Nonconforming Product (21 CFR §820.90)

21 CFR §820.90 is a short clause with four mandatory controls: identify nonconforming product, document the nonconformity, evaluate the nonconformity, and dispose of it under a documented procedure. ISO 13485 §8.3 — which becomes the binding text under QMSR on 2 February 2026 — adds two explicit requirements that QSR left implicit: maintain records of the actions taken and re-verify reworked product before release.

Identification is more than a red hold-tag. The system must positively prevent the nonconforming unit from being used or shipped — physical segregation (a quarantine cage), electronic segregation (a status flag in the MES/WMS that blocks pick and ship transactions), and labelling must all align. A unit that is physically in a quarantine cage but still showing 'available' in the ERP is a §820.90 finding waiting to happen, as is a unit with a hold flag in the system but no physical tag.

The most common failure mode is the 'engineering loaner' or 'sample for the trade show' that is pulled from quarantine without re-dispositioning. The audit trail of who removed the unit, under what authority, and what happened to it after must exist; otherwise the system is presumed not to control nonconforming product.

Every nonconformance must be evaluated. The evaluation answers three questions: what is the extent (one unit, one lot, many lots), what is the risk (does this unit / lot present a hazard if it had been used), and is an investigation required (is the cause known, or does it need root-cause work).

§820.90(a) requires an investigation 'as required by §820.100', i.e., when the issue is systemic, recurrent, or has effectiveness implications beyond the immediate event. ISO 13485 §8.3 is more explicit: investigation is required whenever the impact extends beyond the immediate product. A documented decision either way must exist in the NCR.

1. Extent assessment — single unit, lot-wide, or multi-lot. Lot-wide and multi-lot trigger broader sampling under §820.250.
2. Risk assessment — link to the ISO 14971 risk file. If the failure mode was already characterised, the existing risk control adequacy is re-evaluated. If it is a new failure mode, the risk file is updated.
3. Cause assessment — known cause (e.g., a documented procedural deviation that already has a root cause) vs unknown cause. Unknown cause requires a documented root-cause analysis before disposition.
4. Trend assessment — is this the third occurrence in 90 days? Recurrence triggers a CAPA per §820.100 regardless of the individual severity.

Disposition authority must be assigned in the procedure. Typically QA has final authority for use-as-is and scrap; manufacturing engineering can authorise rework against the validated procedure; only the change-control board can authorise repair (rework outside the validated process).

§820.90(b)(2) is one of the QSR clauses that catches most manufacturers: 'The activities of rework, including a re-evaluation of the nonconforming product after rework, shall be documented in the DHR.' The re-evaluation has to use the same acceptance criteria as the original — you cannot rework a unit to a looser standard than the original passed-or-failed against.

If the rework operation itself is not part of the original validated process — for example, a unit that has been re-soldered after a cold-joint failure when the original process did not include a re-solder step — then the rework procedure must itself be validated, or the rework must be authorised as a repair under change control with a documented risk assessment. This is the most-cited rework finding in 483s.

A concession (use-as-is) under ISO 9000 §3.12.5 vocabulary is permission to release product that does not conform to specified requirements. ISO 13485 §8.3.3 adds two device-specific constraints:

• Concessions require justification, approval and identification of the responsible person — the same level of rigor as any other disposition.
• Where the original requirement was a regulatory requirement (e.g., a labelling requirement under §801) or a customer requirement explicitly captured in the contract, the concession requires notification to the regulator or the customer before release.

Concessions cannot be used to release product that fails a safety or effectiveness requirement — the only legitimate dispositions for a unit that fails a safety/effectiveness requirement are rework (to meet the requirement), scrap, or return to supplier. A concession on a safety requirement is, by definition, releasing unsafe product and is the basis for an inspectional finding of inadequate quality system controls.

A nonconformance is not automatically a CAPA. The CAPA decision is a separate risk-based assessment under §820.100 / §8.5.2: recurrence rate, severity, regulatory commitments and risk to patient safety drive it. A single, isolated, low-risk nonconformance closes under §820.90 with the immediate corrective action recorded inside the NCR and no CAPA opened.

The link to complaint handling (§820.198) runs the other direction: a complaint investigation that traces back to a specific manufactured unit will pull the eDHR, and any NCR on that unit becomes evidence in the complaint investigation. A pattern of nonconformances on units that later generated complaints is, in itself, a CAPA trigger.