FDA 21 CFR Part 820 is now the Quality Management System Regulation (QMSR). The final rule was published in the Federal Register on 2 February 2024 (89 FR 7496) and took effect on 2 February 2026. Since then, Part 820 incorporates ISO 13485:2016 by reference, and FDA inspects device manufacturers under Compliance Program 7382.850 instead of the Quality System Inspection Technique (QSIT) (FDA: QMSR FAQ).
The result is a much shorter regulation. The old subparts A to O with their detailed requirements are gone; most of the substance now sits in ISO 13485, and Part 820 adds the points FDA wanted to keep. This article walks through what the current text actually says, section by section. For the transition itself, see our earlier article on aligning 21 CFR 820 with ISO 13485:2016.
The structure of Part 820 today
The current 21 CFR Part 820 has two subparts and six sections. Subparts C to O are reserved.
| Section | Title | What it does |
|---|---|---|
| 820.1 | Scope | Who and what the QMSR applies to |
| 820.3 | Definitions | ISO 13485 and ISO 9000 definitions, with FDA overrides |
| 820.7 | Incorporation by reference | Incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015 |
| 820.10 | Requirements for a quality management system | The core obligation, plus links to other FDA regulations |
| 820.35 | Control of records | Additional content for complaint, servicing and UDI records |
| 820.45 | Device labeling and packaging controls | Additional labelling and packaging checks |
Source: 21 CFR Part 820 (eCFR).
Sections such as the former 820.30 (design controls) and 820.100 (CAPA) no longer exist. Procedures, templates and training that still cite them need updating to the ISO 13485 clause and the current Part 820 section.
Subpart A: General provisions
820.1 Scope
The QMSR governs the methods, facilities and controls used for the design, manufacture, packaging, labelling, storage, installation and servicing of finished devices intended for human use. It applies to devices made in the United States and to devices imported or offered for import. Manufacturers include those performing contract sterilisation, installation, relabelling, remanufacturing, repacking or specification development, and initial distributors of foreign entities performing these functions. Component manufacturers are not covered, but are encouraged to apply the regulation where appropriate.
Where an ISO 13485 clause conflicts with the FD&C Act or FDA's other regulations, the FD&C Act and those regulations take precedence (820.1(b)).
820.3 Definitions
The definitions in ISO 13485 and in Clause 3 of ISO 9000 apply, with two kinds of exceptions. First, the definitions in section 201 of the FD&C Act, such as "device" and "labeling", override the ISO terms. Second, FDA supersedes some ISO definitions:
Organization means "manufacturer" as defined in Part 820.
Rework is limited to action on nonconforming product before it is released for distribution.
Safety and performance has the meaning of "safety and effectiveness", and does not reduce the obligation to provide reasonable assurance of safety and effectiveness.
Part 820 also adds definitions that ISO 13485 lacks, including batch or lot, component, finished device and remanufacturer. Note that "component" explicitly includes software and firmware.
820.7 Incorporation by reference
This section incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015. Incorporation by reference means the clauses of ISO 13485 are enforceable as part of the regulation, not guidance.
820.10 Requirements for a quality management system
820.10 is the core of the QMSR. A manufacturer must:
(a) document a quality management system that complies with ISO 13485 and the other applicable requirements of Part 820;
(b) comply with other FDA regulations to fully meet specific ISO 13485 clauses:
Clause 7.5.8 (identification): unique device identification under 21 CFR Part 830;
Clause 7.5.9.1 (traceability): Part 821, where applicable;
Clause 8.2.3 (reporting to regulatory authorities): notify FDA of complaints that meet the Medical Device Reporting criteria of Part 803;
Clauses 7.2.3, 8.2.3 and 8.3.3 (advisory notices): handle them under Part 806, corrections and removals;
(c) comply with design and development, Clause 7.3, for class II and III devices, class I devices automated with computer software, and five listed class I devices;
(d) apply Clause 7.5.9.2, traceability for implantable devices, to devices that support or sustain life where failure could reasonably be expected to cause significant injury.
Under 820.10(e), failure to comply with any applicable requirement renders a device adulterated under section 501(h) of the FD&C Act.
For software, 820.10(c) matters most: class I devices automated with computer software are explicitly within design controls. Our article on FDA adverse event reporting covers the Part 803 link in 820.10(b)(3).
Subpart B: Supplemental provisions
820.35 Control of records
In addition to Clause 4.2.5 of ISO 13485, Part 820 requires specific content in some records:
| Record | Minimum content required by 820.35 |
|---|---|
| Complaints (820.35(a)) | Device name; date received; UDI or UPC and other identification; complainant's name, address and phone number; nature and details; any correction or corrective action; any reply |
| Servicing (820.35(b)) | Device name; UDI or UPC; date of service; who serviced it; service performed; test and inspection data |
| UDI (820.35(c)) | The UDI recorded for each device or batch |
Source: 21 CFR 820.35.
The complaint content applies to complaints reportable under Part 803, complaints the manufacturer decides to investigate, and complaints it investigated anyway. If a similar complaint has already been investigated, a new investigation is not needed, but the justification must be recorded. Records can be marked confidential to help FDA decide on public disclosure (820.35(d)).
820.45 Device labeling and packaging controls
In addition to Clause 7.5.1 of ISO 13485, manufacturers must document procedures for the integrity, inspection, storage and handling of labelling and packaging. Before release or storage, labelling and packaging must be checked for the correct UDI or UPC, expiry date, storage instructions, handling instructions and any additional processing instructions. The release of labelling must be documented, and labelling and packaging operations must prevent mix-ups.
What changed for inspections
According to FDA's QMSR FAQ:
FDA does not require ISO 13485 certificates, and a certificate does not exempt a manufacturer from inspection.
The former exception in 820.180(c) is not kept, so FDA can now inspect management review, quality audit and supplier audit reports.
FDA stopped using QSIT and inspects under Compliance Program 7382.850.
In our view, the second point is the one teams underestimate. Management review minutes and internal audit reports used to be shielded from routine review; they are now records an investigator can ask for, so they need to be written with that reader in mind. Our article on Form 483 and Warning Letters covers what happens after an inspection.
Common mistakes in QMSR files
Citing deleted sections. Procedures that still refer to 820.30, 820.100 or 820.198 should cite the ISO 13485 clause and current Part 820 section instead.
Treating ISO 13485 certification as sufficient. A certificate shows conformity to the standard, not compliance with 820.10(b), 820.35 or 820.45.
Dropping preventive action or the management representative. Both remain in ISO 13485 (Clauses 8.5.3 and 5.5.2), and therefore in the QMSR.
Missing the software scope. Class I software devices are within design controls under 820.10(c)(1).
A hypothetical example
Hypothetical example: a Dutch SaMD manufacturer holds ISO 13485 certification and sells a class II device in the US. Its complaint procedure still cites 820.198, and its complaint form has no field for the complainant's phone number or the device's UDI.
Under the QMSR, the procedure should cite ISO 13485 Clause 8.2.2 and 21 CFR 820.35(a), and the form needs every element listed in 820.35(a), including the UDI. The procedure also needs a step that checks each complaint against the Part 803 reporting criteria (820.10(b)(3)). The ISO certificate does not change any of this: an FDA investigator will check the records against Part 820 directly.
Conclusion
21 CFR Part 820 is now short, but not light. ISO 13485 carries most of the requirements, while 820.10, 820.35 and 820.45 add the links to UDI, traceability, Medical Device Reporting and corrections and removals, and the record and labelling details FDA wanted to keep. In our view, the quickest health check is to search your procedures for citations of deleted sections and for FDA-specific record content that the ISO-based templates leave out.
If you need help aligning your quality management system with the QMSR, our management system team can help, and our overview of the ISO 13485 quality management system covers the standard itself. You can also contact MedQAIR.
Frequently asked questions
When did the QMSR take effect?
On 2 February 2026. The final rule was published in the Federal Register on 2 February 2024 (89 FR 7496).
Does Part 820 still have subparts A to O?
No. Part 820 now has Subpart A (820.1 to 820.10) and Subpart B (820.35 and 820.45). Subparts C to O are reserved.
Is ISO 13485 certification required under the QMSR?
No. FDA does not require ISO 13485 certificates, and a certificate does not exempt a manufacturer from FDA inspection.
Does the QMSR apply to software as a medical device?
Yes, where the software is a device. Design and development (Clause 7.3) applies to class II and III devices and to class I devices automated with computer software (820.10(c)).
Can FDA review management review and internal audit records now?
Yes. The former exception in 820.180(c) was not kept, so FDA can inspect management review, quality audit and supplier audit reports.
What records does 820.35 add?
Specific content for complaint records, servicing records and UDI records, on top of ISO 13485 Clause 4.2.5.
