Guide

21 CFR 820 → ISO 13485 Mapping: A Clause-by-Clause Guide (Including QMSR Harmonisation)

For twenty years, medical-device manufacturers running for both US and international markets have kept two parallel QMS documentation sets — one aligned to 21 CFR Part 820 (the Quality System Regulation, QSR) and one aligned to ISO 13485. On 2 February 2024 FDA published the Quality Management System Regulation (QMSR) final rule, which by reference incorporates ISO 13485:2016 into Part 820 and takes effect on 2 February 2026. That is closer than it looks — most QMS documentation projects need 12 months, and the transition is not free. This guide gives you a clause-by-clause map between the legacy Part 820, ISO 13485:2016 and the QMSR, calls out the seven places where FDA has kept a US-specific requirement on top of the ISO baseline, and lists the specific documentation edits and evidence artefacts you need in place before the effective date. Written for QA/RA leaders, quality-system owners and management representatives at Class II and III device manufacturers.

Start free trial Free trial, no credit card, onboard in days, not months.

What QMSR actually changes (and what stays)

The QMSR final rule replaces most of Part 820's Subpart-by-Subpart text with a reference to ISO 13485:2016 clauses 4–8, keeps a slimmed-down set of Part 820 clauses for US-specific requirements (labelling, UDI, complaint files, MDR reporting linkage, records retention, and definitions), and preserves Part 803 (MDR reporting), Part 806 (corrections and removals) and Part 830 (UDI) untouched. The practical effect: your QMS documentation should be structured around ISO 13485:2016 clause numbers, with cross-references to the remaining Part 820 clauses in a handful of specific places. Manufacturers who have historically written procedures citing 820.30, 820.100, 820.198 etc. need to re-cite most of those clauses to their ISO 13485 equivalents while keeping the Part 820 cite for the US-specific residuals.

Clause-by-clause map — Subpart B (Quality System)

Part 820.5 (Quality system) maps to ISO 13485 clauses 4.1 (general requirements) and 4.2.1 (documentation). Part 820.20 (Management responsibility) maps to ISO 13485 clause 5 in full — 5.1 management commitment, 5.2 customer focus, 5.3 quality policy, 5.4.1 quality objectives, 5.4.2 QMS planning, 5.5 responsibility and authority, 5.6 management review. Part 820.22 (Quality audit) maps to ISO 13485 clause 8.2.4. Part 820.25 (Personnel) maps to ISO 13485 clause 6.2 (human resources) with an additional US expectation that training records show competence before task assignment. Under QMSR the ISO 13485 clauses become the primary citation for these areas; the 820 numbers survive only as historical references in legacy documentation.

Clause-by-clause map — Subpart C (Design Controls) and Subpart D (Document Controls)

Part 820.30 (Design controls) maps to ISO 13485 clause 7.3 in full — 7.3.2 planning, 7.3.3 inputs, 7.3.4 outputs, 7.3.5 review, 7.3.6 verification, 7.3.7 validation, 7.3.8 transfer, 7.3.9 changes, 7.3.10 files. The DHF concept survives explicitly in QMSR; the DMR is aligned with ISO 13485 clause 4.2.3 (medical device file). Part 820.40 (Document controls) maps to ISO 13485 clauses 4.2.4 (control of documents) and 4.2.5 (control of records). Watch for two subtle differences: ISO 13485 clause 7.3.10 requires a design and development file 'for each medical device type or medical device family' — broader than the DHF-per-device pattern many US manufacturers use — and ISO 13485 clause 4.2.3 medical device file is not a one-to-one substitute for the DMR; it can reference multiple documents.

Clause-by-clause map — Subpart E (Purchasing) and Subpart F (Identification and Traceability)

Part 820.50 (Purchasing controls) maps to ISO 13485 clause 7.4 — 7.4.1 purchasing process, 7.4.2 purchasing information, 7.4.3 verification of purchased product. Supplier qualification evidence, purchasing data on the PO, and receiving inspection all cross-cite cleanly. Part 820.60 (Identification) and 820.65 (Traceability) map to ISO 13485 clause 7.5.8 (identification) and 7.5.9 (traceability). ISO 13485 clause 7.5.9.2 adds specific traceability requirements for implantable devices — components, materials and work environment conditions — that go beyond what Part 820.65 has historically required in practice; if you make implantables, this clause needs an explicit look during the transition.

Clause-by-clause map — Subpart G (Production and Process Controls) and Subpart H (Acceptance Activities)

Part 820.70 (Production and process controls) maps to ISO 13485 clause 7.5.1 (control of production and service provision) with sub-clauses for cleanliness (7.5.2), installation (7.5.3), servicing (7.5.4), sterile devices (7.5.5), validation of processes (7.5.6), and validation of sterilisation and sterile-barrier systems (7.5.7). Part 820.72 (Inspection, measuring and test equipment) maps to ISO 13485 clause 7.6. Part 820.75 (Process validation) maps to ISO 13485 clause 7.5.6. Part 820.80 (Receiving, in-process, and finished device acceptance) and Part 820.86 (Acceptance status) map to ISO 13485 clause 8.2.6 (monitoring and measurement of product) and clause 7.5.1 (production controls). This is the area where FDA has retained a US-specific expectation around DHR completeness — Part 820.184 remains a discrete residual clause under QMSR.

Clause-by-clause map — Subpart I (Nonconforming Product) and Subpart J (CAPA)

Part 820.90 (Nonconforming product) maps to ISO 13485 clause 8.3 — 8.3.1 general, 8.3.2 actions in response to nonconforming product detected before delivery, 8.3.3 actions after delivery, 8.3.4 rework. Part 820.100 (Corrective and preventive action) maps to ISO 13485 clause 8.5.2 (corrective action) and 8.5.3 (preventive action). Note that ISO 13485:2016 separates corrective and preventive action into two clauses; US manufacturers who have run a single 'CAPA' process under 820.100 need to make sure procedures address both directions distinctly. Effectiveness verification is required by both regimes and is one of the most-cited gaps at both FDA inspections and notified-body audits.

Clause-by-clause map — Subpart K (Labelling), Subpart L (Handling / Storage / Distribution / Installation), and Subpart M (Records)

Part 820.120 (Device labelling) and 820.130 (Device packaging) map partially to ISO 13485 clause 7.5.1 (production controls) with residual US-specific labelling requirements retained under QMSR. Part 820.140 (Handling), 820.150 (Storage), 820.160 (Distribution) and 820.170 (Installation) map to ISO 13485 clauses 7.5.11 (preservation), 7.5.1 (production controls) and 7.5.3 (installation). Part 820.180–186 covers records: 820.180 (general requirements) maps to ISO 13485 clause 4.2.5, 820.181 (DMR) to clause 4.2.3, 820.184 (DHR) is a US-specific residual under QMSR, and 820.186 (quality system record) maps to clause 4.2.4. Subpart N (Servicing, 820.200) maps to ISO 13485 clause 7.5.4. Subpart O (Statistical techniques, 820.250) maps to ISO 13485 clause 8.4 (analysis of data).

The seven US-specific residuals to watch

Under QMSR seven areas retain US-specific requirements on top of the ISO 13485:2016 baseline. First, terminology reconciliation — FDA has added an interpretive section reconciling ISO terms like 'authorized representative' with US usage. Second, the DHR under 820.184 remains a discrete US artefact. Third, labelling controls under 820.120 keep US-specific residuals for the label inspection and release step. Fourth, complaint files under 820.198 remain a residual and cross-reference Part 803 (MDR reporting). Fifth, records retention (820.180) keeps the US-specific minimum of the expected life of the device or two years from release, whichever is longer. Sixth, MDR reporting under Part 803 is untouched by QMSR. Seventh, UDI under Part 830 is untouched. Your QMS should keep explicit cross-references to these seven areas even after ISO 13485 becomes the primary citation for everything else.

The 12-month QMS transition plan

Months 1 to 2: publish a management-approved position on QMSR transition; freeze the current QMS as the pre-QMSR baseline. Months 3 to 5: re-cite every procedure to its ISO 13485:2016 primary clause plus any residual Part 820 / 803 / 830 reference; add the seven US-specific residuals as explicit callouts in the affected procedures. Months 6 to 8: re-map the internal-audit programme to ISO 13485 clause 8.2.4 with a US-residuals audit schedule; re-map the management-review inputs to ISO 13485 clause 5.6. Months 9 to 10: train all personnel on the new citation structure and the seven residuals; capture the training as competence evidence under ISO 13485 clause 6.2. Months 11 to 12: dry-run a QMSR-style FDA inspection with internal QA playing investigator, focused on the seven residuals plus the ISO 13485 clauses 4, 7.3, 7.5, 8.2 and 8.5. Close any gap and freeze the QMSR baseline before 2 February 2026.

Frequently asked

After 2 February 2026, do I still need to cite Part 820 anywhere?

Yes — the seven US-specific residuals (terminology reconciliation, DHR under 820.184, labelling controls under 820.120, complaint files under 820.198, records retention under 820.180, MDR reporting under Part 803, UDI under Part 830) remain in force and require explicit Part 820 / 803 / 830 citations in the affected procedures. Everywhere else, ISO 13485:2016 clauses become the primary citation.

How different are the design-controls expectations between 820.30 and ISO 13485 clause 7.3?

For US-only manufacturers who have executed 820.30 well, the transition to ISO 13485 clause 7.3 is mostly a citation change — the substantive expectations are aligned. The main additions are the design-file requirement in ISO 13485 clause 7.3.10 (per device or device family, which can be broader than the DHF-per-device pattern) and slightly more explicit expectations around design and development planning in clause 7.3.2. Neither is a redesign — they are documentation additions.

Does QMSR change how MDR reports are filed?

No — 21 CFR Part 803 (MDR reporting) is untouched by QMSR. The complaint-file clause 820.198 remains as a residual under QMSR and continues to cross-reference Part 803. The 30-day, 5-day and 15-day MDR clocks are unchanged.

If we already run a dual QSR + ISO 13485 QMS, is anything new required?

Less than for a US-only manufacturer, but not nothing. The seven US-specific residuals need to be re-verified as explicit cross-references in the affected procedures, the internal-audit programme needs to be re-mapped to ISO 13485 clause 8.2.4 as the primary basis with a US-residuals audit schedule on top, and management review needs to be re-scoped to ISO 13485 clause 5.6 inputs and outputs. Most mature dual-QMS operators close this in 3 to 4 months.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →