21 CFR 820

FDA 21 CFR Part 820 outlines Current Good Manufacturing Practice (cGMP) regulations that govern the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use. These requirements are meant to ensure that medical devices are safe and effective.

From 1996 to 2025, Part 820 was Quality System Regulation (QSR) and included requirements broken into 15 subparts. In 2024, the FDA issued an amended rule that changes Part 820 to the Quality Management System Regulation (QMSR), which fully incorporates ISO 13485:2016 with modifications and additional requirements.

Certification to Part 820 (QMSR) is not possible. Instead, businesses comply with the regulation to ensure safe and quality product, and to show due diligence to the US FDA. Typical businesses that comply with the standard are as follows:

• Finished medical device manufacturers
• Suppliers to medical device manufacturers
• Distributors to medical device manufacturers

ISO 13485, and therefore 21 CFR Part 820, requires auditing to verify the effectiveness of the quality system. The auditing must be performed by properly trained individuals that are impartial or unbiased against the areas they are auditing. Additionally, the standard and regulation require that follow-up on deficient items be performed to ensure adequate remediations. Excerpts from the incorporated ISO 13485, Internal Audit §8.4.2 are listed below:

“The organization shall conduct internal audits at planned intervals to determine whether the quality management system:

a) conforms to planned and documented arrangements, requirements of this International Standard, quality management system requirements established by the organization, and applicable regulatory requirements;

b) is effectively implemented and maintained.”

“The selection of auditors and conduct of audits shall ensure objectivity and impartiality of the audit process. Auditors shall not audit their own work.”
“The management responsible for the area being audited shall ensure that any necessary corrections and corrective actions are taken without undue delay to eliminate detected nonconformities and their causes. Follow-up activities shall include the verification of the actions taken and the reporting of verification results.”

We have compiled the following resources to help educate you about QMSR and the changes:

• More about QMSR learn more from our QMSR page.
• ISO 13485 FREE read-only version via ANSI IBR Standards Portal
• ISO 13485:2016 Purchase the standard
• FDA QMSR Federal Register Listing
• AAMI TIR102:2019 Purchase the official mapping of 21 CFR applicable regulatory requirements to ISO 13485
•