21 CFR Part 820 QMSR: Medical Device GMP Compliance Guide

What Is 21 CFR Part 820?

21 CFR Part 820 is the FDA's current good manufacturing practice (CGMP) regulation for finished medical devices. It sets the quality system requirements a manufacturer must meet for the design, manufacture, packaging, labeling, storage, installation, and servicing of devices intended for human use in the United States. The legal hook is section 501(h) of the Federal Food, Drug, and Cosmetic Act, which deems a device adulterated if the methods used in its manufacture, packaging, storage, or installation do not conform to CGMP requirements. That is why a Part 820 failure is never just a paperwork problem. It can make the product itself adulterated.

For nearly three decades the regulation was known as the Quality System Regulation, or QSR. That changed with the final rule published in the Federal Register on February 2, 2024 (89 FR 7496), which amended Part 820 and renamed it the Quality Management System Regulation, or QMSR. The rule took effect on February 2, 2026. Since you are reading this in late 2026, the transition period is over, and FDA investigators are now inspecting against the QMSR.

In my view, that is the single most important fact for anyone searching this topic today. A lot of the content still ranking for "21 CFR 820" describes the old section-by-section QSR, and a quality system built only from that material will have gaps.

What Changed: From the QSR to the QMSR

The QMSR does not throw out the old framework and start over. It does something more unusual: it incorporates ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes, by reference into Part 820. Under the amended 21 CFR 820.10, a manufacturer must comply with the requirements of ISO 13485:2016 as incorporated, along with the additional FDA-specific provisions that remain in the regulation. The main ones are 820.35 (control of records, including complaint records, servicing records, and UDI-related records) and 820.45 (device labeling and packaging controls). Section 820.10 also ties the ISO text to the requirements of the FD&C Act and FDA regulations wherever the standard refers to applicable regulatory requirements. Confirm the exact paragraph text in the eCFR when you build your crosswalk. Terms are drawn from ISO 9000:2015 where the QMSR does not define them itself.

Three practical consequences follow from that structure.

First, the clause numbers you cite in your quality manual and procedures change. Where you once pointed to 820.30 for design controls, you now point to ISO 13485:2016 clause 7.3. Where you pointed to 820.100 for corrective and preventive action, you now look at clauses 8.5.2 and 8.5.3.

Second, vocabulary shifts. The QSR's device master record, device history record, and design history file are no longer the defined terms. ISO 13485 speaks of the medical device file (clause 4.2.3) and records of production for each batch or unit (clause 7.5.1). Many companies keep their familiar internal names, and as far as I can tell FDA does not require you to rename your documents, but your system has to show the content ISO 13485 expects.

Third, the regulation is now built on risk. ISO 13485:2016 applies a risk-based approach to the controls needed for processes in the quality management system (clause 4.1.2), and it ties risk management to product realization in clause 7.1. The old QSR mentioned risk analysis mostly inside design validation. The QMSR makes it a thread through the whole system.

QSR vs. QMSR at a Glance

That last row deserves attention, and I will come back to it in the inspection section.

Who Must Comply with Part 820?

The scope in 21 CFR 820.1 reaches manufacturers of finished devices intended for commercial distribution in the United States, which includes foreign establishments exporting to the U.S. market. The regulation covers more roles than people expect:

• Original equipment manufacturers who design and make their own devices.
• Specification developers who design a device but contract out production. You hold the design and you are responsible for the system, even if you never touch the product.
• Contract manufacturers and sterilizers, when they produce finished devices or perform steps that affect device quality.
• Remanufacturers and relabelers, who take on manufacturer responsibilities under the regulation.
• Manufacturers of software as a medical device, where the software itself meets the definition of a device.

Component manufacturers are generally not subject to Part 820, though FDA encourages them to use the regulation as a guide, and finished-device manufacturers are expected to control them through purchasing controls. Two further points affect scope:

• Certain Class I devices have historically been exempt from most quality system requirements by device-specific classification regulations, though they still carry duties such as complaint files and records.
• If you think you are exempt, confirm it against the classification regulation for your product code, not a rule of thumb.

Combination products add another layer. For a drug-device or biologic-device combination, 21 CFR Part 4 explains how Part 820 and the drug CGMPs in Parts 210 and 211 fit together, usually through a streamlined approach where the manufacturer demonstrates compliance with one set and shows the specific provisions of the other. If you make combination products, that interaction is worth mapping out early.

The Core Elements of a Part 820-Compliant System

You do not need a different system for each clause. What the regulation looks for, in my experience, is a connected quality management system where the processes talk to each other. Here are the parts that tend to decide an inspection.

Management Responsibility and the Quality Management System

ISO 13485:2016 clause 5 puts weight on top management: a quality policy, measurable quality objectives, defined responsibility and authority, and management review at planned intervals (clause 5.6). Clause 4.1.1 requires you to document the roles you play under the applicable regulatory requirements. FDA has always asked for management with executive responsibility, and the QMSR keeps that but makes it more concrete.

A pattern I see often is a management review that is held but does not drive anything. If the minutes show the same open CAPAs and the same overdue audits quarter after quarter with no resource decisions, an investigator will read that as management that is informed but not responsible.

Design and Development

Clause 7.3 covers design and development planning, inputs, outputs, review, verification, validation, transfer, changes, and the design file. The ideas will be familiar from 820.30, but the QMSR version asks for more explicit planning and for design transfer to be a controlled activity (clause 7.3.8). Design inputs must include applicable regulatory requirements and risk management outputs (clause 7.3.3).

The common failure is not a missing design file. It is a design file that does not trace. A user need that never reaches a verification test, or a hazard control in the risk file that has no matching design output, is the kind of gap that turns into a Form FDA 483 observation.

If your device includes software that makes or supports decisions, or uses machine learning, the validation burden grows. I wrote about that separately in validating AI systems in FDA-regulated GMP environments, and much of the thinking carries over to software in devices.

Purchasing and Supplier Controls

Clause 7.4.1 requires criteria for evaluating and selecting suppliers, with the control applied in proportion to the effect on the finished device and the associated risk. Purchasing information must be documented (clause 7.4.2) and incoming product verified (clause 7.4.3). Quality agreements with critical suppliers are the usual way to make change notification and audit rights enforceable.

Because supplier audit reports are no longer treated as off limits, I recommend that you write them as if an investigator will read them. That means evidence of what was examined, not a checklist with every box ticked and no notes.

Production, Process Validation, and Controls

Clause 7.5.6 requires validation of any process where the output cannot be fully verified by later monitoring or measurement. Sterilization, sealing, molding, and cleaning of reusable devices are the typical examples. Clause 7.5.2 and related clauses address cleanliness and contamination control, clause 7.5.8 covers identification, and clause 7.5.9 covers traceability. Clause 4.1.6 requires validation of software used in the quality management system, which includes the electronic quality system you may be using for CAPA and document control.

Equipment calibration (clause 7.6), environmental controls (clause 6.4), and infrastructure maintenance (clause 6.3) round out what an inspector walks through on the floor. When I walk a plant, I usually start at the point where a nonconforming product would be caught, because that tells me quickly how seriously the rest is taken.

Corrective Action, Preventive Action, and Complaints

In my experience CAPA draws more attention than any other subsystem, and nothing in the move to ISO 13485 makes it easier to ignore. Clause 8.5.2 requires corrective action without undue delay, including review of nonconformities and complaints, determining causes, and verifying that the action does not adversely affect the ability to meet regulatory requirements. Clause 8.5.3 addresses preventive action. Records of the investigation and its results are required.

Complaint handling under clause 8.2.2 requires a documented process, timely investigation, and a decision on whether the complaint must be reported to regulators. In the U.S., that second part connects to 21 CFR Part 803 (Medical Device Reporting), which is not part of the QMSR and was not replaced by it. Likewise, 21 CFR Part 806 (corrections and removals) and Part 830 (Unique Device Identification) stay in force. A company can pass its ISO 13485 audit and still fail on a missed MDR timeline.

Records

Clause 4.2.5 of ISO 13485 requires records to be legible, identifiable, and retrievable, with retention for at least the lifetime of the device as defined by the manufacturer but not less than two years from release. On top of that, 21 CFR 820.35 adds FDA-specific record requirements, including complaint records, servicing records, and UDI-related records. Check your retention schedule against both the ISO clause and 820.35.

ISO 13485 Certification Versus FDA Compliance

This is where I get asked the most questions. Having an ISO 13485:2016 certificate does not mean you comply with Part 820. The certificate shows that an accredited certification body found your system conforms to the standard. FDA does not recognize that certificate as a substitute for inspection, and the QMSR includes provisions that go beyond the ISO text, such as the requirement to follow FDA labeling rules and the handling of records of complaints and reportable events.

The reverse is also true. A company that was fully QSR compliant is not automatically conformant to ISO 13485. Clauses on documented risk management, supplier monitoring, and process-based thinking were not stated that way in the old regulation. Here is how I describe the relationship to clients:

If you participate in the Medical Device Single Audit Program, your MDSAP audit results remain useful to FDA, which has long accepted them in lieu of routine inspections. The QMSR brings the U.S. requirements closer to the language MDSAP auditors already use, which should reduce duplicated effort for companies selling in several markets.

How FDA Inspects Under the QMSR

The legacy Quality System Inspection Technique, known as QSIT, organized inspections around subsystems: management controls, design controls, CAPA, and production and process controls. FDA has been updating its inspectional approach to align with the QMSR, and its device manufacturing inspection compliance program, CP 7382.850 (Inspection of Medical Device Manufacturers), reflects the new structure. Read that program document before an inspection. It tells you how investigators are directed to assess your processes and the risk logic behind them.

Two shifts matter to preparation:

1. Management review, internal audit, and supplier audit records are now reviewable. Under the legacy 820.180(c) policy, FDA did not generally ask to see these reports. The QMSR removes that carve-out. A weak internal audit program used to be your own business. It is now evidence.
2. Risk management is inspected as a system. Expect questions about how a complaint trend feeds back into the risk file, and how a change to a process triggers a review of its risk controls.

If you want a structured way to rehearse, my FDA inspection preparation guidance walks through how I organize a mock inspection, including storyboards, record retrieval drills, and interviews with operators.

A Practical Gap Assessment Approach

Whether you are still closing gaps from the transition or building a system for a first device, I suggest a sequence like this.

1. Map your procedures to the ISO 13485:2016 clauses. Build a crosswalk from each existing procedure to the clause and to any FDA-specific provision in Part 820. Orphan clauses with no procedure and procedures that reference old 820 section numbers show up quickly.
2. Check your records vocabulary. Confirm that what you called the DMR and DHF contains what the medical device file and design and development file require. You may not need to rename anything, but you need to prove equivalence.
3. Audit your risk management file against ISO 14971. The QMSR does not incorporate ISO 14971 by reference, but ISO 13485 expects a documented risk management process, and 14971 is the recognized way to do it.
4. Re-run an internal audit with the knowledge that it can be read by FDA. Look at whether findings are specific, whether closure is verified, and whether the auditors are independent of the area they audit (clause 8.2.4).
5. Test CAPA effectiveness checks. Pull ten closed CAPAs and ask what evidence shows the problem did not come back. If the answer is "the CAPA was closed on schedule," you have a finding waiting.
6. Validate the software that runs your system. Clause 4.1.6 means your electronic document control, complaint, and CAPA tools need documented validation proportional to risk.
7. Confirm the non-QMSR obligations. MDR (Part 803), corrections and removals (Part 806), UDI (Part 830), registration and listing (Part 807), and labeling (Part 801) all need to be living, tested processes.

This takes time, but most of the work is rewiring rather than rebuilding. For a wider view of how a quality system gets built from the ground up, see the GMP certification overview.

Common Observations I Still See

These observations come from my own client and audit experience, not from a formal analysis of FDA data. They are not exotic. They are old problems with new clause numbers:

• CAPA records that name a root cause of "operator error" with no look at the process that allowed it.
• Complaints closed as "no product defect found" with no documented rationale for the MDR decision.
• Process validations that were run once and never revisited after a change in equipment, material, or supplier.
• Design changes made on the floor without design review or risk reassessment.
• Supplier approvals based on a questionnaire alone for a supplier that provides a critical component.
• Procedures that still cite 21 CFR 820.30 or 820.100 as if the regulation had not changed.

None of those require new technology to fix. They need someone to look at the system the way an investigator will.

A Final Check

What I would ask you to think about is simple. If an investigator asked to read your last three management reviews, your last internal audit report, and your last supplier audit, would you be comfortable handing them over today?

Frequently Asked Questions

What is the difference between 21 CFR Part 820 QSR and QMSR?

The QSR was a set of FDA-written quality system requirements in 21 CFR 820.20 through 820.250. The QMSR, effective February 2, 2026, amends Part 820 to incorporate ISO 13485:2016 by reference while keeping certain FDA-specific provisions. The scope of devices covered did not change, but the structure, terminology, and risk emphasis did.

Do I need to rename my DMR, DHR, and DHF?

Not necessarily. The QMSR uses ISO 13485 terms such as the medical device file, but you can keep familiar internal names if the records contain what the standard requires and you can show how they correspond.

If you want a second set of eyes on your crosswalk or a mock inspection before FDA arrives, you can reach out through the contact page.

Jared Clark, JD, MBA, PMP, CMQ-OE, CQA, CPGP, Certify Consulting

Last updated: 2026-10-20