---
title: Recalls Under MDR: The Process for Withdrawing a Device from the Market
description: A recall under MDR is an FSCA that withdraws a device from use or from the market. Here is the process, the reporting, and how startups should plan for the possibility.
authors: Tibor Zechmeister, Felix Lenhard
category: Post-Market Surveillance & Vigilance
primary_keyword: recalls MDR
canonical_url: https://zechmeister-solutions.com/en/blog/recalls-mdr-withdrawing-device-from-market
source: zechmeister-solutions.com
license: All rights reserved. Content may be cited with attribution and a link to the canonical URL.
---

# Recalls Under MDR: The Process for Withdrawing a Device from the Market

*By Tibor Zechmeister (EU MDR Expert, Notified Body Lead Auditor) and Felix Lenhard.*

> **A recall under MDR is any measure aimed at achieving the return of a device that has already been made available to the end user, as defined in Article 2(55) of Regulation (EU) 2017/745. A recall is one specific form of Field Safety Corrective Action under Article 2(68), reportable to the competent authority under Article 87(1)(b), subject to coordinated assessment under Article 89, and — where the device presents an unacceptable risk — potentially enforced by competent authorities under Article 95. The interpretive reference for how a recall is handled in practice is MDCG 2023-3 Rev.2, revised January 2025. The process is bounded by the Regulation, but the execution is operational: identify, decide, report, notify, retrieve, document, close.**

**By Tibor Zechmeister and Felix Lenhard. Last updated 10 April 2026.**

---

## TL;DR

- A recall under MDR Article 2(55) is any measure aimed at achieving the return of a device that has already been made available to the end user — the clinical site, the professional user, or the patient.
- A recall is a specific form of Field Safety Corrective Action (FSCA) under Article 2(68). Every recall is an FSCA, but not every FSCA is a recall — withdrawal from distribution before end-user availability is a different concept under Article 2(56).
- A recall is reportable under Article 87(1)(b) the moment the manufacturer decides to undertake it, not when execution begins. The decision is the trigger.
- For devices made available in more than one Member State, the coordinating competent authority mechanism under Article 89 applies so that a single aligned recall runs across markets.
- Where a competent authority concludes the device presents an unacceptable risk, Article 95 allows it to require the manufacturer to take corrective measures — including recall — or to impose the measures itself.

---

## Why this matters for your startup

A recall is the outcome nobody plans for but every serious manufacturer prepares for. The first time a startup has to pull a device out of the field is usually the first time anybody on the team has read the relevant articles in full, the first time the FSN template is stress-tested, and the first time the distributor contracts are checked for who is responsible for which step of retrieval. That is too late.

The reason this post exists is that recalls have a specific legal meaning under the Regulation that many startups use loosely. "Recall" in common speech means "we took the product back." Under MDR, it has a narrower definition, sits inside a broader FSCA framework, and triggers a chain of obligations that the manufacturer cannot delegate. Getting the vocabulary right is the first step to running the process cleanly. Getting the process right is the second. The two are not separable.

## The definition of recall under Article 2(55) — and why it differs from withdrawal

Article 2(55) of Regulation (EU) 2017/745 defines a recall as any measure aimed at achieving the return of a device that has already been made available to the end user. Two phrases in that definition carry the entire operational weight.

"Achieving the return." A recall is an action oriented at getting the device back. It is not an advisory, not a labelling update, not a usage restriction. Those can be other forms of FSCA under Article 2(68), but they are not recalls. A recall involves physical return of the device — for destruction, exchange, or retrofit at the manufacturer's site.

"Already been made available to the end user." The end user is the clinician, the hospital, the care pathway, or the patient. Once the device has crossed that boundary, any measure to get it back is a recall. Before that boundary — while the device is still in the distribution chain and has not yet reached the end user — the correct term is withdrawal, defined separately in Article 2(56) as any measure aimed at preventing a device in the supply chain from being further made available on the market.

The distinction matters because the two actions have different scope, different communication obligations, and different logistics. A withdrawal can be executed quietly with distributors and importers. A recall reaches into clinical environments, creates documentation obligations for each returned unit, and requires a Field Safety Notice in language the end user can act on. A startup that conflates the two underestimates what a recall costs to execute.

## The trigger conditions — when a recall becomes the right answer

A recall is not the default response to every problem. It is the response when the risk associated with the device in the field cannot be adequately reduced by any means short of physical retrieval. Other FSCAs — software patch, IFU update, modification in place, advice on use — are preferred when they can genuinely reduce risk to an acceptable level, because they are faster, less disruptive to clinical care, and less likely to create supply-side harm. A recall that removes the only available therapy from a clinical setting can itself cause harm. The risk-benefit logic under EN ISO 14971:2019 + A11:2021 has to account for that.

A recall becomes the right answer when one of several conditions is met. The risk cannot be mitigated in place because the defect is intrinsic to the hardware. The population of affected units cannot be isolated — every unit carries the risk and needs to be touched. The corrective action requires return-to-manufacturer work such as component replacement, recalibration, or destructive analysis. The competent authority has directed, under Article 95, that the device be removed from the market because the risk is unacceptable and in-place mitigations are insufficient. Or the manufacturer has decided, on its own initiative under Article 2(68), that the cleanest way to reduce risk is physical retrieval.

MDCG 2023-3 Rev.2 is the interpretive reference for the edge cases. It frames the decision in terms of the manufacturer's own risk assessment against the current technical documentation and the obligation under Article 87(1)(b) to report the FSCA once the decision has been made. The Regulation does not prescribe a single threshold — it requires the manufacturer to decide, to document the reasoning, and to report without undue delay.

## The recall process — step by step

A clean recall under MDR runs through a predictable sequence. The sequence is short when it is working and long when it is not. The goal is to keep each step inside the envelope the Regulation allows and leave nothing undefined for improvisation under pressure.

Step one is the trigger event. A signal arrives through the PMS system under Article 83, a complaint channel, a trend analysis under Article 88, a notified body finding, or an external report. The signal is assessed against EN ISO 14971:2019 + A11:2021 risk management and against the benefit-risk balance captured in the technical documentation.

Step two is the decision. The responsible team — typically the PRRC under Article 15, the quality lead, the clinical lead, and the regulatory lead — concludes that field-level retrieval is necessary. That conclusion is logged with the reasoning traced to Article 2(68) and the supporting risk assessment. The moment the decision is recorded, the FSCA clock under Article 87(1)(b) starts running.

Step three is the initial report to the competent authority. The report is made without undue delay. It identifies the device, the affected units by UDI or lot range, the technical or medical reason for the recall, the intended scope, the draft FSN, and the expected timeline. For devices made available in more than one Member State, Article 89 routes the assessment through the coordinating competent authority.

Step four is the Field Safety Notice. The FSN is the written communication to end users and to anyone in the distribution chain who holds affected devices. It names the device, the problem, the clinical risk, the action the recipient has to take, the timeline, and the contact for follow-up. A clinician reading the FSN once should know what to do next.

Step five is execution. Affected devices are identified across the distribution chain using UDI traceability under Article 27 and the manufacturer's own serial, lot, or batch records. Retrieval logistics are coordinated with distributors, importers, and end users. Each returned unit is logged, quarantined, assessed, and processed — destroyed, reworked, or exchanged — per the recall plan.

Step six is the progress and closure reporting. The competent authority is updated as the recall progresses. Final closure is not declared by the manufacturer alone — the authority accepts the closure once the final report demonstrates that the affected devices have been retrieved or accounted for, the root cause has been addressed, and the CAPA loop under EN ISO 13485:2016 + A11:2021 has been closed.

## Coordinating with distributors and importers

A recall is not something the manufacturer executes alone. Distributors and importers are legal actors under MDR with their own obligations, and a recall pulls them in immediately. Article 13 obligates importers, among other things, to cooperate with the manufacturer on any corrective action, and Article 14 imposes a parallel obligation on distributors. The operational translation is that distributors and importers must be reachable, must have clean records of which devices they passed to which end users, and must be willing to act on the manufacturer's recall instructions within the timeline the Regulation expects.

That obligation is only as strong as the contract. A distribution agreement that does not specify recall cooperation in writing, with timelines, contact points, data-sharing expectations, and cost allocation, will collapse under the weight of a real recall. The time to fix that is not during the recall. The time to fix it is before the first unit ships.

Importers under Article 13(6) are also required to keep a register of complaints, non-conforming devices, and recalls, and to inform the manufacturer, authorised representative, and distributors accordingly. That register becomes evidence in the recall report. If the importer does not maintain it, the manufacturer carries the gap.

## Notification duties under Article 87 and Article 95

The core notification duty sits in Article 87(1)(b): the manufacturer reports any FSCA — including recalls — in respect of devices made available on the Union market to the relevant competent authority. The report is filed without undue delay and is updated as the recall progresses.

A separate and potentially overlapping duty arises under Article 95. Where a competent authority, typically after a market surveillance investigation under Article 94, concludes that a device presents an unacceptable risk to health or safety, Article 95 allows that authority to require the manufacturer to take appropriate and justified corrective measures — which can include withdrawal, recall, or restriction of availability — and, where the manufacturer fails to act, to take those measures itself. A recall initiated under Article 95 is therefore an authority-driven recall, distinct from a manufacturer-initiated recall under Article 2(68), though the operational mechanics are similar and the Article 87(1)(b) reporting obligation still applies.

A startup reading the articles side by side should take one point away: the manufacturer always has the option to initiate a recall under its own judgment, and that option is almost always the better path. A recall the manufacturer decides on is a recall the manufacturer controls. A recall the manufacturer delays until Article 95 is invoked is a recall the authority controls, with a much narrower margin on scope, wording, and timing.

## Retrieval, documentation, and closure

A recall is only as good as its paper trail. Every unit must be accounted for — returned, confirmed destroyed at the end-user site under controlled conditions, quarantined in place, or documented as unreachable. The Regulation does not accept handwaving about what happened to the installed base. The competent authority will ask, and the notified body will re-ask at the next surveillance audit.

The practical structure is a recall register that holds, per affected unit, the UDI or serial number, the end user or distributor of record, the date of recall notification, the date of return or confirmed disposition, the condition of the returned unit, and the final disposition. That register links into the CAPA record under EN ISO 13485:2016 + A11:2021, which links into the risk management file update under EN ISO 14971:2019 + A11:2021, which links into the technical documentation update required when design or labelling changes result from the recall.

Closure of the recall in the manufacturer's eyes is a three-part statement: the affected devices have been retrieved or accounted for within the defined scope; the root cause has been identified and the CAPA has been implemented; and the effectiveness of the corrective action has been verified. Closure in the competent authority's eyes comes later — when the authority accepts the final report. A recall is not closed because the retrievals stopped coming in. It is closed when the authority says it is.

## Common recall mistakes startups make

- Conflating recall with withdrawal. Using "recall" for actions that stop at the distribution layer, and calling withdrawals "recalls" in regulatory correspondence, creates traceability problems that surface at the next audit.
- Waiting for the FSN to be perfect before reporting under Article 87(1)(b). The reporting obligation starts at the decision, not at the finished FSN. Initial reports can be updated as the action progresses.
- Treating the distributor and importer relationship as transactional. Contracts that do not spell out recall cooperation fail exactly when they are needed.
- Under-resourcing the retrieval register. "We'll track it in email" is not a register and will not survive authority review.
- Forgetting the risk of the recall itself. Removing the only available therapy from a clinical setting has its own risk profile that must be weighed in the Article 14971 analysis — a recall is a clinical intervention, not just a logistics operation.
- Declaring closure too early. Closure is not the end of retrieval; it is the competent authority accepting the final report with CAPA evidence attached.

## The Subtract to Ship angle

A recall process that cannot be run by a four-person startup on a bad Tuesday is not a recall process. It is a binder. The Subtract to Ship approach — described in the [Subtract to Ship framework for MDR](/blog/subtract-to-ship-framework-mdr) — strips the recall SOP to the minimum elements that trace directly to the Regulation: the Article 2(55) definition, the Article 2(56) withdrawal boundary, the Article 2(68) FSCA decision, the Article 87(1)(b) reporting trigger, the Article 89 coordination pathway, the Article 95 authority-measure pathway, and the CAPA and risk management linkages under EN ISO 13485:2016 + A11:2021 and EN ISO 14971:2019 + A11:2021.

What you need in place before you need it: a named recall owner, a pre-drafted FSN template reviewed by a clinician, a UDI-indexed retrieval register ready to populate, distributor and importer contracts that include recall cooperation in writing, a single-page decision log template that captures the technical or medical reasoning for the recall, a contact list for the relevant competent authority and the expected coordinating authority under Article 89, and an annual dry-run that walks through a hypothetical recall end to end. Every element must map to an article. No element exists because "it felt important." That is the subtract test.

## Reality Check — Where do you stand?

1. Can your team distinguish, in writing, between a recall under Article 2(55) and a withdrawal under Article 2(56), and apply the distinction correctly in a real case?
2. Is your FSN template pre-drafted in language a clinician can act on under time pressure, and has a clinician actually read it?
3. Do your distribution and import contracts explicitly spell out recall cooperation, timelines, data-sharing, and cost allocation?
4. Can you identify every unit of a given lot, by UDI or serial, across the full distribution chain, without relying on memory or email threads?
5. Does your recall decision log trace the reasoning to Article 2(68) and the risk reassessment under EN ISO 14971:2019 + A11:2021?
6. Have you identified the coordinating competent authority you would expect under Article 89 for a multi-market recall, and documented why?
7. When was the last time you ran a recall dry-run from signal to authority-accepted closure?

## Frequently Asked Questions

**What is a recall under MDR in one sentence?**
A recall under Article 2(55) of Regulation (EU) 2017/745 is any measure aimed at achieving the return of a device that has already been made available to the end user, and it is one specific form of Field Safety Corrective Action under Article 2(68).

**What is the difference between a recall and a withdrawal under MDR?**
A recall reaches into end-user hands — the clinician, the hospital, or the patient — under Article 2(55). A withdrawal under Article 2(56) is a measure aimed at preventing a device in the supply chain from being further made available on the market, stopping before the end-user boundary. Different scope, different communication obligations, different logistics.

**When is a recall reported to the competent authority?**
At the moment the manufacturer decides to undertake it, under Article 87(1)(b). The reporting obligation is tied to the decision, not the execution. MDCG 2023-3 Rev.2 is explicit that waiting until the FSN is finalised or the logistics are scheduled is not permitted.

**Can a competent authority force a recall?**
Yes. Under Article 95, where a competent authority concludes that a device presents an unacceptable risk to health or safety, it can require the manufacturer to take appropriate corrective measures — including recall — or take those measures itself where the manufacturer does not act. A manufacturer-initiated recall under Article 2(68) is almost always the better path because it preserves control over scope and timing.

**Does a recall always require a Field Safety Notice?**
Yes. A recall is an FSCA, and every FSCA requires a Field Safety Notice under Article 2(69) — the written communication to users and customers explaining the problem, the risk, the required action, and the timeline.

## Related reading

- [What Is Vigilance Under MDR?](/blog/what-is-vigilance-mdr) — the pillar post placing recalls inside the full vigilance framework.
- [MDR Articles 87–92: The Vigilance Reporting Framework](/blog/mdr-articles-87-92-vigilance-framework) — the article-by-article anatomy of the full vigilance chapter.
- [Serious Incidents Under MDR](/blog/serious-incidents-mdr) — the Article 2(65) definition that underpins FSCA and recall triggers.
- [Vigilance Reporting Timelines: 15-Day, 10-Day, and 2-Day Clocks](/blog/vigilance-reporting-timelines-15-day-2-day) — the Article 87(3) timing rules that set the rhythm for recall reporting.
- [Field Safety Corrective Actions (FSCAs) Under MDR](/blog/field-safety-corrective-actions-fscas-mdr) — the umbrella concept that includes recalls and the full Article 2(68) framework.
- [Field Safety Notices Under MDR](/blog/field-safety-notices-mdr) — the Article 2(69) communication obligation that sits on every recall.
- [Trend Reporting Under MDR Article 88](/blog/trend-reporting-mdr-article-88) — how trend signals can escalate into a recall decision.
- [Eudamed Vigilance Module Under Article 92](/blog/eudamed-vigilance-module-mdr-article-92) — where the coordinated recall flow will be carried once the module is fully operational.
- [The Subtract to Ship Framework for MDR](/blog/subtract-to-ship-framework-mdr) — the methodology behind the lean recall process described here.

## Sources

1. Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, Article 2(55) (definition of recall), Article 2(56) (definition of withdrawal), Article 2(68) (definition of field safety corrective action), Article 87 (reporting of serious incidents and field safety corrective actions), Article 89 (analysis of serious incidents and field safety corrective actions), Article 95 (procedure for dealing with devices presenting an unacceptable risk to health and safety). Official Journal L 117, 5.5.2017.
2. MDCG 2023-3 Rev.2 — Questions and Answers on vigilance terms and concepts as outlined in Regulation (EU) 2017/745 and Regulation (EU) 2017/746, first publication February 2023, Revision 2 January 2025.
3. EN ISO 13485:2016 + A11:2021 — Medical devices — Quality management systems — Requirements for regulatory purposes.
4. EN ISO 14971:2019 + A11:2021 — Medical devices — Application of risk management to medical devices.

---

*This post is part of the Post-Market Surveillance & Vigilance series in the Subtract to Ship: MDR blog. Authored by Felix Lenhard and Tibor Zechmeister. A recall is not the end of a product — it is the vigilance system reaching into the field to reduce a risk the manufacturer has decided cannot be reduced any other way. Run it cleanly and the authority, the notified body, and the clinical community all end up trusting you more than they did before.*

---

*This post is part of the [Post-Market Surveillance & Vigilance](https://zechmeister-solutions.com/en/blog/category/pms-vigilance) cluster in the [Subtract to Ship: MDR Blog](https://zechmeister-solutions.com/en/blog). For EU MDR certification consulting, see [zechmeister-solutions.com](https://zechmeister-solutions.com).*