21 CFR Part 820 – Quality System Regulation (Legacy)

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • Medical Device QMS • Quality, Regulatory, Manufacturing

21 CFR Part 820 (the legacy FDA Quality System Regulation, QSR) defined U.S. medical device QMS requirements across design controls, purchasing, production/process controls, CAPA, records, and more. In 2024 the FDA issued the Quality Management System Regulation (QMSR) to align with ISO 13485. Organizations should operate to QMSR/ISO 13485 going forward, while maintaining legacy 820 traceability in historical records and procedures until fully transitioned.

“Think of 820 as the legacy blueprint and QMSR as the aligned, modern build—same foundations, cleaner integration with ISO 13485.”

1) Scope—What 820 Covered

General QMS requirements for finished devices: management responsibility; design controls; document and record controls; purchasing controls; identification and traceability; production/process controls; acceptance activities; corrective and preventive action; equipment, facilities, and environmental controls; packaging, labeling, handling, storage, distribution; installation and servicing; and device master/history records.

2) Core Records—DHF, DMR, DHR

DHF: design planning, inputs/outputs, verification/validation (including software and HFE), reviews, and design transfer. DMR: the manufacturing “recipe” (specs, drawings, BOMs, procedures, inspection/testing). DHR: proof each unit/lot was built and released per DMR (traceability, results, labeling, release sign‑offs). See DHF and DHR.

3) Design Controls (Legacy 820.30)

Plan design and maintain traceability from inputs to outputs; verify outputs meet inputs; validate that the device meets user needs and intended use; control changes; and transfer to production. Integrate risk management (ISO 14971), usability (HFE), software lifecycle, and clinical evidence as applicable.

4) Purchasing & Supplier Controls

Evaluate and monitor suppliers based on risk; define acceptance criteria; verify purchased product; and escalate issues using SCAR. Link to SQM and Supplier Qualification.

5) Production & Process Controls

Define and validate processes where output cannot be fully verified; maintain equipment qualification (IQ/OQ/PQ), calibration, MSA, environmental controls, and personnel training. Use control plans, SPC, and label verification to prevent defects and mislabeling.

6) Identification, Traceability & UDI

Identify product status throughout manufacturing; maintain lot/serial traceability for risk‑based items; implement UDI and align GTIN/SSCC with packaging levels (GS1 GTIN, SSCC) to support recalls and postmarket analysis.

7) Acceptance Activities

Define receiving, in‑process, and final acceptance criteria; record results and dispositions; segregate nonconforming product with clear status in WMS; and route to MRB as needed.

8) Nonconforming Product & CAPA

Document nonconformities; investigate root cause (RCA); implement corrections and corrective/preventive actions; verify effectiveness; and trend outcomes. Integrate complaint handling and field actions with CAPA governance and management review.

9) Records, Document Control & Training

Control documents with versions, approvals, and effective dates; keep complete records (DHF, DMR, DHR); ensure personnel are competent and trained to current procedures (Training Matrix); and retain records per policy with Data Integrity safeguards and audit trails.

10) Labeling & Packaging Controls

Control label artwork, variable data (UDI/lot/expiry), and verification at pack; validate packaging to protect during distribution; and maintain hold/release status until QA disposition (Lot Release).

11) Complaint Handling & Postmarket

Capture, evaluate, and investigate complaints; feed signals to CAPA; and coordinate with reporting requirements (see 21 CFR 803/806/821/807 as applicable). Maintain field traceability via UDI.

12) Transition to FDA QMSR

Map legacy 820 procedures to ISO 13485/QMSR; adjust terminology and records (e.g., documented information); align risk‑based controls; update training; and revise supplier and software validation approaches to reflect 13485 expectations. Maintain a cross‑reference for inspectors during the transition period.

13) Metrics That Demonstrate QMS Control

• Design control throughput: plan adherence, V&V completion, change cycle time.
• Supplier performance: quality score, OTD, SCAR closure time.
• Process capability: Cpk/Ppk on critical features and complaint escape rate.
• CAPA effectiveness: recurrence rate and time‑to‑verify.
• Complaint handling: detection‑to‑closure cycle and MDR timeliness (where applicable).

Use risk‑based dashboards to prioritize attention and prove continued suitability and effectiveness.

14) Common Pitfalls & How to Avoid Them

• Paper‑only design traceability. Use governed digital DHF/DHR with clickable links and audit trails.
• Unvalidated special processes. Validate and re‑validate after changes; monitor with SPC.
• Weak supplier oversight. Risk‑tier, qualify, monitor, and escalate via SCAR with evidence.
• Label errors. Lock artwork, verify variables, and enforce line clearance and pack checks.
• CAPA as a backlog. Prioritize by risk, enforce effectiveness checks, and close the loop in management review.

15) What Belongs in the Inspection‑Ready Pack

Quality policy and organization; procedures mapped to 820/QMSR; DHF/DMR/DHR exemplars; supplier files and performance; process validation and calibration evidence; complaint/CAPA summaries with trends; labeling/UDI controls; training records; internal audits and management review outputs; and change records—governed under Document Control.

16) How This Fits with V5 by SG Systems Global

Unified QMS backbone. The V5 platform provides versioned Document Control, role‑based approvals, training, and e‑signatures aligned with ISO 13485 and FDA QMSR.

Design & production evidence. V5 links design records (DHF) to execution (MES) and release (Lot Release), generating audit‑ready DHRs with identity, status, and test results.

Supplier & labeling control. V5 manages supplier lifecycle (SQM, Qualification, SCAR) and enforces label verification with UDI and GS1 identifiers.

Closed‑loop CAPA & analytics. Complaints route to investigations and CAPA with effectiveness checks; dashboards trend process capability, complaints, and supplier performance for risk‑based management review.

Bottom line: Whether you reference legacy 820 or the modern QMSR, V5 operationalizes the device QMS with live, linked, and defensible evidence.

17) FAQ

Q1. Is 21 CFR 820 still in force?
FDA has issued QMSR aligning to ISO 13485. Operate to QMSR/13485 while maintaining legacy cross‑references for inspections during transition.

Q2. Do we still need DHF/DMR/DHR?
Yes. These records remain core evidence of design, manufacturing specification, and production/release history.

Q3. How does risk management fit?
Apply ISO 14971 across design and production; connect risks to controls, verification, and postmarket feedback.

Q4. What about software validation?
Validate QMS‑impacting software proportionate to risk under CSV; capture requirements, testing, and approvals.

Q5. Which other parts of 21 CFR matter postmarket?
Device reporting and corrections/removals (21 CFR 803/806), registration/listing (807), and tracking (821).

Q6. How do we show we’ve transitioned?
Provide a mapped matrix 820→QMSR/ISO 13485, updated procedures and training records, and examples of records generated under the new process.

Related Reading
• Frameworks: FDA QMSR | ISO 13485 | ISO 14971
• Core Records & Controls: DHF | DHR | Process Validation | Control Plans
• Postmarket & Identity: UDI | Part 803 | Part 806 | Part 821 | Part 807
• Governance: Document Control | CAPA | Internal Audit | Training Matrix