The requirements in 21 CFR Part 820 set the current good manufacturing practice rules for medical devices sold in the United States, and as of February 2, 2026, they operate through the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference as the substantive backbone of the quality system. Any company that designs, manufactures, packages, labels, or services a finished device intended for human use must document and maintain a quality management system that complies with ISO 13485, plus a short list of FDA-specific supplements that Part 820 keeps in its own text. A device produced outside that framework is legally adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act.
Who Is In Scope
Part 820 applies to every manufacturer of a finished device intended for human use, whether the facility sits inside the United States or ships into it from abroad. A finished device means any device or accessory suitable for use or capable of functioning, regardless of whether it has been packaged, labeled, or sterilized. That definition sweeps in standalone medical software, surgical instruments, implantable hardware, and diagnostic equipment.
Narrower operators are also covered when their work fits the manufacturing definition: contract sterilizers, remanufacturers, repackers, relabelers, specification developers, and initial distributors of foreign manufacturers. A company that performs only some of these functions is only obligated to comply with the requirements that apply to those operations.
Two boundary points worth naming, because searchers often assume the opposite. Makers of individual components or parts that another company assembles into a finished device are not covered by Part 820, though the FDA encourages voluntary compliance. Blood and blood component manufacturers are excluded and fall under a separate regulatory framework.
ISO 13485 as the Core Requirement
Section 820.10 requires every covered manufacturer to establish, implement, and maintain a quality management system that complies with ISO 13485:2016. The substantive requirements that used to appear directly in the CFR text now sit inside that standard, which manufacturers must purchase from ISO or an authorized distributor; section 820.7 identifies the specific edition incorporated by reference and gives contact information for obtaining it.
ISO 13485 covers the full lifecycle of a device. Its major requirement areas include:
- Management responsibility, including a defined quality policy, planned quality objectives, documented management reviews, and adequate trained personnel.
- Design and development, with documented procedures for planning, inputs, outputs, reviews, verification, validation, transfer, and change control, all captured in a design and development file for each device type or family.
- Purchasing and supplier controls, based on documented evaluation criteria and ongoing monitoring of suppliers.
- Production and service provision under controlled conditions, with process validation for any step whose results cannot be fully verified by later inspection.
- Corrective and preventive action, covering identification of nonconformities, root cause investigation, correction, and effectiveness verification.
- Monitoring and measurement, including feedback systems, internal audits, process monitoring, and product acceptance activities.
The FDA-Specific Supplements
ISO 13485 is the foundation, not the whole obligation. Three sections of Part 820 add requirements that either extend the standard or connect the quality system to other FDA regulations that have no ISO equivalent.
Regulatory Tie-Ins Under §820.10
Section 820.10 identifies four areas where FDA rules run alongside ISO 13485:
- Unique device identification under 21 CFR Part 830, satisfying the identification requirements in ISO 13485.
- Device tracking under 21 CFR Part 821 where applicable, which goes beyond ISO 13485’s general traceability expectations.
- Medical device reporting under 21 CFR Part 803 for complaints meeting the reporting thresholds, layered onto ISO 13485’s regulatory-reporting requirement.
- Corrections and removals under 21 CFR Part 806, mapping onto multiple ISO 13485 clauses.
Section 820.10 also extends ISO 13485’s implantable-device traceability requirements to any device that supports or sustains life if a failure during proper use could reasonably cause significant injury. And it states directly that noncompliance renders a device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act.
Records Under §820.35
Section 820.35 adds FDA-specific detail to ISO 13485’s record controls. Complaint records must include the device name, the date the complaint was received, any UDI or product codes, the complainant’s contact information, the nature of the complaint, any corrective action taken, and any reply sent. If a manufacturer decides not to investigate a complaint involving a possible device failure, it must document the justification. Servicing records must capture the device name, identifiers, service date, personnel involved, work performed, and any test or inspection results. The UDI must be recorded for each device or batch.
Labeling and Packaging Under §820.45
The FDA found ISO 13485’s labeling provisions insufficient standing alone, so section 820.45 requires that someone examine labels for accuracy before they are released for use or storage. The examination covers the UDI or product code, expiration date, storage and handling instructions, and any processing instructions, and the release must be documented. Labeling and packaging operations must include controls to prevent mix-ups, and the results of pre-use labeling inspections must be recorded.
Design Controls
Design controls apply to all Class II and Class III devices, plus certain Class I devices: those automated with computer software and a short list of specific products including tracheobronchial suction catheters, non-powdered surgeon’s gloves, protective restraints, and radionuclide therapy sources.
The process begins with documented planning that identifies design stages, reviews, responsibilities, and required resources. Design inputs must capture functional, performance, usability, and safety requirements based on intended use, along with applicable regulatory standards and risk management outputs. Inputs need to be complete, unambiguous, and internally consistent.
Design outputs must meet the inputs, provide enough detail for purchasing and manufacturing, reference acceptance criteria, and identify characteristics essential for safe use. Verification confirms through testing and objective evidence that outputs meet inputs. Validation goes further, confirming the device meets the needs of its intended users under conditions that simulate real-world use, and must be completed before the device is released.
All of this feeds a design and development file maintained per device type or family. The file must include or reference records demonstrating that the design met every requirement, including any changes along the way. Auditors look here first when assessing whether a manufacturer truly controlled its design process or documented one after the fact.
Production and Process Validation
Production must happen under controlled conditions: documented work instructions, suitable equipment, a monitored work environment, and defined workmanship criteria. Environmental controls such as air filtration, temperature regulation, and contamination prevention are expected wherever the device’s specifications or the process require them.
Process validation is where manufacturers most commonly stumble. Any manufacturing step whose results cannot be fully verified by later inspection or testing must be validated with a high degree of assurance before production begins. A plastic sealing process or a sterilization cycle cannot be inspected into confidence unit by unit, so the process itself has to be proven to work consistently up front. Validated processes must be run by qualified personnel, monitored against defined parameters, and revalidated whenever changes or deviations occur.
Supplier management remains central. Manufacturers must evaluate and select suppliers based on demonstrated ability to meet specified quality requirements, document the evaluation, and put technical expectations into written agreements. Manufacturing equipment must be maintained, calibrated, and inspected on a defined schedule, with all activity documented.
Corrective and Preventive Action
CAPA is the self-repair mechanism of the quality system, and it draws more FDA enforcement attention than almost any other area. Under ISO 13485 Clauses 8.5.2 and 8.5.3, manufacturers must maintain documented procedures for corrective action, which addresses problems that have already happened, and for preventive action, which heads off problems that have not.
Corrective action means identifying the nonconformity, investigating the root cause, implementing a fix, and verifying that the fix worked without introducing new problems. Preventive action follows a parallel track: analyzing data to spot potential issues, deciding whether action is warranted, planning and implementing it, and confirming effectiveness. Both must be prioritized by the risk they pose.
The data feeding CAPA should come from across the organization: production records, process monitoring, audit findings, customer complaints, service reports, and returned product analysis. A manufacturer whose CAPA inputs stop at formal complaints is missing most of the picture.
Complaints and Medical Device Reporting
ISO 13485 requires a feedback process and complaint handling procedures. Section 820.35 adds teeth by specifying what complaint records must contain and when investigations are required. Every complaint alleging a possible failure of the device, its labeling, or its packaging to meet specifications must be investigated unless the manufacturer has already investigated a substantially similar complaint and documented that another investigation is unnecessary.
Complaints meeting the reporting thresholds in 21 CFR Part 803 trigger mandatory medical device reports to the FDA. These cover events where the device may have caused or contributed to a death or serious injury, and malfunctions that could cause either outcome if they recurred. Manufacturers can keep MDR event files inside their complaint files, but reportable events must be prominently identified as such. The FDA will not consider an MDR compliant unless the event was also evaluated through the quality management system.
Software as a Medical Device
Standalone software intended for a medical purpose is a device in its own right, distinct from software embedded in physical hardware. The FDA recognizes this category as Software as a Medical Device (SaMD), and diagnostic algorithms, clinical decision support tools, and remote monitoring platforms can all fall inside it.
SaMD manufacturers must comply with Part 820 the same as makers of physical devices. The practical difficulty is that ISO 13485 was written primarily with hardware in mind: software development cycles are faster, updates more frequent, and the line between a design change and a production change is thin. Design controls under Clause 7.3 apply to all Class II and III SaMD and to Class I software devices automated with computer software. Validation of software used inside the quality system itself is also required, because a bug in a quality tool compromises the integrity of the data it manages.
What Happens If You Don’t Comply
Section 820.10(e) states the consequence directly: failure to comply with any applicable requirement in Part 820 renders the device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act. Introducing an adulterated device into interstate commerce is a prohibited act under 21 U.S.C. § 331.
Enforcement typically escalates through a predictable sequence. During a routine inspection, an investigator who observes possible violations issues a Form 483 at the close of the visit. A 483 is not a final determination; it is an opportunity for the manufacturer to respond and correct. If the response is inadequate, or the problems are serious enough, the FDA may issue a Warning Letter demanding corrective action within a specified timeframe.
When Warning Letters go unanswered or the response falls short, the FDA moves to judicial enforcement. The most common tool is an injunction filed through the Department of Justice, which can shut down a facility until an independent expert certifies compliance to the FDA. The manufacturer pays for the expert and for periodic audits after operations resume. The FDA can also seek seizure of violative products through federal court, with the U.S. Marshals Service carrying out the physical seizure.
Civil monetary penalties for device-related violations reach $15,000 per violation and $1,000,000 per proceeding under the statutory base in 21 U.S.C. § 333(f)(1)(A), with annual inflation adjustments. Knowing violations involving counterfeit devices carry criminal penalties of up to ten years of imprisonment. Even without criminal intent, a pattern of noncompliance can produce a consent decree that puts the FDA in effective control of a manufacturer’s operations for years.
What Changed From the Old QSR
Before February 2, 2026, Part 820 spelled out its requirements across dozens of specific sections: 820.20 for management responsibility, 820.30 for design controls, 820.50 for purchasing, 820.70 for production, 820.100 for CAPA, and so on. Those sections now read “[Reserved]” in the eCFR. The substantive requirements did not disappear; they moved into ISO 13485, which covers the same ground with different terminology and clause numbering.
The QMSR keeps only a handful of operative sections: 820.1 (scope and applicability), 820.3 (definitions, drawing primarily from ISO 13485 and ISO 9000:2015 but adding some FDA-specific terms), 820.7 (incorporation by reference), 820.10 (quality management system requirements and FDA tie-ins), 820.35 (supplemental records), and 820.45 (labeling and packaging). Everything else routes through ISO 13485.
For manufacturers already selling internationally under an ISO 13485-certified system, the transition mostly involves confirming that the existing system addresses the FDA-specific supplements and updating documentation to reflect the new structure. For companies that built their quality systems around the old QSR section numbers, the work is heavier: every procedure, work instruction, and training document that cites a now-reserved section needs to be remapped to the corresponding ISO 13485 clause. The substance of the quality system may not change much. The scaffolding around it does.