21 CFR Part 806

This glossary term is part of the SG Systems Global regulatory & operations guide library.

Updated January 2026 • 21 CFR Part 806, medical device corrections and removals reporting, field actions, recall vs enhancement vs market withdrawal, recordkeeping & retention • Primarily Medical Device Manufacturing & Distribution (postmarket controls, CAPA, complaints, traceability)

21 CFR Part 806 (“Reports of Corrections and Removals”) is the FDA rule that turns device field actions into a governed, time-bounded reporting and recordkeeping obligation. If you initiate a device correction or removal to reduce a risk to health or to remedy a violation that may present a risk to health, Part 806 is the part that asks: Did you report it correctly, did you report it fast enough, and can you prove the decision logic and execution?

Here’s the part many teams miss until it’s expensive: Part 806 is not only about “big public recalls.” It’s also about the gray zone where companies quietly do field actions (label updates, software changes, retrievals, replacements) and later struggle to explain whether it was a recall-type correction/removal or a non-reportable action like a market withdrawal or stock recovery. The difference isn’t semantics. It’s whether FDA expects a report and whether your evidence holds up when someone pressure-tests your reasoning.

This is why Part 806 naturally connects to your broader quality system: complaint intake, risk assessment, CAPA decisions, distribution control, and traceability. If those are weak, Part 806 becomes chaos. If those are strong, Part 806 becomes an executable workflow.

“Part 806 is where ‘we handled it’ stops being a story and becomes a regulated, auditable decision and execution trail.”

1) What people mean when they cite 21 CFR Part 806

When someone says “we need to be compliant with Part 806,” they usually mean one of these real-world situations:

First: the business is about to do (or already did) a field action and needs to determine whether it’s reportable and how to build an evidence package that survives review.

Second: the business has a complaint trend, adverse event signal, or nonconformance that is drifting toward a correction/removal decision—and leadership wants to avoid being late, sloppy, or inconsistent.

Third: the business is in an FDA inspection posture where field actions are being examined as proof of whether the quality system is real. Part 806 isn’t only a “regulatory filing” problem; it’s a systems integrity test.

2) Scope map: what Part 806 actually governs

Part 806 is narrow in topic but heavy in consequence: it governs reports and records for device corrections and removals. The fastest way to understand it is to treat it as a decision-and-evidence rule for field actions.

3) Who Part 806 applies to (and who gets surprised)

Part 806 applies to device manufacturers and importers initiating corrections or removals of a device in distribution. The surprise is that “we’re not a manufacturer” doesn’t always save you—especially if your business initiates field actions, manages distribution, or controls labeling and rework decisions.

Also, Part 806 risk is often created by organizational seams: QA decides, Regulatory files (or doesn’t), Operations executes partial retrievals, Customer Service communicates inconsistently, and no one owns the end-to-end evidence. Part 806 punishes that fragmentation.

4) Corrections vs removals vs market withdrawals (the definitions that matter)

The definition layer is where companies get trapped. Part 806 defines the core terms—correction and removal—and also defines categories that often explain why a report is not required, such as market withdrawal, stock recovery, and routine servicing.

If you want the real operational takeaway: don’t label an action “market withdrawal” because it sounds safer. Label it based on defensible trigger logic and risk rationale, and make sure your records show that logic clearly.

5) When a Part 806 report is expected (the trigger logic)

The Part 806 report trigger is conceptually straightforward: if the correction/removal was initiated to reduce a risk to health posed by the device, or to remedy a violation caused by the device that may present a risk to health, FDA generally expects a report.

In practice, this means your team needs a repeatable decision pattern: signal → risk evaluation → field action decision → classification (reportable vs non-reportable) → execution plan → evidence package. If you can’t replay that sequence cleanly months later, your compliance posture is fragile.

6) Timing: the “10 working day” reality

When a correction/removal is reportable, the timing expectation is tight. The operational implication is not “file faster.” It’s “decide faster, document faster, and control execution faster”—because the moment you initiate action, the clock starts.

Tell it like it is: if your decision process depends on leadership availability, scattered spreadsheets, and email archaeology, you’re structurally incapable of being on time under pressure.

7) What the report needs to contain (in practical terms)

A Part 806 report isn’t a single sentence like “we recalled the device.” It’s an evidence summary that tells FDA what happened, why it happened, what product is affected, how it was distributed, how you communicated, and what you’re doing to control risk.

Operationally, this pushes you toward strong master data and traceability discipline: clear device identity, clear distribution scope, clear action description, clear customer communication control, and clear effectiveness logic.

8) Records you must keep even when reporting isn’t required

This is where a lot of teams get blindsided: even when a report isn’t required (for example, you classify it as a market withdrawal), Part 806 still expects you to maintain records of corrections and removals in a structured way. If you can’t produce those records quickly and coherently, your classification decision looks like a post-hoc excuse.

That’s why organizations that take Part 806 seriously treat it as a record architecture requirement, not a “regulatory filing” requirement.

9) Retention: how long you keep Part 806 records

Retention is not optional decoration. Part 806 establishes a retention baseline tied to device life expectations. If your retention strategy is “shared drives and hope,” you’re designing failure into your system.

From an execution standpoint, retention only works when records are (1) created from real events, (2) stored as retrievable objects, and (3) protected from silent overwrite and orphaned context. This is one reason Part 806 programs often get built inside a governed quality system rather than as a set of ad hoc folders.

10) How Part 806 ties to complaints, CAPA, and Part 820 controls

Part 806 doesn’t live in isolation. It usually starts with complaints, nonconformances, adverse events, or postmarket signals and then becomes a field action decision. If you want Part 806 compliance to be durable, your upstream controls must be real: complaint handling, trending, risk assessment, and CAPA governance.

That’s why teams doing Part 806 work typically anchor their operating model in a coherent triangle: complaint handling, CAPA, and core QMS discipline aligned to Part 820. When those are weak, Part 806 becomes reactive scrambling and inconsistent classification.

11) Traceability & distribution control: the hidden make-or-break factor

A Part 806 action is only as “bounded” as your ability to identify affected product and control it. Weak traceability turns every field action into a broad, expensive, brand-damaging overreach because you can’t confidently scope who received what.

Practically, this is where your returns and reverse logistics capability matters. If you’re serious about building a resilient posture, treat returns and retrieval as controlled workflows—not customer service improvisation. A useful operational complement is structured returned product handling (see Returned Product Handling) and disciplined nonconforming product controls (see Nonconforming Product Control).

12) Execution discipline: communications, effectiveness checks, and closure

Field actions fail in the same places every time: inconsistent communications, partial retrieval, missing acknowledgements, and sloppy closure evidence. That failure pattern isn’t “bad people.” It’s bad workflow design.

A clean execution model has (1) a controlled communication plan, (2) a distribution list derived from authoritative records, (3) clear success criteria (what “effective” means), and (4) a closure package that ties actions back to the initiating signal and risk rationale. If you can’t produce that closure package quickly, you’re not “done”—you’re just tired.

13) Inspection & incident response: how to avoid “field action theater”

Part 806 scrutiny often happens under stress: inspection questions, a safety signal, a customer escalation, or a regulatory inquiry. In those moments, the difference between control and theater is whether your evidence was created during normal execution or reconstructed afterward.

Run drills. Pick a closed field action and attempt to replay it end-to-end: initiating signal → decision → classification → communications → execution → effectiveness → closure. If that takes days and three spreadsheets, your posture is performative.

14) Copy/paste readiness scorecard

Use this scorecard as a blunt self-check. If you can’t answer cleanly, fix the operating model—not the wording.

15) Selection pitfalls: how Part 806 gets faked

• “Market withdrawal” as a euphemism. If it was risk-driven, calling it a market withdrawal doesn’t make it so.
• Email-as-a-QMS. Decisions scattered across email threads are not defensible governance.
• Traceability by memory. If you can’t derive impacted customers from system records, you don’t have control.
• Late formalization. The file looks “clean” because it was rebuilt after the fact. Inspectors can tell.
• Closure without proof. “We sent letters” isn’t effectiveness. It’s activity.
• Records that aren’t retrievable. Having PDFs somewhere is not the same as being able to produce a coherent record set quickly.

16) How this maps to V5 by SG Systems Global

V5 supports Part 806 outcomes by making field actions workflow-driven and evidence-linked rather than reconstructive. Part 806 success is fundamentally a systems property: decision governance, controlled execution, and retrievable records.

In practice, Part 806 programs align tightly with a governed quality backbone (see V5 Quality Management System (QMS)) and strong distribution control so holds and retrievals are real (see V5 Warehouse Management System (WMS)). When device history and execution records matter for scope and root cause, manufacturing evidence matters too (see V5 Manufacturing Execution System (MES)).

If you want the product-level picture of how the platform fits together, start with V5 Solution Overview. For connecting distribution, quality, and execution data into one field-action view (without manual reconciliation), V5 Connect API is the practical integration spine.

17) Extended FAQ

Q1. Is Part 806 only about “recalls”?
No. It’s about corrections and removals. Some are classic recalls. Others are quieter field actions that still require disciplined classification and records.

Q2. What’s the most common Part 806 failure pattern?
Weak classification evidence. Teams decide “non-reportable” but can’t prove why with structured risk rationale and documented execution details.

Q3. If we didn’t report, do we still need records?
Yes—lack of a report does not mean lack of accountability. Your ability to show records is what makes the “non-reportable” conclusion credible.

Q4. How does Part 806 relate to MDR (Part 803)?
MDR is event reporting (adverse events). Part 806 is field action reporting and recordkeeping (corrections/removals). In real operations they’re linked: complaint/adverse signals often drive field actions.

Q5. What’s the fastest way to test whether our program is real?
Run a retrieval drill: choose a past field action, then prove you can bound distribution, show communications, show effectiveness evidence, and produce the record set without manual reconstruction.

Related Reading (keep it practical)
If you’re implementing the operational side of Part 806, start with a controlled complaint and CAPA backbone, then build field-action execution discipline on top. For implementation patterns, see Complaint Management Software, Recall Readiness Software, and Audit Readiness. For the primary regulation text, use 21 CFR Part 806 (eCFR) or the section-level view at 21 CFR Part 806 (Cornell).