Medical device complaint files and MDR reportability decisions for complaint-handling AI

Why MAUDE alone cannot train a reportability model

MAUDE is a record of positives, so a model trained only on it never sees the complaints that did not cross the reporting threshold. FDA publishes MDR data files in bulk [1], and the MAUDE tables split reports into master event, device, narrative text and device problem code files [1]. That makes MAUDE valuable for pretraining a coder on event narratives and problem terms. It is weak for triage, because every row already passed someone's "reasonably suggests" judgment.

Manufacturer complaint files close that gap. A complaint system (often MasterControl, Veeva Vault QMS, TrackWise, SAP QM or a Salesforce-based case system) logs every allegation of a deficiency, including cosmetic packaging issues, user errors and duplicates. The share of complaints that become MDRs is usually small, so the class imbalance is real and must be preserved, not rebalanced by the supplier, if the eval set is to reflect production.

Public narratives also have quality limits: text fields can be redacted, supplemental reports arrive later as separate records, and problem coding varies by reporter [1]. Treat MAUDE as a complement to licensed files, and see the industry operational data buyer's guide for how this category fits beside other decision records.

Labels that define a reportability decision

The label set comes straight from Part 803: a manufacturer reports when information reasonably suggests its device may have caused or contributed to a death or serious injury, or malfunctioned in a way likely to cause or contribute to one if it recurred. Initial reports are due within 30 calendar days of awareness, and within 5 work days when remedial action is needed to prevent an unreasonable risk of substantial harm or FDA requests it in writing [7]. Supplemental reports follow when new information arrives; confirm deadlines against the current eCFR text of Part 803 as of October 2026 [7].

That gives four decision labels a buyer should expect per complaint: not reportable, 30-day report, 5-day report, and supplemental. The awareness date matters as much as the label, since a triage model is judged on whether it flags an event before the clock runs out. Ask for the awareness date, decision date, decision maker role and the free-text MDR decision rationale, which is the field that lets an eval separate a correct answer from a lucky one.

US rules are only one regime. Files from manufacturers selling in the EU also carry vigilance decisions under the EU MDR, and Canadian or other national reports may be linked. As of October 2026, FDA's Quality Management System Regulation aligns Part 820 complaint handling with ISO 13485; confirm with the supplier which procedure version governed each record, since decision criteria in older files may follow superseded SOPs.

IMDRF codes as the shared label vocabulary

IMDRF adverse event terminology is the most portable coding scheme for this data, because regulators in several jurisdictions accept it and it is free to reuse. Annex A device problem codes use a three-level hierarchy, with codes such as A030102. Annexes B, C and D cover investigation type, findings and conclusion, Annexes E and F cover health effects, and Annex G covers the device component.

Releases change. IMDRF updates the annexes periodically, and the Annex A page lists its current release number. A dataset that mixes legacy FDA problem codes, older IMDRF releases and the current release will produce a coder that predicts deprecated terms. Require a release identifier per coded field and a crosswalk for any remapping the supplier performed.

What a licensable complaint record should contain

A complete record links intake, coding, investigation and decision so each model stage has its own ground truth. The schema below shows the minimum structure to request.

Illustrative example: invented to show structure; it does not describe an available dataset.

Two failure modes to test for in a sample: rationale fields that are templated boilerplate, and codes applied after the decision to justify it rather than during intake. Both inflate apparent model accuracy. ISO/IEC 5259-4 frames labelling quality checks for supervised ML that suit this review [7]. For the related service history that often explains a malfunction, see medical device field service records.

Privacy handling for patient and facility details

Complaint narratives routinely include patient names, ages, hospital names, physician names, lot and serial numbers, and reporter contact details, so de-identification is mandatory before any transfer. Where records contain protected health information received from a covered entity or business associate, HIPAA de-identification applies, and the Safe Harbor identifier categories include device identifiers and serial numbers [5]. Replacing serials with random surrogate keys, rather than codes derived from the serial, preserves unit-level linkage without exposing traceable units [5].

Free text is the hard part. Rule-based scrubbing misses misspelled names and rare-condition descriptions that re-identify a patient in a small facility, which is why NIST cautions about the limits of traditional de-identification [4]. Ask for the method, the residual-risk review, and a sample audit result. SourceX removes or replaces personal details such as names, emails, phone numbers and account numbers before delivery, records the method and checks a sample, while noting that no method is perfect; health records require HIPAA de-identification by Safe Harbor or Expert Determination.

Rights and use terms to settle before training

Complaint files are a manufacturer's regulated quality records, so the license must say what the buyer may do with them and what happens to derived models. Settle allowed uses (training, evaluation, or both), whether coded labels may be redistributed inside a product, how long the data may be retained, and whether the supplier's product names must be masked. If you plan to sell a complaint-handling product, confirm whether outputs trained on one manufacturer's files can be offered to its competitors.

Vendor material shows the category is active, with AI applied to complaint intake, triage and coding [2][3], but published case studies rarely describe the training data rights. The AI training data licensing guide covers term structures, and decision records with rationale explains why rationale fields deserve explicit license coverage. If you want this negotiated for you, describe the data you need on the SourceX buyer intake.

Buyer checklist for a complaint data request

A good request describes the decisions you need labeled, not the companies you want them from.

• Device classes and product families in scope, and whether software as a medical device is included.
• Date range, with the procedure versions that governed decisions in that range.
• Required fields: narrative, IMDRF annexes A, E, G and B to D with release IDs, investigation conclusion, reportability label, awareness and decision dates, rationale.
• Inclusion of non-reportable complaints at their natural rate.
• Jurisdictions: FDA MDR only, or also EU vigilance and other national reports.
• De-identification method, residual-risk review and sample audit.
• Intended uses: intake classification, code extraction, reportability triage, held-out eval.

This category sits alongside other regulated-decision data such as prior authorization packets and payer decisions and outcome-labeled evaluation data. Owner pages for the sectors involved are healthcare buyers, manufacturing buyers and manufacturing quality datasets.

This page is general information, not legal advice. Confirm requirements with counsel for your jurisdiction and use case.

Requesting medical device complaint data for AI

SourceX sources operational datasets from US companies on request, looking for businesses that hold the complaint, investigation and decision records you describe; a request does not guarantee a match, and every release is approved by the supplying company. Each dataset is rights-reviewed and delivered under a license that defines records, uses, term and delivery, after an executed agreement. Describe the complaint and MDR decision data you need.