Select all the resources you are interested in downloading.
21 CFR Part 820, formerly known as the Quality System Regulation (QSR), is now the ISO 13485-aligned Quality Management System Regulation (QMSR). As of February 2, 2026, the FDA has updated 21 CFR Part 820 to incorporate by reference the international standard ISO 13485:2016, harmonizing U.S. device regulations with global standards and effectively supplanting 21 CFR Part 820 moving forward.
21 CFR Part 820 outlines the requirements for the quality systems used in the design, manufacturing, packaging, labeling, storage, installation, distribution, and servicing of medical device products in the United States. This U.S. Food and Drug Administration (FDA) regulation covers the complete lifecycle of manufactured medical devices, from initial design controls through production and postmarket surveillance.
The 21 CFR Part 820 regulation applies to finished medical device products and their components, setting specific requirements for quality systems that prevent defects before they occur. It covers everything from management responsibility and design controls to production processes, corrective and preventive actions, and complaint handling. Rather than dictating how to manufacture devices, 21 CFR Part 820 requirements establish what medical device quality systems must achieve.
All manufacturers of medical devices intended for sale in the United States must comply with 21 CFR Part 820 to ensure their products are consistently produced and controlled according to quality standards.
Understanding where 21 CFR Part 820 regulations fit within the broader regulatory landscape transforms how companies approach medical device quality systems. This isn't an isolated rulebook. It's part of an interconnected ecosystem where different frameworks support and reinforce each other.
Foundation and Global Context
The Quality System Regulation (QSR) emerged from the FDA's commitment to harmonize with international standards while maintaining U.S.-specific requirements. At its core, 21 CFR Part 820 aligns closely with ISO 13485, the internationally recognized standard for medical device quality management systems. Both frameworks share fundamental principles: risk-based thinking, process validation, design controls, and systematic documentation. Yet 21 CFR Part 820 includes specific requirements unique to FDA oversight, particularly around design validation and the device master record (DMR).
This alignment creates practical advantages. Companies already certified to ISO 13485 find their systems largely compatible with 21 CFR Part 820 compliance requirements. The FDA's Quality Management System Regulation (QMSR), finalized in 2025 and implemented in 2026, further harmonizes these frameworks by formally incorporating ISO 13485:2016 by reference.
Regional Regulatory Integration
The regulation connects to current good manufacturing practice (cGMP) requirements that govern all pharmaceutical and medical device production. While cGMP provides broad quality principles, 21 CFR Part 820 delivers device-specific applications. European medical device manufacturers working under the Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) requirements enforced by the European Medicines Agency (EMA) often find their ISO 13485-based systems meet most QSR requirements with targeted adjustments.
Complementary Guidelines and Standards
Several supporting frameworks create the complete quality ecosystem:
ISO 14971 provides risk management processes that fulfill design control requirements.
ISO 10993 covers biocompatibility testing referenced in validation activities.
IEC 62304 addresses software lifecycle processes for software-driven devices.
FDA guidance documents clarify specific requirements like Design Control Guidance and Process Validation.
Historical Evolution and Modern Philosophy
The FDA introduced 21 CFR Part 820 in 1996, replacing the old GMP guidelines specific to medical devices. The regulation shifted focus from inspection-based quality to prevention-based systems. Rather than catching defects through testing, the framework requires building quality into products from initial design through final distribution.
The QMSR that went into effect in 2026 represents the next evolution. By formally adopting ISO 13485:2016 while maintaining critical FDA-specific requirements, the new framework modernizes how medical device quality systems operate. This doesn't eliminate 21 CFR Part 820 requirements. It creates a harmonized approach where international quality standards and U.S. regulatory expectations work together seamlessly.
Today's interpretation emphasizes risk-based approaches, continuous improvement, and documented evidence of effective quality systems. The philosophy moves beyond mere compliance toward building robust systems that reliably produce safe, effective medical device products while maintaining regulatory readiness.
The requirements established under 21 CFR Part 820 transform abstract quality concepts into operational reality. Success comes from understanding not just what's required, but how these elements work together, creating reliable medical device manufacturing systems.
Core System Elements Under 21 CFR Part 820
21 CFR Part 820 requirements organize around several foundational components:
Design Controls (Subpart C) mandate systematic processes for translating user needs into validated product specifications. Companies must document design inputs, outputs, reviews, verification, validation, and design changes. Each phase requires evidence that designs meet intended use requirements.
Production and Process Controls (Subpart G) ensure manufacturing processes remain validated and under control. This includes establishing procedures for installation, inspection, measuring equipment, and process validation. Critical processes require written validation protocols proving they consistently produce acceptable results.
Corrective and Preventive Action (Subpart J) creates systematic approaches for identifying, analyzing, and eliminating quality problems. Companies must investigate complaints, analyze data for trends, implement corrections, and verify effectiveness. Corrective action/preventive action (CAPA) systems turn reactive firefighting into proactive prevention.
Document Controls (Subpart D) govern how procedures, specifications, and records get created, reviewed, approved, and modified. Every controlled document needs approval signatures, effective dates, and distribution tracking.
Management Responsibilities
Leadership doesn't delegate quality system oversight. Management must establish quality policy, ensure adequate resources, conduct management reviews, and appoint competent personnel. The Part 820 regulation specifically requires designated management representatives with authority to resolve quality matters.
21 CFR Part 820 Documentation Requirements
Expect to create and maintain extensive documentation:
A quality manual defining the quality system scope and structure.
Quality system procedures covering each regulatory requirement.
Device master record containing complete manufacturing specifications.
Device history record (DHR) documenting production history for each batch or unit.
Complaint files tracking product issues and resolutions.
Audit reports demonstrating internal compliance verification.
Records must remain legible, protected from damage, and retrievable throughout specified retention periods. For most records, that means maintaining files for the lifetime of the device plus two years.
Technical Specifications
Certain requirements demand specific technical capabilities. Measuring equipment requires calibration against standards traceable to national or international references. Environmental controls must maintain appropriate conditions for operations. Computer systems need validation proving they perform intended functions reliably.
Ongoing QSR Compliance Activities
Compliance isn't a one-time achievement. Organizations maintain 21 CFR Part 820 compliance through:
Internal audits conducted at defined intervals covering all requirements.
Management reviews evaluating quality system effectiveness.
Continuous monitoring of process capability and product conformance.
Regular supplier evaluations and controls.
Periodic procedure reviews ensuring documentation reflects current practices.
Complaint trending and analysis identifying systemic issues.
FDA inspections verify these activities occur consistently. Inspectors review documentation, observe operations, interview personnel, and trace specific devices through complete manufacturing records. Preparation means maintaining systems that demonstrate ongoing compliance, not scrambling when notice arrives.
When medical device companies implement compliant quality systems under 21 CFR Part 820, operations transform from reactive chaos into predictable excellence. The benefits extend far beyond satisfying FDA inspectors.
Measurable Operational Impact of Part 820 Compliance
Companies with mature quality systems see dramatic improvements across multiple metrics:
Reduced batch failures by 30%-50% through validated processes that catch deviations before they cascade.
Faster problem resolution because systematic CAPA processes identify root causes rather than symptoms.
Lower manufacturing costs as rework and scrap rates decrease through prevention-focused controls.
Accelerated product launches when design controls create right-first-time development cycles.
Quality system regulation compliance eliminates the firefighting mode where teams constantly address quality escapes and regulatory observations. Instead, organizations spend time improving products and processes rather than explaining failures.
Cross-Functional Strategic Value
Strong quality systems create advantages across the organization. R&D teams develop products with market access built in from concept stages. Manufacturing operations maintain validated processes that consistently meet specifications. Customer service handles fewer complaints because fewer defects reach the market. Supply chain teams work with vetted suppliers who deliver components meeting established requirements.
Regulatory and Competitive Advantages
21 CFR Part 820 compliance opens U.S. market access, but benefits extend globally. Systems aligned with international standards support regulatory submissions worldwide. During FDA inspections, documented quality systems demonstrate organizational commitment to safe, effective medical device products. Clean inspection outcomes protect market continuity and corporate reputation.
Companies viewing quality systems as strategic infrastructure gain competitive differentiation. While competitors struggle with quality issues and regulatory observations, organizations with mature systems focus on innovation, market expansion, and customer satisfaction. The regulation transforms compliance from a burden to a framework for operational excellence that drives business performance.
Medical device manufacturers face unique compliance challenges based on device classification. Class III devices requiring premarket approval demand the most rigorous design controls and validation. Class II devices need moderate controls, including design verification. Even Class I manufacturers exempted from certain provisions must maintain complaint handling and corrective actions.
A cardiac pacemaker manufacturer exemplifies comprehensive 21 CFR Part 820 requirements in action. The company’s design controls track every specification from initial safety requirements through clinical validation. Production processes maintain validated assembly procedures where even minor deviations trigger investigation. Their DHRs document every component, assembly step, and test result for each serialized unit. When a field complaint occurs, the CAPA system traces back through manufacturing records, identifies potential systemic issues, and implements verified corrections across all affected processes.
Class II surgical instrument manufacturers face different scenarios. Design controls focus on biocompatibility validation and functional performance rather than extensive clinical data. Process validation proves sterilization procedures consistently achieve specified sterility assurance levels. Supplier controls ensure raw materials meet biocompatibility requirements. Document controls maintain specifications that manufacturing teams actually use rather than outdated files collecting dust.
The practical advantage: Manufacturers with mature quality systems spend less time explaining deviations and more time improving products. During FDA inspections, compliant organizations demonstrate quality through documented evidence, not verbal promises. Design control records show systematic development. Process validation proves manufacturing capability. CAPA files demonstrate continuous improvement. The outcome isn't just regulatory compliance. It's manufacturing excellence that reduces costs, accelerates development cycles, and ensures patients receive safe, effective medical device products consistently. Companies positioning quality systems as competitive infrastructure gain market advantages competitors can't easily replicate.
Contract manufacturing organizations (CMOs) and contract development and manufacturing organizations (CDMOs) face unique 21 CFR Part 820 compliance challenges because they produce medical device products for multiple clients simultaneously. Quality systems must accommodate different device designs, specifications, and risk profiles while maintaining systematic controls across all operations.
The complexity starts with design controls. CDMOs often receive device designs from clients, requiring clear interface definitions. Quality agreements must specify which party controls design outputs, validation protocols, and design changes. When contract manufacturers perform design activities, they need full documentation demonstrating design control compliance for each project. The device master record for one client's device operates independently from another's, yet both require the same rigorous control levels.
Process validation becomes particularly critical. A CDMO manufacturing orthopedic implants alongside diagnostic instruments requires validated processes for each device type. Sterilization validation for implants demands specific parameters, loading patterns, and biological indicators. Electronic assembly for diagnostic devices needs different environmental controls and electrostatic discharge protection. The quality system must prove each process consistently achieves intended results regardless of which client's product runs through manufacturing.
Document control challenges multiply across clients. Each customer's specifications, procedures, and requirements need separate master records while sharing common quality system procedures. Change control becomes complex when process modifications affect multiple clients' products. Notification requirements, impact assessments, and approval processes must satisfy every affected customer's expectations.
The strategic advantage: CDMOs with robust quality systems attract high-value clients seeking reliable manufacturing partners. When medical device companies evaluate potential contractors, mature quality systems demonstrate capability and regulatory readiness. Clean FDA inspection histories prove operational excellence. Sophisticated CAPA systems show continuous improvement rather than reactive problem-solving. Contract manufacturers positioning quality systems as competitive differentiators command premium pricing, maintain long-term partnerships, and scale operations without proportional quality resource increases. The regulation becomes infrastructure supporting profitable growth rather than overhead expenses limiting expansion.
Combination product manufacturers navigate complex regulatory terrain where 21 CFR Part 820 requirements intersect with pharmaceutical cGMP regulations. For instance, a drug-eluting stent contains both device components and pharmaceutical substances. An insulin delivery pen combines mechanical injection mechanisms with drug storage. Each element requires appropriate quality controls under different regulatory frameworks.
The challenge intensifies with design controls. Device components need verification proving mechanical performance, biocompatibility, and sterility. Drug components require validation demonstrating potency, stability, and purity throughout shelf life. The combination requires additional validation proving drug delivery rates, dosing accuracy, and component compatibility. Design control documentation must address all three aspects systematically.
Process validation exemplifies the complexity. Manufacturing medical device quality systems must validate device assembly under 21 CFR Part 820 while pharmaceutical production follows cGMP validation requirements. A prefilled syringe manufacturer validates glass component specifications, drug filling accuracy, plunger placement precision, and sterility assurance. Each process needs protocols, acceptance criteria, and documented evidence meeting both regulatory frameworks simultaneously.
Documentation requirements essentially double. Companies maintain device master records covering device specifications alongside batch manufacturing records for pharmaceutical components. Complaint handling must distinguish device failures from drug quality issues while addressing combination product performance failures. CAPA systems track trends across both domains because improvements in one area often affect the other.
The competitive reality: Combination product manufacturers with integrated quality systems move faster than competitors managing parallel systems. When design controls address device and drug aspects together, development cycles shorten. When manufacturing processes validate both components systematically, scale-up proceeds smoothly. Organizations treating quality systems as unified infrastructure rather than separate compliance exercises reduce redundancy, improve efficiency, and maintain regulatory readiness across multiple inspectorate jurisdictions. The result isn't just 21 CFR Part 820 compliance. It's operational excellence creates sustainable competitive advantages in increasingly complex medical device markets.
Software as a Medical Device (SaMD) developers face 21 CFR Part 820 requirements adapted for intangible products without traditional manufacturing processes. A clinical decision support algorithm or remote patient monitoring application requires quality systems focused on design controls, configuration management, and software validation rather than production line controls.
Design controls are paramount for SaMDs. Requirements traceability links user needs to software requirements, architecture, detailed design, and test protocols. Design verification proves code meets specifications through systematic testing. Design validation demonstrates the software performs intended clinical functions in realistic use environments. When a diagnostic imaging algorithm analyzes medical images, validation must prove it accurately detects intended conditions across diverse patient populations and imaging equipment variations.
Version control replaces traditional manufacturing controls. Configuration management systems track every code modification, ensuring deployed software matches validated versions. The software bill of materials (SBOM) documents all components, libraries, and dependencies. When third-party libraries get updated, change controls assess impacts and trigger appropriate verification activities. The DDHR release documentation mapping software builds to specific validation evidence and distributed versions.
Risk management permeates SaMD development. Software failures can directly impact patient safety without physical device malfunctions. Cybersecurity vulnerabilities create risks, requiring systematic identification and mitigation. Updates, fixing bugs, or adding features require risk assessment to determine whether changes need new premarket submissions.
The practical advantage: SaMD companies with mature quality systems accelerate development while maintaining regulatory compliance. Automated testing integrated into design controls catches issues early. Continuous integration systems maintain configuration management rigorously. When FDA questions arise, documented design controls demonstrate systematic development rather than ad-hoc coding. Organizations viewing quality systems as development infrastructure rather than compliance overhead ship updates faster, maintain security responsiveness, and scale development teams without creating quality debt that eventually demands expensive remediation.
The FDA's Quality Management System Regulation (QMSR) harmonizing 21 CFR Part 820 with ISO 13485:2016 requires compliance as of February 2, 2026. Companies must update their quality systems to meet the new framework, starting with gap analyses comparing current systems against ISO 13485:2016 requirements. Organizations already certified to ISO 13485 face fewer changes but still need documentation updates reflecting the harmonized requirements.
Maintain quality systems demonstrating ongoing 21 CFR Part 820 compliance rather than temporarily fixing issues when inspectors arrive. Conduct internal audits covering all regulation subparts, review recent FDA warning letters to understand current inspection focus areas, and ensure device master records accurately reflect current manufacturing processes. Train personnel on professional responses that reference documented evidence and appoint experienced quality professionals to coordinate inspection logistics.
Quality System Regulation (QSR) compliance, now QMSR, requires a quality manual defining system scope, quality system procedures covering each regulation requirement, device master records containing complete manufacturing specifications, and DHRs documenting production history with traceability. Additional critical records include design control files, validation protocols and reports, internal audit records, complaint files with investigation documentation, and CAPA records demonstrating systematic problem resolution. Maintain documents throughout specified retention periods, typically device lifetime plus two years.
Yes, the FDA may update regulations to reflect new medical developments, technology advances, or safety information. To ensure ongoing compliance, manufacturers must stay informed about any changes, such as the initiative to harmonize the regulation with the ISO 13485 standard.
Inspection preparation should include ensuring that all aspects of the quality system are in line with Part 820 requirements, conducting internal audits toward those ends, appropriately training employees, reviewing, and updating essential documentation auditors may ask for, and fixing any identified gaps or deficiencies in the quality system.