A nonconformance is a failure to meet a specified requirement; ISO 9000:2015 (clause 3.6.9) defines a nonconformity in four words, "non-fulfilment of a requirement". The requirement can be a product specification, a written procedure, a customer contract or a regulation. In a GMP facility, nonconformances are classified as critical, major or minor, recorded on a nonconformance report (NCR), segregated, dispositioned, and sent to root cause analysis and CAPA when the risk warrants it. This guide uses Atlas Form 483 data from the release of August 15, 2026, covering every Medical Devices and Human Drugs 483 issued from January to July 2026.
Key facts:
- ISO 9000:2015 clause 3.6.9 defines a nonconformity as the non-fulfilment of a requirement; "nonconformance", "non-conformance" and "nonconformity" are used interchangeably in practice.
- Since February 2, 2026, FDA's Quality Management System Regulation (21 CFR 820.10) incorporates ISO 13485:2016, so device nonconforming product control is cited as ISO 13485 clause 8.3 instead of the legacy 21 CFR 820.90.
- In the Atlas Form 483 database (release of Aug 15, 2026), 62 of 389 medical device 483s issued in 2026, or 16%, cite ISO 13485 clause 8.3 or 21 CFR 820.90.
- In the same release, 84 of 323 human drug 483s issued in 2026, or 26%, cite 21 CFR 211.192, the requirement to investigate any batch failure or unexplained discrepancy.
- Under 21 CFR 211.165(f), a drug product that fails its specifications must be rejected; reprocessing is allowed only under written procedures approved by the quality control unit (21 CFR 211.115).
What are the types of nonconformance?
Nonconformance types are graded by risk to the patient and the product: critical, major and minor. The grade decides how fast containment happens, who must approve the disposition, and whether a full root cause investigation and CAPA are required. FDA does not grade Form 483 observations this way. The three tiers are an industry convention; EU and PIC/S GMP inspectors grade deficiencies as critical, major or other, and ISO 13485 certification auditors use major and minor.
| Grade | Definition | Examples in a GMP facility | Typical response |
|---|---|---|---|
| Critical | Has caused, or is likely to cause, a product that harms the patient or is adulterated | Sterile batch released after a media fill failure; label mix-up between two strengths; falsified test data | Immediate hold and quarantine, quality head notified the same day, full investigation, CAPA, recall assessment |
| Major | Significant departure from GMP or specification with potential product impact, not immediately hazardous | Balance out of calibration used for dispensing; batch record step skipped and found at review; cleaning not validated for a new product on shared equipment | Hold affected lots, impact assessment across batches, root cause analysis, CAPA |
| Minor | Departure with no realistic effect on product quality, safety or data integrity | Missing operator initials corrected the same day; superseded log form used with correct data; calibration label partly unreadable but in date | Correct, record, trend; CAPA only if the trend repeats |
A second way to classify, used on most NCR forms, is by where the failure sits:
- Product nonconformance: the material, component, intermediate or finished product does not meet its specification (a dimension out of tolerance, an assay below limit).
- Process nonconformance: a step was not run as the validated procedure requires (wrong hold time, skipped in-process check).
- System nonconformance: the quality system itself is missing or broken (no procedure for nonconforming product, no rework records, training not documented).
System nonconformances are the ones FDA writes up most often in the device sector. Of the 2026 device 483s in the Atlas directory that cite clause 8.3.1, half say the procedure for nonconforming product was not documented at all.
What goes in a nonconformance report (NCR)?
A nonconformance report (NCR) is the controlled record that identifies the nonconforming item, describes how it fails the requirement, and documents the decision made about it. ISO 13485 clause 8.3.1 requires records of the nature of the nonconformity and any subsequent action, including the evaluation, investigation and the rationale for decisions. A complete NCR carries these fields:
| Field | What to record |
|---|---|
| NCR number and date | Unique ID, date found, who found it |
| Item identification | Part, material or product name, lot or batch, quantity affected, location |
| Requirement not met | The specification, drawing, SOP or regulation, with revision number |
| Description | What was observed, measured value against limit, evidence attached |
| Classification | Critical, major or minor; product, process or system |
| Containment | Quarantine location, hold tag, other lots checked |
| Evaluation | Risk to patient and product, need for investigation, external party notified |
| Disposition | Use as is, rework, reject, return to supplier, with justification |
| Approval | Name, role and signature of the person authorizing the disposition |
| Root cause and CAPA link | Investigation reference and CAPA number, or the reason none is needed |
| Verification and closure | Evidence that rework passed, product scrapped, CAPA effective; closure date |
The approval field is the one auditors read first. ISO 13485 clause 8.3.2 lets a manufacturer accept nonconforming product by concession only if a justification is provided, approval is obtained, regulatory requirements are still met, and the identity of the person authorizing it is recorded.
How is a nonconformance handled, step by step?
A nonconformance is handled in seven steps: identify, segregate, evaluate, disposition, investigate root cause, act through CAPA, and verify before closure. The first four protect the product in front of you. The last three protect the next batch.
- Identify. The operator, inspector, auditor or complaint handler records the nonconformance and opens an NCR. Late recording is itself a finding.
- Segregate. Tag and physically move the item to a quarantine or MRB (material review board) area, or block it in the inventory system, so it cannot be used by mistake.
- Evaluate. Assess the risk to the patient and product, check other lots made with the same material, equipment or operator, and decide whether a formal investigation is needed. Clause 8.3.1 requires this evaluation; "not adequately evaluated" appeared on 7 device 483s in 2026.
- Disposition. Choose one outcome and record who approved it:
- Use as is (concession): only with documented justification that the item still meets regulatory requirements. Not available for a drug batch that fails specification, which 21 CFR 211.165(f) says must be rejected.
- Rework or reprocess: under a written procedure, with the reworked item re-verified against the original requirements (clause 8.3.4; 21 CFR 211.115 for drugs, with quality unit approval).
- Reject or scrap: destroy under control and record it.
- Return to supplier: send back with a supplier corrective action request; our SCAR process guide covers that loop.
- Investigate root cause. Use 5 Whys, fishbone or fault tree, scaled to the grade. A minor one-off may need only a documented rationale.
- Act through CAPA. Corrective action removes the cause of this nonconformance; preventive action removes the cause of similar ones elsewhere. See our guide to corrective and preventive action and the corrective action request that often starts it.
- Verify and close. Confirm the rework passed, the scrap happened, and the CAPA worked, then close the NCR with evidence. Trend NCRs monthly so repeats surface before an investigator finds them.
Nonconformances found after delivery follow the same steps, plus clause 8.3.3: action proportionate to the effects, which can mean an advisory notice or recall.
Nonconformance vs deviation vs OOS vs CAPA: what is the difference?
A nonconformance is a product, process or system that fails a requirement; a deviation is a departure from an approved instruction; an OOS is a laboratory result outside specification; and a CAPA is the action taken to remove the cause. The first three are events, and CAPA is the response to them.
| Term | What it is | Typical trigger | Main regulation | Leads to |
|---|---|---|---|---|
| Nonconformance | Product, process or system that does not meet a requirement | Failed inspection, audit finding, supplier defect | ISO 13485 clause 8.3; ISO 9001 clause 8.7 | NCR, disposition, possibly CAPA |
| Deviation | Departure from an approved procedure, batch record or protocol, planned or unplanned | Step skipped, parameter outside range during processing | 21 CFR 211.100(b), 211.192 | Deviation report, impact assessment, possibly CAPA |
| OOS result | Test result outside the approved specification or acceptance criteria | QC release or stability testing | 21 CFR 211.160, 211.165, 211.192; FDA OOS guidance | Phase I lab and phase II full-scale investigation |
| CAPA | Action to eliminate the cause of a detected (corrective) or potential (preventive) nonconformity | Any of the above, complaints, audit trends | ISO 13485 clauses 8.5.2 and 8.5.3; 21 CFR 820.100 (legacy) | Effectiveness check, closure |
Drug facilities tend to say "deviation" for process events and "nonconformance" for materials and components; device facilities use "nonconformance" for both. An OOS result is a specific kind of product nonconformance with its own investigation rules, covered in our OOS guide.
Which regulations govern nonconforming product?
Nonconforming product control for medical devices sits in ISO 13485:2016 clause 8.3, made binding in the US by the Quality Management System Regulation at 21 CFR 820.10 from February 2, 2026. For drugs, there is no single nonconformance section; three parts of 21 CFR 211 do the work.
| Sector | Section | What it requires |
|---|---|---|
| Devices | ISO 13485 clause 8.3.1 | Documented procedure to identify, document, segregate, evaluate and dispose of nonconforming product; records of the decision |
| Devices | Clause 8.3.2 and 8.3.3 | Actions before delivery (correct, prevent use, concession) and after delivery (proportionate action, advisory notice) |
| Devices | Clause 8.3.4 | Rework under documented procedures, with re-verification |
| Devices, before Feb 2, 2026 | 21 CFR 820.90(a) and (b) | Legacy control of nonconforming product, and review and disposition |
| Drugs | 21 CFR 211.192 | Any unexplained discrepancy or failure of a batch to meet specifications must be thoroughly investigated, whether or not the batch was distributed, extended to other batches, with a written record |
| Drugs | 21 CFR 211.115 | Written reprocessing procedures; no reprocessing without quality control unit approval |
| Drugs | 21 CFR 211.165(f) | Drug products that fail standards or specifications are rejected; reprocessed material must meet specifications before use |
Clause 8.3 also ties into design: a nonconformance that traces back to a design input belongs in design change control, which our post on medical device design controls explains.
How often does FDA cite nonconforming product control?
FDA cited nonconforming product control on one in six medical device Form 483s issued in 2026. In the Atlas Form 483 database (release of Aug 15, 2026), 62 of 389 device 483s dated January to July 2026 cite ISO 13485 clause 8.3 or 21 CFR 820.90. For human drugs, 84 of 323 2026 483s, or 26%, cite 21 CFR 211.192.
The QMSR switch shows clearly in the data. The 40 device 483s issued in January 2026, before the new rule took effect, still cited the old Part 820: 8 of them, 20%, cite 820.90. Of the 349 issued from February 2 onward, 54, or 15%, cite clause 8.3. Clause 8.3.1 alone appears on 44 device 483s and ranks sixth among ISO 13485 clauses cited in 2026, behind clause 7.1 (109), 8.5.2 corrective action (91), 8.2.2 complaint handling (68), 7.4.1 purchasing (62) and 7.5.6 process validation (56).
The finding text tells you what investigators check. "Procedure for nonconforming product not documented" appears on 22 device 483s, "records of nonconforming product and actions taken not maintained" on 9, "nonconforming product not identified and controlled" on 8, and "not adequately evaluated" on 7. Rework under clause 8.3.4 shows up on 6. These are system failures, not single bad parts. Four indexable examples from the FDA Form 483 database:
- Light Age, Inc., Somerset, May 15, 2026: 18 observations, including clauses 8.3.1, 8.3.3 and 8.4, with the nonconforming product procedure not documented.
- LeMaitre Vascular, North Brunswick, June 25, 2026: 8 observations, including nonconforming product not adequately evaluated (8.3.1) and corrective action procedures not documented (8.5.2).
- MICROspecialties, Middletown, June 17, 2026: 2 observations, one of them nonconforming product not identified and controlled.
- Procter & Gamble Manufacturing, June 9, 2026: 4 drug observations, including 211.115(a), reprocessing procedures lacking the steps to be taken, and 211.192. It is the only 2026 human drug 483 in the release citing 211.115.
Both device examples above, Light Age and LeMaitre, were written by investigator Frank J Marciniak, who cited clause 8.3.1 at each. On the drug side, the Baxter Healthcare 483 of April 2, 2026 pairs 211.192 with 211.165(d) acceptance and rejection levels. 211.165 in any subsection appears on 21 of the 323 drug 483s, and subsection (f), rejection of failing product, on 2.
AtlasSee what the FDA knows about your next investigator.
30 minutes with the founder. No pitch deck.
How do you prevent nonconformances from recurring?
Recurring nonconformances are prevented by trending NCRs, fixing causes at the system level, and closing CAPAs only on evidence. The 2026 Form 483 record points to four controls worth checking before an inspection.
- Have the procedure. Half of the clause 8.3.1 findings in 2026 were a missing procedure. One SOP that covers identification, segregation, evaluation, disposition authority, concessions and rework closes the most common observation outright.
- Make the disposition traceable. Every NCR names the approver and the justification. "Use as is" without a written rationale is how a concession becomes a 483.
- Extend the investigation. 21 CFR 211.192 requires the investigation to reach other batches and products that may share the failure. A drug NCR that stops at one lot fails that test.
- Trend and escalate. Review NCRs by part, supplier, line and failure mode each month. A minor nonconformance that repeats three times is a major one, and it belongs in CAPA and management review. Supplier-driven repeats go back to the supplier through a SCAR.
The link between nonconformance control and CAPA is where most device 483s connect: clause 8.5.2 corrective action is the second most cited ISO clause in 2026, on 91 of 389 device 483s.
AtlasFDA Inspection Intelligence Digest
We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.
Frequently asked questions
A common example is a lot of molded components measured at 10.4 mm against a drawing limit of 10.0 to 10.3 mm. The parts do not meet the drawing, so the inspector tags them, moves them to quarantine and opens an NCR. The material review board then decides to scrap, rework, return to the supplier or accept by documented concession.
Written by
Bhavish Agarwal
Founder, Atlas
Bhavish Agarwal is the founder of Atlas and previously worked at Google and Microsoft. He has spent the past several years building regulatory data infrastructure for the pharmaceutical industry.