Share this
by QT9 QMS Software on November 10, 2026
Every medical device starts as a set of design inputs, risk controls and verification evidence. Behind those records are all the decisions engineers made about how the device should perform for the clinicians and patients who depend on it. Once the device ships, those decisions are put to the test every day in hospitals, clinics and homes.
A customer complaint is often the first sign that something isn’t working the way it was meant to. Getting to the root cause quickly is important — the same problem could be affecting other devices, and every day spent searching for answers is another day it could happen again. What's more, regulators will look for evidence that the manufacturer understood the problem, decided whether it needed to be reported and undertook the right course of action.
For quality teams handling medical device complaints, the answers are rarely available in one place. Customer interactions often sit in one system, production records in another and the design history file in a third. Investigators spend hours chasing down records, re-entering data and confirming that files from different systems describe the same device. Medical device complaint handling slows down, not because the work is hard, but because nothing connects the records that hold the answers.
Contents
What does medical device complaint handling require?
What slows a complaint investigation?
Why efficient complaint handling matters more than ever
What connected traceability looks like in practice
Take the Traceability Stress Test
What does medical device complaint handling require?
Medical device complaint handling is the documented process for receiving, evaluating and investigating feedback that alleges a problem with a device after it has been released. ISO 13485:2016 sets the baseline requirements most regulators build on.
-
Receiving and recording feedback information
-
Evaluating feedback to determine whether it is a complaint
-
Investigating complaints or documenting why an investigation isn’t needed
-
Deciding whether the event must be reported to a regulatory authority
-
Handling any product involved in the complaint
-
Determining whether a correction or corrective action is needed
Regional rules add to that baseline. In the United States, the QMSR requires complaint records that capture the review, evaluation and investigation, along with device identifiers, such as the UDI. Under EU MDR, complaints feed post-market surveillance and vigilance reporting. In a recall scenario, especially, those steps depends on finding records quickly.
What slows a medical device complaint investigation?
Follow a single customer complaint through a typical investigation and you often see the same pattern of hopping from system to system searching for data held in various locations and by different departments.
Delays build up at the handoffs between systems:
-
Complaint to lot: Investigators must find the device history record for the unit, then the lot, components and suppliers behind it.
-
Lot to history: They next need to check whether that lot or component already had a nonconformance, deviation or similar complaint, and whether they are connected.
-
Complaint to CAPA: If the investigation opens a CAPA, the evidence often has to be re-gathered or re-attached if the records don't already share links.
-
CAPA to design: If the root cause points to a design input or a risk control, someone has to find the right revision of the design output, the risk analysis and the verification evidence.
-
Closing the loop: If the fix is a design change, it has to flow forward through change control into documents, training and production, then be verified.
While the steps aren't difficult, they can be time-consuming and often wasted searching for data, re-keying and proving that records from different systems describe the same thing. Across a complaint investigation, this is how hours become weeks.
Why efficient complaint handling matters more than ever
From the U.S. to the EU and beyond, regulators increasingly expect complaint handling to work as part of a connected quality system, with complaints feeding risk management, CAPA and design decisions rather than sitting in a standalone procedure.
When the U.S. FDA's Quality Management System Regulation (QMSR) took effect in February 2026, FDA retired the QSIT inspection technique in favor of a risk-based program built around how linked quality processes work together.
That puts more emphasis on how complaint handling, CAPA, risk management and design controls connect as one system, not as separate procedures. Regulators examining a complaint will expect to follow the thread.
EU MDR and ISO 13485 point the same way. ISO 13485 treats complaint and feedback data as a potential input into risk management. And EU MDR’s UDI and supply chain requirements extend traceability beyond where a device went to the records behind its design, manufacture and distribution.
What connected traceability looks like in practice
When complaints, nonconformances, CAPA, risk and design controls live in one connected QMS, the trace becomes a path you follow, not a project you run:
-
A complaint links to the product, lot and customer it came from, with lot and device history data flowing in from QT9 ERP.
-
The nonconformance links to the complaint and to the lot, component and supplier involved.
-
The CAPA opens from the nonconformance and carries its evidence with it.
-
A risk assessment links to the same record, so risk decisions stay attached to the event.
-
Design controls (inputs, outputs, reviews and risk) sit in the same system, so the investigation can reach the design record without leaving the QMS.
-
Change control and training carry the fix forward to documents and the people who use them.
That's the difference between weeks of digging and getting to root cause in hours — not working faster but spending less time searching.
A practical example
Sunset Healthcare Solutions, a Chicago-based manufacturer of home medical and hospital equipment, moved from a different software solution and paper-based processes to QT9 QMS. They now run customer feedback, nonconforming product, CAPA, engineering change, document control and training in one connected system. In less than a year they completed their pre-audit and full ISO 13485 certification with no major nonconformities, and with no customizations.
"I have worked in several systems over the years, and out of the box, QT9 is head and shoulders above the rest," says Joe Consoli, Director of Quality and Regulatory.
Read the Sunset Healthcare story →
Take the Traceability Stress Test
Our Traceability Stress Test takes about two minutes. Enter your complaint volume and how long each trace takes today, and see where the hours go, from complaint to root cause to design.
How to Keep Corrective Action Requests (CARs and SCARs) Moving
