QMSR: The end of 21 CFR part 820?

In 21 CFR part 820, the FDA formulates the requirements for the quality management systems of medical device manufacturers, among others. Thus, 21 CFR part 820 (Quality System Regulation QSR) is or was the counterpart to ISO 13485.

1. QMSR: The amendments to 21 CFR part 820

This is because the FDA decided on February 2, 2024, to largely “gut” 21 CFR part 820 and supplement it with a reference to ISO 13485.

• This reference is in the new section § 820.7 (“Incorporation by reference”).
• Tab. 1 shows which sections have become obsolete as a result.

Because ISO 13485 refers to quality management systems, the FDA has decided to rename the title of 21 CFR 820. It is no longer called the Quality System Regulation (QSR) but the Quality Management System Regulation (QMSR).

a) Comparison of the old and new 21 CFR part 820

Subparts A-D

21 CFR part 820 old (QSR)	21 CFR part 820 new (QMSR)
Subpart A – General Provisions § 820.1 – Scope § 820.3 – Definitions § 820.5 – Quality system	Subpart A – General Provisions § 820.1 – Scope § 820.3 – Definitions § 820.5 – Quality system. § 820.7 – Incorporation by reference § 820.10 – Requirements for a quality management system
	Subpart B – Supplemental Provisions
Subpart B – Quality System Requirements § 820.20 – Management responsibility § 820.22 – Quality audit § 820.25 – Personnel	Deleted (reserved for future additions)
	§ 820.35 Control of records
Subpart C – Design Controls § 820.30 – Design controls	Deleted (reserved for future additions)
Subpart D – Document Controls § 820.40 – Document controls	Deleted (reserved for future additions)

Subparts E-O

21 CFR part 820 old	Planned amendments
Subpart E – Purchasing Controls § 820.50 – Purchasing controls	Deleted
Subpart F – Identification and Traceability § 820.60 – Identification § 820.65 – Traceability	Deleted
Subpart G – Production and Process Controls § 820.70 – Production and process controls § 820.72 – Inspection, measuring, and test equipment § 820.75 – Process validation	Deleted
Subpart H – Acceptance Activities § 820.80 – Receiving, in-process, and finished device acceptance § 820.86 – Acceptance status	Deleted
Subpart I – Nonconforming Product § 820.90 – Nonconforming product	Deleted
Subpart J – Corrective and Preventive Action § 820.100 – Corrective and preventive action	Deleted
Subpart K – Labeling and Packaging Control § 820.120 – Device labeling. § 820.130 – Device packaging	820.45 Device labeling and packaging controls.
Subpart L – Handling, Storage, Distribution, and Installation § 820.140 – Handling § 820.150 – Storage § 820.160 – Distribution § 820.170 – Installation	Deleted
Subpart M – Records § 820.180 – General requirements § 820.181 – Device master record § 820.184 – Device history record § 820.186 – Quality system record § 820.198 – Complaint files	Deleted Deleted § 820.35 Control of records (only regarding UDI) Deleted § 820.35 Control of records
Subpart N – Servicing § 820.200 – Servicing	§ 820.35 Control of records (only regarding servicing records)
Subpart O – Statistical Techniques § 820.250 – Statistical techniques	Deleted

b) Differences compared to ISO 13485

The Quality Management System Regulation in part 820 and ISO 13485 are not completely congruent:

Aspect	Differences
Scope	The scope (§ 820.1) differs overall. For class I devices (excluding, for example, devices containing software), the FDA waives the requirements of Chapter 7.3 of ISO 13485 (“Design and Development”).
Definitions	The FDA adds in § 820.3 its own definitions to ISO 13485, such as “Component,” “Finished Device,” “Remanufacturer.” The terms “Implantable medical device,” “Manufacturer,” “and”Organization,” “Rework,” and “Safety and Performance” are defined differently. This means that the FDA overwrites the corresponding terms in ISO 13485.
Product identification, traceability, and labeling	Here, the FDA is more specific and requires the UDI as described in § 830 and “traceability” according to § 821. The labeling requirements are also more specific than those of ISO 13485, just as in the MDR, and can be found in the new § 820.45.
Vigilance and communication with authorities	For the more specific requirements, FDA refers to Parts § 803 and § 806.
Documentation	The FDA specifies in more detail the content of records of customer complaints and service activities.

c) Timing and transition periods

The “final rule” for the QMSR was published on February 02, 2024. It will become valid and therefore applicable with a deadline of 2 years, i.e., February 02, 2026. Until then, the old QSR must still be followed.

2. 21 CFR part 820 before referencing ISO 13485

a) Overview

The Quality System Regulation consists (before referencing) of Subparts A to O, which include Sections 1 to 250 (see Tab. 1 and Fig. 2).

Part 820 requires a complete quality management system, which requires that the “common” standard operating procedures must be documented and implemented. These include:

• Document control
• Purchasing
• Development
• Production

b) Applicability of 21 CFR part 820

Depending on the class of the medical device, the manufacturers must comply with the General Controls (§ 501 ff) laid down in the “Food, Drug & Cosmetic Act” and, from class II, also with the “Special Controls.” The “General Controls” already include “Good manufacturing practice requirements” that relate to the design, production, packaging, storage, and installation of the devices.

It is precisely these requirements for “Current good manufacturing practice (CGMP)” that are the subject of the Quality System Regulation QSR. Thus, these regulations must be complied with by all medical device manufacturers and also other players such as contract manufacturers. Only a few class I devices are exempt or GMP-exempt. The FDA checks compliance with CGMP by inspection.

c) Development requirements

Area 820.30, with the design controls, is particularly relevant for the development department. This even applies to the development of class I medical devices if they contain software or are software.

The requirements of 820.30 are very general. For this reason, manufacturers of medical devices that contain software, for example, are also guided by the FDA’s guidance documents. These describe in detail how, for example, the design input must be documented.

Many manufacturers underestimate the importance of the Design History File DHF (820.30 j). This set of documents must make it possible to prove that the procedures described in 21 CFR part 820 were actually implemented and that the documentation was not created retrospectively.

d) Difference between 21 CFR 820 and ISO 13485

AnsonGroup has published a comparison of the requirements of ISO 13485 and FDA QSR. The extensive correspondence between the two standards is obvious. Nevertheless, there are differences between ISO 13485 and part 820 to consider:

• The requirements for the documentation are higher. Also, the logical grouping of the documents into the Design History File, the Device Master Record, and the Device History Record is not known in ISO 13485.
• Conversely, the requirements of ISO 13485 and ISO 9001 for customer satisfaction and continuous improvement of the QM system go beyond the requirements of the QSR.
• Furthermore, the handling of complaints and the reporting system differ significantly.

3. Summary and conclusion

It is a great step forward for the harmonization of regulatory requirements that the FDA essentially replaces its requirements for a QM system in 21 CFR part 820 with reference to ISO 13485. It explains in the “new” 21 CFR part 820 how certain requirements, e.g., for product identification and vigilance, are to be met in concrete terms.

It would have served medical device manufacturers if the MDR and IVDR had also followed this path.

---

Change history

• 2024-02-21: Revision based on the passed version of the QMSR from February 02, 2024