21 CFR Part 820 is the U.S. federal regulation that sets manufacturing quality standards for medical devices. Published by the FDA under Title 21 of the Code of Federal Regulations, it tells companies exactly how to design, produce, package, label, store, and service their devices so that every unit is safe and performs as intended. All medical devices sold in the United States are subject to Part 820 unless a specific exemption applies.
As of February 2, 2026, the FDA renamed and restructured this regulation. It is now called the Quality Management System Regulation (QMSR) and incorporates by reference the international standard ISO 13485:2016, aligning U.S. requirements with the quality framework used in most other countries. Understanding both the original structure and the new direction is essential for anyone working in medical device manufacturing or compliance.
What the Regulation Covers
Part 820 functions as a current good manufacturing practice (CGMP) rule for medical devices. It doesn’t tell manufacturers how to build a specific product. Instead, it requires them to establish and follow a quality management system, a documented set of processes that controls every stage of a device’s lifecycle from initial design through production, distribution, and post-market servicing.
The regulation applies broadly. Class I, Class II, and Class III devices are all subject to it, though specific requirements may vary depending on a device’s risk classification. Component manufacturers, contract manufacturers, and repackagers can also fall under its reach depending on the activities they perform. There is no blanket exemption for low-risk devices; you need to check the specific classification regulation for your product to confirm which sections apply.
Design Controls
One of the most significant parts of the original regulation is the design controls section (820.30), which requires manufacturers to plan and document the entire design process for a device. The goal is straightforward: make sure the finished product actually meets the needs it was designed to address, and keep a paper trail proving it.
Design controls break down into several linked steps:
- Design input: Document user needs and intended uses in measurable terms. Resolve any requirements that are incomplete, ambiguous, or conflicting before moving forward.
- Design output: Translate those inputs into specifications, drawings, and acceptance criteria that can be objectively evaluated.
- Design review: Hold formal, documented reviews at key stages. These must include people from relevant departments and at least one person who is not directly responsible for the work being reviewed.
- Design verification: Confirm through testing or examination that the design output meets the design input. In plain terms, does the product meet its own specifications?
- Design validation: Confirm under actual or simulated use conditions that the device meets user needs and performs as intended. Validation is done on initial production units, not just prototypes, and must include software validation and risk analysis where appropriate.
- Design history file (DHF): Maintain a complete file for each device type that compiles all the records from every stage above.
The distinction between verification and validation trips up many manufacturers. Verification asks, “Did we build the product right?” Validation asks, “Did we build the right product?” Both are required, and both must be documented.
Process Validation
Some manufacturing processes can’t be fully checked by inspecting or testing the finished device. Sterilization is a classic example: you can’t verify that every unit in a batch is sterile without destroying it. For these processes, Part 820 requires validation with a “high degree of assurance,” meaning you must demonstrate through documented evidence that the process consistently produces acceptable results before relying on it in production.
Corrective and Preventive Action (CAPA)
CAPA is the backbone of continuous improvement under Part 820, and it is one of the areas FDA inspectors scrutinize most closely. The regulation requires manufacturers to maintain formal procedures that do seven specific things:
- Analyze quality data from complaints, returned products, audit reports, service records, and production processes to spot existing and potential problems. Statistical methods must be used when needed to detect recurring issues.
- Investigate root causes of nonconforming products or quality system failures.
- Identify corrective and preventive actions to fix current problems and stop them from recurring.
- Verify or validate that the chosen actions actually work and don’t create new problems for the finished device.
- Implement and record any changes to methods or procedures.
- Disseminate information about quality problems to the people responsible for preventing them.
- Submit relevant findings to management review.
Every step must be documented. A CAPA system that exists only in practice but not on paper will not pass an FDA audit.
Key Documentation Requirements
Part 820 is, at its core, a documentation regulation. Three record types form the foundation of any compliant quality system:
The Device Master Record (DMR) is the complete collection of procedures and specifications for a finished device. It includes device specifications like bills of materials and drawings, production process instructions, quality assurance procedures with acceptance criteria, packaging and labeling specifications, and installation or servicing procedures. Think of the DMR as the recipe: it tells your team exactly how to make and inspect the product.
The Device History Record (DHR) is the production history of a specific device or batch. It documents dates of manufacture, quantities produced and released, and acceptance records proving the device was made according to the DMR. It also tracks labeling: which labels were used, when they were examined, and who signed off. If the DMR is the recipe, the DHR is the log showing you followed it.
The Quality System Record (QSR) houses procedures and records that apply across your quality system rather than to a specific device. Training and qualification records, internal audit procedures and results, and management review documentation all live here.
Document control itself is a requirement. Manufacturers must have procedures for reviewing, approving, and updating documents so that obsolete versions don’t end up on the production floor.
The 2026 Transition to QMSR
For decades, Part 820 existed as a standalone U.S. regulation, separate from the ISO 13485 standard that most other countries recognize. This created a dual compliance burden for manufacturers selling devices globally: you had to maintain a quality system satisfying Part 820 for the U.S. market and ISO 13485 for everywhere else.
The FDA published a final rule in February 2024 that overhauled Part 820. Effective February 2, 2026, the regulation is now titled the Quality Management System Regulation (QMSR) and incorporates ISO 13485:2016 by reference. In practical terms, this means the ISO standard’s requirements now carry the force of U.S. federal law for medical device manufacturers.
The restructured Part 820 is significantly streamlined. The old Subparts C through O, which covered design controls, production, CAPA, and other areas in detail, are now reserved. In their place, Subpart A contains general provisions, scope, and definitions, while Subpart B holds supplemental provisions on record control and device labeling and packaging. The bulk of the substantive quality system requirements now come from ISO 13485 itself.
For manufacturers already certified to ISO 13485, the transition simplifies compliance. For those who built their quality system solely around the old Part 820, the shift requires mapping existing procedures to the ISO framework, identifying gaps, and updating documentation before the effective date. The core principles, designing devices systematically, controlling production, investigating problems, and documenting everything, remain the same. The structure around them has changed to match the rest of the world.