FDA quality system requirements for medical devices

A manufacturer engaged in any of the following for a finished device intended for human use must establish and maintain a quality management system appropriate to its specific devices.¹

• design
• manufacture
• packaging
• labeling
• storage
• installation
• servicing

The system must be documented so that it complies with the applicable requirements of ISO 13485:2016, which is incorporated by reference into 21 CFR Part 820, together with the additional requirements written into the part itself.¹ Design and development controls under Clause 7.3 of ISO 13485 and its subclauses apply to manufacturers of class II devices, class III devices and the class I devices named in § 820.10(c).¹ Part 820 has been the Quality Management System Regulation since February 2026, and the terms of the former Quality System Regulation no longer appear in it.

What the regulation covers and who it binds

Part 820 sets out the current good manufacturing practice requirements for devices. It governs the methods used in, and the facilities and controls used for, the following activities on all finished devices intended for human use:

• design
• manufacture
• packaging
• labeling
• storage
• installation
• servicing

The part applies to any finished device manufactured in any State or Territory of the United States, the District of Columbia or the Commonwealth of Puerto Rico, and to any finished device imported or offered for import into the United States.¹ A finished device is any device or accessory to a device that is suitable for use or capable of functioning, whether or not it is packaged, labeled or sterilized.¹

The persons bound are manufacturers, defined in § 820.3(b) as any person who designs, manufactures, fabricates, assembles or processes a finished device. That definition reaches the following.¹

• contract sterilizers
• installers
• relabelers
• remanufacturers
• repackers
• specification developers
• initial distributors of foreign entities performing those functions

Where a manufacturer engages in only some of the operations subject to the part, it need only comply with the requirements applicable to the operations in which it is engaged.¹

Manufacturers of components or parts of finished devices are outside the part, though the regulation encourages them to consider its provisions as appropriate.¹ Manufacturers of blood and blood components for transfusion or further manufacturing are subject to subchapter F instead.¹ Manufacturers of HCT/Ps that are regulated as devices are within the part, and are also subject to the donor-eligibility requirements in part 1271 subpart C and the current good tissue practice requirements in part 1271 subpart D.¹

How ISO 13485 operates inside the regulation

Section 820.10(a) requires the manufacturer to document a quality management system that complies with the applicable requirements of ISO 13485 and the other applicable requirements of Part 820.¹ The definitions in ISO 13485 and in Clause 3 of ISO 9000 apply, subject to the substitutions in § 820.3(b).¹ The term “organization” in the standard carries the meaning of “manufacturer” as defined in Part 820, so each clause addressed to the organization binds the manufacturer.¹ Definitions in section 201 of the Federal Food, Drug, and Cosmetic Act supersede the correlating ISO 13485 terms, including device and labeling.¹ “Safety and performance” carries the meaning of “safety and effectiveness”, and its use does not relieve a manufacturer of any obligation to implement controls that give reasonable assurance of safety and effectiveness.¹

Where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or its other implementing regulations, the statute and those regulations control.¹ Section 820.10(b) names four points where the standard must be read together with other United States regulations. Unique device identification under Clause 7.5.8 must follow part 830. Traceability under Clause 7.5.9.1 must follow part 821 where applicable. Reporting to regulatory authorities under Clause 8.2.3 requires notification of FDA of complaints that meet the reporting criteria of part 803. Advisory notices under Clauses 7.2.3, 8.2.3 and 8.3.3 must be handled in accordance with part 806.¹

The record terminology changed between the previous regulation and the present text. The current Part 820 text uses the medical device file of ISO 13485, and the definition of rework in § 820.3(b) is framed against the specified requirements in that file.¹ The design history file, device master record and device history record of the former regulation are absent from the text now in force.

From what point design and development requirements apply

Clause 7.3 of ISO 13485 and its subclauses bind manufacturers of class II devices and class III devices.¹ They also bind manufacturers of two categories of class I device. The first is class I devices automated with computer software. The second consists of the five devices listed in table 1 to § 820.10(c)(2).¹

• the tracheobronchial suction catheter (§ 868.6810)
• the non-powdered surgeon’s glove (§ 878.4460)
• the protective restraint (§ 880.6760)
• the manual radionuclide applicator system (§ 892.5650)
• the radionuclide teletherapy source (§ 892.5740)

Clause 7.3 does not apply to the remaining class I devices.¹

The general obligation in § 820.1(a) is broader than Clause 7.3. A manufacturer that performs design work on a finished device is engaged in an operation subject to the part, and must maintain a quality management system covering that operation.¹ For a device within § 820.10(c), the following requirements of Clause 7.3 govern the development work itself, rather than attaching only at the point of commercial manufacture.

• planning
• inputs
• outputs
• review
• verification
• validation
• transfer
• change control
• design file

Manufacturers of devices that support or sustain life must also comply with Clause 7.5.9.2 on traceability for implantable devices, where failure of the device to perform when properly used in accordance with its labeling can reasonably be expected to result in significant injury.¹ That requirement is additional to all other applicable requirements of the part. An implantable medical device takes the meaning of “implant” in § 860.3.¹

Records the regulation adds to the standard

Section 820.35 adds record content requirements to Clause 4.2.5 of ISO 13485. For complaints, the manufacturer must maintain records of the review, evaluation and investigation of any complaint involving a possible failure to meet specifications. This covers the device, its labeling or its packaging.¹ Where an investigation has already been performed for a similar complaint, a further investigation is not necessary, and the manufacturer must keep records justifying that decision.¹ For complaints reportable under part 803, complaints the manufacturer determines must be investigated and complaints it investigates in any event, the record must capture the following:

• the name of the device
• the date the complaint was received
• any UDI or UPC and any other device identification
• the name, address and phone number of the complainant
• the nature and details of the complaint
• any correction or corrective action taken
• any reply to the complainant

Servicing records under Clause 7.5.4 must state, at a minimum, the name of the device serviced, any UDI or UPC and other identification, the date of service, the individuals who serviced the device, the service performed and any test and inspection data.¹ The UDI must be recorded for each medical device or batch of medical devices.¹ Records the manufacturer deems confidential may be marked to assist FDA in determining whether the information may be disclosed under part 20.¹

Section 820.45 adds labeling and packaging controls to Clause 7.5.1. The manufacturer must document and maintain procedures describing the activities that ensure integrity, inspection, storage and operations for labeling and packaging during processing, storage, handling, distribution and use.¹ Labeling and packaging must be examined for accuracy before release or storage, covering the correct UDI or UPC or other identification, expiration date, storage instructions, handling instructions and any additional processing instructions.¹ The release of labeling for use must be documented under Clause 4.2.5.¹ Operations must be established and maintained to prevent mixups, including inspection before use to confirm that all devices bear the labeling and packaging specified in the medical device file.¹

Combination products

A device that is a constituent part of a combination product is treated as a finished device within the meaning of the QMSR.² Part 820 applies to any combination product that includes a device constituent part, and parts 210 and 211 apply to any combination product that includes a drug constituent part other than a medical gas.² Part 213 applies where the drug constituent part is a medical gas, and part 1271 applies where the product includes an HCT/P.²

For single-entity and co-packaged combination products, § 4.4 offers two routes. The manufacturer may comply with the specifics of each applicable set of regulations, or it may operate a single system built on one set and demonstrate compliance with a defined list of provisions from the other.² A system shown to comply with the drug or medical gas CGMP requirements must additionally satisfy §§ 820.10, 820.35(a) and 820.35(b), together with the following clauses of ISO 13485.²

• Clause 4.1
• Clause 5
• Clause 6.1
• Clause 7.3
• Clause 7.4
• Clause 7.5.3
• Clause 7.5.4
• Clause 8.2.2
• Clause 8.4
• Clause 8.5

A system shown to comply with the QMSR must additionally satisfy the listed drug provisions, which include the following.²

• § 211.84
• § 211.103
• § 211.132
• § 211.137
• § 211.165
• § 211.166
• § 211.167
• § 211.170

Timing matters at facility level. While a constituent part is manufactured at a facility separate from the other constituent parts, the operating system at that facility must comply with all CGMP requirements applicable to that type of constituent part.² Once two or more types of constituent part have arrived at the same facility, or their manufacture is proceeding there, the streamlined system under § 4.4(b) may begin.² The sets of requirements supplement each other, and the regulation most specifically applicable to the constituent part in question supersedes the more general.²

Enforcement, variances and imported devices

Failure to comply with any applicable requirement of Part 820 renders the device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act.¹ The device and any person responsible for the failure are subject to regulatory action.¹ A device imported or offered for import is subject to refusal of admission under section 801(a) if it appears to be adulterated.¹

A manufacturer subject to a requirement under section 520(f)(1) may petition for an exemption or variance under section 520(f)(2), following the procedures in § 10.30.¹ FDA may also initiate and grant a variance where it determines this to be in the best interest of the public health, including where there is a public health need for the device and the device would not likely be made sufficiently available otherwise.¹ Such a variance remains in effect only while that need and that shortage of availability persist.¹

Questions people also ask

Does the current Part 820 still require a device master record and a device history record?

The regulation in force incorporates ISO 13485:2016 and uses its terminology. The text refers to the medical device file, for example in the definition of rework in § 820.3(b) and in the labeling controls in § 820.45(c).¹ The terms device master record, device history record and design history file do not appear in the current part.

Do manufacturers of class I devices have to apply design and development controls?

Clause 7.3 of ISO 13485 applies to class I devices automated with computer software and to the five class I devices listed in table 1 to § 820.10(c)(2).¹ Manufacturers of other class I devices remain subject to the rest of the quality management system requirements that apply to their operations.¹

Does Part 820 apply to a supplier that makes only components?

The provisions of the part do not apply to manufacturers of components or parts of finished devices, although the regulation encourages such manufacturers to consider its provisions as appropriate.¹ Purchasing controls under ISO 13485 remain the responsibility of the finished device manufacturer.

Which quality requirements apply to a drug-device combination product?

Part 820 applies because of the device constituent part, and parts 210 and 211 apply because of the drug constituent part.² Section 4.4 permits a single operating system built on one of those sets, provided the listed provisions of the other set are also shown to have been satisfied.² The requirements supplement one another rather than displacing one another.²

Are foreign manufacturers subject to the same quality management system requirements?

The part applies to finished devices imported or offered for import into the United States.¹ A device that appears to be adulterated is subject to refusal of admission under section 801(a) of the Federal Food, Drug, and Cosmetic Act.¹

Does an ISO 13485 certificate establish compliance with Part 820?

Part 820 incorporates ISO 13485:2016 by reference and adds requirements in §§ 820.10, 820.35 and 820.45, along with the cross-references to parts 803, 806, 821 and 830.¹ Definitions from section 201 of the Federal Food, Drug, and Cosmetic Act supersede the correlating terms in the standard, and the statute controls in the event of conflict.¹

Footnotes

1. 21 CFR Part 820, Quality Management System Regulation. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-820 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²² ↩²³ ↩²⁴ ↩²⁵ ↩²⁶ ↩²⁷ ↩²⁸ ↩²⁹ ↩³⁰ ↩³¹ ↩³² ↩³³ ↩³⁴ ↩³⁵ ↩³⁶ ↩³⁷ ↩³⁸ ↩³⁹ ↩⁴⁰ ↩⁴¹ ↩⁴² ↩⁴³ ↩⁴⁴ ↩⁴⁵ ↩⁴⁶ ↩⁴⁷

2. 21 CFR Part 4, Regulation of Combination Products. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-4 ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹²