10 CFR Part 21: A Clear Guide to Reporting Defects in 2026

10 CFR Part 21 is the NRC regulation that turns a quality problem into a reporting obligation. Under Section 206 of the Energy Reorganization Act, anyone who builds a licensed nuclear facility or supplies a basic component for one must evaluate deviations, decide within 60 days whether they amount to a defect that could create a substantial safety hazard, and tell the NRC within two days of concluding that they do. It is the regulation that makes an NQA-1 program consequential outside the plant fence: a supplier’s nonconformance report can become a federal filing. This guide explains who 10 CFR Part 21 reaches, the definitions that decide whether something is reportable, the four clocks, what the report must contain, and the posting and records duties most suppliers overlook.

Who 10 CFR Part 21 applies to

Section 21.2 sets the scope. It reaches NRC licensees and applicants — for source, byproduct and special nuclear material, production and utilization facilities, spent fuel storage installations and repositories — and their directors and responsible officers. It also reaches, and this is the part that matters for the supply chain, “each individual, corporation, partnership, or other entity doing business within the United States” that constructs a licensed facility or “supplies basic components” for one. Consulting, design, analysis, inspection and testing services associated with a basic component are inside the definition of basic component too. The most recent amendment (91 FR 15775, 30 March 2026) added references to the Part 53 licensing framework alongside Parts 50 and 52, so the rule covers advanced reactor licensees and their suppliers on the same terms.

Two consequences follow. First, a supplier does not need an NRC licence to be bound by Part 21; supplying a basic component is enough. Second, the obligation attaches to named people — directors and responsible officers — not only to the company. Section 21.61 provides civil penalties for a director or responsible officer who “knowingly and consciously fails to provide the notice required”.

The definitions that decide reportability

Almost every Part 21 argument turns on four defined terms in section 21.3.

Two further definitions bind dedication to Part 21. A dedicating entity — the manufacturer, a third party or the licensee — is responsible under 21.21(c) for identifying and evaluating deviations, reporting defects for dedicated items, and maintaining auditable records of the dedication process. And critical characteristics are the design, material and performance characteristics of a commercial grade item that, once verified, give reasonable assurance it will perform its safety function. Our guide to commercial grade dedication covers the acceptance methods; Part 21 is what makes the dedicating entity answerable for the result.

The four clocks in 10 CFR Part 21

Section 21.21 sets out the procedure every entity in scope “shall adopt”. The timescales are fixed and run from defined events.

Three points about the clocks catch suppliers out.

• The 60 days is a ceiling, not a target. The rule says “as soon as practicable” first. An evaluation that routinely uses all 60 days invites the question why.
• The interim report is mandatory, not optional. If the evaluation cannot be completed inside 60 days, an interim report goes to the NRC in writing within those 60 days. Suppliers who treat the interim report as an extension request have misread it: it is a filing.
• The 2-day clock is short and starts on receipt. It runs from the moment the director or responsible officer receives the information, which is why 21.21(a)(3) requires them to be told within 5 working days of the evaluation completing. The two rules together mean an evaluation completed on a Monday must be with the NRC by the Wednesday of the following week at the latest — and usually much sooner.

When a supplier cannot evaluate

Section 21.21(b) addresses the common case where a supplier finds a deviation but does not have the design information to judge whether it creates a substantial safety hazard — the component’s safety function depends on how the licensee uses it. In that case the supplier “must inform the purchasers or affected licensees within five working days of this determination” so that they can evaluate it. This is not a way out of Part 21; it moves the evaluation to the party that can perform it, and the supplier’s notification has to be documented and retained.

What the 10 CFR Part 21 written report must contain

Section 21.21(d)(4) lists the minimum content of the 30-day written notification, “to the extent known”:

1. Name and address of the individual or individuals informing the Commission.
2. Identification of the facility, activity or basic component that fails to comply or contains a defect.
3. Identification of the firm constructing the facility or supplying the basic component.
4. Nature of the defect or failure to comply and the safety hazard created or that could be created.
5. The date the information was obtained.
6. For a basic component, the number and location of the components in use at, supplied for, or being manufactured for licensed facilities or activities.
7. The corrective action taken, being taken or planned; the person or organization responsible; and the time it has taken or will take.
8. Any advice about the defect given, being given or to be given to purchasers or licensees.
9. For an early site permit, the entities to whom it was transferred.

Item 6 is the one that needs a working records system: a supplier who cannot say where its basic components went cannot complete the report. That is why 21.51 requires suppliers to retain a record of purchasers of basic components for 10 years after delivery.

Posting, procurement documents and records

Three 10 CFR Part 21 duties sit outside the evaluation-and-report sequence and are the most common inspection findings.

Posting (21.6)

Every entity in scope must post current copies of Part 21, Section 206 of the Energy Reorganization Act, and its own Part 21 procedures “in a conspicuous position on any premises within the United States where the activities subject to this part are conducted”. Where posting the full documents is impractical, a notice describing them, naming the individual to whom reports may be made and stating where they can be examined, is acceptable — but Section 206 must still be posted.

Procurement documents (21.31)

Each procurement document for a facility or basic component must specify, when applicable, that Part 21 applies. This is the flow-down clause: it is how a licensee’s obligation reaches a tier-two machine shop, and its absence from a purchase order is a finding against the purchaser. It pairs with NQA-1 Requirement 4, Procurement Document Control.

Records (21.51)

Retain evaluations of all deviations and failures to comply for at least 5 years after the evaluation; retain notifications sent to purchasers and licensees for at least 5 years; retain the record of purchasers of basic components for 10 years after delivery. Section 21.41 gives the NRC the right to inspect records, premises, activities and basic components.

Building the Part 21 procedure inside an NQA-1 program

Part 21 does not stand alone. It sits on top of the nonconformance and corrective action processes of an Appendix B program — NQA-1 Requirements 15 and 16 — and the evaluation it demands is a screening step inside them. A workable procedure does five things: defines who screens every nonconformance for potential Part 21 applicability and documents that screening (which fixes the discovery date); assigns the evaluation to someone with the design knowledge to judge safety significance, with a route to the purchaser under 21.21(b) when that knowledge is not in-house; sets internal deadlines shorter than the regulatory ones; names the director or responsible officer and the designated notifier under 21.21(d)(5); and closes the loop into the corrective action program so that the “corrective action” item of the written report is real. Our guide to the corrective action program covers the second half; the 18 criteria of Appendix B cover the program it lives in.

Frequently asked questions

Does 10 CFR Part 21 apply to suppliers without an NRC licence?
Yes. Section 21.2 reaches any entity doing business in the United States that supplies basic components for a licensed facility or activity, and their directors and responsible officers, whether or not they hold a licence.

What is the difference between a deviation and a defect?
A deviation is a departure from procurement or design requirements. It becomes a defect only if evaluation shows it could create a substantial safety hazard — a major reduction in the protection of public health and safety.

How long do we have to report?
Evaluate within 60 days of discovery; inform the director or responsible officer within 5 working days of completing the evaluation; notify the NRC Operations Center within 2 days of the officer receiving the information; file the written report within 30 days.

What if we cannot tell whether it is a safety hazard?
Under 21.21(b) a supplier that cannot perform the evaluation must inform the purchasers or affected licensees within five working days so they can evaluate it. Document that notification.

Does Part 21 apply to commercial grade items?
Once a commercial grade item is dedicated for safety-related use it is a basic component, and the dedicating entity carries the Part 21 evaluation, reporting and records duties for it under 21.21(c).

Where this leaves you

Treat 10 CFR Part 21 as four clocks and three standing duties. Screen every nonconformance so discovery is dated, evaluate inside 60 days or file the interim report, get the finding to the responsible officer inside 5 working days and to the NRC inside 2, and keep the postings, the procurement flow-down and the 5- and 10-year records that an inspector will ask for first.

References

• 10 CFR Part 21 — Reporting of Defects and Noncompliance — The regulation on the eCFR, as amended 30 March 2026.
• 10 CFR 50 Appendix B — The quality assurance criteria the Part 21 procedure sits inside.

More on nuclear quality assurance

• 10 CFR Part 21 — you are here
• NQA-1 and which edition binds you
• 10 CFR 50 Appendix B: the 18 criteria
• Commercial grade dedication: four methods
• The corrective action program
• NQA-1 vs ISO 9001: six differences

A Part 21 evaluation and reporting procedure, the screening form, the notification templates and the nonconformance and corrective action procedures it connects to are in the NQA-1 Nuclear Quality Assurance Toolkit, or start with the free templates.