Written and maintained by CASRAI Editorial Board
Last updated
General regulatory information for lab, clinic and quality staff. It is not legal, regulatory or medical advice.
Short answer
CAPA (corrective and preventive action) is the quality-system process a medical device manufacturer uses to investigate the cause of a problem, fix it, stop it recurring and check that the fix worked. For FDA, the legacy text sat in 21 CFR 820.100; the Quality Management System Regulation (QMSR), effective February 2, 2026, now runs through the incorporated ISO 13485:2016. When a CAPA leads to a correction or removal of a marketed device to reduce a health risk, a separate 10-working-day report to FDA under 21 CFR Part 806 applies.
What is CAPA under FDA rules (CAPA for a medical device)?
CAPA is a closed loop: collect quality data, investigate causes of nonconformities, act, verify, and feed the result to management. It is not specific to FDA; it comes from general and device quality frameworks such as ISO 9001, ISO 13485 (clauses 8.5.2 corrective action and 8.5.3 preventive action) and, for drugs, ICH Q10. For a step-by-step view of running one, see CAPA process steps, and for how a CAPA record is laid out, CAPA report and plan structure. The wider terminology is in the CAPA dictionary entry.
From 820.100 to the QMSR: what changed
The legacy Quality System Regulation text of 21 CFR 820.100 opened: “Each manufacturer shall establish and maintain procedures for implementing corrective and preventive action.” That text is superseded. FDA states that the QMSR rule is effective February 2, 2026, and incorporates “ISO 13485:2016 Medical devices – Quality management systems – Requirements for regulatory purposes” and clause 3 of ISO 9000:2015 (FDA QMSR page, checked 2026-11-01). The Part 820 guide maps which old section numbers are now reserved.
FDA also states that on that date it stopped using the Quality System Inspection Technique (QSIT) and now uses Compliance Program 7382.850, “Inspection of Medical Device Manufacturers.” FDA’s QMSR page does not discuss CAPA by name; CAPA expectations now sit in the incorporated ISO 13485 clauses, which are copyrighted and not reproduced here.
What the legacy 820.100 required
The legacy text (eCFR, checked 2026-11-01) required procedures to do the following. It is a useful checklist of what a CAPA system has traditionally been expected to show, and a prompt for confirming each item is still covered in your procedures under ISO 13485.
| Legacy 820.100 duty | Question to ask of a CAPA file |
|---|---|
| Analyze quality data sources, using statistical methods where necessary | Which data triggered it, and how was it analyzed? |
| Investigate the cause of nonconformities in product, processes and the quality system | Is a cause recorded, not just a symptom? |
| Identify the actions needed to correct and prevent recurrence | Are both the fix and the recurrence barrier named? |
| Verify that actions are effective and do not adversely affect the finished device | Is there a recorded effectiveness check? |
| Implement and record changes in methods and procedures | Did the documents actually change? |
| Disseminate information to those responsible for the product or quality | Who was told? |
| Submit relevant information for management review | Did it reach management review? |
| Document all of these activities | Can an inspector trace it end to end? |
How CAPA connects to corrections, removals and recalls (Part 806)
A CAPA can end internally, or it can lead to action on devices already on the market. FDA’s recalls page (checked 2026-11-01) defines the terms:
| Term | FDA wording |
|---|---|
| Correction | “repair, modification, adjustment, relabeling, destruction, or inspection (including patient monitoring)” of a product without moving it elsewhere |
| Removal | “the physical removal of a device from its point of use to some other location” |
| Recall | “a firm’s removal or correction of a marketed product that the FDA considers to be in violation of the laws” FDA administers |
Under 21 CFR Part 806, manufacturers and importers must report “any correction or removal of a medical device(s)” initiated to reduce a risk to health posed by the device (or to remedy a violation of the Act caused by the device that may present a risk to health), and the report “must be submitted to FDA within 10 working days from the time the firm initiates the correction or removal.”
A decision aid built from those definitions
- Does the CAPA action change, repair, relabel or inspect devices already marketed, or pull them from where they are used? If not, it is an internal quality action.
- If yes, is the action meant to reduce a risk to health? If so, FDA states Part 806 reporting applies, with the 10-working-day clock starting when the firm initiates the correction or removal.
- Whether FDA will regard it as a recall depends on whether the product is considered in violation of the laws FDA administers; that is FDA’s determination, not the firm’s label.
The sequence above is a reading of how the two regimes interact, drawn from FDA’s definitions; FDA does not present it as a CAPA step. Related reading: field safety corrective action (the EU counterpart) and complaint handling for medical devices, a common CAPA input.
Where it matters for labs, clinics and supply decisions
Staff who use devices are often the first to see the data that starts a CAPA: a repeated fault, a labeling problem, an unexpected result. A manufacturer’s field correction or removal notice reaches users through the processes above. Quality systems are also inspected; see what an FDA warning letter is and the MDSAP audit program for related oversight routes. Root-cause method is covered in root cause analysis.
Common misunderstandings
- “820.100 is still the CAPA rule.” It is the legacy text; the QMSR is effective February 2, 2026 and incorporates ISO 13485:2016.
- “Every CAPA is reportable.” The Part 806 report concerns a correction or removal initiated to reduce a risk to health, not every CAPA.
- “A correction means the device leaves the site.” FDA defines a correction as action taken without moving the product elsewhere; moving it is a removal.
- “FDA inspects with QSIT.” FDA says it stopped using QSIT and uses Compliance Program 7382.850.
FAQ
What does CAPA stand for at FDA?
Corrective and preventive action. The legacy 21 CFR 820.100 used that title; it is now handled through the incorporated ISO 13485:2016 under the QMSR.
Is CAPA required for a medical device?
Under the legacy rule, each manufacturer had to establish and maintain CAPA procedures. Under the QMSR, device quality-system requirements come from ISO 13485:2016, which has corrective (8.5.2) and preventive (8.5.3) action clauses.
When does a CAPA require reporting to FDA?
When it results in a correction or removal of a device initiated to reduce a risk to health, Part 806 requires a report within 10 working days of initiating it.
Sources
- FDA, Quality Management System Regulation (QMSR), checked 2026-11-01.
- FDA, Recalls, Corrections and Removals (Devices), checked 2026-11-01.
- eCFR, 21 CFR Part 820 (legacy 820.100 text as of 2026-02-02), checked 2026-11-01.
