiry). Triage; ambiguous cases treated as complaints
- Reportability assessment. Reportability clock starts at firm awareness; assessment is time-critical
- Investigation. Depth scales with severity and reportability; serious-injury reports get retained-sample testing
- Response to complainant. Where appropriate; response is part of the record
- Vigilance report submission. Within regulatory timeline; track submission and follow-up
- CAPA linkage. Systemic / recurring / safety / field-action complaints trigger CAPA
- Closure. Formal QA closure with investigation conclusion and CAPA reference
- Trending. Aggregate by product, batch, type, severity; feeds CAPA, change control, supplier oversight, MR
What strong complaint handling programs do
The programs that hold up at inspection share consistent procedural and engineering controls:
The 'complaint that was really an MDR' finding
An inspector reviews the complaint log and finds one classified as a 'product performance question' that actually described a malfunction with patient injury implications. If the MDR wasn't submitted within 30 days of firm awareness, the firm has a missed-reporting finding, not just a complaint-handling finding. The investigation has to demonstrate the classification call was reasonable — and if it wasn't, the firm has to address the systemic gap in how reportability is assessed.
- Defined intake channels with logged receipt — every channel routes to the complaint system with timestamp
- Prompt logging — same-day or next-business-day standard
- Defined classification criteria — complaint vs inquiry; ambiguous = complaint; periodic review of inquiry filings
- Reportability assessment as controlled step — separate, controlled, qualified assessor
- Vigilance reporting timeline tracked from awareness — late submissions are recordable events themselves
- Investigation scaled to severity — serious-injury = retained sample + full batch reconstruction
- Root cause analysis when warranted — 'customer misuse' without analysis rarely sufficient
- CAPA criteria defined — recurring patterns, severity threshold, regulatory commitments, field action
- Periodic trending — visible in Management Review
- Field action triggered when needed — recalls, field safety notices, customer communication
- Cross-reference to deviations and CAPAs — same root cause across multiple record types = pattern
- Audit trail per complaint
How Complere supports complaint handling
Complaints don't arrive on a schedule, and they don't always look like complaints when they land. Complere gives your team a single, consistent place to receive them, triage them, investigate them, and report the ones that need reporting — without the work fragmenting across inboxes, spreadsheets, and side-channel emails. Your quality lead sees the whole post-market picture in one view, not five.
When a complaint comes in, your team logs it with everything an inspector will later ask for: who reported it, when, through which channel, which product, which lot. The complaint-versus-inquiry call is a structured step with its own record, so the decision to investigate (or not) is visible and defensible. Severity is captured on the record so your quality lead can route accordingly — routine cosmetic complaints take a lighter path; serious-injury reports go immediately to the people who own the regulatory clock.
Investigations run the same way your CAPA and deviation investigations run, with structured root cause, evidence capture, reviewer and approver signatures, and a per-record audit trail your team can hand to an inspector unedited. When the complaint reveals something systemic, it links across to the CAPA workflow so closure of one is visible from the other; nothing falls between the cracks because two different teams owned two different records.
Your team gets the timing aids that matter under MDR, vigilance, and ADR frameworks: turnaround-time tracking from firm awareness, overdue-item escalation, and a place to record submission to the regulator and any follow-up. You can capture site-specific fields — regulator submission references, complaint category codes, market codes — without waiting for engineering. Across customers, your data stays in your own space; it never mixes with another firm's complaint records.
What Complere doesn't do by design: it doesn't auto-decide reportability for you. That call is a quality judgement based on regulatory expertise and the specifics of the complaint, and it stays with your qualified personnel. The platform structures the assessment, captures the rationale, tracks the clock, and produces the evidence — your team makes the call.
Frequently asked questions
Common questions about Complaint Handling sourced from regulatory references and inspection patterns.
What counts as a complaint under GxP?
For devices, the QMSR (21 CFR Part 820, effective February 2, 2026; former QSR §820.3(b)) defines a complaint as “any written, electronic, or oral communication that alleges deficiencies related to the identity, quality, durability, reliability, usability, safety, or performance of a device after it is released for distribution.” For drugs, 21 CFR §211.198 carries the parallel obligation. The breadth of the definition is deliberate — any external communication alleging a deficiency is in scope until the firm's evaluation determines otherwise.
What's the difference between a complaint and an inquiry?
A complaint alleges a deficiency in the product. An inquiry asks for information (how to use it, where to buy it, technical clarification). The discipline matters because inquiries don't trigger investigation or reporting obligations, while complaints do. The diagnostic rule for ambiguous cases: treat it as a complaint until the evaluation says otherwise. Inspectors look for inquiry filings being used to keep reportable events out of the complaint log — a recurring 483 pattern.
How quickly should a complaint be logged?
Same-day or next-business-day is the industry standard. The reason is the regulatory clock: MDR, vigilance, and ADR timelines all start at the firm's awareness, not at the date of logging. Delays in logging compress the time available to assess reportability, perform initial investigation, and submit the report — and 'we logged it late' is not a defence against a missed reporting deadline.
When does a complaint become a reportable MDR?
Under 21 CFR Part 803, a 30-day report is required from awareness of an event that reasonably suggests the device may have caused or contributed to a death or serious injury, or that a malfunction occurred which would likely cause or contribute to a death or serious injury if it recurred. A 5-day report is required for events requiring remedial action to prevent an unreasonable risk of substantial harm to public health. EU MDR Article 87 sets parallel timelines: 15 days for serious incidents, 10 days for death or unanticipated serious deterioration, and 2 days for serious public health threats.
When does a complaint trigger CAPA?
CAPA is triggered when the complaint surfaces a systemic issue: recurring pattern across multiple complaints, safety implications, regulatory commitment, or a field action (recall, field safety notice). A one-off complaint with a contained root cause may close without CAPA, but the rationale needs to be on the record. The most common 483 pattern is the opposite: clear recurring patterns that closed individually without anyone aggregating them into CAPA.
What are the most common complaint handling findings?
Late logging that compresses the reportability window; failure to recognise reportable events (classification or filtering); investigations that close without a documented root cause; absence of trending across the complaint population; complaints conflated with inquiries to avoid reporting; and the same root cause appearing across complaints, deviations, and CAPAs without anyone connecting them.
Does complaint handling differ between drugs and devices?
The frameworks run in parallel but aren't identical. For drugs, 21 CFR §211.198 governs complaint files and EU GMP Chapter 8 covers complaint handling, quality defects, and recalls. For devices, 21 CFR Part 820 (QMSR, retaining §820.198 for complaint files alongside ISO 13485:2016 §8.2.2 by reference) governs complaint files, and EU MDR Articles 87–92 govern vigilance, trend reporting, and PSURs. The underlying discipline — recognise, log, assess, investigate, report on time, close, trend — is the same.
How long must complaint records be retained?
At least as long as the predicate rule requires for the underlying product record. For devices under the QMSR (21 CFR Part 820, incorporating ISO 13485:2016 §4.2.5 by reference; former QSR §820.180), the longer of the expected device lifetime or two years from the date of release for distribution. For drugs under 21 CFR §211.180(a), at least one year past the batch expiration date (or one year past distribution for non-expiration OTC products). EU GMP and MDR carry similar retention expectations. Complaint files and their investigations have to remain retrievable throughout the period.
Continue Exploring
Explore related topics, modules, and compliance resources for a deeper understanding of your quality system.
See Complaint Handling in action during a Complere demo
Walk through how Complere operationalizes this concept inside a validation-ready quality system.