FDA's VMSR Program: Not Every Malfunction Qualifies

Teams that discover FDA's Voluntary Malfunction Summary Reporting Program usually treat it as a filing-frequency decision the company gets to make: file individually, or elect to summarize quarterly instead. That is not what VMSR is. It is an alternative reporting format FDA grants under 21 CFR 803.19, scoped to specific product codes FDA has designated eligible, and scoped again at the event level to malfunctions that carry no association with death or serious injury. A manufacturer can be enrolled correctly and still file a defective summary report, simply by misreading either gate.

VMSR is a grant, not an opt-in

21 CFR 803.19 gives FDA broad authority to exempt manufacturers from, or grant variances and alternatives to, any of Part 803's standard reporting requirements, including changing the frequency of reporting. VMSR, established in 2018, is FDA's standing exercise of that authority for malfunction reports specifically: manufacturers of devices in FDA-designated product codes may report qualifying malfunction events in summary form on a quarterly basis rather than filing an individual MDR within 30 days of each one. The authority sits with FDA, not the manufacturer — eligibility is defined by product code on a list FDA controls, publishes, and can revise, not by a manufacturer's own determination that its malfunctions are routine enough to summarize.

The malfunction-only gate controls more than the code list

Product-code eligibility is the gate most teams check once, at enrollment, and then stop thinking about. The gate that actually requires ongoing judgment sits at the event level: VMSR only ever covers events that are malfunctions with no associated death or serious injury. A manufacturer whose product code is squarely on FDA's eligible list still has to run the standard reportability decision on every individual event before it goes into a quarterly summary — and an event that is, or later becomes, associated with a death or serious injury has to be pulled out and reported individually under the standard Part 803 timeline, not folded into the next quarter's summary because the product code happens to qualify.

• Assuming a whole product line is VMSR-eligible once one code clears. Eligibility is per product code, and a device family frequently spans more than one code — each needs its own check against the current list.
• Treating "no injury reported yet" as the same as "malfunction only." If an event could plausibly have caused death or serious injury had the malfunction recurred under different conditions, the standard 803.50/803.53 analysis can still make it individually reportable, independent of VMSR eligibility.
• Forgetting eligibility runs in both directions. FDA can remove a product code from the eligible list, not just add one on request — a code that qualified last year may not qualify this quarter.
• Filing in the pre-2024 summary format. The format changed to the revised Form FDA 3500A for events a manufacturer becomes aware of on or after August 29, 2024, under the Federal Register notice that modified 803.19(d).

VMSR is not a lighter version of medical device reporting. It is a narrower one — narrower by product code, and narrower again by event type. Why eligibility doesn't scale down the reportability analysis

Requesting eligibility, and keeping it

A manufacturer whose device sits in an ineligible product code can ask FDA to add it under 803.19(b), but the request does not create eligibility on its own — FDA decides, and until the code appears on the published list, every event in that code still needs an individual 30-day (or 5-day, where the 5-day trigger applies) report. The reverse also holds: FDA can withdraw a code's eligibility, and a manufacturer that keeps summarizing events for a code FDA has quietly removed is filing incomplete reports without realizing it. Checking the current list each reporting period, not relying on the list from the quarter a program was first enrolled, is the only way to catch that before an inspector does.

Done correctly, VMSR genuinely reduces the filing burden on complaint teams managing high-volume, low-severity malfunction patterns. Done by assumption — enrolling once and summarizing everything afterward without re-checking the code list or triaging events individually — it quietly converts reportable events into unreported ones. Our complaint handling and MDR reporting and post-market surveillance teams build the event-level triage and eligibility-monitoring workflow before a VMSR enrollment goes live, specifically so a product-code change at FDA's end doesn't surface for the first time during a 483 review.