21 CFR Part 820 to ISO 13485: The QMSR Crosswalk

TL;DR

Since 2 February 2026, 21 CFR Part 820 has been the Quality Management System Regulation (QMSR). The old Quality System regulation had 31 sections across 15 subparts. The QMSR has six active sections: scope, definitions, incorporation by reference, the core requirement to comply with ISO 13485:2016, record controls, and labeling and packaging controls. Everything else is reserved. The substantive requirements now come from ISO 13485:2016, which section 820.7 incorporates by reference. ¹

FDA has not published a section-by-section crosswalk. Its proposed rule offered a subpart-level table, the final rule's preamble maps some sections explicitly, and FDA's QMSR pages point readers to a paid AAMI technical report for the full mapping. ²

This guide gives a complete crosswalk of all 31 old sections. It marks which mappings FDA stated and which are ours, and it lists the FDA-specific requirements ISO 13485 does not cover. It also shows where ten years of FDA Form 483 citations land once you translate them into ISO 13485 clauses.

What 21 CFR Part 820 contains today

The current Part 820 is short. Read it alongside ISO 13485:2016 and ISO 9000:2015 clause 3, which carry the force of law through incorporation by reference.

Sections 820.5, 820.20 to 820.30 and 820.40 are reserved, as are Subparts C to O. ¹ The final rule was published on 2 February 2024 and took effect two years later. ³

What QMSR removed or renamed

Several familiar terms are gone from the regulation. The records behind them still exist, under ISO 13485 names.

• DHF, DMR and DHR. FDA did not retain the design history file, device master record or device history record. In the preamble FDA writes that it "eliminated terms associated with these specific record types." The device master record content now sits in the medical device file of ISO 13485 clause 4.2.3. The design history file becomes the design and development file of clause 7.3.10. The device history record becomes the record for each device or batch under clause 7.5.1.
• Management with executive responsibility becomes "top management," as defined in ISO 9000.
• The 820.180(c) exception is gone. Management reviews, quality audit reports and supplier audit reports are now open to inspection. FDA's FAQ says so directly. ⁴
• The independent design reviewer required by old 820.30(e) is not retained. Clause 7.3.5 governs design reviews instead.
• QSIT. FDA stopped using the Quality System Inspection Technique on 2 February 2026. Inspections now follow Compliance Program 7382.850. ⁵
• "Design controls" and "design validation" survive in practice but not as regulatory terms. FDA's software guidance now notes that QMSR "does not utilize certain terms, such as 'Design Controls,' and 'Design Validation'." It points to clause 7.3 instead. ⁶

The complete crosswalk: old QS regulation to ISO 13485:2016

Every old section has a home. In the source column, "FDA" means the QMSR preamble or Compliance Program 7382.850 states the mapping. "Pure Global" means we derived it from the ISO 13485 clause titles and CP 7382.850 Attachment A.

FDA's own subpart-level table, in the 2022 proposed rule, found most subparts "substantially similar" to ISO 13485. It flagged document controls, labeling and packaging, records and servicing as areas where FDA would add requirements. Those additions became 820.35 and 820.45. FDA describes that table as "a higher-level mapping," not a requirement-by-requirement analysis. ⁷

FDA requirements that ISO 13485 alone does not cover

An ISO 13485 certificate does not make a firm QMSR-compliant. These are the FDA-specific obligations to add on top of the standard.

1. The four linked FDA rules (820.10(b)). ISO 13485 clause 7.5.8 must be met together with Part 830 (UDI), and 7.5.9.1 with Part 821 (tracking), where tracking applies. Clause 8.2.3 must be met with Part 803 (medical device reporting). Advisory notices under 7.2.3, 8.2.3 and 8.3.3 must also satisfy Part 806 (corrections and removals).
2. Design-control applicability (820.10(c)). Clause 7.3 applies to Class II and III devices, Class I devices automated with software and five listed Class I device types. It also applies to investigational devices.
3. Traceability for life-supporting and life-sustaining devices (820.10(d)). They must meet the implantable-device traceability of clause 7.5.9.2.
4. Complaint record content (820.35(a)). Records for complaints that are investigated or MDR-reportable must include the device name, the date received, any UDI or UPC, the complainant's name, address and phone number, and the nature and details of the complaint. They must also record any correction or corrective action and any reply to the complainant. If you decide not to investigate because a similar investigation exists, document the justification.
5. Servicing records (820.35(b)). Record the device name, any UDI or UPC, the date of service, who serviced the device, the service performed, and test and inspection data.
6. UDI recording (820.35(c)). "The UDI must be recorded for each medical device or batch of medical devices."
7. Labeling and packaging (820.45). Examine labeling for UDI, expiration date, storage and handling instructions before release. Document the release, and control labeling operations to prevent mix-ups.
8. FDA definitions and the conflict rule (820.1, 820.3). "Device" and "labeling" carry their FD&C Act meanings. Where ISO 13485 conflicts with FDA law, FDA law controls.
9. Inspection, not certification. FDA's FAQ: "A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection." MDSAP audit reports can still substitute for routine surveillance inspections. ⁸

Where ten years of FDA citations land in ISO 13485

We translated every device Form 483 citation from FY2016 to FY2025 into the ISO 13485 clause that now covers it. Five clause families carry almost half of a decade of findings.

FDA's annual Inspection Observations spreadsheets record 25,937 device citations from FY2016 to FY2025. The table below regroups them by clause. Design and development combines old 820.30 in full, including risk analysis under 820.30(g), which now also falls under clause 7.1. ⁹

Two practical points follow. First, the subsystems FDA cites most are the ones where ISO 13485 and the old regulation were already closest, so transition work alone will not move the numbers. CAPA, complaint and design files have to work in practice. Second, two areas were mostly hidden from investigators before 2026 and are now in scope: internal audits (8.2.4, already 4.0% of citations) and management review (part of clause 5). Investigators can now read the reports themselves, not just check that procedures exist. Our inspection readiness checklist turns this into a preparation plan.

ISO 13485 and 21 CFR 820: the differences that matter in practice

• Risk management runs through the whole QMS. The old regulation mentioned risk analysis only in design validation (820.30(g)). ISO 13485 requires a risk-based approach to QMS processes (4.1.2) and risk management throughout product realization (7.1). FDA's QMSR page says the rule "now specifically requires risk management." ISO 14971 is the usual way to meet it. See our ISO 14971 risk management file guide.
• Software validation reaches the QMS itself. Clause 4.1.6 requires validation of software used in the QMS, such as eQMS, ERP and complaint databases. Clauses 7.5.6 and 7.6 cover production and monitoring software.
• Outsourcing is explicit. Clause 4.1.5 makes the manufacturer responsible for outsourced processes "proportionate to the risk involved," on top of supplier controls in 7.4.
• The medical device file is one file per device type or family. It replaces the DMR, but its contents follow clause 4.2.3: description, intended use, labeling, specifications, production, servicing and installation procedures.
• Records retention. Clause 4.2.5 requires retention for at least the lifetime of the device as defined by the manufacturer, and no less than two years from release.
• "Regulatory requirements" appear throughout ISO 13485. In the US those include Parts 801, 803, 806, 807, 821 and 830. The QMSR links several of them explicitly through 820.10(b).

A QMSR transition checklist

1. Re-baseline the quality manual and procedures on ISO 13485:2016, with a crosswalk like the table above as a controlled document.
2. Rename and restructure the record types. Index the medical device file, the design and development file, and the device or batch records. Retire DHF, DMR and DHR references, or define them as aliases in your procedures.
3. Add the FDA-specific content in 820.10(b) to (d), 820.35 and 820.45 to the relevant procedures and forms, especially complaint and servicing forms.
4. Prepare management review and internal audit records for inspection. They are now inspectable, so write them as if an investigator will read them.
5. Close the evidence gaps that FDA cites most. That means CAPA effectiveness checks, complaint investigation decisions, risk file updates after post-market events and design-change regulatory assessments.
6. Train staff on the new vocabulary and inspection approach, including how CP 7382.850 organizes an inspection into six QMS areas.

FDA's FAQ notes that investigators may review records created before 2 February 2026. It suggests that "a manufacturer may find it useful to complete some type of comparative analysis." Pure Global AI's free QMSR gap analysis is one way to start. ¹⁰

How Pure Global helps

We run QMSR gap assessments against ISO 13485:2016 and the FDA-specific provisions, and rewrite procedures and forms for complaints, servicing, labeling and the medical device file. We also prepare teams for inspections under CP 7382.850. For companies already certified to ISO 13485 under MDSAP or the EU MDR, we focus on the FDA additions and on the records that are newly inspectable. See FDA QMSR consulting or contact our team.

How we built the crosswalk and the numbers

• Regulation text: the current eCFR text of Part 820 as of October 2026, and the 2023 edition of 21 CFR Part 820 for the 31 pre-QMSR sections. ¹¹
• "FDA" mappings: taken from the QMSR final-rule preamble (for example its discussion of the DHF, DMR and DHR, storage, labeling, traceability and the records exception) and from CP 7382.850 Attachment A. Rows marked "Pure Global" are our analysis and are not an FDA crosswalk.
• Citation counts: FDA's Inspection Observations workbooks for FY2016 to FY2025, Devices tab. They count citation frequency on 483s issued from FDA's electronic system. We grouped citations by section and, for 820.30, by paragraph.