21 CFR Part 820: Subpart-by-Subpart Map and QMSR Transition Status

Status as of 26 August 2026: 21 CFR Part 820 is in force, and it is the Quality Management System Regulation (QMSR). LAC Health’s procurement-facing glossary covers the QMSR / 21 CFR 820 transition from a buyer’s perspective. The legacy Quality System Regulation (QSR) text — the Subpart A–O structure most people picture when they hear “Part 820” — stopped being operative regulatory text on 2 February 2026. Subparts C through O now read [Reserved]. If you are working from a Part 820 checklist keyed to 820.30, 820.50, 820.100 or 820.181, you are working from text that no longer exists.

This page is the U.S. regulation itself: how Part 820 is structured now, where every legacy subpart went, what the four record types (DMR, DHR, DHF, quality system record) are called today, and what a manufacturer actually has to change. For what the incorporated standard requires clause by clause — and what an auditor asks you to produce against it — see CASRAI’s companion guide to ISO 13485 medical device quality management systems, which covers the standard’s own structure and the QMSR’s supplemental provisions in detail. Part 820 sits inside the wider Title 21 framework mapped in 21 CFR: what Title 21 covers, and inside the broader lab compliance cluster.

What Part 820 contains today

The whole of the current regulation is nine section headings, verified against the eCFR text of Part 820. It is short enough to read in a sitting, and that brevity is the single most important structural fact about it:

• Subpart A — General Provisions. § 820.1 Scope; § 820.3 Definitions; § 820.5 [Reserved]; § 820.7 Incorporation by reference; § 820.10 Requirements for a quality management system.
• Subpart B — Supplemental Provisions. §§ 820.20–820.30 [Reserved]; § 820.35 Control of records; § 820.40 [Reserved]; § 820.45 Device labeling and packaging controls.
• Subparts C–O — [Reserved].

Two consequences follow immediately. First, most of the substantive requirement is no longer in the CFR at all — 820.7 incorporates ISO 13485:2016(E) by reference for §§ 820.1, 820.3, 820.10, 820.35 and 820.45, and Clause 3 of ISO 9000:2015(E) for 820.3 only. Second, the five sections that do carry text are exactly the delta between conformance to the standard and compliance with U.S. law. Those five are broken down provision by provision on the ISO 13485 guide; this page does not repeat them.

How Part 820 got here: the dates that matter

Every date below is from FDA’s own QMSR page or the Federal Register source note carried on the part in eCFR. Getting them right matters, because a surprising amount of published commentary describes the transition in the future tense.

• 21 July 1978 — FDA issues the first device CGMP final rule under FD&C Act section 520(f) (43 FR 31508), codified at Part 820. Effective 18 December 1978.
• 7 October 1996 — the Quality System Regulation is published (61 FR 52602), adding the design controls authorised by the Safe Medical Devices Act. Effective 1 June 1997. This is the Subpart A–O structure that ran for the next 29 years.
• 2 February 2024 — the QMSR final rule is published at 89 FR 7523, with a two-year runway. Corrected and amended at 89 FR 82945 on 15 October 2024.
• 2 February 2026 — the QMSR becomes effective. FDA simultaneously changes how it inspects (below). This date has passed.

A practical trap when you pull historical text. eCFR applied the amendment with an issue date of 4 February 2026, not 2 February. A point-in-time eCFR request for 2026-02-01 or 2026-02-02 still returns the full legacy QSR, titled “Quality System Regulation,” with all 31 sections intact. That is an artefact of how eCFR versions its snapshots, not a statement about when the rule took effect. If you need the legacy text for a gap assessment or a records question, request a date on or before 3 February 2026 — it is still retrievable, just no longer current.

Subpart by subpart: where every legacy requirement went

This is the table most people arriving at “21 CFR Part 820” actually need: they know the old section numbers, and they need to know what to cite now. Read the right-hand column as orientation, not as a citable equivalence.

Where an exact clause correspondence has to be defensible, use the mapping FDA itself points at: AAMI TIR102:2019, U.S. FDA 21 CFR mapping to the applicable regulatory requirement references in ISO 13485:2016, which FDA lists as a QMSR resource. The table below is a practical navigation aid built from the current and superseded regulatory text; it is not the official crosswalk, and CASRAI has not reproduced TIR102 or ISO 13485 clause text here because both are copyrighted standards.

DMR, DHR, DHF and the quality system record

The four-record model was the most recognisable thing about the legacy QSR, and all four defining sections are now reserved. The records themselves did not disappear — the regulatory terms of art did. This matters in practice because the acronyms are still everywhere: in supplier quality agreements, in SOP titles, in FDA guidance documents written before 2024, and in premarket submissions.

The judgment call this creates. You do not have to rename your files. A quality system that keeps a folder called “DHF” is not non-compliant for doing so — the requirement is that the design and development file required by Clause 7.3.10 exists and is complete. What does need attention is anywhere the acronym is load-bearing: a procedure that says “maintain the DMR in accordance with 21 CFR 820.181” now cites reserved text, and a supplier agreement obliging a contract manufacturer to “comply with 21 CFR 820.184” obliges them to comply with nothing. Those are the strings to grep for. The same review applies to any quality agreement and to vendor qualification and supplier audit documentation that cites Part 820 section numbers.

Who Part 820 applies to

Scope is set by § 820.1, and it is broader than “companies that build devices.” A manufacturer is subject to the part if it performs any of the covered functions — and only for the operations it actually performs:

• Covered functions include design, manufacture, packaging, labeling, storage, installation and servicing of finished devices, and expressly extend to contract sterilization, installation, relabeling, remanufacturing, repacking and specification development, as well as initial distributors of foreign entities performing those functions. A specification developer that outsources all physical manufacturing is squarely in scope.
• Partial applicability is explicit. A manufacturer engaged in only some covered operations “need only comply with those requirements applicable to the operations in which it is engaged.” This is the textual basis for a scoped QMS, and it is worth quoting in a scope statement.
• Components and parts are out. The part does not apply to manufacturers of components or parts of finished devices — who are nonetheless “encouraged to consider” it. This is where purchasing controls under ISO 13485 Clause 7.4 do the work instead; see incoming inspection sampling plans.
• Blood and blood components are out (subchapter F applies instead). HCT/Ps regulated as devices are in, and additionally subject to donor-eligibility requirements in Part 1271 Subpart C and current good tissue practice in Part 1271 Subpart D.
• Imports. Foreign manufacturers are reached through section 801(a): a device that appears adulterated is subject to refusal of admission.
• Exemptions and variances. A manufacturer may petition for an exemption or variance under FD&C Act section 520(f)(2), submitted per 21 CFR 10.30. FDA may also initiate a variance on public-health-need grounds, which lasts only as long as that need does.

CGMP-exempt does not mean records-exempt. Some device types are exempted from CGMP requirements by their classification regulation in 21 CFR Parts 862–892. Per FDA, that exemption does not relieve a finished device manufacturer of complaint files or of the record requirements in 820.35. Separately, devices manufactured under an investigational device exemption are not exempt from design and development requirements under 820.10(c) and ISO 13485 Clause 7.3. Two carve-outs that are routinely over-read.

Conflicts are resolved by 820.1(b) in a specific order: the QMSR supplements other parts of the chapter unless stated otherwise; where requirements conflict, the requirement specific to the device in question supersedes the more general one; and where any ISO 13485 clause conflicts with the FD&C Act or its other implementing regulations, the statute and its regulations control. An incorporated standard does not outrank the Act that authorises its incorporation.

What a manufacturer actually changes in the transition

The substance of a mature device QMS did not need to be rebuilt — the QSR and ISO 13485 were similar in substance. What changed is the frame, the vocabulary and the citation layer. In rough order of how much rework each generates:

1. Re-point every internal citation. SOP headers, audit checklists, training material, CAPA forms, validation protocols and design review templates keyed to 820.20/820.30/820.40/820.50/820.70/820.75/820.100/820.181/820.184/820.198 all now reference reserved text. This is the bulk of the work and it is clerical, not technical.
2. Adopt the regulation’s glossary, not the standard’s. 820.3 makes FD&C Act section 201 definitions supersede the correlating ISO terms, redefines several others, and adds terms ISO 13485 does not use at all. A QMS glossary pointing only at ISO 13485 is not the U.S. glossary. The provision-level detail is on the ISO 13485 guide.
3. Expect risk management to be assessed across the whole QMS, not just design. This is the most substantive change in kind. The legacy QSR raised risk analysis essentially in one place, at 820.30(g), inside design validation. ISO 13485:2016 requires a risk-based approach to control of processes and risk management across product realization, referencing ISO 14971. A system that treated risk as a design-phase deliverable has a genuine gap to close, not just a renumbering exercise.
4. Implement the five supplemental provisions. 820.1, 820.3, 820.10(b)–(d), 820.35 and 820.45 are the parts an ISO 13485-conformant system will not already satisfy: the U.S. glossary, the four named clause bridges to Parts 830, 821, 803 and 806’s reports of corrections and removals, the class-scoped design-control requirement, the life-supporting traceability extension, the enumerated complaint and servicing record fields, and the labeling and packaging controls. Each is set out in full on the ISO 13485 guide.
5. Review outward-facing documents that cite Part 820. Quality agreements, supplier contracts, premarket submission quality sections, and certificates of conformity. The citation “21 CFR Part 820” still resolves — it simply resolves to different text than it did when the document was drafted, which may or may not be what the parties intended.
6. Historical records. The change altered the framework a manufacturer must operate under from 2 February 2026 onward; it is not a licence to discard, nor an instruction to retrospectively re-document, records created under the QSR. Where a specific retention or reconstruction question is consequential, read the final rule and its preamble at 89 FR 7523 rather than a secondary summary — commentary on this point has been inconsistent.

Inspections changed on the same day

This is the part most easily missed, and it is squarely a U.S.-regulation matter rather than a standards one. Per FDA:

• On 2 February 2026, FDA stopped using the Quality System Inspection Technique (QSIT) for device inspections.
• FDA began using the inspection process described in the updated compliance program Inspection of Medical Device Manufacturers, 7382.850.
• Two documents were retired the same day: Inspection of Medical Device Manufacturers (7382.845) and Medical Device PMA Preapproval and PMA Postmarket Inspections (7383.001).

The practical implication for inspection readiness: QSIT’s four-subsystem model — management controls, design controls, CAPA, and production and process controls — was the organising logic behind a great many internal audit programmes, mock inspections and readiness checklists. Those artefacts are now modelled on a technique the agency no longer uses. Any programme that was built to “pass QSIT” should be re-derived from 7382.850 and the ISO 13485 clause structure. Internal audit itself remains required, under Clause 8.2.4; see also GMP audit checklists and the second-party audit distinction.

What did not change

Worth stating explicitly, because harmonisation invites over-reading:

• Part 820 is still the device CGMP requirement, authorised by FD&C Act section 520(f). It was amended, not repealed.
• The enforcement hook is unchanged. Failure to comply with any applicable requirement of the part renders the device adulterated under section 501(h), and both the device and the responsible person are subject to regulatory action.
• FDA does not certify anyone to ISO 13485 and does not require a certificate. It requires compliance with Part 820 and verifies that by inspection. Incorporation by reference makes the standard’s clauses law; it does not make a certification body’s audit a substitute for an FDA one.
• Part 820 is not the drug CGMP. Parts 210 and 211 remain separate and apply to drugs; combination products still trigger the streamlined approach in Part 4. See good manufacturing practice and GxP compliance for how the CGMP families divide.
• Part 11 is untouched. Electronic records and signatures used to satisfy Part 820 requirements remain subject to 21 CFR Part 11; see computer system validation and the validation master plan guide.

Frequently asked questions

What is the difference between the QMSR and the QSR?

They are the same regulation at two points in time, not two competing rule sets. The Quality System Regulation (QSR) was 21 CFR Part 820 as it stood up to and including 1 February 2026: fifteen subparts, A through O, with FDA writing every requirement in its own words. The Quality Management System Regulation (QMSR) is 21 CFR Part 820 as it has stood since 2 February 2026: nine section headings, Subparts C through O reserved, with § 820.7 incorporating ISO 13485:2016 by reference so that the standard’s clauses carry the substantive requirement. The citation did not change and nothing was repealed — the part was amended in place. Three practical differences follow: you read most of the requirement in ISO 13485 rather than in the CFR; the records vocabulary changed (medical device file rather than device master record); and five sections remain in FDA’s own text on top of the standard — 820.1, 820.3, 820.10(b)–(d), 820.35 and 820.45 — which are the only place a conformant ISO 13485 system can still be non-compliant in the U.S. Those five are set out provision by provision on the ISO 13485 guide.

Is 21 CFR Part 820 still in effect?

Yes. Part 820 is current, enforceable CGMP regulation. What changed is its content: since 2 February 2026 it is the Quality Management System Regulation, and Subparts C through O are reserved. “Part 820 was replaced” and “Part 820 was repealed” are both wrong — it was amended in place, keeping its citation.

Where did 21 CFR 820.30 design controls go?

820.30 is reserved. The requirement is now ISO 13485 Clause 7.3 and its subclauses, made mandatory by 820.10(c) — but only for class II and class III devices, class I devices automated with computer software, and five specifically listed class I device types. Every other class I device falls outside the U.S. design-control requirement, a scoping distinction ISO 13485 does not itself draw. The listed devices and the full 820.10(c) scope are on the ISO 13485 guide.

Do I still need a device master record and a device history record?

You still need what they contained. The terms are no longer defined in Part 820: 820.181 and 820.184 are reserved. The DMR’s function is now the medical device file at ISO 13485 Clause 4.2.3 — a term the current regulation uses itself, at 820.3 and 820.45(c). DHR-equivalent production records fall under Clauses 7.5.1 and 4.2.5, with 820.35(c) requiring the UDI to be recorded for each device or batch. Keeping the old file names is fine; keeping the old citations is not.

What replaced QSIT?

Compliance program 7382.850, Inspection of Medical Device Manufacturers. FDA stopped using QSIT on 2 February 2026 and retired compliance programs 7382.845 and 7383.001 the same day.

How do I read the old Quality System Regulation text now?

Through eCFR’s point-in-time view, requesting a date on or before 3 February 2026 — the legacy text is retained as a historical version, not deleted. Note that eCFR snapshots for 2026-02-01 and 2026-02-02 both still return the full QSR, because eCFR applied the amendment with a 4 February 2026 issue date. The 1996 rule as published is at 61 FR 52602.

Do I have to buy ISO 13485 to read Part 820?

Not to read it. Material incorporated by reference must be available for public inspection: per 820.7, the incorporated standards are available for inspection at FDA (Dockets Management Staff, 5630 Fishers Lane, Rm. 1061, Rockville, MD 20852) and at the National Archives and Records Administration. To hold and work from a copy, you obtain it from ISO. This is a genuine practical consequence of incorporation by reference — a binding U.S. requirement whose text is not printed in the CFR and not free to reproduce, which is also why no CASRAI page quotes ISO 13485 clause text.

Are class I device manufacturers exempt from Part 820?

Not as a class. Some device types are exempted from CGMP requirements by their own classification regulation in 21 CFR Parts 862–892 — an exemption granted device-type by device-type, not by class. Even where it applies, FDA states the exemption does not relieve a finished device manufacturer of complaint files or of the 820.35 record requirements. Separately, most class I devices are outside the design control requirement under 820.10(c), which is a different and narrower point than being outside the part.

Does an IDE study exempt me from design controls?

No. FDA states that devices manufactured under an investigational device exemption are not exempt from the design and development requirements of 820.10(c) and ISO 13485 Clause 7.3.

Primary sources

• 21 CFR Part 820 — current text on eCFR (verified 26 August 2026 against the 24 August 2026 issue).
• FDA — Quality Management System Regulation (QMSR), content current as of 2 February 2026: effective date, inspection changes, CGMP exemptions and IDE scope.
• Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7523 (2 February 2024); amended 89 FR 82945 (15 October 2024).

Related CASRAI resources

• ISO 13485: medical device quality management systems — the incorporated standard clause by clause, and the QMSR supplemental provisions in full.
• 21 CFR: what Title 21 covers — where Part 820 sits among Parts 11, 50, 56, 210/211, 312, 812 and 830.
• Software as a Medical Device (SaMD) and predetermined change control plans — where 820.10(c)’s software trigger bites.
• FDA human factors and usability engineering and biocompatibility — evidence that sits inside design validation and verification.
• Sterilization validation and calibration certificates — the process validation and measuring-equipment requirements formerly at 820.75 and 820.72.
• CAPA and nonconformity, NCR and NCAR — the requirements formerly at 820.100 and 820.90.
• Medical device reprocessing — where remanufacturing brings a party into 820.1 scope.
• ISO 17025 — the accreditation-versus-certification distinction, which behaves differently again for testing laboratories.
• IEC 62304 software lifecycle processes — what device software development must produce under the quality system Part 820 and the QMSR require.