21 CFR 820 Explained: FDA QSR, QMSR, and ISO 13485

July 11, 2026 · QualityManager Team

21 CFR Part 820 is the FDA regulation that sets minimum quality system requirements for anyone who designs, manufactures, or distributes medical devices sold in the United States. As of February 2, 2026, Part 820 has been amended into the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference rather than restating FDA-specific requirements.

If you’re building a medical device company, this regulation is not optional reading — it’s the baseline FDA inspectors check against. Here’s what it actually requires, what changed with the QMSR, and where to start if you’re facing it for the first time.

What is 21 CFR 820?

21 CFR 820 sits in Title 21 of the Code of Federal Regulations, the section FDA uses to regulate food and drugs — Part 820 specifically covers medical devices. It’s commonly called the Quality System Regulation, or QSR, and it has governed US device manufacturing since it replaced the original 1978 Good Manufacturing Practice regulation in 1996.

The regulation doesn’t tell you how to build your product. It tells you what controls your quality management system must have so that your product is consistently safe and effective: documented procedures, design verification, supplier controls, corrective action when things go wrong, and traceable records. FDA inspectors use it as their checklist during facility inspections.

What changed with the QMSR in 2026?

For nearly three decades, FDA maintained its own device quality language in Part 820 that ran parallel to, but was not identical to, the international standard ISO 13485. Manufacturers selling in both the US and international markets often maintained two overlapping quality systems, or one system mapped awkwardly to both.

FDA published the Quality Management System Regulation (QMSR) final rule on February 2, 2024, amending Part 820 to incorporate ISO 13485:2016 by reference as the core quality system standard, with a small number of FDA-specific additions layered on top (such as complaint handling and reporting requirements unique to US law). The rule set a two-year transition period, and the QMSR became the enforced standard on February 2, 2026.

Practically, this means: if your quality management system already conforms to ISO 13485:2016, you are most of the way to QMSR compliance. If you were running an older QSR-only system that never aligned to ISO 13485, you need to close the gap now — the transition period is over. Because regulatory text and enforcement guidance can be updated, treat this article as an orientation, not a legal reading, and check current requirements at fda.gov before making compliance decisions.

What does 21 CFR 820 (QMSR) actually require?

The regulation is organized into subparts, each covering a category of quality system control. This is the map most quality teams build their QMS structure around, whether they call it “Part 820” or “QMSR” internally.

Design controls and CAPA are the two areas FDA investigators scrutinize most closely, because weak design history or a CAPA system that closes issues without verifying they actually stopped recurring are the most common sources of serious findings.

21 CFR 820 vs ISO 13485 vs QMSR: what’s the difference now?

Since these three terms get used interchangeably and inaccurately, here’s how they actually relate to each other.

The practical upshot: a company already certified to ISO 13485:2016 is well positioned for QMSR, but certification alone doesn’t guarantee an FDA inspector will find no gaps — FDA’s additions and its own inspection approach still apply.

What does an FDA inspection under the QMSR look like?

FDA typically inspects using the Quality System Inspection Technique (QSIT), which samples four areas: management controls, design controls, corrective and preventive action, and production/process controls, on the theory that a system with strong controls in these four areas is likely sound throughout. The investigator reviews records, interviews staff, and walks the production floor.

Nonconformances are documented on a Form 483. The firm has an opportunity to respond in writing, typically within 15 business days, describing the corrective action it will take. Serious or unresolved findings can escalate to a warning letter, import alert, or in extreme cases an injunction — but the large majority of inspections result in a 483 (if anything) that gets closed through a documented corrective action, not an enforcement action.

First 5 things a small device startup should do

Founders facing 21 CFR 820 for the first time usually make the same mistake: they treat the QMS as a paperwork exercise to finish right before FDA submission. That backfires, because design controls and document history are supposed to be built as you go, not reconstructed after the fact.

1. Write your quality policy and identify a management representative. This is the management responsibility backbone the rest of the system hangs on — it doesn’t need to be elaborate, but it needs to exist and be signed.
2. Open a design history file the day design work starts, not when you file for clearance. Retroactively reconstructing design inputs, reviews, and verification records is far harder than capturing them in real time.
3. Stand up document control before you have very many documents. Decide now how SOPs get drafted, reviewed, approved, and revised — this is the single most common early-audit weak spot, and it only gets harder to fix as the document set grows. Document control starts with well-written SOPs; QualityManager.AI’s free AI SOP generator drafts a structured first version so your quality lead is editing, not starting from a blank page.
4. Set up a CAPA log from day one, even before you have a formal CAPA process document. Recording the first few nonconformances and how you resolved them gives you real evidence of a working system, not just a procedure that’s never been used. Our CAPA process guide covers how to structure this.
5. Map your supplier and purchasing controls before your first outsourced build. Know which suppliers are “critical” to device quality, and have a basic qualification and incoming-inspection plan for them before parts arrive, not after a nonconformance traces back to one.

None of this requires expensive software on day one. It requires a habit of writing things down as they happen and organizing them the way Part 820/QMSR expects.

A note on scope

This article summarizes the structure and intent of 21 CFR 820 and the QMSR transition; it is not legal or regulatory advice, and specific applicability depends on your device classification, intended market, and current FDA guidance. For binding requirements, always check the current regulation text and FDA’s own QMSR guidance at fda.gov rather than a secondary source, including this one.

If you’re comparing software to help run this system day-to-day, our best QMS software roundup covers what to look for at different company stages, and what is an SOP is a good starting point if document control is your current gap.