What Is 21 CFR Part 820? FDA QMSR Rules, Changes, and Penalties

21 CFR Part 820 is the Food and Drug Administration’s rule setting quality management system requirements for companies that make medical devices for the U.S. market. As of February 2, 2026, the FDA restructured the regulation and renamed it the Quality Management System Regulation (QMSR). The rule now incorporates the international standard ISO 13485:2016 by reference and adds a small number of FDA-specific requirements on top of it.¹ A device that fails to meet the applicable requirements is adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act, and the manufacturer is exposed to FDA enforcement.²

Who Has to Comply

Part 820 applies to any manufacturer engaged in the design, manufacture, packaging, labeling, storage, installation, or servicing of a finished device intended for human use. The FDA reads “manufacturer” broadly. Contract sterilizers, remanufacturers, repackers, specification developers, and initial U.S. distributors of foreign-made devices all fall inside the definition. A company that performs only some of those functions only has to comply with the requirements that apply to the operations it actually performs.³

The rule covers finished devices made anywhere in the United States, its territories, the District of Columbia, and Puerto Rico, as well as devices imported or offered for import. A few boundaries are worth stating plainly because it is easy to assume otherwise. Component and part manufacturers are not subject to Part 820, though the FDA encourages them to follow it voluntarily. Blood and blood components for transfusion are regulated under a separate framework in subchapter F. Human cells, tissues, and cellular and tissue-based products that are also regulated as devices must meet Part 820 alongside the donor-eligibility and tissue-practice rules in Part 1271.³

What Changed on February 2, 2026

Before the 2026 amendments, Part 820 was known as the Quality System Regulation, or QSR. It spelled out each requirement in FDA-drafted regulatory text across Subparts A through O. The FDA concluded that ISO 13485:2016 was substantially similar to the QSR and offered a comparable level of assurance that devices are manufactured safely.⁴ Instead of running a parallel U.S. rulebook, the agency pointed manufacturers to ISO 13485 for most quality system requirements and added supplemental provisions where it felt the international standard was not detailed enough.

The regulation is now lean on paper. Subpart A holds the scope, definitions, incorporation-by-reference details, and the core requirements section at 820.10. Subpart B contains two supplemental provisions, 820.35 on control of records and 820.45 on labeling and packaging controls. Everything from Subpart C through Subpart O is marked “[Reserved].”³ Where ISO 13485 conflicts with the FD&C Act or other FDA regulations, the statute and those other regulations control.

One practical shift catches manufacturers off guard. The old QSR, at former section 820.180(c), shielded internal audit reports, supplier audit reports, and management review records from FDA inspection. That language is not in the QMSR. Those records can now be requested and reviewed during an inspection, and manufacturers should assume they will be. The FDA also retired the Quality System Inspection Technique on the same date and replaced it with the inspection process described in Compliance Program 7382.850.¹

The Core Requirement: Section 820.10

Section 820.10 is the hub of the regulation. It requires every manufacturer subject to Part 820 to establish and maintain a quality management system that meets the applicable requirements of ISO 13485, along with the additional FDA requirements in the rule. Beyond that general mandate, 820.10 lists specific cross-references to other parts of Title 21 that manufacturers must follow to satisfy certain ISO 13485 clauses.²

Unique device identification under ISO 13485 Clause 7.5.8 must comply with Part 830.
Traceability under Clause 7.5.9.1 must follow the procedures in Part 821 where applicable.
Reporting to the FDA under Clause 8.2.3 requires complaint reporting that meets Part 803 (Medical Device Reporting).
Advisory notices, corrections, and removals must be handled under Part 806.

Section 820.10 also expands the ISO 13485 traceability requirement for implantable devices in Clause 7.5.9.2 to cover any device intended to support or sustain life, a broader category than implantables alone.²

The Two FDA Supplements in Subpart B

The FDA identified two areas where ISO 13485 alone was not specific enough for U.S. purposes. Both sit in Subpart B and both are enforceable regulatory requirements, not guidance.

Section 820.35: Complaint and Servicing Records

Section 820.35 requires manufacturers to maintain records of the review, evaluation, and investigation of any complaint alleging that a device, its labeling, or its packaging failed to meet specifications. When a complaint must be reported to the FDA under Part 803, or when the manufacturer decides an investigation is needed, the record has to capture specific fields: the device name, the date the complaint was received, any unique device identifier (UDI) or universal product code (UPC), the complainant’s name and contact information, the nature and details of the complaint, any corrective action taken, and any reply to the complainant.⁵

The same section requires detailed servicing records whenever a device is serviced, including the device name, UDI, date of service, who performed the service, what was done, and any test or inspection data. Medical device reporting event files may be kept as part of the complaint file, provided those records are prominently identified as MDR-reportable events.⁶

Section 820.45: Labeling and Packaging Controls

Section 820.45 requires documented procedures covering the integrity, inspection, storage, and operations for labeling and packaging throughout processing, handling, distribution, and use. Before release, the manufacturer must verify labeling accuracy against specific elements: the correct UDI or UPC, expiration date, storage instructions, handling instructions, and any additional processing instructions.⁷ Labeling and packaging operations have to be designed to prevent mix-ups, including inspection before use to confirm that each device carries the correct labeling specified in its medical device file.

What the ISO 13485 Clauses Actually Require

Because the QMSR points to ISO 13485 for most of the substance, understanding Part 820 in practice means understanding what the referenced clauses demand. The requirements group into seven working areas.

Management Responsibility and Resources

Clause 5 requires top management to establish a quality policy and quality objectives, conduct management reviews at defined intervals, and provide the authority structure, communication channels, and resources needed to sustain compliance. Reviews must evaluate audit results, customer feedback, process performance, product conformity, and the status of corrective and preventive actions, and their output must include decisions on resources and system improvements. Clause 6 covers personnel competence, training, infrastructure, and the work environment. People whose work affects product quality must be competent based on education, training, skills, and experience, and training records must be maintained. Because the old audit-and-review inspection shield is gone, the documentation from management reviews should be prepared with the understanding that an FDA investigator may read it.

Design and Development Controls

Design controls under Clause 7.3 follow the same sequence experienced manufacturers know from the old QSR: planning, inputs, outputs, review, verification, validation, transfer, changes, and file maintenance. The FDA treats Clause 7.3 as substantially similar to the former 820.30. Design inputs must capture the intended use, performance requirements, safety considerations, and applicable regulatory requirements. Outputs must be documented in a form that permits verification against inputs. Verification confirms that outputs meet input specifications; validation confirms that the finished device meets user needs under real or simulated conditions, which often means clinical evaluations or human-factors studies.

Design controls apply to Class II and Class III devices and to a short list of Class I devices that includes those automated with computer software, tracheobronchial suction catheters, non-powdered surgeon’s gloves, protective restraints, manual radionuclide applicator systems, and radionuclide teletherapy sources.² All other Class I devices are exempt from Clause 7.3.

Terminology changed alongside the substance. Clause 7.3.10 requires a “design and development file” for each device type or family, replacing the old “design history file” (DHF). The file must include or reference records showing that design and development requirements were met, including records of any design changes.⁸

Production, Process Controls, and Software Validation

Clause 7.5 requires manufacturers to plan and carry out production under controlled conditions, including documented work instructions, suitable equipment, monitoring and measurement activities, and defined processes for release, delivery, and post-delivery. Environmental conditions affecting product quality, such as temperature, humidity, or particulate levels, must be monitored and controlled.

Process validation remains a cornerstone. When the results of a manufacturing step cannot be fully verified by later inspection or testing, the process itself must be validated to provide a high degree of assurance that it consistently produces acceptable results. Sterilization is the classic example. If a validated process changes, revalidation is required before the change takes effect. Computer software used in production or in the quality system must also be validated for its intended use, and all software changes require validation before approval and implementation.

Acceptance Activities and Nonconforming Product

Acceptance activities happen at three stages: receiving, in-process, and finished device. At each stage, manufacturers must verify conformance to specifications through inspections, tests, or other verification methods. Finished devices must be held or otherwise controlled until acceptance activities are complete, associated data has been reviewed, and a designated individual has signed and dated the release. Nothing can be distributed until those conditions are met.

Nonconforming product requires documented procedures for identification, segregation, evaluation, and disposition. The evaluation must decide whether an investigation is needed and whether the responsible people or organizations need to be notified. A decision to use nonconforming product rather than scrap it must be justified and signed by an authorized individual. Rework is permitted but tightly controlled. Reworked product must be retested and re-evaluated against current approved specifications, and the manufacturer must determine whether the rework itself caused any adverse effect. All rework and re-evaluation activities have to be recorded.

Corrective and Preventive Action

Corrective and preventive action (CAPA) sits in Clauses 8.5.2 and 8.5.3 and mirrors the old 820.100 requirements. Corrective action starts with identifying a nonconformity, investigating its root cause, implementing a fix, and verifying that the fix worked without creating new problems. Preventive action runs a parallel track focused on potential problems identified through trend analysis, risk assessment, and review of historical data before a failure occurs. Both paths require documentation of the investigation, the actions taken, and the verification of effectiveness. Where statistical methods help detect recurring problems, manufacturers must establish procedures for identifying valid statistical techniques for monitoring process capability and product characteristics, and any sampling plans must rest on a valid statistical rationale.

Records and Documentation

Clause 4.2 establishes the documentation framework. Manufacturers must maintain a quality manual, documented procedures, and records demonstrating that the system is operating effectively. The standard also requires a “medical device file” for each device type or family, consolidating or referencing specifications, production procedures, and quality requirements. This replaces the old “device master record” terminology, and the production history formerly captured in the “device history record” is now maintained through record-keeping requirements spread across several ISO 13485 clauses. The manufacturer still needs to document the date of manufacture, quantities produced, labeling used, and acceptance results for each production run or batch. Document control procedures must ensure that documents are reviewed and approved before use, that current versions are available where needed, and that obsolete documents are promptly removed from circulation.

Purchasing Controls and Internal Audits

Clause 7.4 requires manufacturers to ensure that purchased product conforms to specified requirements. Suppliers, contractors, and consultants must be evaluated and selected based on their ability to meet defined quality requirements, and the results must be documented. Purchasing documents must describe the specified requirements for the purchased product, and where possible should include an agreement that the supplier will notify the manufacturer of changes. The manufacturer remains responsible for the final device regardless of whether a defective component came from an outside vendor.

Clause 8.2.4 requires internal audits at planned intervals to verify that the quality management system conforms to the planned arrangements and to the requirements of the standard. Auditors must be independent of the activity being audited. Results must be recorded and reported to management, and corrective actions must be taken without undue delay when nonconformities are found. Again, these audit records are no longer shielded from FDA inspection.

Risk Management

ISO 13485 threads risk management through the whole system rather than isolating it in a single section. A risk-based approach applies to process controls, design and development, supplier management, and monitoring activities. The standard does not mandate any particular methodology, but ISO 14971 is the framework most manufacturers use.¹ With ISO 13485 now incorporated by reference, risk management is an explicit regulatory expectation.

What Noncompliance Costs

Section 820.10(e) is direct: failure to comply with any applicable requirement in Part 820 renders a device adulterated under section 501(h) of the FD&C Act, and both the device and any responsible person are subject to regulatory action.²

Enforcement typically escalates in stages. When an FDA investigator finds conditions that may violate the law, they document them on a Form 483, which is issued to the manufacturer’s management at the close of the inspection.⁹ A Form 483 is not a final agency determination, but an inadequate response can lead to a warning letter, a public document identifying serious violations and demanding corrective action within a specified timeframe. Beyond warning letters, the FDA can seek injunctions to halt manufacturing, seize adulterated devices, require mandatory recalls, or pursue criminal prosecution for willful violations. Consent decrees, in which a manufacturer agrees to specific corrective measures under court supervision, are common in cases involving repeated or systemic failures.

1
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
2
eCFR. 21 CFR 820.10 – Requirements for a Quality Management System
3
eCFR. 21 CFR Part 820 – Quality Management System Regulation
4
U.S. Food and Drug Administration. Quality Management System Regulation – Frequently Asked Questions
5
eCFR. 21 CFR 820.35 – Control of Records
6
eCFR. 21 CFR Part 803 – Medical Device Reporting
7
Federal Register. Medical Devices; Quality System Regulation Amendments
8
U.S. Food and Drug Administration. QMSR Design and Development
9
U.S. Food and Drug Administration. FDA Form 483 Frequently Asked Questions