Patrick Blumentritt
Head of Consulting North,
Quality Management & Regulatory Affairs

Tel.: 07131 2774-40


Questions on this topic?

Send us a message!



21 CFR 820: FDA Quality System Regulation

What is quality? It is the most possible excellent version of an object and may be defined by set standards. When it comes to medical devices in the U.S., the quality standards are regulated by FDA regulations. Read more about it.


In the field of medical devices, it is especially important to have a clear concept of what quality is in order to apply it to a system or as a standard on products. But what is quality? Put into simple words, it is the most possible excellent version of an object. This excellent version is defined by set standards. For that reason, the FDA provides The Code of Federal Regulation and defines quality in section 820.3 as “the totality of features and characteristics that bear on the ability of a device to satisfy fitness-for-use, including safety and performance.”


In general, as a manufacturer it is important to establish and follow a quality system. Such a system ensures that the products conform to applicable requirements and specifications. Within the FDA-regulated realm the quality system is (also) known as current good manufacturing practice. In the 21 CFR part 820 – Quality System Regulation (QSR) the FDA provides cGMP requirements for medical devices.

For the QSR must apply to a great variety of different types of medical devices, it does not regulate in every detail how exactly a specific medical device must be produced. This would probably also go beyond the scope of the regulation. Instead, it rather provides a framework to all manufacturers, which they must follow. Thus, the QSR requires manufacturers to develop and follow procedures in order to ensure high quality for that specific device they manufacture, using appropriate details and knowledge that is current state of the art. It is important to know that title 21 is revised once a year and always published on 1 April. That is how it is ensured that the law corresponds to the most current state of the art.

The Quality System Regulations are structured into 14 subparts. Each part regulates an individual aspect of the whole quality system and represents an own entity. The following part will list all the subparts and explain shortly what their most important aspect is.

It is obvious that the FDA has been strongly involved in the revision of ISO 13485:2016, as QSR and ISO 13485 have become very similar. Now, many well-known elements of ISO 13485 can also be found in the QSR and vice versa.


1. General Provisions

The general provisions ensure that a finished device will be safe and effective. Also, the regulations have to be applicable to all manufacturers of finished medical devices. Here, finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labelled or sterilised. Every important term for the implementation of the QSR is defined in subpart A.

This section corresponds with chapter 4 of ISO 13485.

2. Quality System Requirements

There are certain requirements that need to be part of the quality system, such as: quality policy, organization structure, responsibility and authority, resources, management representative, management review, quality planning, quality system procedures, also establishing procedures for quality audits and conducting such audits. Personnel is also a part of the QS, for it needs to have the appropriate education and background, training and experience.

This section corresponds with chapter 4, 5 and 6 of ISO 13485.

3. Design Controls

Controls the whole design and development process, consisting of

  • Design and development planning (corresponds to chapter 7.3.2 of ISO 13485)
  • Design input (corresponds to chapter 7.3.3 of ISO 13485)
  • Design output (corresponds to chapter 7.3.4 of ISO 13485)
  • Design review (corresponds to chapter 7.3.5 of ISO 13485)
  • Design verification (corresponds to chapter 7.3.6 of ISO 13485)
  • Design validation (corresponds to chapter 7.3.7 of ISO 13485)
  • Design transfer (corresponds to chapter 7.3.8 of ISO 13485)
  • Design changes (corresponds to chapter 7.3.9 of ISO 13485)

At the end of the design controls, the so-called Design History File (DHF) and the Device Master Record (DMR) are created. For more information, read our article about "Design Controls".

4. Document Controls

Describes requirements on document approval and distribution, and document changes. Records need to be kept on when (date) a document was approved and by whom (signature). It should ensure that obsolete documents are removed and that there is a comprehensible overview for all important documents created during the process. The same procedure is applied for changes in documents. Further, they should be communicated to the appropriate personnel on time.

This section corresponds with chapter 4.2 of ISO 13485.

5. Purchasing Control

Management (determination, evaluation and qualification) of suppliers, contractors and consultants based on their ability to meet specified requirements. Agreements are very important, that the suppliers, contractors and consultants notify the manufacturer of changes in the product or service.

This section corresponds with chapter 7.4 of ISO 13485.

6. Identification and Traceability

To prevent mixups, each manufacturer shall establish and maintain procedures for identifying a product during all stages of receipt, production, distribution and installation. Each device needs a control number to ensure traceability through every stage.

This section corresponds with chapter 7.5.8 and 7.5.9 of ISO 13485.

7. Production and Process Controls

Develop, conduct, control and monitor production processes to ensure that a device conforms to its specifications. Also establish and maintain procedures for changes to a specification, method, process or procedure. Changes need to be verified or validated. Control of environmental conditions that could have an adverse effect on product quality. Further, establish and maintain a process for requirements for the health of the personnel, cleanliness, personal practices and clothing. Procedures to prevent contamination of equipment or product by substances that could be expected to have an adverse effect on product quality. Other processes need to be established and maintained concerning buildings, equipment, adjustment, manufacturing material, automated processes, inspection, measuring and test equipment and process validation. It is necessary to prevent negative effects on the whole process and to ensure quality.

This section corresponds with chapter 7.5 and 7.6 of ISO 13485.

8. Acceptance Activities

Receiving, in-process and finished device acceptance. These activities need to be documented and they shall be part of the Device History Record. Activities to identify the acceptance status of a product in order to indicate the conformance or non-conformance of products with acceptance criteria.

This section corresponds with chapter 7 and 8 of ISO 13485.

9. Nonconforming Product

Control of nonconforming products: establishing and maintaining procedures to control a product that does not conform to specified requirements. Nonconformity review and disposition: justification for use of the predicate “nonconforming”. Product needs to be reworked and should then meet its current approved specifications.

This section corresponds with chapter 8.3 of ISO 13485.

10. Labeling and Packaging Control

Label integrity states that the label must be printed and applied to remain legible and affixed during the customary conditions. It goes that far, as it is necessary to make sure that the device packaging and shipping containers are designed and constructed to protect the device from alteration or damage.

This section corresponds with chapter 7.5 of ISO 13485.

11. Handling, Storage, Distribution and Installation

During handling no mixups, damage, deterioration, contamination or other adverse effects should occur to the product. The control of storage areas and stock rooms is fundamental to prevent adverse effects. Only those devices approved for release must be distributed and purchase orders need to be reviewed. Adequate installation and inspection instructions need to be provided.

This section corresponds with chapter 7.5 of ISO 13485.

12. Records

Records shall be made available for review and copying by FDA, they should be legible and stored to minimize deterioration and to prevent loss. Some records may be marked confidential by the manufacturer. The record retention period describes a period of time which is equivalent to the design and expected life of the device, but in no case less than two years from the date of release, exceptions are management reviews, quality audits and supplier audit reports. Other important records and their regulations are the Device Master Record, Device History Record, Quality System Record and complaint files. The DMR contains records on the procedures and specifications for a finished device, whereas the DHR is about the production history of a finished device. Quality System Record includes procedures and the documentation of activities which are required. Complaint files process all complaints in a uniform and timely manner, and they need to be evaluated to determine if an investigation is necessary.

This section corresponds with chapter 4.2, 7 and 8 of ISO 13485.

13. Servicing

Analyse service reports with appropriate statistical methodology.

This section corresponds with chapter 7.5.4 of ISO 13485.

14. Statistical Techniques

Procedures for identifying valid statistical techniques required for establishing, controlling and verifying the acceptability of process capability and product characteristics.

This section corresponds with all chapters of ISO 13485 relating to data acquisition and handling.


Differences between the Quality System Regulations and the ISO 13485

Although at first glance, there is a great correlation between the two systems of regulation, certain differences are not to be underestimated. The following table shows some of them:



ISO 13485

Document control

Requires specifically to communicate changes in documents to the affected personnel and communication with the FDA

Much more detailed documentation in general

Requires the organisation to define a retention period for obsoleted documents



Not same wording for files. DHF corresponds to Design and development files.

DMR corresponds to Medical device files.

DHR has no exact equivalence, but such records are required in chapter 7.5.1

Customer orientation

Less important

Considered in Communication, Feedback and Complaint handlings sections

Management responsibility

Focus on communication

Focus on meeting the customer requirements and applicable regulatory requirements

Management review

Summary for the FDA inspection is necessary



Focus on the creation of maintenance schedules, inspections and adjustment of equipment and manufacturing materials

Same intent, but not as detailed

Production controls

Control of used product to prevent contamination of other product, the manufacturing environment and personnel

Same intent, but not as detailed

Purchasing controls

Agreement of the supplier to notify the organisation of changes to the product or service -> possibility to assess the potential effect on quality of the medical device

Organisation should ensure the adequacy of purchasing requirements prior to communicating them to the supplier

Other parts

More detailed in statistical techniques

Complaint files focus on customer complaints

Higher requirements for the investigation of nonconforming products

More detailed CAPA


How does the FDA perform their inspections?

A company needs to prepare carefully for an FDA inspection. In the process, the FDA may ask for copies of important documents such as the company’s Quality Policy, Quality Manual or others.

The FDA inspector will be prepared well, especially in the parts of management control, corrective and preventive actions (CAPA), design controls and production and process controls.

If everything is prepared the FDA inspection follows a certain procedure. It starts with an opening session that can take up to two hours. The company is presented, the investigator authorised, and the agenda is discussed. The investigator decides on the agenda and what parts will be inspected. Afterwards, the actual inspection follows, which can take between 5 and 8 hours per day. After the investigation, there is a summary of the results, the investigator explains the further proceeding and closes the inspection officially.

If there are one or more nonconformities with the QSR, the investigated company will receive a FDA Form 483 ("Inspectional Observations") or a warning letter from the FDA. Those nonconformities could be a total failure to define, document or implement a quality system or one of the subsystems, a major deficiency in one or more elements of the subsystems, products which clearly do not comply with the manufacturer’s specifications and/or the QSR, non-correction of major deficiencies from previous inspections or an excessive number of minor nonconformities.

Major nonconformities constitute employees that have not been trained adequately on a special system or other important procedures. Further nonconformities constitute calibration procedures that do not include a limit for accuracy and precision or that design validation results were not documented and filed in the design history file.


The Quality System Regulations by the FDA are quite complex, but with the right help every company can implement them successfully. We, the seleon gmbh, can provide you all necessary support and knowledge to succeed!


Please note that all data and listings do not have the claim of completeness, are without guarantee and serve the pure information.

Every product is unique – the mandatory tasks and measures for entering the market need to be specified individually. seleon advises you on your individual questions without any obligation.


[Inhalt: Englisch]



Further entries from the "Quality management" category

Quality Management

With a focus on the essentials, the one or other extra pound (not only on the scales, but also in the company process) becomes clear. Put your risk management in order, get an overview of clinical data and more.

Quality Management

What do the MDCG's new approaches to the MDSAP mean for Europe's manufacturers and the audits by notified bodies? Read here about the opportunities, but also the stumbling blocks, as well as details on responsibilities and consequences.

Quality Management

For most midwives, quality management systems are all Greek to them. However, since mid-2019 at the latest, the legislator has been making explicit demands on midwives, which also include requirements for the quality of care.

Regulatory Affairs

Gaining approval for medical devices is complex and quite often also confusing. We bring clarity…


> Regulatory Affairs

Clinical Affairs

Clinical affairs of medical devices requires numerous evidences and evaluations. What we know about it …


> Clinical Affairs

Development Excellence

Product development of medical devices is subject to its own rules. We bring light into the darkness …


> Development Excellence