FSCA and Recall: Field Safety Notices and the 60-Day Completion Deadline

1. Key takeaways

FSCA (Field Safety Corrective Action) covers recall, destruction of devices, software upgrade, modification and retrofit. Initiating an FSCA must be supported by a formal risk assessment conforming to the current ISO 14971 (the FDA retains the power to overturn the conclusion of that assessment). An FSCA report form must be submitted to the FDA, and a field safety notice (FSN) must be distributed to device users. The implementation and completion of the corrective action must fall within 60 calendar days.

• FSCA is broader than recall. Software upgrades, retrofits and destruction of stock are all corrective actions within scope.
• Risk assessment is the gate, not the justification. Without it, an action cannot properly start; with it, the regulator can still disagree.
• 60 calendar days covers implementation and completion, not merely the decision to act.
• The FSN goes directly to users, and the distribution record is the evidence that it did.
• Commercial upgrades with no safety risk are expressly excluded, which keeps ordinary product iteration out of the FSCA process.

2. Legal basis

FSCA requirements derive from Annex 5 of the AMDD as implemented by AO No. 2025-0030, with recall execution referred back to the FDA product recall guideline. The table below sets out the operative elements. Three of them interact: the risk assessment determines whether an action is required, the FSN determines whether users have been reached, and the 60-day clock determines whether the action is finished. An FSCA file is complete only when all three are documented, and regulators read the file in that order.

3. Expert insights

Insight 1: ISO 14971 is the threshold for the FSCA decision, and the FDA keeps the final judgement.

The rigour of this rule lies in two places. First, the necessity of an FSCA must be supported by a formal risk assessment and cannot rest on intuition. Second, the FDA retains the power to overturn the company assessment. A company therefore cannot exonerate itself by concluding that no recall is needed: if the FDA takes the opposite view, the action must still be executed. The practical consequence is that the risk assessment file must be written to withstand external review, with traceable inputs, stated assumptions and a documented link between the hazard analysis and the decision taken.

Insight 2: the 60-day deadline applies to implementation and completion, not to initiation.

Companies often read FSCA as complete once the notice has been issued. The rule requires that implementation and completion together fall within 60 calendar days, and the initial FSCA report must already state the expected implementation and completion schedule. Any deviation from the initial schedule must be explained in the final report. The schedule in the initial report is therefore a commitment that later documents are measured against, which makes the first submission the most important one to get right.

Insight 3: commercial upgrades are expressly excluded, which is a protective rule.

The rule states clearly that a commercial upgrade without a safety risk is not an FSCA. This prevents companies from misreporting routine product iteration as a corrective action, and prevents the regulator from being submerged in reports that carry no safety signal. The criterion remains whether a safety risk exists. Documenting that assessment is what allows a company to keep a routine upgrade outside the FSCA process with confidence rather than by assumption.

Insight 4: the relationship between FSCA and the recall guideline is specific rule plus general procedure.

AO No. 2025-0030 provides that where a report leads to a product recall, the reporting, classification and implementation procedures of FDA Circular No. 2016-012, Guidelines on Product Recall, and its amendments apply. In other words, FSCA is the framework, recall is one specific form of FSCA, and execution returns to 2016-012. A company preparing an FSCA that will become a recall should read both instruments together rather than treat the FSCA form as the complete procedure. The recall guideline supplies the classification logic and the sequence of follow-up reports, while the Administrative Order supplies the trigger and the assessment standard, so a submission that satisfies only one of them is incomplete on its face.

4. Practical recommendations

• Make the ISO 14971 risk assessment the gate in front of every FSCA decision. No assessment, no initiation, and equally no unilateral decision not to initiate.
• Present the 60-day schedule in the initial report. Any later deviation must be explained in writing, so the initial schedule should be realistic rather than optimistic.
• Distribute the FSN directly to users. Retain distribution records as evidence, including the date, recipient and method for each notification.
• Separate commercial upgrades from FSCA. Upgrades with no safety risk should follow the ordinary change process, with the safety determination documented.
• Apply FC 2016-012 in parallel where a recall arises. Follow its classification and reporting procedure in addition to the FSCA requirements.

5. Verification checklist

• □ Risk assessment documentation available and based on the current version of ISO 14971
• □ Report form deadline mapped at 14 calendar days (draft basis)
• □ Completion deadline set within 60 calendar days
• □ FSN distributed to users, with distribution records retained
• □ Commercial upgrades screened out through a documented no-safety-risk determination
• □ Recall scenarios handled under FC No. 2016-012

How GRZAN can help. GRZAN provides medical device and IVD registration, quality system, authorised representative and local testing support across Southeast Asia, including the Philippines. Our team prepares CMDN/CMDR dossiers to ASEAN CSDT structure, manages submissions and deficiency responses with the FDA Philippines, and supports post-market vigilance obligations. Business enquiries: info@grzanglobal.com