21 CFR Part 807

This glossary term is part of the SG Systems Global regulatory & operations guide library.

Updated December 2025 • Medical device establishment registration, device listing, 510(k) premarket notification procedures, exemptions, importer roles, listing accuracy, submission evidence packages • Primarily Medical Devices (FDA “front door” requirements + the most common premarket pathway)

21 CFR Part 807 is the FDA regulation that answers two brutally practical questions for medical devices:

1) Are you in FDA’s system correctly? (establishment registration + device listing)

2) Do you need a 510(k), and if so, what must you submit? (premarket notification procedures)

In other words: Part 807 is not “your quality system” (that’s 21 CFR Part 820 and/or ISO 13485). Part 807 is your regulatory identity and your premarket “gate” for a huge share of Class II—and some Class I—device workflows.

Why it matters operationally: Part 807 is where teams get caught thinking “admin” means “low risk.” It doesn’t. If your registration/listing is wrong, your premarket posture is confused, or your 510(k) evidence can’t be reproduced cleanly, you don’t have a paperwork problem—you have a control problem.

Part 807 also exposes a systems truth: FDA expects your regulatory story to be consistent across what you say you make, what you list, what you distribute, and what you submit. That consistency lives (or dies) in your master data, your change control discipline, and your ability to produce evidence without heroic reconstruction.

“Part 807 is where medical device companies learn the difference between ‘we believe we’re compliant’ and ‘we can prove we’re compliant.’”

1) What people mean when they cite 21 CFR Part 807

When someone says “we need to be compliant with Part 807,” they’re usually pointing at one (or more) of these operational realities:

They need to register and list correctly. That means the company’s establishments and device listings must be accurate, current, and aligned with what’s actually happening in operations—especially when outsourcing manufacturing, sterilization, labeling, or importing.

They need to decide the right premarket path. For many devices, that means understanding whether a 510(k) clearance is required, and if so, building a submission that is coherent, evidence-backed, and reproducible.

They’re trying to avoid an avoidable regulatory failure. A surprising number of “serious” device problems start with simple identity failures: wrong listing, stale establishment data, unclear role boundaries, or a weak change process around what triggers a new submission decision.

Tell it like it is: Part 807 gets treated like an admin checkbox until it becomes a business interruption problem. Your best defense is to treat it as controlled evidence, not a yearly scramble.

2) Scope map: what Part 807 actually contains

Part 807 is not “one rule.” It’s a bundle of related subparts that map to different regulatory control functions.

Operational takeaway: Part 807 is a coherence regulation. It forces your establishment identity, device identity, and premarket story to match reality.

3) Who Part 807 applies to (and why “admin” is not a safe place to cut corners)

Part 807 obligations are role-driven. The companies that get surprised are the ones who assume only “the manufacturer” matters.

FDA’s registration/listing guidance is explicit that establishments involved in the production and distribution of devices intended for commercial distribution in the U.S. are required to register, and that most establishments required to register are also required to list devices and activities. The practical consequence is simple: if you outsource operations (contract manufacturing, sterilization, relabel/repack, specification development, importing), you still own the end-to-end regulatory truth.

4) Subpart B: Establishment registration in operational terms

Establishment registration is the “you exist” transaction with FDA. It’s foundational, and it is easy to mishandle when your operating model changes faster than your documentation model.

The regulatory text anchor for registration requirements is commonly referenced through 21 CFR 807.20, while FDA’s operational view of who must register/list/pay (including common establishment types) is summarized here: Who Must Register, List and Pay the Fee (FDA).

Here’s the operational mistake: teams treat registration as an annual form-fill. A mature program treats registration as master data with governance. That means:

If that feels “too strict,” good. That strictness is exactly what keeps registration from becoming a scramble during inspections, partner onboarding, or a submission cycle.

5) Subpart C: Device listing in operational terms

Device listing is where companies accidentally misrepresent themselves. Listing isn’t just “we sell a widget.” It ties a device to establishments and activities, and it becomes part of the regulatory trail that customers, partners, and FDA can pressure-test.

A clean regulatory anchor for listing expectations is 21 CFR 807.65. Practically, the discipline is straightforward: your listed device identity must match what you’re actually putting into commerce, and it must stay current through changes.

The usual failure mode isn’t bad intent. It’s organizational drift: product names evolve, packaging evolves, manufacturing moves, and nobody is explicitly accountable for keeping listing aligned. Drift becomes a finding when it collides with an inspection or a submission review.

6) The most misunderstood point: registration/listing ≠ clearance/approval

Say it plainly: registering and listing does not mean your device is cleared or approved.

Registration/listing is your regulatory footprint. Clearance/approval is your market authorization (when required). Confusing the two is how companies end up with compliance theater: “we’re listed, so we’re good.” You can be listed and still be marketing a device without the required premarket authorization.

This is why Part 807 needs to be run like a system: registration/listing is necessary, but it is not sufficient. Your premarket pathway logic must be controlled and documented.

7) Subpart E: 510(k) premarket notification as an evidence package

For many teams, “Part 807” really means “the 510(k) question.” In SG terms, the 510(k) is not a document—it’s an evidence package that has to hang together: intended use, technological characteristics, performance testing, labeling, and a defensible comparison to a predicate device.

The underlying procedural framework lives in Part 807, and the operational reality is captured well by FDA’s overview on selecting and preparing the appropriate premarket submission type: Premarket Submissions: Selecting and Preparing the Correct Submission (FDA).

If your organization can’t reproduce the submission logic months later—what you claimed, what evidence supported it, what version was final—you don’t have regulatory control. You have a one-time project artifact.

8) When a 510(k) is required (and how teams get it wrong)

The cleanest text anchor for “when is a premarket notification required?” is 21 CFR 807.81. But the bigger lesson is operational: the requirement decision must be explicit, not assumed.

How teams get it wrong in practice:

• They assume exemption without documenting why. “It’s Class I” is not a controlled decision.
• They treat design/manufacturing changes as “engineering improvements” and don’t run a structured submission impact review.
• They rely on memory. “Regulatory said it’s fine” isn’t evidence unless it’s captured, reviewed, and retrievable.

If you want this to be stable, treat “does this change affect our premarket status?” as a defined workflow gate—not a hallway conversation.

9) What FDA expects in a 510(k) (plain-English translation)

The CFR text that many teams use as a content checklist is 21 CFR 807.87. You don’t need to memorize it, but you do need to design your submission system so those information types can be assembled without chaos.

Plain-English translation: FDA expects you to show a coherent device identity and a coherent justification for marketing—supported by evidence. If your submission is a patchwork of files where no one can explain provenance, versioning, and review history, you are building fragility into the process.

10) Predicate devices & substantial equivalence: don’t wing it

If you’re operating in 510(k) land, predicate strategy is not a vibe—it’s a control decision. The predicate comparison is where weak teams get exposed because it’s tempting to “make the story fit” after the fact.

Practically, you want predicate logic to be:

• Documented: why this predicate, why this comparison approach
• Evidence-backed: testing and analysis align to the differences that matter
• Repeatable: if you re-run the rationale later, you land on the same conclusion

If you need internal anchors for the concept, see Predicate Device and the practical submission framing in 510(k) Submission.

11) Change control: the “do we need a new 510(k)?” question

This is the question that separates mature device organizations from fragile ones: when the device changes (design, materials, labeling, manufacturing process, supplier, sterilization), do you have a disciplined mechanism to decide whether that change impacts regulatory status?

The trap is obvious: operations wants speed; engineering wants flexibility; regulatory wants defensibility. The way out is not more meetings. It’s a defined change gate with required inputs and recorded outputs. If a change is approved, the record should show the decision logic—not just the decision.

This is also where quality documentation primitives matter. If your DHF, DMR, and DHR are weak, your ability to justify “no new submission needed” will be weak too.

12) Where Part 807 meets Part 820 and ISO 13485

Part 807 is not the Quality System Regulation—but it is deeply dependent on quality system behaviors. Submissions and listings are only as reliable as the system that produces the underlying truth.

That’s why mature organizations connect Part 807 posture to their QMS posture: 21 CFR Part 820 and ISO 13485 create the controlled environment where design outputs, validation evidence, and production records can be trusted.

If your QMS is sloppy, your Part 807 artifacts will be sloppy—because you’ll be forced to reconstruct evidence instead of exporting it.

13) Data integrity and Part 11 considerations for submissions and records

Submission packages, listing updates, and registration actions all rely on electronic records in modern organizations. That raises a practical question: can you prove who did what, when, and under what authority?

Part 11 applicability can be nuanced, but the operational truth isn’t: if you can’t show integrity, you can’t show control. If you want a practical readiness lens, see 21 CFR Part 11 and the implementation-oriented guide Part 11 Readiness.

Bottom line: “it’s in SharePoint” isn’t the same as “it’s controlled.” For Part 807 artifacts, versioning, approvals, and traceability matter.

14) Registration/listing as master data: how it breaks in real companies

Most Part 807 pain is not caused by the CFR. It’s caused by inconsistent identity across systems.

Common breakpoints:

• Multiple “official” device names. Marketing uses one, engineering uses one, regulatory uses one.
• Outsourced activities not modeled. Contract sterilization exists operationally but is not reflected cleanly in the regulatory story.
• Submission-to-listing mismatch. You can’t reliably tie listing entries to the correct authorization basis.
• Unowned updates. Nobody is explicitly responsible for keeping listing current after product lifecycle changes.

If your regulatory identity is not grounded in a controlled data model, every audit becomes a negotiation.

15) Inspection and incident posture: how to avoid chaos

Part 807 becomes “real” under pressure: a partner due diligence request, an FDA inspection, a complaint cluster, or a recall/correction decision that pulls in Part 806 and potentially Part 803.

In those moments, the organization needs three things:

• Fast retrieval: you can produce the current registration/listing and the supporting internal records quickly
• Traceable decisions: you can show why you chose a pathway and why changes did/did not trigger new actions
• Controlled artifacts: you can prove version control and approvals for submissions and updates

If the only way you can respond is by asking three people “who has the latest file,” you’re not inspection-ready.

16) Copy/paste readiness scorecard (self-assessment)

Use this as a blunt self-test. If you can’t answer these cleanly, your Part 807 posture is fragile.

Notice what this scorecard measures: not policy, not intent—control and evidence.

17) Selection pitfalls: how Part 807 compliance gets faked

• “October scramble” governance. If updates only happen during annual registration season, drift accumulates all year.
• PDF-as-a-system. Submissions and decisions stored as loose files without traceability, approvals, and version control.
• Outsourcing blindness. Contract operations exist, but your regulatory story doesn’t reflect them cleanly.
• Uncontrolled device naming. Names, models, and product codes become free text, creating mismatched records.
• Change control theater. “We reviewed it” with no evidence of inputs, criteria, and conclusion logic.

These pitfalls don’t just create compliance exposure. They create operational drag: every customer audit, every submission, every integration becomes slower because nobody trusts the data.

18) How this maps to V5 by SG Systems Global

V5 supports Part 807 outcomes by turning regulatory identity and submission evidence into structured, governed records rather than scattered documents. Part 807 success requires coherence across establishments, devices, submissions, and changes—coherence is a system property.

If you want a practical product anchor, start with the V5 Solution Overview and the Quality Management System (QMS). Those are the layers where controlled approvals, audit trails, and evidence traceability become enforceable instead of aspirational.

And if your Part 807 posture depends on stitching data across systems (ERP, PLM, labeling, complaint systems), the integration layer matters. That’s why the V5 Connect API exists: to reduce “manual reconciliation” as a permanent operating model.

For a medical-device-specific framing, see Medical Device Manufacturing.

19) Extended FAQ

Q1. Is Part 807 the same as Part 820?
No. Part 807 is registration/listing + 510(k) procedures. Part 820 is quality system requirements. They interact, but they are not substitutes.

Q2. If we use contract manufacturers/sterilizers, do we still “own” Part 807 outcomes?
Yes. Outsourcing changes the operational model, not the accountability. You still need a coherent regulatory truth across establishments and device activities.

Q3. What’s the most common Part 807 failure pattern?
Identity drift: listings and registration details don’t track operational reality, and 510(k) decisions aren’t captured as controlled, reviewable evidence.

Q4. Does being “listed” mean we’re cleared?
No. Listing is not clearance or approval. Treat that confusion as a red flag in your internal training and governance.

Q5. How do we make this less painful?
Stop treating it as an annual admin task. Treat it as master data + change control + evidence retrieval. If you can’t retrieve it quickly, you don’t control it.

20) Related reading (minimal, high-signal)

If you want the primary text anchors, start with 21 CFR Part 807 (Cornell LII) and the two sections teams cite most often: 807.20 (Registration) and 807.81 (When 510(k) is required). For FDA’s operational framing of who must register/list, use Who Must Register, List and Pay the Fee (FDA). For submission selection, use Premarket Submissions: Selecting and Preparing the Correct Submission (FDA).

Implementation note: Part 807 readiness gets easier when your documentation and validation discipline is real. If you need a practical operational bridge, see System Validation and Audit Readiness.