FDA finalized an amendment that restructured Part 820 into the Quality Management System Regulation (QMSR), incorporating ISO 13485:2016 by reference instead of standing on its own 15-subpart structure. Teams that keep calling it "the QSR" without updating their internal procedures are working from an outdated map.
This guide breaks down what Part 820 actually requires today, who has to follow it, where inspectors find the most trouble, and what it takes to build a team that can execute under real audit pressure, not just recite clause numbers.
Key Takeaways
- Part 820 became the Quality Management System Regulation (QMSR) on February 2, 2026, incorporating ISO 13485:2016 by reference
- Only Subparts A and B remain in Part 820 itself; Subparts C through O are reserved and route to ISO 13485
- DHF, DMR, and DHR are retired as defined terms, but their substantive records still exist inside ISO 13485
- ISO 13485 certification does not equal QMSR compliance
- FDA enforces the QMSR through Compliance Program 7382.850, not the retired QSIT model
What Is FDA 21 CFR Part 820?
21 CFR Part 820 is FDA's current good manufacturing practice (cGMP) regulation for finished medical devices. It sets the requirements for how a device gets designed, manufactured, packaged, labeled, stored, installed, and serviced in the United States. If a device reaches a patient or provider, some portion of Part 820 touched it along the way.
Reading the Code: What "21 CFR Part 820" Means
The name follows the federal government's standard numbering system:
- Title 21 covers Food and Drugs
- Chapter I belongs to FDA, within the Department of Health and Human Services
- Subchapter H covers Medical Devices specifically
- Part 820 is the section governing quality management systems for finished devices
As of the 2024 final rule, Part 820 is officially titled the Quality Management System Regulation (QMSR). "QSR" is a legacy term for the pre-2026 version of the same part, built around 15 standalone subparts. Both names describe the same regulation at different points in its history.
A Short Regulatory History
- 1978 – FDA published the original CGMP rule at 43 FR 31508, creating Part 820
- 1996 – A revision added design controls following the Safe Medical Devices Act, effective June 1997
- 2024 – FDA finalized the Medical Devices; Quality System Regulation Amendments, setting the February 2, 2026 harmonization with ISO 13485:2016 in motion
None of this is optional guidance. Under 21 CFR 820.10(d), failing to meet an applicable QMSR requirement makes the device adulterated under FD&C Act section 501(h). That single word turns a documentation gap into a legal compliance failure, with consequences ranging from warning letters to forced recalls.
The QSR-to-QMSR Transition: What Changed and Why
The February 2, 2026 amendment did more than update terminology. It replaced the old 15-subpart QSR structure with two retained subparts: Subpart A and Subpart B. Everything else is folded into ISO 13485:2016 by reference. Subparts C through O are now reserved.
Why FDA Made the Change
FDA's stated rationale is harmonization. Device manufacturers selling into multiple countries often ran two parallel quality systems: one built around Part 820, another around ISO 13485 for the EU, Canada, and other MDSAP markets.
Aligning the two cuts duplicate documentation and audit burden for companies that already sell internationally.
The incorporation isn't limited to ISO 13485 itself. Part 820.7 also pulls in Clause 3, Terms and Definitions, from ISO 9000:2015. Where FDA-specific definitions in Part 820 or the FD&C Act conflict with ISO language, the FDA definitions win. A term like "validation" does not always carry the same meaning across the two frameworks.
Where the Old Sections Live Now
FDA's own transition materials mark most former sections simply as "incorporated by reference" without pinpointing an exact ISO clause for each one. Here's how the major provisions generally map, based on FDA's transition presentation and the MDSAP Audit Approach:
| Former QSR Section | Where It Lives Now |
|---|---|
| §820.20, Management Responsibility | ISO 13485 Clause 5 (FDA pairs former §820.20(c) management review with Clause 5.6) |
| §820.30, Design Controls | ISO 13485 Clause 7.3, Design and Development |
| §820.50, Purchasing Controls | ISO 13485 product realization; FDA marks as incorporated by reference (no single clause) |
| §820.100, CAPA | ISO 13485 Clauses 8.5.2 and 8.5.3 (MDSAP Audit Approach) |
| §820.198, Complaint Files | Incorporated by reference; FDA-specific recordkeeping now in §820.35 |
Does ISO Certification Satisfy FDA?
No. FDA states plainly that it will neither require nor issue certificates of conformance to ISO 13485, and holding one doesn't exempt a facility from inspection. Certification still carries value for other markets and MDSAP participation, but it runs on a separate track from QMSR compliance.
What Happened to DHF, DMR, and DHR
FDA retired Design History File (DHF), Device Master Record (DMR), and Device History Record (DHR) as defined terms in Part 820. The paperwork didn't disappear. Its substance now lives inside ISO 13485 constructs:
- Design and development file (Clause 7.3.10)
- Medical device file (Clause 4.2.3)
- Batch/device records (Clause 7.5.1)
Inside the Regulation: Subparts A, B, and the ISO 13485 Clauses That Govern Your QMS
According to the current eCFR text of Part 820, only two subparts remain written directly into the regulation. Subpart A (General Provisions) and Subpart B (Supplemental Provisions) carry the FDA-specific language; everything else routes through ISO 13485.
Subpart A: General Provisions
Subpart A covers the foundational sections:
- §820.1, Scope – defines what "finished device" means and who the regulation applies to
- §820.3, Definitions – applies ISO 13485 and ISO 9000 Clause 3 definitions, subject to FDA's own definitions where they conflict
- §820.7, Incorporation by Reference – formally names ISO 13485:2016 and ISO 9000:2015 Clause 3 as binding material
- §820.10, Quality Management System – the core requirement for a documented QMS, including extending implantable-device traceability rules to life-sustaining devices
Subpart B: Supplemental Provisions
Subpart B adds two sections where FDA decided ISO 13485 needed reinforcement:
- §820.35, Control of Records – adds specificity beyond ISO 13485 for complaint and servicing records
- §820.45, Device Labeling and Packaging Controls – requires documented labeling and packaging controls, release examination, and safeguards against mix-ups
FDA kept these two sections standalone because ISO 13485 does not spell out the same level of detail for complaint recordkeeping and labeling controls. US enforcement history has repeatedly flagged both areas as high-risk.
ISO 13485's Five Operative Clauses
The bulk of your QMS now runs through five clauses:
- Clause 4, Quality Management System – documentation structure, risk-based process control, the medical device file, and records retention
- Clause 5, Management Responsibility – quality policy, objectives, and management review
- Clause 6, Resource Management – personnel competence, infrastructure, and contamination control
- Clause 7, Product Realization – design and development, purchasing, production controls, and identification/traceability
- Clause 8, Measurement, Analysis and Improvement – complaint handling, internal audit, nonconforming product, and CAPA
Design controls are worth a closer look. What used to be a standalone Part 820.30 subpart now sits inside Clause 7.3. The mechanics have not changed: design inputs, outputs, verification, validation, transfer, design changes, and the design history record all still apply. The citation changed; the requirements did not.
Who Must Comply — and Who Enforces Part 820
Part 820 applies to any manufacturer of finished devices for human use made in, or imported into, the United States. That net is wider than "manufacturer" implies. It also covers:
- Contract sterilizers
- Relabelers
- Remanufacturers
- Specification developers
Notable exemptions:
- Component and parts manufacturers aren't required to comply, though FDA encourages it
- Blood and blood component manufacturers fall under separate biologics CGMP rules
- Design controls under Clause 7.3 don't apply to most Class I devices (exceptions: software-automated Class I devices and five named types, including tracheobronchial suction catheters and radionuclide teletherapy sources)
FDA is the sole enforcing authority. Enforcement runs primarily through establishment inspections.
As of February 2, 2026, FDA retired the Quality System Inspection Technique (QSIT) it had used for nearly three decades and replaced it with Compliance Program 7382.850, its updated QMSR-aligned inspection program.
Inspection outcomes typically land in one of three categories:
- No Action Indicated (NAI)
- Voluntary Action Indicated (VAI)
- Official Action Indicated (OAI)
Common Compliance Pitfalls and Audit Risk Areas
FDA investigators keep finding the same categories of problems. Recurring findings include:
- Incomplete complaint investigations – complaints logged but not fully traced to root cause
- Weak CAPA effectiveness verification – corrective actions closed without evidence they actually worked
- Supplier control gaps – purchasing controls that exist on paper but aren't applied consistently to every supplier
- Inconsistent production records – device records missing signatures, dates, or required data points
- Uncontrolled document changes – revisions made without following the formal change process
The pattern behind almost all of these is inconsistent execution, not ignorance of the rule. A procedure exists and an SOP describes the correct process.
What fails is the trail: records on the shop floor or in the complaint file don't show the process was followed every time.
That gap is exactly what an FDA investigator is trained to probe. They don't just read your procedures; they pull records and check whether reality matches paper.
The strongest inspection preparation connects every written procedure to real, dated evidence, not just the existence of a document.
Investigators look for artifacts like:
- Training records showing staff were qualified before performing the task
- Management review outputs with dated action items, not just meeting minutes
- Internal audit results that led to actual corrective action
- CAPA closure documentation with objective evidence of effectiveness, not just a signature
Building Real Audit-Ready Capability for QMSR Compliance
Knowing that Clause 8.5.2 covers corrective action doesn't mean a quality engineer can walk into an FDA inspection and defend a live CAPA. That gap—between clause familiarity and practiced judgment—is where most teams get exposed. Applying root cause analysis, risk-based thinking, and CAPA effectiveness checks to a live nonconformity under time pressure is a different skill than passing a quiz on the regulation.
This is the problem QMS Learning was built around. The platform's courses come from practitioners with two decades of hands-on compliance and audit experience. Paired with each pathway is an AI Workbench that helps teams work a live quality problem end to end:
- Diagnose the issue and route it to the right method (5-Why, CAPA, FMEA, or gap analysis)
- Generate the audit-ready artifact an FDA investigator would expect to see
For medical device teams, the Workbench is trained on ISO 13485:2016, FDA 21 CFR Part 820, ISO 14971, and FDA's inspection approach. It supports drafting:
- Design and development file entries
- Risk management documentation
- CAPA records tied to a specific nonconformity
QMS Learning's Medical Device & Life Sciences QMS pathway covers ISO 13485, FDA 21 CFR Part 820, and ISO 14971 together. A pilot cohort opens in Q3 2026, with early access at reduced pricing for the first teams in exchange for curriculum feedback. Medtech quality teams can build this capability before the next FDA inspection—not after a Form 483.
Frequently Asked Questions
What is FDA 21 CFR Part 820?
FDA 21 CFR Part 820 is the agency's cGMP regulation—now called the Quality Management System Regulation (QMSR). It covers how finished medical devices are designed, manufactured, packaged, labeled, stored, installed, and serviced for the US market.
What is the difference between ISO 13485 and 21 CFR 820?
As of February 2026, Part 820 incorporates ISO 13485:2016 by reference. FDA adds supplemental requirements in Subparts A and B rather than running a separate, conflicting system.
Is 21 CFR 820 going away?
No. Part 820 still exists, but it was restructured into the QMSR. Most detailed requirements now point to ISO 13485:2016 instead of standalone FDA subparts.
Who enforces 21 CFR 820?
FDA enforces the QMSR through facility inspections under Compliance Program 7382.850, along with warning letters and enforcement actions, including adulteration findings for noncompliant devices.
Does ISO 13485 certification satisfy FDA requirements?
No. FDA requires QMSR compliance, not formal ISO 13485 certification. Certification can support your compliance program and helps with other markets, but it doesn't replace an FDA inspection.
What happens if a company doesn't comply with 21 CFR Part 820?
Noncompliant devices are legally considered adulterated under the FD&C Act. That can trigger warning letters, import refusals, or forced recalls depending on the severity of the finding.
