21 CFR Part 820: The Complete 2026 Section-by-Section Guide

21 CFR Part 820 is now one of the shortest parts in the medical device chapter, and that surprises people who last read it under the old Quality System Regulation. Since the Quality Management System Regulation took effect on 2 February 2026, the part has nine sections — four of them reserved — and everything else it used to say now comes from ISO 13485:2016, incorporated by reference.

This guide walks 21 CFR Part 820 section by section: what each one requires, which are reserved, and which requirements an ISO 13485 quality system does not already satisfy.

What this guide covers

• What 21 CFR Part 820 contains now
• 21 CFR Part 820.1 — Scope
• 820.3 — Definitions, and where FDA overrides ISO
• 820.7 — Incorporation by reference
• 21 CFR Part 820.10 — The quality management system requirement
• 820.35 — Control of records
• 820.45 — Device labeling and packaging controls
• What is not in 21 CFR Part 820 any more
• How 21 CFR Part 820 is inspected
• Frequently asked questions
• Where to go next

What 21 CFR Part 820 contains now

Six substantive sections. The old part had 31. Citing a reserved section as a live requirement — 820.40 is the usual offender, because it was “Document controls” and the number gets carried across — is a visible error in a mapping matrix.

21 CFR Part 820.1 — Scope

Applicability under 21 CFR Part 820 turns on the operations you perform. The part governs the methods, facilities and controls used for the design, manufacture, packaging, labeling, storage, installation and servicing of all finished devices intended for human use. A manufacturer engaged in only some of those operations need comply only with the requirements applicable to those operations.

Crucially, “manufacturer” reaches further than people expect: contract sterilisation, installation, relabeling, remanufacturing, repacking, specification development, and initial distributors of foreign entities performing those functions.

Three carve-outs. Components and parts are outside the part, though their makers are encouraged to consider it. Blood and blood components for transfusion or further manufacturing fall under subchapter F. HCT/Ps are in scope only where regulated as devices.

820.3 — Definitions, and where FDA overrides ISO

This is the section that changes the meaning of clauses elsewhere. Definitions come from three places: ISO 13485, ISO 9000 Clause 3, and 21 CFR Part 820 itself.

Terms 820.3(a) adds because they are not used or defined in the incorporated standards: batch or lot, component, Federal Food Drug and Cosmetic Act, finished device, HCT/P regulated as a device, and remanufacturer.

Definitions that supersede the ISO wording under 820.3(b):

The Organization row is the one most quality systems miss, and it is why contract manufacturers and specification developers cannot treat ISO clauses as somebody else’s problem.

820.7 — Incorporation by reference

21 CFR Part 820 incorporates two standards: ISO 13485:2016(E) third edition, 1 March 2016, for sections 820.1, 820.3, 820.10, 820.35 and 820.45; and ISO 9000:2015(E) Clause 3, fourth edition, 15 September 2015, for the definitions in 820.3.

Incorporation by reference pins those editions until FDA amends the regulation. A later ISO edition does not apply automatically, so “updating” a QMSR quality system to a newer edition is a compliance error rather than housekeeping.

21 CFR Part 820.10 — The quality management system requirement

The load-bearing section of 21 CFR Part 820, in five parts.

(a) Document a quality management system complying with the applicable requirements of ISO 13485 and the other applicable requirements of this part.

(b) Comply with other applicable requirements in title 21 to fully comply with a listed ISO clause. Four bridges are named:

(c) Design and development under Clause 7.3 applies to class II, class III, and class I devices automated with computer software — plus five named class I types: tracheobronchial suction catheter (868.6810), non-powdered surgeon’s glove (878.4460), protective restraint (880.6760), manual radionuclide applicator system (892.5650) and radionuclide teletherapy source (892.5740).

(d) Devices that support or sustain life, where failure in proper use could reasonably be expected to cause significant injury, must also meet Clause 7.5.9.2 implantable traceability. Note this is not limited to implanted devices.

(e) Failure to comply with any applicable requirement renders the device adulterated under FD&C section 501(h), and the device and any person responsible are subject to regulatory action.

820.35 — Control of records

This supplements ISO 13485 Clause 4.2.5 rather than replacing it, in four ways.

(a) Complaint records must carry seven data elements: device name; date received; any UDI or UPC and other identification; complainant name, address and phone; nature and details; any correction or corrective action; and any reply. Records of review, evaluation and investigation are required for any complaint involving possible failure of a device, labeling or packaging to meet specifications — and where no investigation is performed because a similar complaint was already investigated, the justification must be recorded.

(b) Servicing records must carry six: device name; UDI or UPC and other identification; date of service; who serviced it; the service performed; and any test and inspection data.

(c) The UDI must be recorded for each device or batch — a separate obligation from assigning it and from printing it on a label.

(d) Records deemed confidential may be marked to aid FDA in deciding what may be disclosed under Part 20.

820.45 — Device labeling and packaging controls

The most prescriptive section in 21 CFR Part 820. It requires documented procedures giving a detailed description of activities ensuring integrity, inspection, storage and operations for labeling and packaging across processing, storage, handling, distribution and use.

Labeling must be examined for accuracy before release or storage, covering five items: the correct UDI, UPC or other identification; expiration date; storage instructions; handling instructions; and any additional processing instructions. Release of labeling for use must be documented per Clause 4.2.5, and mixup prevention requires inspection before use against the medical device file, with results documented.

What is not in 21 CFR Part 820 any more

Section 820.180(c) formerly exempted management review reports, internal quality audit reports and supplier audit reports from FDA review, allowing only a written executive certification that they had been performed. There is no section 820.180 in the current part, and FDA Compliance Program 7382.850 lists Internal Audits and Management Review as inspection elements. That protection is gone.

How 21 CFR Part 820 is inspected

Knowing the sections is only half of it. Since 2 February 2026 FDA has inspected under Compliance Program 7382.850, which replaced the Quality System Inspection Technique on the same day the QMSR took effect.

The program does not walk the part section by section. It organises the quality system into six QMS Areas — Change Control, Design and Development, Management Oversight, Measurement Analysis and Improvement, Outsourcing and Purchasing, and Production and Service Provision — containing 54 elements in total, each mapped to ISO 13485 clauses and, where relevant, to sections of 21 CFR Part 820.

Alongside those sit four Other Applicable FDA Requirements covering exactly the four parts 820.10(b) bridges to: 803, 806, 821 and 830. The regulation’s own cross-references and FDA’s inspection structure agree, which is a useful signal about where to concentrate.

Inspections are risk-based rather than sampled to a fixed pattern, and one inspection model requires at least one element from each of the six areas — so every area is touched, whatever the product.

Frequently asked questions

Is 21 CFR Part 820 the same as ISO 13485?

No, though it now depends on it. The part incorporates ISO 13485:2016 by reference and adds FDA-specific requirements in six substantive sections. Meeting the standard is necessary but not sufficient; the supplements in 820.10(b)–(e), 820.35 and 820.45 are additional.

Do we still need to follow the old subpart structure?

No, and continuing to organise a quality system around Subparts A to O will make an inspection harder than it needs to be. Compliance Program 7382.850 inspects against six QMS Areas mapped to ISO clauses, not against the old subparts.

Which sections apply if we only distribute?

It depends what you do. Applicability follows the operations performed, and initial distributors of foreign entities that perform covered functions are manufacturers under 820.3(b). Record the determination for each operation rather than assuming distribution is outside the part.

Where can I read the current 21 CFR Part 820 text?

eCFR carries the current consolidated text, and the Federal Register carries the final rule with its preamble, which is useful for understanding intent behind the supplements. Both are linked below.

Where to go next

For the change in context, start with the FDA QMSR guide. If you are moving an older quality system across, the QSR to QMSR transition maps all 31 former sections. For what an existing certificate does and does not cover, see QMSR vs ISO 13485.

The current text of 21 CFR Part 820 is on eCFR, and the final rule is on the Federal Register.

Our FDA QMSR Toolkit is built on exactly this structure — a document set per substantive section of 21 CFR Part 820, the four bridge procedures, and the record and labeling supplements, with the applicable-requirements register pre-loaded so every title 21 part that touches your device has a row.