Clause 8 of ISO 13485 is where a quality system proves its value. Feedback, complaint handling and corrective and preventive action (CAPA) turn problems into improvements and give regulators confidence that issues are caught and fixed.
Feedback and complaint handling
- Feedback (8.2.1): systematically gather information from production and post-production, including customer feedback, service data and literature, and use it as input to risk management and improvement
- Complaints (8.2.2): receive, record, evaluate and investigate every complaint in a timely way, decide whether it must be reported to authorities, and document the outcome
- Regulatory reporting (8.2.3): report incidents and field actions to regulators within the required timelines
Nonconforming product
Products that do not meet requirements must be identified, segregated and evaluated, whether discovered before or after delivery. For software, this includes defects found after release. Decisions to release under concession, rework, recall or scrap must be justified and approved.
Data analysis
Clause 8.4 requires analysis of data from feedback, complaints, audits, process monitoring, suppliers and product conformity. Trend analysis is what turns individual events into early warnings.
A practical CAPA process
- Describe the problem clearly and assess its risk
- Contain the issue to protect patients and customers
- Investigate the root cause with structured tools such as 5 Whys or fishbone analysis
- Define corrective actions that remove the cause, and preventive actions for similar products or processes
- Verify that actions do not create new risks or regulatory issues
- Implement, then check effectiveness with objective data
- Close with management review of trends
Common pitfalls
- Opening a CAPA for everything, so the important ones drown
- Stopping at “human error” instead of finding the system cause
- Closing CAPAs without checking whether the fix worked
- Complaints from distributors that never reach the manufacturer
- No link between CAPA, risk management and design changes
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.