ISO 13485 Customer Feedback and Complaint Handling Procedure Template and Guide

ISO 13485 does not require you to measure customer satisfaction. This is where device quality systems most often inherit the wrong shape.

The phrase appears everywhere in ISO 9001, and organizations running both standards assume the requirement carries across. It does not. Clause 8.2.1 asks whether customer requirements have been met — an objective conformity question, not a perception question. There is no clause requiring a survey, no clause requiring a score, and an assessor will not ask for either.

What Clause 8.2.1 does require, and what device organizations consistently under-build, is that the information gathered serve as potential input into risk management. That sentence is the link between the complaint file and the ISO 14971 file, and it is the most commonly missing connection in a device quality system. Complaints get logged diligently, investigated properly, closed on time, and never once cause anyone to revisit whether the risk estimates made during design still hold.

Since February 2, 2026, the FDA Quality Management System Regulation has incorporated ISO 13485:2016 by reference into 21 CFR Part 820. Your complaint handling procedure is no longer only a quality document. For US-marketed devices it is the operative form of a federal regulatory requirement, the records it generates are inspectable, and failure to comply renders a device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act.

What is actually in the document

• Complete Clause 8.2.1, 8.2.2 and 8.2.3 procedure — 41 pages, editable Word
• Regulatory position section mapping six QMSR obligations to where each is met
• All six minimum requirements of Clause 8.2.2 a) to f), each as its own procedure step
• Reportability at Section 7.3, placed before the investigation at 7.4 — because Part 803 timeframes run from awareness, not from conclusion
• The seven 21 CFR 820.35(a) complaint record fields, captured at receipt rather than reconstructed later, including UDI
• Justification for not investigating — the four fields the regulation requires when a similar complaint has already been investigated
• Section 7.5, handling of complaint-related product, including retention while a determination or investigation is open
• Section 7.8, the feedback-into-risk-management link — a dated comparison of observed complaint rates against the occurrence estimates in the ISO 14971 file
• Eleven stated thresholds with owners, including two independent clocks that run in parallel rather than in sequence
• Distributor and importer obligations — the onward reporting timeframe that has to be in the agreement to work
• Records table with retention set against the Clause 4.2.5 device lifetime floor
• Process interaction map, shipped as an editable SVG as well as inside the document
• Nine key performance indicators, the first three regulatory rather than commercial
• Maturity ladder — eight elements, four levels each, with reportability marked as the one element where stopping at Level 1 is not a legitimate position
• Cross-reference to twenty-five ISO 13485 requirements and twelve QMSR requirements
• Appendices A to D — complaint record with the QMSR fields marked, log, desk-level instruction with two worked examples, and the determination worksheet

Who it is for

Quality and regulatory professionals at medical device manufacturers, contract manufacturers supplying under device quality agreements, and consultants supporting device clients. Relevant whether you are ISO 13485 certified, preparing for certification, or adjusting to QMSR.

What it changes

Stop adapting a 9001 procedure that was never built for this. ISO 13485 predates the harmonized ten-clause structure. Feedback sits at 8.2.1, not 9.1.2, and it asks a different question.

Get the reportability sequence right. An organization that investigates first and decides about reporting afterwards will file late on exactly the complaints that mattered most — while following its own procedure correctly.

Record the not-reportable decision too. A file of reports filed on time shows the process ran. A set of complaints with no determination recorded shows nothing, and an investigator cannot tell whether the determination was negative or never made.

Close the risk file gap. Comparing observed complaint rates against the occurrence estimates in the risk file is not difficult and is almost never scheduled. Section 7.8 makes it a dated step with a named owner.

Capture the UDI while you still can. It is trivial at the moment of receipt and disproportionately hard afterwards. Putting it on the receipt form rather than the investigation form is a one-line change with an outsized effect.

Specification

About MSI. Management Systems International has spent 28 years helping organizations build management systems that work in practice rather than only on paper. We have supported 80+ certifications, attended 200+ audits alongside our clients, and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries. MSI is veteran-owned and female-owned, founded in 1998.

Perennia Corp and Perennia Healthcare are fictional organizations used for illustration throughout the templates, and are not connected with any real organization of the same or a similar name. This is a template and guide, not certification or legal advice.

© 2026 Management Systems International, LLC · All rights reserved. · msi-international.com · 760-434-9141