The Workbench · Craft
An FDA order, not a device type, triggers tracking
This blog has already covered how ISO 13485's own traceability clause leaves most of its reach for the organization to define, and fixes that reach itself only for implants. 21 CFR Part 821 runs on a different premise entirely. It isn't a clause an organization interprets and applies to its own product line — it's a program FDA switches on for one device at a time, and only after FDA decides to, no matter how squarely the device already fits the criteria that make tracking possible in the first place.
Section 519(e) names the population; it doesn't track anything on its own
Section 519(e) of the FD&C Act lets FDA require tracking of a class II or class III device that meets one of three conditions: the device's failure would be reasonably likely to have serious, adverse health consequences; it's intended to be implanted in the human body for more than one year; or it's a life-sustaining or life-supporting device used outside a device user facility. Meeting one of those three conditions makes a device eligible for tracking. It doesn't make the device a tracked device, and the duties a manufacturer actually has to build a system around don't attach to eligibility at all — they attach to something 519(e) leaves entirely in FDA's own hands.
The duties start with an order, not a determination the manufacturer makes itself
FDA imposes tracking requirements only by issuing an order to a specific manufacturer — typically alongside the same premarket notification clearance or premarket approval decision covering the device the order names — stating that FDA has determined the device meets section 519(e)'s criteria and directing the manufacturer to track it. A device that plainly meets one of the three statutory conditions but has never received that order isn't a tracked device under 21 CFR Part 821. A compliance file that starts building a tracking system on its own reading of 519(e), ahead of any order, is building a system for an obligation the device doesn't have yet.
What the order actually asks the manufacturer to reach
Once the order issues, Part 821 doesn't ask for the lot-and-batch traceability a quality system already keeps for every device. Its distributor and manufacturer obligations reach further down the chain: the manufacturer has to be able to identify each distributor who received the device, and, through the distributor, the patient who ultimately received it — name, address, and other identifying information collected for exactly that purpose. 21 CFR 821.55(a) gives the patient the right to refuse release of that information, and a distributor's own duty under 821.30 to supply it runs only up to the point a patient exercises that refusal. That's a reach past a manufacturer's own customer list, into a chain of custody an ordinary lot-traceability procedure was never built to close.
The order comes with its own response clock, in two speeds
21 CFR 821.25 doesn't leave the manufacturer's response time to interpretation once FDA actually asks for tracking data. For a device still upstream of the patient — sitting with a distributor ahead of final distribution — the manufacturer has 3 working days from FDA's request to produce the identity and location of whoever is holding it. Once the device has already reached a patient, the clock relaxes to 10 working days, and the data FDA can ask for expands to the device's own identifiers — its UDI, lot, batch, model, or serial number — alongside the patient or multiple-distributor information the earlier stage didn't yet require. A tracking system tested only against the easier, post-distribution timeline hasn't been tested against the one that actually binds a manufacturer first.
The order can end the same way it started — on FDA's own action
Because the obligation runs from the order rather than from the device's own characteristics, FDA can also rescind a tracking order once it decides tracking is no longer necessary for that device, without anything about the device's risk profile having to change first. A tracking file that treats the requirement as a permanent property of the device type, rather than a standing order that stays in force only until FDA lifts it, is tracking the wrong trigger for when the duty actually ends.
Where this meets the file
A device-tracking compliance file needs to carry the order itself as the operative record — its date, the specific device it names, and the 519(e) basis FDA cited — separately from the lot-traceability procedure the rest of the quality system already runs, because the two answer different questions and one of them can exist without the other ever starting. A device-tracking readiness worksheet built around that separation is previewed in the launch catalog. If your program has operated under a tracking order and structures the file differently, the shelf takes that correction directly.
The Regulatory Toolkit launches soon — a free shelf of source-mapped templates, checklists and browser-only tools for regulatory teams. Get one email when it opens, or contribute a template.