21 CFR Part 820 in 2026: the QMSR, where 820.30 and 820.198 went, and what FDA cites

21 CFR Part 820 is the FDA regulation that sets current good manufacturing practice for finished medical devices, now called the Quality Management System Regulation (QMSR). Since February 2, 2026, Part 820 requires manufacturers to document a quality management system that meets ISO 13485:2016, which it incorporates by reference, plus a short list of US-only requirements.

Most pages on Part 820 still quote the old Quality System Regulation text. This one maps each old section to where it lives now and adds what FDA investigators cited at 1,124 device inspections from January 2025 to October 2026, from Atlas analysis of the FDA Data Dashboard citations dataset (downloaded October 21, 2026).

Key facts:

• FDA published the QMSR final rule on February 2, 2024 (89 FR 7496), and it took effect on February 2, 2026.
• The current Part 820 has six active sections: 820.1, 820.3, 820.7 and 820.10 in Subpart A, and 820.35 and 820.45 in Subpart B. Subparts C to O are reserved.
• At 377 device inspections ending February 4 to October 1, 2026, 349 (92.6%) cited ISO 13485 clauses and only 4 cited an old QSR section number.
• Risk management (ISO 13485 clauses 7.1 and 4.1.2) appeared at 39.5% of those inspections, up from 13.9% for its nearest QSR equivalent, 820.30(g), at 747 inspections in 2025.
• The old 820.180(c) exemption is gone, so internal audit, supplier audit and management review reports are now open to FDA review.

What is 21 CFR Part 820?

21 CFR Part 820 is the device CGMP regulation that governs the methods, facilities and controls used to design, manufacture, package, label, store, install and service finished devices for human use. Part 820 applies to any manufacturer of a finished device, including contract sterilizers, relabelers, remanufacturers, repackagers, specification developers and initial distributors of foreign devices.

Section 820.1(a) also says a firm that performs only some of those operations has to comply only with the requirements for the operations it performs. Component manufacturers sit outside Part 820, though FDA expects the finished device manufacturer to control them through purchasing controls. A device that fails any applicable Part 820 requirement is adulterated under section 501(h) of the FD&C Act, which is the legal hook behind every device Form 483 and warning letter.

The current text is on eCFR, 21 CFR Part 820, and the rule history is in the Federal Register final rule of February 2, 2024.

What changed in 21 CFR Part 820 on February 2, 2026?

Part 820 changed from a self-contained rulebook of 15 subparts into a short regulation that points to ISO 13485:2016. FDA moved the design, CAPA, complaint, purchasing and production requirements into ISO 13485 clause text, and the US sections that remain add what ISO 13485 leaves out.

The sections that remain in force:

Section 820.10(b) holds the US links that a pure ISO 13485 gap assessment misses. ISO 13485 never mentions FDA's medical device reporting rule, so 820.10(b) ties clause 8.2.3 to Part 803, advisory notices to Part 806, traceability to Part 821 where it applies, and identification to the UDI rule in Part 830. Section 820.10(c) keeps design controls mandatory for class II and class III devices and for the class I devices it lists, including any device automated with computer software.

Two inspection changes came with the rule. FDA stopped using the Quality System Inspection Technique (QSIT) on February 2, 2026 and now inspects under Compliance Program 7382.850, and it dropped the 820.180(c) exception that kept internal audit, supplier audit and management review reports away from investigators. Our guide to FDA QSIT inspections covers the older method for teams still reading QSIT-era 483s.

Where did the old 21 CFR 820 sections go?

Each old QSR section now maps to one or more ISO 13485:2016 clauses, sometimes with a US add-on in 820.35 or 820.45. The table gives the nearest home for each and the share of 2026 device inspections that cited it, from the same Atlas analysis of FDA citation data.

Two cautions on reading the right-hand columns. The 2026 window is shorter and still filling in, because FDA adds an inspection's citations to the dashboard only after it finalizes the classification. And one old section often splits across several clauses, so a drop in one row can reappear in another, which is what happened with risk management.

What happened to 21 CFR 820.30 design controls?

21 CFR 820.30 no longer exists as a requirement; design controls now sit in ISO 13485:2016 clause 7.3, design and development, and its ten subclauses. Section 820.10(c) keeps the same scope as before: class II and class III devices, plus listed class I devices and any device automated with software. The design history file is now the design and development file in clause 7.3.10.

FDA cites design about as often as before. Design and development appeared at 27.2% of 2025 device inspections under 820.30 and at 26.0% of 2026 QMSR inspections under clause 7.3. Within clause 7.3, design changes (7.3.9) led with 34 inspections, ahead of the design and development file (7.3.10, 20) and validation (7.3.7, 17). Our full guide to medical device design controls under the QMSR has the paragraph-by-paragraph crosswalk from 820.30(a) to (j).

What happened to 21 CFR 820.198 complaint files?

21 CFR 820.198 was replaced by ISO 13485:2016 clause 8.2.2, complaint handling, plus 21 CFR 820.35(a), which keeps the US record content. For any complaint that is reportable under Part 803 or that you investigate, 820.35(a) still requires the device name, date received, any UDI or UPC, complainant contact details, the nature of the complaint, any corrective action and any reply.

Complaint handling appeared at 37.2% of 2025 device inspections under 820.198 and at 22.8% of 2026 inspections under clause 8.2.2 or 820.35(a). The wording investigators use has shifted too: the top 2026 complaint citations read "complaint handling procedures not documented" (31 citations) and "complaint handling procedures lack required elements" (23). Complaint review also feeds MDR decisions under Part 803, and 21 CFR 803.17, written MDR procedures, still appeared at 9.5% of 2026 inspections. The FDA MAUDE database guide shows how those reports reach the public.

What do FDA investigators cite most under the QMSR?

Under the QMSR, FDA investigators cite risk management most: ISO 13485 clause 7.1 appeared at 32.1% of 377 device inspections ending February 4 to October 1, 2026, and clauses 7.1 or 4.1.2 together at 39.5%. Corrective action (8.5.2) and complaint handling (8.2.2) follow, each on a fifth or more of inspections.

FDA's standard wording for clause 7.1 names the gap. The most common text, on 64 citations, reads "product realization risk management processes not documented", and another 35 read "records of risk management activities in product realization not maintained." Under the QSR, risk analysis lived inside design validation, 820.30(g). ISO 13485 asks for documented risk management across product realization, so a firm whose ISO 14971 file covers only the design phase now draws a citation that did not exist in the same form before.

Corrective action dropped from 42.7% to 24.4%, and internal audit from 14.9% to 8.5%. The FDA citation data shows 3.1 citations per device inspection under the QMSR against 3.3 in 2025. Risk management took a larger share of a similar number of citations, so CAPA and audit findings that once led a form now appear further down it, or fold into a risk citation. Expect these shares to shift as FDA finalizes more 2026 inspections.

Named Form 483s from the Atlas directory show the pattern:

None of these forms cites 820.30, 820.100 or 820.198. Marlen's form also shows how the US add-ons appear: 21 CFR 830.300, a UDI database requirement, sits on the same form as ISO clauses.

Investigators bring their own habits to these clauses, so the useful next step is to see which sections the investigator likely to visit your facility has cited at other device firms.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

How do you move a QSR quality system to the QMSR?

You move a QSR system to the QMSR by re-citing procedures to ISO 13485 clauses, closing the clause gaps the QSR never required, and wiring in the US add-ons from 820.10(b), 820.35 and 820.45. The five steps below follow what FDA cites most in 2026.

1. Re-cite your procedures. Replace every 820.30, 820.100 and 820.198 reference with the ISO 13485 clause and any 820.35 or 820.45 add-on, so an investigator can follow your quality manual in clause order.
2. Build the risk thread. Show your ISO 14971 risk file feeding product realization planning (7.1), design inputs (7.3.3), supplier controls (7.4.1) and CAPA (8.5.2). This is the single most cited gap in 2026.
3. Check the US add-ons. Confirm MDR procedures meet Part 803, corrections and removals meet Part 806, tracking meets Part 821 where it applies, and UDI is recorded per device or batch under 820.35(c).
4. Prepare for open audit records. Internal audit, supplier audit and management review reports are now reviewable, so write them as evidence: findings, owners, dates and closure.
5. Rehearse an inspection under Compliance Program 7382.850. Walk one complaint, one corrective action and one design change from intake to closure, the way an investigator samples records.

For the CAPA side of step 2, our CAPA guide for pharma and medical devices covers effectiveness checks, and the supplier qualification guide covers the evaluation records clause 7.4.1 asks for. Device teams preparing a new submission can pair this with the 510(k) submission guide, since a cleared device still has to meet Part 820 once it ships. To see how a peer firm's QMSR inspection went, search the FDA Form 483s directory by company.

Clause shares will keep moving as FDA finalizes more 2026 inspections, and the digest sends the new device citations as FDA posts them.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe