21 CFR Part 820 (QMSR)

What It Covers

The quality system requirements for finished medical devices sold in the United States. In place of FDA’s own rules for design controls, CAPA and production, Part 820 now points to ISO 13485:2016 and adds a short list of US-specific provisions where the law requires them.

Who It Applies To

Manufacturers of finished devices for the US market, including specification developers, contract manufacturers, remanufacturers, repackagers, and relabelers. Component makers are reached through their customers’ purchasing controls rather than directly.

Key Requirements

• ISO 13485:2016 applied as US law; where a clause conflicts with the FD&C Act or FDA regulations, the US requirement controls.
• FDA-specific record content kept in §820.35, including what complaint and servicing records must show and the unique device identifier.
• Device labeling and packaging controls kept in §820.45: labels inspected for accuracy before release, with a record.
• Management review, internal audit, and supplier audit reports are no longer shielded from FDA inspection.
• Risk management throughout the quality system, as ISO 13485 requires, not only in design.

Structure at a Glance

Requirements Checklist

Work down the list with the evidence in hand. The PDF has a column for noting where each item is evidenced.

1. Quality manual updated to name the QMSR and ISO 13485:2016 as the governing requirements.
2. Procedure index cross-referenced from old Part 820 sections to ISO 13485 clauses; no orphan citations.
3. Complaint procedure records the MDR decision and rationale for every complaint (21 CFR 803).
4. Servicing records analyzed as feedback, with links to complaints where they reveal a failure.
5. UDI recorded in device history and distribution records.
6. Label inspection before release documented, including who released and when.
7. Management review and audit reports written to be read by an investigator.
8. Risk management planned and evidenced across the QMS, not only in design files.
9. Purchasing controls proportionate to supplier risk, with evidence of evaluation and monitoring.
10. Software used in the QMS (ERP, spreadsheets, eQMS) validated for its intended use.
11. Training records show competence on the revised procedures, not attendance alone.
12. A mock inspection run against Compliance Program 7382.850.

Implementation Roadmap

1. 1. Map Crosswalk every procedure, form, and work instruction that cites a Part 820 section to the ISO 13485 clause now in force.
2. 2. Rewrite Revise the documents that changed in substance first: complaints, records, labeling, management review, audits.
3. 3. Train Train the people who own those processes, and test that they can apply the revised procedure.
4. 4. Verify Run an internal audit and a mock inspection against Compliance Program 7382.850; close what it finds through CAPA.

How It Fits with Other Standards

An ISO 13485 certificate does not replace an FDA inspection, and FDA does not certify. MDSAP audit reports can stand in for routine FDA inspections. Parts 803 (reporting), 806 (corrections and removals), 830 (UDI) and 11 (electronic records) are unchanged and still apply alongside Part 820.

Findings We See Most Often

• Complaint handling that records the customer’s words but not the investigation, the MDR decision, or the trend.
• CAPA that closes on retraining without evidence the cause was found or the fix worked.
• Supplier files with an approval and no monitoring since.
• Label control that relies on the printer rather than an inspection someone signs for.

Related Standards

• ISO 13485:2016QMS for Medical Devices
• 21 CFR Part 803Medical Device Reporting
• 21 CFR Part 806Corrections and Removals
• 21 CFR Part 830Unique Device Identification
• 21 CFR Part 11Electronic Records and Signatures
• ISO 14971:2019Risk Management
• MDSAPSingle Audit Program