What is 21 CFR 820 (Medical Device GMP)

21 CFR 820 is a set of regulations produced by the U.S. Food and Drug Administration (FDA) under Title 21 of the Code of Federal Regulations. It sets out the minimal current Good Manufacturing Practice (cGMP) criteria for processes, facilities, and controls used in the design, production, packaging, labelling, storage, installation, and service of completed medical devices.

The aim of the rule is to ensure that medical devices are manufactured and controlled to quality standards, thereby lowering the risk of device failure, injury to patients and non-compliance with regulations.

In 2024, the FDA completed the finalization of the Quality Management System Regulation (QMSR) under 21 CFR Part 820, aligning the current QSR framework with ISO 13485. This modernization allows global firms to meet FDA and international standards simultaneously.

21 CFR Part 820 applies to manufacturers of finished medical devices which are sold or distributed in the United States

• Class I Medical Devices – Low risk (some exempt but some Class I devices with significant risk still require full QSR compliance)
• Class II Medical Devices – Blood pressure monitors, surgical gloves, powered wheelchairs and other moderate-risk devices
• Class III Medical Devices – High risk devices such as pacemakers, implantable defibrillators and heart valves

The regulation applies to the below parties other than the actual device manufactures

1. Contract manufacturers
2. Specifications developers
3. Re-labelers and Re-packagers
4. Reprocessors of single-use devices
5. First distributors of imported devices

If your company touches a finished medical device at any point in the supply chain before it gets to the end user, then there’s a very good chance your operations are under 21 CFR Part 820.

The regulation is split into subparts, each dealing with a major part of the quality system. Here is a summary of your organization’s requirements under each subpart:

Management Responsibility (§820.20): The quality policy shall be established, documented, and implemented by top management. Regular management reviews must be held to assess the effectiveness of the QMS.

Design Controls (§820.30): One of the most audited sections. Class II and III device manufacturers must have procedures established to control the design process, including design planning, input, output, review, verification, validation and transfer.

§820.40 Document Controls: All documents required by the QMS must be reviewed, approved and controlled. Document changes must be reviewed and approved prior to being put into effect.

Purchasing Controls (§820.50): Procedures to evaluate and select suppliers based on their ability to meet specified requirements. Supplier agreements, audits and continuous monitoring are required.

Production and Process Controls (§820.70): Manufacturers shall develop, conduct, control and monitor production processes to ensure conformance to device. These include controls of environment, personnel hygiene, contamination and equipment maintenance.

Process Validation (§820.75): Where results cannot be fully verified by inspection and testing, processes must be validated to a high degree of assurance prior to production.

Corrective and Preventive Action – CAPA (§820.100): CAPA is the core of any FDA compliant QMS. Manufacturers shall determine the root cause of nonconformities, and shall take action to prevent recurrence.

Labelling and Packaging Controls (§820.120 / §820.130): Device labelling must be controlled, legible and meet FDA labelling requirements. Labels have to be checked before use.

Records Management (§820.180- §820.198): Device master records (DMR), device history records (DHR), and quality system records (QSR) must be kept and made available to FDA for inspection.

Complaint Handling (§820.198): A formally designated unit shall receive, review, and evaluate all complaints. Escalate any complaints that may involve MDR-reportable events, in an appropriate manner.

I3CGlobal offers end-to-end consulting support for medical device companies at every stage of their GMP compliance journey — from initial gap assessment to full QMS implementation and FDA inspection readiness.

Gap Analysis & Assessment We conduct a thorough review of your existing quality system against the requirements of 21 CFR Part 820 / QMSR. Our detailed gap analysis report identifies areas of non-compliance and prioritizes corrective actions with a clear remediation roadmap.

QMS Implementation & Documentation Our consultants develop, review, and implement all documentation required under 21 CFR Part 820, including SOPs, work instructions, quality manual, DMR templates, DHR frameworks, and CAPA procedures — tailored to your device type and business size.

GMP Training We deliver practical, role-based GMP training for your staff — from shop floor operators to senior management. Training covers cGMP principles, document control, CAPA, complaint handling, and FDA inspection readiness.

Internal QSR Audits Our lead auditors conduct full or partial internal audits of your quality system against 21 CFR Part 820 requirements, delivering detailed audit reports with findings, observations, and recommendations.

Supplier Qualification & Audits We assist in developing your supplier qualification program and conduct supplier audits to ensure your supply chain meets the purchasing control requirements of §820.50.

FDA Pre-Inspection Support Before an FDA inspection, we conduct a comprehensive mock audit simulating real FDA inspection conditions. We identify vulnerabilities in your quality system and prepare your team with inspection readiness training and coaching.

FDA 483 Response & Warning Letter Support If your facility has received an FDA Form 483 or Warning Letter, our consultants prepare formal, well-documented responses and corrective action plans that demonstrate genuine commitment to compliance and resolution.

QMSR Transition Support (2024 Update) With the FDA’s new QMSR final rule aligning 21 CFR Part 820 with ISO 13485:2016, many companies need support transitioning their existing QMS. We guide you through the gap analysis, documentation updates, and implementation required for a smooth transition.

Deep Regulatory Knowledge: Our consultants are ex-FDA reviewers, certified quality auditors and industry veterans with decades of hands-on experience in medical device GMP compliance.

U.S. Regulatory Focus, Global Reach:  We work with medical device manufacturers across the globe who are exporting to the U.S. market, and we provide the local regulatory expertise that global companies need.

Knowledge Specific to the Device: We understand the nuances of the various device types, from combination products, IVDs to Class III implantable and tailor our consulting methods accordingly.

Audit-Ready & Practical Deliverables: We make sure that every document, SOP and procedure is inspection-ready. Not just compliant on paper, but defensible under the FDA microscope.

Ongoing Support: Not a One-Time Project Compliance is not a one-time project. We offer annual retainer services to keep your QMS up-to-date, perform internal audits and keep your team up-to-date with regulatory changes.

Proven Track Record: We’ve helped clients pass FDA inspections, close 483 observations and achieve GMP certification.

There are many manufacturers who want to know how 21 CFR Part 820 relates to ISO 13485:2016, the international standard for medical device quality management systems. The two frameworks have the same core objective – ensuring device quality and patient safety – but there are important differences:

Issued By:  The U.S. FDA issues 21 CFR Part 820 (QSR/QMSR) whereas ISO 13485:2016 is issued by ISO and is applicable globally.

Geography Scope: 21 CFR Part 820 applies only to the United States market. ISO 13485:2016 is accepted worldwide, including in the EU, Canada, Australia, Japan and other major markets.

Legal Status:  21 CFR Part 820 is a mandatory U.S. federal regulation and failure to comply can lead to enforcement action. ISO 13485:2016 is a voluntary standard, but in some markets (EU under MDR/IVDR, Canada under CMDCAS) it’s almost mandatory.

Design Control : Design controls are required for Class II and Class III devices by 21 CFR Part 820. Design and development controls are required for all applicable devices regardless of class per ISO 13485:2016.

Complaint Handling: 21 CFR Part 820 requires complaint handling under §820.198. ISO 13485:2016 has the equivalent requirement in Clause 8.2.2. CAPA (Corrective and Preventive Action)

CAPA: 21 CFR Part 820: 820.100 and ISO13485:2016: Clause 8.5.2 Corrective Action Clause 8.5.3 Preventive Action

The FDA finalised the 2024 QMSR Final Rule, which fully harmonises 21 CFR Part 820 with ISO 13485:2016, allowing manufacturers that are certified to ISO 13485 to satisfy a large portion of their 21 CFR Part 820 requirements at the same time. i3CGlobal helps companies leverage this alignment to achieve dual compliance.

In February 2024, the FDA released the final rule for the Quality Management System Regulation (QMSR), modifying 21 CFR Part 820 to align with ISO 13485:2016. Here are some key highlights of this update:

• The QMSR references ISO 13485:2016, which means that compliance with ISO 13485 is now at the heart of FDA’s QMS expectations moving forward.
• Full compliance is effective February 2, 2026, allowing manufacturers time to transition.
• A number of FDA-specific requirements (e.g. Design History File, Unique Device Identification and MDR linkage) are added on top of the ISO 13485 framework.
• For companies already certified to ISO 13485:2016, the transition will be easier, but FDA-specific additions need to be paid attention to.

Our QMSR transition consulting service will help you to assess your current QMS vs. the new requirements, fill the gaps and prepare your documentation and team for full compliance.