21 CFR Part 820 — Quality Management System Regulation (QMSR) | FDA | eCFR current (effective Feb 2, 2026)
Background — FDA Quality System Regulation Amendments (Final Rule, Feb 2, 2024):
"FDA is amending the device current good manufacturing practice (CGMP) requirements of the Quality System Regulation (QSR), which are codified in 21 CFR part 820. The agency is revising part 820 to incorporate by reference the international consensus standard ISO 13485:2016, Medical devices – Quality management systems – Requirements for regulatory purposes. FDA also is making other revisions to part 820 to align with the incorporated standard. This final rule renames part 820 the Quality Management System Regulation (QMSR)."— 89 FR 7496, Feb 2, 2024 (Docket No. FDA-2019-N-1947)
Historical Background — QSR (Quality System Regulation, 1996):
The original QSR took effect on June 1, 1997. It was FDA's first comprehensive quality system standard for medical device manufacturers and was modeled on ISO 9001 (1987 version). Over the following decades, ISO 13485 emerged as the global benchmark — adopted by the EU (IVDR/MDR), Canada (CMDCAS), Japan (JPAL), and most competent authorities worldwide. This created a dual-compliance burden: U.S. manufacturers had to maintain both an FDA QSR system AND an ISO 13485 QMS simultaneously.
21 CFR § 820.1 — Scope (QMSR, effective Feb 2, 2026):
"(a) The requirements in this part govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use. The requirements in this part are intended to ensure that finished devices will be safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (the act). This part establishes basic requirements applicable to manufacturers of finished devices. If a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manufacturer need only comply with those requirements applicable to the operations in which it is engaged."— 21 CFR § 820.1(a) (paraphrased from QMSR final rule; verify against current eCFR)
"(b) FDA does not intend this part to apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to use appropriate provisions of this regulation as guidance."
Why FDA Changed the Rule — Stated Rationale:
Global harmonization: Align U.S. requirements with international standard already adopted by most competent authorities.
Reduce duplicative burden: Manufacturers certified to ISO 13485 will have substantially overlapping QMS documentation; QMSR eliminates the need to maintain two parallel systems.
Leverage modern quality concepts: ISO 13485:2016 incorporates risk-based thinking, lifecycle management, and software-specific provisions absent from the 1996 QSR.
FDA enforcement alignment: FDA can inspect against ISO 13485 clauses, providing a common framework recognized by inspectors globally (MDSAP).
"By incorporating ISO 13485 by reference, FDA is able to leverage the work of a consensus standards organization and provide requirements that are consistent with an internationally recognized QMS standard. This will reduce the compliance burden for manufacturers that maintain a quality management system consistent with ISO 13485."— FDA preamble, 89 FR 7496 (Feb 2, 2024)
21 CFR Part 820 — QMSR | FDA | §§ 820.1–820.3 | eCFR current as of April 2026
§820.1(a) — General
(1) Current good manufacturing practice (CGMP) requirements are set forth in this quality system regulation. The requirements in this part govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use. The requirements in this part are intended to ensure that finished devices will be safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (the act). This part establishes basic requirements applicable to manufacturers of finished medical devices.
(2) If a manufacturer engages in only some operations subject to the requirements in this part, and not in others, that manufacturer need only comply with those requirements applicable to the operations in which it is engaged.
(3) With respect to class I devices, design controls apply only to those devices listed in §820.30(a)(2). This regulation does not apply to manufacturers of components or parts of finished devices, but such manufacturers are encouraged to use appropriate provisions of this regulation as guidance. Manufacturers of human blood and blood components are not subject to this part, but are subject to part 606 of this chapter.
§820.1(b) — Responsibility of manufacturers
Each manufacturer shall be responsible for establishing and maintaining an adequate quality system with the organizational structure, responsibilities, procedures, processes, and adequate resources for assuring that devices will be safe and effective and otherwise in compliance with this part.§820.1(c) — Applicability
The quality system regulation applies to any finished device manufacturer who imports, exports, repackages, or relabels a device. A manufacturer of a finished medical device must comply with this part regardless of where the device is manufactured.§820.1(d) — Foreign manufacturers
If a manufacturer who offers devices for import into the United States refuses to permit or allow the completion of a Food and Drug Administration inspection of the foreign facility for the purpose of determining compliance with this part, it shall appear for purposes of section 801(a) of the act, that the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, or servicing of any devices produced at such facility that are offered for import into the United States do not conform to the requirements of section 520(f) of the act and this part and that the devices manufactured at that facility are adulterated.§820.1(e) — Exemptions or variances
Any person who wishes to petition for an exemption or variance from any device quality system requirement is subject to the requirements of section 520(f)(2) of the act. Petitions for an exemption or variance shall be submitted according to the procedures set forth in §10.30 of this chapter, the FDA's administrative procedures. Guidance documents on the exemption procedures are available from CDRH.
"Each manufacturer shall be responsible for establishing and maintaining an adequate quality system…for assuring that devices will be safe and effective."— 21 CFR §820.1(b)
21 CFR Part 820 — QMSR | FDA | §820.4 + ISO 13485:2016 §§4–6
Text effective February 2, 2026 (21 CFR Part 820 QMSR Final Rule)
Each manufacturer subject to this part must establish, implement, and maintain a quality management system that meets the requirements of ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, incorporated by reference in §820.1(b), as supplemented by the requirements in Appendix A of this part.
Under the Administrative Procedure Act (5 U.S.C. 552(a)) and 1 CFR Part 51, when FDA incorporates a document by reference into the Code of Federal Regulations, that document carries the full legal force of federal regulation. Compliance with ISO 13485:2016 is therefore not voluntary guidance — it is a federal legal requirement for all manufacturers subject to 21 CFR Part 820.
The Office of the Federal Register publishes availability notices when standards are incorporated. Manufacturers must use the specific version cited in §820.1(b) — ISO 13485:2016 — regardless of whether newer versions of the standard are released.
§820.4 applies to manufacturers of finished devices intended for commercial distribution in the United States. The term "manufacturer" is defined in §820.3 and includes any person who designs, manufactures, fabricates, assembles, or processes a finished device. Contract manufacturers (CDMOs), specification developers, and repackagers are all potentially subject depending on their role.
The QMSR operates as a two-layer framework:
Layer 1 — ISO 13485:2016: The baseline QMS standard providing all general requirements for documentation, management responsibility, resources, product realization, and measurement/analysis/improvement.
Layer 2 — Appendix A: FDA-specific supplemental requirements that either modify ISO 13485 provisions or add requirements that have no ISO 13485 equivalent. Where Appendix A and ISO 13485 differ, Appendix A controls.
4.1 General Requirements: The organization shall establish, document, implement, and maintain a QMS and maintain its effectiveness in accordance with the requirements of the standard. The organization shall document its QMS in a manner that ensures the ability of devices and services to meet requirements and to facilitate improvement of the QMS.
4.2 Documentation Requirements:
4.2.1 General: QMS documentation shall include a documented quality policy and quality objectives; a quality manual; documented procedures required by the standard; documents needed to ensure the effective planning, operation, and control of processes; records required by the standard; and any other documentation specified by applicable regulatory requirements.
4.2.2 Quality Manual: Must include the scope of the QMS with justification for any exclusions; documented procedures or references to them; a description of the interaction between QMS processes; and a description of the structure of the documentation used in the QMS.
4.2.3 Medical Device File (Technical File/DHF): Each device or family of devices must have a dedicated medical device file that includes documents providing a description of the device, its intended use, labeling, and specifications; procedures and records relevant to the device including design and development, production, testing, and post-market activities.
4.2.4 Control of Documents: Procedures for approving documents for adequacy, reviewing/updating and re-approving, identifying changes and revision status, ensuring current versions at point of use, ensuring readability, identifying external documents, and preventing unintended use of obsolete documents.
4.2.5 Control of Records: Records established to provide evidence of conformity and effective operation of the QMS shall be controlled. Retention period must be at least equivalent to the lifetime of the device as defined by the manufacturer, but not less than 2 years from the date of product release by the manufacturer, or as specified by applicable regulatory requirements.
5.1 Management Commitment: Top management shall provide evidence of its commitment to development and implementation of the QMS and maintaining its effectiveness by communicating regulatory requirements, establishing quality policy and objectives, conducting management reviews, and ensuring availability of resources.
5.3 Quality Policy: Top management shall ensure the quality policy is appropriate to the organization's purpose; includes a commitment to comply with requirements and to maintain the effectiveness of the QMS; provides a framework for quality objectives; is communicated and understood at appropriate levels; and is reviewed for continuing suitability.
5.4 Planning: 5.4.1 Quality objectives must be established at relevant functions and levels, be measurable, consistent with the quality policy, and include those needed to meet product requirements. 5.4.2 Quality management system planning must maintain the integrity of the QMS when changes are planned and implemented.
5.5 Responsibility, Authority, and Communication: Top management shall define and communicate responsibilities and authorities. A management representative must be appointed with authority and responsibility for ensuring QMS processes are established and maintained, reporting on QMS performance, and promoting awareness of applicable regulatory requirements and QMS requirements throughout the organization.
5.6 Management Review: Top management shall review the QMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. Records of management reviews shall be maintained.
Management review inputs must include: feedback, complaint handling, reporting to regulatory authorities, audit results, monitoring and measurement of processes and products, corrective and preventive actions, follow-up actions from previous reviews, changes that could affect the QMS, and recommendations for improvement.
Management review outputs must include decisions and actions related to: improvement needed to maintain the suitability, adequacy, and effectiveness of the QMS; improvement of product related to customer requirements; and resource needs.
6.1 Provision of Resources: The organization shall determine and provide the resources needed to implement and maintain the QMS, maintain its effectiveness, and meet applicable regulatory requirements and customer requirements.
6.2 Human Resources: Personnel performing work affecting product quality shall be competent based on appropriate education, training, skills, and experience. The organization shall determine the necessary competence, provide training or take other actions to achieve necessary competence, evaluate the effectiveness of actions taken, ensure personnel are aware of the relevance and importance of their activities, and maintain appropriate records of education, training, skills, and experience.
6.3 Infrastructure: The organization shall determine, provide, and maintain infrastructure needed to achieve product conformity. Infrastructure includes buildings, workspace, and associated utilities; process equipment (hardware and software); and supporting services such as information systems.
6.4 Work Environment and Contamination Control: The organization shall determine and manage the work environment needed to achieve conformity to product requirements. Requirements include documented requirements for health, cleanliness, clothing of personnel if contact with product or work environment could adversely affect product quality. Arrangements for controlling contaminated or potentially contaminated products shall be documented to prevent contamination of other products, the work environment, or personnel.
| (Controlled Document) | (Record) |
|---|
| | / | |
| | SOPWI | CAPA |
A documented procedure shall be established to define the controls needed for:
Approving documents for adequacy prior to issue
Reviewing and updating as necessary and re-approving documents
Ensuring that changes and the current revision status of documents are identified
Ensuring that relevant versions of applicable documents are available at points of use
Ensuring that documents remain legible and readily identifiable
Ensuring that documents of external origin are identified and their distribution controlled
Preventing the unintended use of obsolete documents, and applying suitable identification to them if they are retained for any purpose
The organization shall prevent the deterioration or loss of documents. Changes to documents shall be reviewed and approved either by the original approving function or another designated function that has access to pertinent background information upon which to base its decisions.
Records shall be established and maintained to provide evidence of conformity to requirements and of the effective operation of the QMS. Records shall remain legible, readily identifiable, and retrievable. A documented procedure shall be established to define the controls needed for:
Identification of records
Storage and protection of records
Retrieval of records
Retention time of records
Disposition of records
The organization shall retain records for at least the period equivalent to the lifetime of the medical device as defined by the organization, but not less than 2 years from the date of product release by the manufacturer, or as otherwise specified by applicable regulatory requirements.
FDA's record retention requirement for device history records (DHRs), device master records (DMRs), and quality system records is more specific than ISO 13485's baseline. Under the QMSR, records must be retained for a period equivalent to the design and expected life of the device, but in no case less than 2 years from the date of release of the device for commercial distribution by the manufacturer.
The practical calculation: identify the expected lifetime of the device (e.g., a reusable surgical instrument with 10-year expected service life), add 2 years, and that is the minimum retention period. For many implantable devices with long service lives (cardiac pacemakers, orthopedic implants), this calculation can extend retention requirements to 15–25+ years.
Appendix A to 21 CFR Part 820 contains FDA-specific requirements that supplement ISO 13485:2016. These fall into two categories: (1) requirements that modify or clarify how ISO 13485 provisions apply in the US context, and (2) requirements with no ISO 13485 equivalent that reflect longstanding FDA regulatory priorities.
ISO 13485:2016 §7.3 permits manufacturers to exclude design and development requirements if the design and development of medical devices is performed by an outside party or if the design is well established and documented. This exclusion is permissible under the international standard for manufacturers that only produce to customer-owned designs.
FDA's Appendix A removes this option for manufacturers subject to §820.4. Design controls are mandatory for all manufacturers of Class II and Class III devices, and for Class I devices with design specifications. A specification developer or US agent who holds the device master record cannot claim ISO 13485 §7.3 exclusion under QMSR. This is one of the most significant FDA additions.
While ISO 13485 §8.2.2 addresses feedback and §8.5.1 addresses complaint handling in general terms, FDA Appendix A requires compliance with the specific requirements of §820.198, which mandates:
A formally designated unit responsible for receiving, reviewing, and evaluating complaints
Written procedures for complaint handling
Evaluation of every complaint to determine whether a MDR report is required under 21 CFR Part 803
Complaint records to be kept at the manufacturing establishment
Specific content requirements for complaint records including the device name, lot/control number, date received, name/address of complainant, nature of complaint, and investigation results
Appendix A establishes explicit cross-references between QMSR quality system activities and the MDR reporting obligations under 21 CFR Part 803. The QMS must include procedures that identify when events associated with marketed devices constitute reportable events, and that ensure timely reporting within the applicable MDR timeframes (30-day for non-malfunction serious injury/death; 5-day for MDR-reportable events requiring immediate action).
For devices distributed in the United States, records, labeling, and submissions required under QMSR must be in the English language or have English translations available. This supplements ISO 13485, which does not specify a language requirement. A company whose operational language is not English must ensure English-language versions of device history records, complaint files, and quality records are accessible to FDA investigators during inspections.
Appendix A establishes that CAPA activities under ISO 13485 §8.5.2 and §8.5.3 must interface with field correction and removal reporting obligations under 21 CFR Part 806. Where a CAPA involves a device already distributed, the QMS must trigger evaluation of whether a §806 report is required.
The original QSR (1996/2002 Quality System Regulation) had a self-contained §820.20 addressing management responsibility. The QMSR replaces those provisions by incorporating ISO 13485 §5 and §6. The table below maps old §820.20 provisions to their QMSR equivalents.
| Old QSR §820.20 Provision | QMSR / ISO 13485:2016 Equivalent | Change Summary |
|---|
****| §820.20(a) — Quality policy: Top management shall establish a quality policy | ISO 13485 §5.1 + §5.3 | Substantially similar; ISO 13485 adds requirement that quality policy provide a framework for quality objectives |
****| §820.20(b)(1) — Organizational structure: Organizational chart and responsibility/authority | ISO 13485 §5.5.1 | Essentially identical; ISO 13485 uses "defined and communicated" language |
****| §820.20(b)(2) — Management representative with authority over QS | ISO 13485 §5.5.2 | ISO 13485 adds explicit requirement to promote awareness of applicable regulatory requirements |
****| §820.20(b)(3) — Adequate resources (personnel, equipment) | ISO 13485 §6.1 + §6.2 + §6.3 | ISO 13485 significantly expands this — adds competence assessment, training effectiveness evaluation, infrastructure maintenance, work environment management |
****| §820.20(c) — Management review at defined intervals with defined records | ISO 13485 §5.6 | ISO 13485 specifies mandatory inputs and outputs; old QSR was less prescriptive on content |
****| §820.20(d) — Quality planning: quality plans, quality objectives | ISO 13485 §5.4 | Essentially equivalent; ISO 13485 adds requirement for QMS planning to maintain integrity during changes |
****| §820.20(e) — Quality system procedures established and maintained | ISO 13485 §4.1 + §4.2 | ISO 13485 adds Medical Device File requirement (§4.2.3) and is more explicit about documentation hierarchy |
**| No equivalent in old QSR §820.20 | ISO 13485 §6.4 — Work environment and contamination control | New explicit requirement for documenting work environment requirements and contamination control arrangements |
The fundamental obligations of management responsibility did not change materially: top management must be engaged, there must be a management representative, resources must be adequate, management reviews must occur, and quality policies and objectives must be established. The QMSR adopted these existing requirements wholesale via ISO 13485.
More prescriptive management review: ISO 13485 §5.6 specifies exactly what inputs must be reviewed and what outputs must be produced — more rigorous than old §820.20(c)
Competence evaluation: Old §820.20 required "adequate" personnel; ISO 13485 §6.2 requires formal competence determination, training, effectiveness evaluation, and records
Work environment: Old QSR addressed this in §820.70(c); ISO 13485 §6.4 consolidates it under resource management
Medical Device File: New concept under ISO 13485 §4.2.3 — each device or device family must have a dedicated file aggregating all relevant QMS documents and records
Background: SterileMed Manufacturing (hypothetical) is a contract manufacturer based in Singapore. It holds ISO 13485:2016 certification from a Notified Body. Its client base includes EU and Japanese OEMs. It has been approached by a US Class II device company to manufacture their sterile single-use laparoscopic instruments under a Supply Agreement. This will be the CDMO's first US-distributed product.
QMSR Compliance Gap Analysis — Actions Required:
1. Design Controls Assessment
SterileMed's ISO 13485 certification excludes §7.3 because all device designs are customer-supplied. Under QMSR Appendix A, this exclusion is not permitted. Action required: determine the scope of design responsibility. If SterileMed only manufactures to customer-locked specifications without modification, it may argue it is not performing design and development under the QMSR definition. However, if it specifies any manufacturing process parameters that affect design outputs, it must establish design controls. Recommend: negotiate a Design Control Matrix with the US client defining where each party's responsibility begins and ends; document this in the Quality Agreement.
2. Complaint Handling Upgrade to §820.198
SterileMed's existing complaint procedure meets ISO 13485 §8.2.2 but lacks: (a) a formal unit designated for US complaint handling; (b) a documented MDR evaluation step for each US complaint; (c) specific record content fields required by §820.198. Action required: revise complaint procedure to add MDR evaluation logic tree, define responsible US-designated unit (can be the client company under Quality Agreement), align complaint record format with §820.198 requirements.
3. English Language Records
SterileMed's quality records are maintained in English and Mandarin Chinese. For FDA inspection purposes, English versions must be the primary accessible versions. Action required: confirm all Device History Records, CAPA records, complaint files, and management review records are available in English; ensure FDA investigators have access during US inspections.
4. MDR Cross-Reference in QMS Procedures
No existing procedure connects ISO 13485 §8.5 CAPA activities to US MDR reporting timelines. Action required: add a procedure step (or new procedure) that routes US complaint-related CAPAs through a 21 CFR Part 803 evaluation; establish 30-day and 5-day MDR clocks in the QMS.
5. Record Retention Adjustment
SterileMed currently retains records for device lifetime + 2 years per ISO 13485. For the US product (single-use instruments, 3-year shelf life), FDA formula yields: 3 years (device lifetime) + 2 years = minimum 5 years from release. Current retention policy likely already meets this. Action required: verify retention calculation for each product type; if any product has a device lifetime exceeding current ISO-driven retention periods, update retention schedule.
§820.4 is brief but comprehensive: Manufacturers must meet ISO 13485:2016 (incorporated by reference with legal force) plus FDA Appendix A supplements. The entire QMSR regulatory framework flows from this single provision.
ISO 13485 §4 (Documentation): Four-tier document hierarchy; controlled documents require version management, approval, and distribution control; records require retention for device lifetime + 2 years minimum under FDA rules.
ISO 13485 §5 (Management): Top management accountability is formalized — quality policy, objectives, management representative, and especially management review with prescribed inputs and outputs. This is substantially more prescriptive than the old QSR.
ISO 13485 §6 (Resources): Competence-based training with effectiveness evaluation; infrastructure maintenance; work environment and contamination control documentation.
Appendix A FDA additions: Design controls cannot be excluded; complaint handling must meet §820.198 detail level including MDR evaluation; MDR and Part 806 cross-references must be built into QMS procedures; English language records must be available.
Document vs. Record distinction: Documents guide future action (mutable, version-controlled); records evidence past action (immutable, retention-controlled). Treating records as documents or vice versa is a common 483 finding.
21 CFR Part 820 — QMSR | FDA | ISO 13485:2016 §7 + FDA Appendix A additions
ISO 13485:2016 §7.3.1 — Design and Development General
The organization shall document procedures for design and development. *Note: Design and development controls may be excluded when justified. See §4.2.2.*21 CFR Part 820 Appendix A (QMSR FDA-Specific Requirements) — Design Controls
Notwithstanding any exclusion permitted under ISO 13485:2016 §7.3, manufacturers of finished devices subject to this part that are Class II or Class III devices, or Class I devices listed in §820.30(a)(2), shall establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met.§820.30(a) — Design and development planning (legacy text, now codified via ISO §7.3.2)
(1) Each manufacturer of any class III or class II device, and the class I devices listed in paragraph (a)(2) of this section, shall establish and maintain procedures to control the design of the device in order to ensure that specified design requirements are met.§820.30(b) — Design and development planning
Each manufacturer shall establish and maintain plans that describe or reference the design and development activities and define responsibility for implementation. The plans shall identify and describe the interfaces with different groups or activities that provide, or result in, input to the design and development process. The plans shall be reviewed, updated, and approved as design and development evolves.§820.30(c) — Design inputs
Each manufacturer shall establish and maintain procedures to ensure that the design requirements relating to a device are appropriate and address the intended use of the device, including the needs of the user and patient. The procedures shall include a mechanism for addressing incomplete, ambiguous, or conflicting requirements. The design input requirements shall be documented and shall be reviewed and approved by a designated individual(s).§820.30(d) — Design outputs
Each manufacturer shall establish and maintain procedures for defining and documenting design output in terms that allow an adequate evaluation of conformance to design input requirements. Design output procedures shall contain or make reference to acceptance criteria and shall ensure that those design outputs that are essential for the proper functioning of the device are identified. Design output shall be documented, reviewed, and approved before release.§820.30(e) — Design review
Each manufacturer shall establish and maintain procedures to ensure that formal documented reviews of the design results are planned and conducted at appropriate stages of the device's design development. The procedures shall ensure that participants at each design review include representatives of all functions concerned with the design stage being reviewed, as well as an individual(s) who does not have direct responsibility for the design stage being reviewed, when practicable. The results of a design review, including identification of the design, the date, and the individual(s) performing the review, shall be documented in the DHF.§820.30(f) — Design verification
Each manufacturer shall establish and maintain procedures for verifying the device design. Design verification shall confirm that the design output meets the design input requirements. The results of the design verification, including identification of the design, method(s), the date, and the individual(s) performing the verification, shall be documented in the DHF.§820.30(g) — Design validation
Each manufacturer shall establish and maintain procedures for validating the device design. Design validation shall be performed under defined operating conditions on initial production units, lots, or batches, or their equivalents. Design validation shall ensure that devices conform to defined user needs and intended uses and shall include testing of production units under actual or simulated use conditions. Design validation shall include software validation and risk analysis, where appropriate. The results of the design validation, including identification of the design, method(s), the date, and the individual(s) performing the validation, shall be documented in the DHF.§820.30(h) — Design transfer
Each manufacturer shall establish and maintain procedures to ensure that the device design is correctly translated into production specifications. These specifications shall be part of the device master record. Where a device design is transferred to an outside manufacturer, the receiving manufacturer must have access to the relevant design history file.§820.30(i) — Design changes
Each manufacturer shall establish and maintain procedures for the identification, documentation, validation or where appropriate verification, review, and approval of design changes before their implementation.§820.30(j) — Design History File (DHF)
Each manufacturer shall establish and maintain a DHF for each type of device. The DHF shall contain or reference the records necessary to demonstrate that the design was developed in accordance with the approved design plan and the requirements of this part.
"Design validation shall be performed under defined operating conditions on initial production units… and shall include testing of production units under actual or simulated use conditions."— 21 CFR §820.30(g), now incorporated via ISO 13485:2016 §7.3.7 + FDA Appendix A
21 CFR Part 820 — QMSR | FDA | ISO 13485:2016 §8 + §820.198 + MDR cross-references
Regulatory Basis: ISO 13485:2016 §8.3 / 21 CFR Part 820 QMSR incorporates ISO 13485 by reference. The organization shall ensure that product which does not conform to product requirements is identified and controlled to prevent its unintended use or delivery.
Core Requirements:
Identification: Nonconforming product must be clearly identified — labeling, tags, physical segregation, system flags in electronic batch records.
Segregation: Physical or system-based quarantine from conforming product. Separate holding areas with controlled access. The purpose is unambiguous — prevent mix-up, prevent inadvertent release.
Documentation: Written records describing the nonconformity, the product involved, quantities, dates discovered, and the disposition decision with rationale.
Disposition Decisions (§8.3.3):
Rework: Processing to bring product into conformance with specification. Requires written rework procedure, re-testing per the original acceptance criteria, and documentation that rework was performed. Rework must be evaluated for adverse effect on product.
Scrap / Destruction: Final disposition for product that cannot be reworked or accepted. Destruction must be documented — quantity, method, personnel, date.
Use-as-Is (Deviation/Concession): Acceptance of nonconforming product under a documented concession. Requires risk-based justification demonstrating the nonconformity does not affect safety, effectiveness, or essential performance. Customer or regulatory notification may be required. Cannot be used for safety-critical nonconformities.
Return to Supplier: For incoming material nonconformities — documented return with supplier notification and quarantine until resolution.
Re-verification After Rework (§8.3.4): Product that has been reworked shall be re-inspected or re-tested against original acceptance criteria. The re-inspection results shall be documented in the DHR (Device History Record).
Advisory Notice Considerations: If a nonconformity is discovered in distributed (released) product, the organization must evaluate:
Does it constitute a malfunction that could cause or contribute to serious injury if it recurs? → MDR evaluation required (21 CFR Part 803)
Does the nonconformity affect a significant number of devices? → Field Correction / Recall consideration (21 CFR Part 806)
Is an Advisory Notice to users required (ISO 13485 §8.3.4)?
Linkage to CAPA: A single nonconformity event may be handled as a deviation. However, if trend analysis reveals a pattern (same nonconformity type recurring), this must trigger a CAPA to address the systemic root cause. ISO 13485 §8.3 → §8.5.2 linkage is mandatory and must be documented.
Applying these regulatory guidelines in practice? Use our free validated calculators for risk management, sampling, and environmental monitoring.