Correspondence

Between
ISO 13485:2016 and
21 CFR Part 820
QMS Requirements

10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158

262.842.1250 262.842.1240 [email protected] rcainc.com
Correspondence Between ISO 13485:2016 and 21 CFR 820 2

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
4 Quality Management System Subpart A--General Provisions

4.1 General Requirements Sec. 820.5 Quality System.

4.1.1 The organization shall document a quality management Each manufacturer shall establish and maintain a quality
system and maintain its effectiveness in accordance with the system that is appropriate for the specific medical device(s)
requirements of this International Standard and applicable designed or manufactured, and that meets the requirements of
regulatory requirements. this part.

The organization shall establish, implement, and maintain any Subpart B--Quality System Requirements
requirement, procedure, activity, or arrangement required to be
documented by this International Standard or applicable Sec. 820.20 Management Responsibility.
regulatory requirements.
(a) Quality Policy. Management with executive responsibility
The organization shall document the role(s) undertaken by the shall establish its policy and objectives for, and commitment
organization under the applicable regulatory requirements. to, quality. Management with executive responsibility shall
ensure that the quality policy is understood, implemented, and
NOTE. Roles undertaken by the organization can include maintained at all levels of the organization.
manufacturer, authorized representative, importer, or
distributor. (b) Organization. Each manufacturer shall establish and
maintain an adequate organizational structure to ensure that
4.1.2 The organization shall: devices are designed and produced in accordance with the
requirements of this part.
a) determine the processes needed for the quality
management system and the application of these (1) Responsibility and Authority. Each manufacturer shall
processes throughout the organization taking into establish the appropriate responsibility, authority, and
account the roles undertaken by the organization; interrelation of all personnel who manage, perform, and assess
work affecting quality, and provide the independence and
b) apply a risk based approach to the control of the authority necessary to perform these tasks.
appropriate processes needed for the quality
management system; (2) Resources. Each manufacturer shall provide adequate
resources, including the assignment of trained personnel, for
c) determine the sequence and interaction of these management, performance of work, and assessment activities,
processes. including internal quality audits, to meet the requirements of
this part.
4.1.3 For each quality management system process, the
organization shall: (3) Management Representative. Management with executive
responsibility shall appoint, and document such appointment
a) determine criteria and methods needed to ensure of, a member of management who, irrespective of other
that both the operation and control of these responsibilities, shall have established authority over and
processes are effective; responsibility for:

b) ensure the availability of resources and information (i) Ensuring that quality system requirements are effectively
necessary to support the operation and monitoring of established and effectively maintained in accordance with this
these processes; part; and

c) implement actions necessary to achieve planned (ii) Reporting on the performance of the quality system to
results and maintain the effectiveness of these management with executive responsibility for review.
processes;
(c) Management Review. Management with executive
d) monitor, measure as appropriate, and analyze these responsibility shall review the suitability and effectiveness of
processes; the quality system at defined intervals and with sufficient
frequency according to established procedures to ensure that
the quality system satisfies the requirements of this part and
the manufacturer's established quality policy and objectives.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 3

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
e) establish and maintain records needed to The dates and results of quality system reviews shall be
demonstrate conformance to this International documented.
Standard and compliance with applicable regulatory
requirements (see 4.2.5). (d) Quality Planning. Each manufacturer shall establish a
quality plan which defines the quality practices, resources, and
4.1.4 The organization shall manage these quality activities relevant to devices that are designed and
management system processes in accordance with the manufactured. The manufacturer shall establish how the
requirements of this International Standard and applicable requirements for quality will be met.
regulatory requirements. Changes to be made to these
processes shall be: (e) Quality System Procedures. Each manufacturer shall
establish quality system procedures and instructions. An
a) evaluated for their impact on the quality outline of the structure of the documentation used in the
management system; quality system shall be established where appropriate.

b) evaluated for their impact on the medical devices

produced under this quality management system;

c) controlled in accordance with the requirements of

this International Standard and applicable regulatory
requirements.

4.1.5 When the organization chooses to outsource any

process that affects product conformity to requirements, it
shall monitor and ensure control over such processes. The
organization shall retain responsibility of conformity to this
International Standard and to customer and applicable
regulatory requirements for outsourced processes. The
controls shall be proportionate to the risk involved and the
ability of the external party to meet the requirements in
accordance with 7.4. The controls shall include written quality
agreements.

4.1.6 The organization shall document procedures for the

validation of the application of computer software used in the
quality management system. Such software applications shall
be validated prior to initial use and, as appropriate, after
changes to such software or its application.

The specific approach and activities associated with software

validation and revalidation shall be proportionate to the risk
associated with the use of the software.

Records of such activities shall be maintained (see 4.2.5).

4.2 Documentation Requirements Subpart A—General Provisions

4.2.1 General Sec. 820.5 Quality System.

The quality management system documentation (see 4.2.4) Each manufacturer shall establish and maintain a quality
shall include: system that is appropriate for the specific medical device(s)
designed or manufactured, and that meets the requirements of
a) documented statements of a quality policy and this part.
quality objectives;
Subpart B--Quality System Requirements
b) a quality manual;
Sec. 820.20 Management Responsibility.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 4

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
c) documented procedures and records required by this (a) Quality Policy. Management with executive responsibility
International Standard; shall establish its policy and objectives for, and commitment
to, quality. Management with executive responsibility shall
d) documents, including records, determined by the ensure that the quality policy is understood, implemented, and
organization to be necessary to ensure the effective maintained at all levels of the organization.
planning, operation, and control of its processes;
(e) Quality System Procedures. Each manufacturer shall
e) other documentation specified by applicable establish quality system procedures and instructions. An
regulatory requirements. outline of the structure of the documentation used in the
quality system shall be established where appropriate.

Subpart D--Document Controls

Sec. 820.40 Document Controls.

Each manufacturer shall establish and maintain procedures to

control all documents that are required by this part. The
procedures shall provide for the following:

(a) Document Approval and Distribution. Each manufacturer

shall designate an individual(s) to review for adequacy and
approve prior to issuance all documents established to meet
the requirements of this part. The approval, including the date
and signature of the individual(s) approving the document,
shall be documented. Documents established to meet the
requirements of this part shall be available at all locations for
which they are designated, used, or otherwise necessary, and
all obsolete documents shall be promptly removed from all
points of use or otherwise prevented from unintended use.

(b) Document Changes. Changes to documents shall be

reviewed and approved by an individual(s) in the same function
or organization that performed the original review and
approval, unless specifically designated otherwise. Approved
changes shall be communicated to the appropriate personnel
in a timely manner. Each manufacturer shall maintain records
of changes to documents. Change records shall include a
description of the change, identification of the affected
documents, the signature of the approving individual(s), the
approval date, and when the change becomes effective.
4.2.2 Quality Manual Subpart B--Quality System Requirements

The organization shall document a quality manual that Sec. 820.20 Management Responsibility.
includes:
(a) Quality Policy. Management with executive responsibility
a) the scope of the quality management system, shall establish its policy and objectives for, and commitment
including details of and justification for any exclusion to, quality. Management with executive responsibility shall
or non-application; ensure that the quality policy is understood, implemented, and
maintained at all levels of the organization.
b) the documented procedures for the quality
management system, or reference to them; (b) Organization. Each manufacturer shall establish and
maintain an adequate organizational structure to ensure that
c) a description of the interaction between the devices are designed and produced in accordance with the
processes of the quality management system. requirements of this part.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 5

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
The quality manual shall outline the structure of the (1) Responsibility and Authority. Each manufacturer shall
documentation used in the quality management system. establish the appropriate responsibility, authority, and
interrelation of all personnel who manage, perform, and assess
work affecting quality, and provide the independence and
authority necessary to perform these tasks.

(2) Resources. Each manufacturer shall provide adequate

resources, including the assignment of trained personnel, for
management, performance of work, and assessment activities,
including internal quality audits, to meet the requirements of
this part.

(e) Quality System Procedures. Each manufacturer shall

establish quality system procedures and instructions. An
outline of the structure of the documentation used in the
quality system shall be established where appropriate.
4.2.3 Medical Device File Subpart M--Records

For each medical device type or medical device family, the Sec. 820.181 Device Master Record.
organization shall establish and maintain one or more files
either containing or referencing documents generated to Each manufacturer shall maintain device master records
demonstrate conformity to the requirement of this (DMR's). Each manufacturer shall ensure that each DMR is
International Standard and compliance with applicable prepared and approved in accordance with 820.40. The DMR
regulatory requirements. for each type of device shall include, or refer to the location of,
the following information:
The content of the file(s) shall include, but is not limited to:
(a) Device specifications including appropriate drawings,
a) general description of the medical device, intended composition, formulation, component specifications, and
use/purpose, and labelling, including any instructions software specifications;
for use;
(b) Production process specifications including the appropriate
b) specifications for product; equipment specifications, production methods, production
procedures, and production environment specifications;
c) specifications or procedures for manufacturing,
packaging, storage, handling and distribution; (c) Quality assurance procedures and specifications including
acceptance criteria and the quality assurance equipment to be
d) procedures for measuring and monitoring; as used;
appropriate, requirements for installation;
(d) Packaging and labeling specifications, including methods
e) as appropriate, procedures for servicing. and processes used; and

(e) Installation, maintenance, and servicing procedures and

methods.

Subpart K--Labeling and Packaging Control

Sec. 820.120 Device Labeling.

Each manufacturer shall establish and maintain procedures to

control labeling activities.

(a) Label Integrity. Labels shall be printed and applied so as to

remain legible and affixed during the customary conditions of
processing, storage, handling, distribution, and where
appropriate use.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 6

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(b) Labeling Inspection. Labeling shall not be released for
storage or use until a designated individual(s) has examined
the labeling for accuracy including, where applicable, the
correct unique device identifier (UDI) or universal product code
(UPC), expiration date, control number, storage instructions,
handling instructions, and any additional processing
instructions. The release, including the date and signature of
the individual(s) performing the examination, shall be
documented in the DHR.

(c) Labeling Storage. Each manufacturer shall store labeling in

a manner that provides proper identification and is designed to
prevent mix-ups.

(d) Labeling Operations. Each manufacturer shall control

labeling and packaging operations to prevent labeling mix-ups.
The label and labeling used for each production unit, lot, or
batch shall be documented in the DHR.

(e) Control Number. Where a control number is required by

820.65, that control number shall be on or shall accompany the
device through distribution.

Sec. 820.130 Device Packaging.

Each manufacturer shall ensure that device packaging and

shipping containers are designed and constructed to protect
the device from alteration or damage during the customary
conditions of processing, storage, handling, and distribution.

Subpart L--Handling, Storage, Distribution, and Installation

Sec. 820.140 Handling.

Each manufacturer shall establish and maintain procedures to
ensure that mix-ups, damage, deterioration, contamination, or
other adverse effects to product do not occur during handling.

Sec. 820.150 Storage.

(a) Each manufacturer shall establish and maintain procedures

for the control of storage areas and stock rooms for product to
prevent mix-ups, damage, deterioration, contamination, or other
adverse effects pending use or distribution and to ensure that
no obsolete, rejected, or deteriorated product is used or
distributed. When the quality of product deteriorates over time,
it shall be stored in a manner to facilitate proper stock rotation,
and its condition shall be assessed as appropriate.

(b) Each manufacturer shall establish and maintain procedures

that describe the methods for authorizing receipt from and
dispatch to storage areas and stock rooms.

Sec. 820.160 Distribution.

(a) Each manufacturer shall establish and maintain procedures

for control and distribution of finished devices to ensure that

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 7

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
only those devices approved for release are distributed and
that purchase orders are reviewed to ensure that ambiguities
and errors are resolved before devices are released for
distribution. Where a device's fitness for use or quality
deteriorates over time, the procedures shall ensure that expired
devices or devices deteriorated beyond acceptable fitness for
use are not distributed.

(b) Each manufacturer shall maintain distribution records

which include or refer to the location of:

(1) The name and address of the initial consignee;

(2) The identification and quantity of devices shipped;

(3) The date shipped; and

(4) Any control number(s) used.

Sec. 820.170 Installation.

(a) Each manufacturer of a device requiring installation shall

establish and maintain adequate installation and inspection
instructions, and where appropriate test procedures.
Instructions and procedures shall include directions for
ensuring proper installation so that the device will perform as
intended after installation. The manufacturer shall distribute
the instructions and procedures with the device or otherwise
make them available to the person(s) installing the device.

(b) The person installing the device shall ensure that the
installation, inspection, and any required testing are performed
in accordance with the manufacturer's instructions and
procedures and shall document the inspection and any test
results to demonstrate proper installation.

Subpart M--Records

Sec. 820.180 General Requirements.

All records required by this part shall be maintained at the

manufacturing establishment or other location that is
reasonably accessible to responsible officials of the
manufacturer and to employees of FDA designated to perform
inspections. Such records, including those not stored at the
inspected establishment, shall be made readily available for
review and copying by FDA employee(s). Such records shall be
legible and shall be stored to minimize deterioration and to
prevent loss. Those records stored in automated data
processing systems shall be backed up.

(a) Confidentiality. Records deemed confidential by the

manufacturer may be marked to aid FDA in determining
whether information may be disclosed under the public
information regulation in part 20 of this chapter.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 8

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(b) Record Retention Period. All records required by this part
shall be retained for a period of time equivalent to the design
and expected life of the device, but in no case less than 2 years
from the date of release for commercial distribution by the
manufacturer.

(c) Exceptions. This section does not apply to the reports

required by 820.20(c) Management review, 820.22 Quality
audits, and supplier audit reports used to meet the
requirements of 820.50(a) Evaluation of suppliers, contractors,
and consultants, but does apply to procedures established
under these provisions. Upon request of a designated
employee of FDA, an employee in management with executive
responsibility shall certify in writing that the management
reviews and quality audits required under this part, and supplier
audits where applicable, have been performed and
documented, the dates on which they were performed, and that
any required corrective action has been undertaken.

Subpart N--Servicing

Sec. 820.200 Servicing.

(a) Where servicing is a specified requirement, each

manufacturer shall establish and maintain instructions and
procedures for performing and verifying that the servicing
meets the specified requirements.

(b) Each manufacturer shall analyze service reports with

appropriate statistical methodology in accordance with
820.100.

(c) Each manufacturer who receives a service report that

represents an event which must be reported to FDA under part
803 of this chapter shall automatically consider the report a
complaint and shall process it in accordance with the
requirements of 820.198.

(d) Service reports shall be documented and shall include:

(1) The name of the device serviced;

(2) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(3) The date of service;

(4) The individual(s) servicing the device;

(5) The service performed; and

(6) The test and inspection data.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 9

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
4.2.4 Control of Documents Subpart D--Document Controls

Documents required by the quality management system shall Sec. 820.40 Document Controls.
be controlled. Records are a special type of document and
shall be controlled according to the requirements given in Each manufacturer shall establish and maintain procedures to
4.2.5. control all documents that are required by this part. The
procedures shall provide for the following:
A documented procedure shall define the controls needed to:
(a) Document Approval and Distribution. Each manufacturer
a) review and approve documents for adequacy prior to shall designate an individual(s) to review for adequacy and
issue; approve prior to issuance all documents established to meet
the requirements of this part. The approval, including the date
b) review, update as necessary and re-approve and signature of the individual(s) approving the document,
documents; shall be documented. Documents established to meet the
requirements of this part shall be available at all locations for
c) ensure that the current revision status of and which they are designated, used, or otherwise necessary, and
changes to documents are identified; all obsolete documents shall be promptly removed from all
points of use or otherwise prevented from unintended use.
d) ensure that relevant versions of applicable
documents are available at points of use; (b) Document Changes. Changes to documents shall be
reviewed and approved by an individual(s) in the same function
e) ensure that documents remain legible and readily or organization that performed the original review and
identifiable; approval, unless specifically designated otherwise. Approved
changes shall be communicated to the appropriate personnel
f) ensure that documents of external origin, determined in a timely manner. Each manufacturer shall maintain records
by the organization to be necessary for the planning of changes to documents. Change records shall include a
and operation of the quality management system, are description of the change, identification of the affected
identified and their distribution controlled; documents, the signature of the approving individual(s), the
approval date, and when the change becomes effective.
g) prevent deterioration or loss of documents;

h) prevent the unintended use of obsolete documents

and apply suitable identification to them.

The organization shall ensure that changes to documents are

reviewed and approved either by the original approving
function, or another designated function that has access to
pertinent background information upon which to base its
decisions.

The organization shall define the period for which at least one
copy of obsolete documents shall be retained. This period
shall ensure that documents to which medical devices have
been manufactured and tested are available for at least the
lifetime of the medical device as defined by the organization,
but not less than the retention period of any resulting record
(see 4.2.5), or as specified by applicable regulatory
requirements.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 10

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
4.2.5 Control of Records Subpart M--Records

Records shall be maintained to provide evidence of conformity Sec. 820.180 General Requirements.
to requirements and of the effective operation of the quality
management system. All records required by this part shall be maintained at the
manufacturing establishment or other location that is
The organization shall document procedures to define the reasonably accessible to responsible officials of the
controls needed for the identification, storage, security and manufacturer and to employees of FDA designated to perform
integrity, retrieval, retention time and disposition of records. inspections. Such records, including those not stored at the
inspected establishment, shall be made readily available for
The organization shall define and implement methods for review and copying by FDA employee(s). Such records shall be
protecting confidential health information contained in legible and shall be stored to minimize deterioration and to
records in accordance with the applicable regulatory prevent loss. Those records stored in automated data
requirements. processing systems shall be backed up.

Records shall remain legible, readily identifiable and (a) Confidentiality. Records deemed confidential by the
retrievable. Changes to a record shall remain identifiable. manufacturer may be marked to aid FDA in determining
whether information may be disclosed under the public
The organization shall retain the records for at least the information regulation in part 20 of this chapter.
lifetime of the medical device as defined by the organization,
or as specified by applicable regulatory requirements, but not (b) Record Retention Period. All records required by this part
less than two years from the medical device release by the shall be retained for a period of time equivalent to the design
organization. and expected life of the device, but in no case less than 2 years
from the date of release for commercial distribution by the
manufacturer.

(c) Exceptions. This section does not apply to the reports

required by 820.20(c) Management review, 820.22 Quality
audits, and supplier audit reports used to meet the
requirements of 820.50(a) Evaluation of suppliers, contractors,
and consultants, but does apply to procedures established
under these provisions. Upon request of a designated
employee of FDA, an employee in management with executive
responsibility shall certify in writing that the management
reviews and quality audits required under this part, and supplier
audits where applicable, have been performed and
documented, the dates on which they were performed, and that
any required corrective action has been undertaken.

Subpart M--Records

Sec. 820.181 Device Master Record.

Each manufacturer shall maintain device master records

(DMR's). Each manufacturer shall ensure that each DMR is
prepared and approved in accordance with 820.40. The DMR
for each type of device shall include, or refer to the location of,
the following information:

(a) Device specifications including appropriate drawings,

composition, formulation, component specifications, and
software specifications;

(b) Production process specifications including the appropriate

equipment specifications, production methods, production
procedures, and production environment specifications;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 11

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)

(c) Quality assurance procedures and specifications including

acceptance criteria and the quality assurance equipment to be
used;

(d) Packaging and labeling specifications, including methods

and processes used; and

(e) Installation, maintenance, and servicing procedures and

methods.

Subpart M--Records

Sec. 820.184 Device History Record.

Each manufacturer shall maintain device history records

(DHR's). Each manufacturer shall establish and maintain
procedures to ensure that DHR's for each batch, lot, or unit are
maintained to demonstrate that the device is manufactured in
accordance with the DMR and the requirements of this part.
The DHR shall include, or refer to the location of, the following
information:

(a) The dates of manufacture;

(b) The quantity manufactured;

(c) The quantity released for distribution;

(d) The acceptance records which demonstrate the device is

manufactured in accordance with the DMR;

(e) The primary identification label and labeling used for each
production unit; and

(f) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used.

Subpart M--Records

Sec. 820.186 Quality System Record.

Each manufacturer shall maintain a quality system record

(QSR). The QSR shall include, or refer to the location of,
procedures and the documentation of activities required by this
part that are not specific to a particular type of device(s),
including, but not limited to, the records required by 820.20.
Each manufacturer shall ensure that the QSR is prepared and
approved in accordance with 820.40.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 12

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
5 Management Responsibility Subpart B--Quality System Requirements

5.1 Management Commitment Sec. 820.20 Management Responsibility

Top management shall provide evidence of its commitment to (a) Quality Policy. Management with executive responsibility
the development and implementation of the quality shall establish its policy and objectives for, and commitment
management system and maintenance of its effectiveness by: to, quality. Management with executive responsibility shall
ensure that the quality policy is understood, implemented, and
a) communicating to the organization the maintained at all levels of the organization.
importance of meeting customer as well as
applicable regulatory requirements; (b) Organization. Each manufacturer shall establish and
maintain an adequate organizational structure to ensure that
devices are designed and produced in accordance with the
b) establishing the quality policy; requirements of this part.

c) ensuring that quality objectives are established; (1) Responsibility and Authority. Each manufacturer shall
establish the appropriate responsibility, authority, and
d) conducting management reviews; interrelation of all personnel who manage, perform, and assess
work affecting quality, and provide the independence and
e) ensuring the availability of resources. authority necessary to perform these tasks.

(2) Resources. Each manufacturer shall provide adequate

resources, including the assignment of trained personnel, for
management, performance of work, and assessment activities,
including internal quality audits, to meet the requirements of
this part.

(3) Management Representative. Management with executive

responsibility shall appoint, and document such appointment
of, a member of management who, irrespective of other
responsibilities, shall have established authority over and
responsibility for:

(i) Ensuring that quality system requirements are effectively

established and effectively maintained in accordance with this
part; and

(ii) Reporting on the performance of the quality system to

management with executive responsibility for review.

(c) Management Review. Management with executive

responsibility shall review the suitability and effectiveness of
the quality system at defined intervals and with sufficient
frequency according to established procedures to ensure that
the quality system satisfies the requirements of this part and
the manufacturer's established quality policy and objectives.
The dates and results of quality system reviews shall be
documented.

(d) Quality Planning. Each manufacturer shall establish a

quality plan which defines the quality practices, resources, and
activities relevant to devices that are designed and
manufactured. The manufacturer shall establish how the
requirements for quality will be met.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 13

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(e) Quality System Procedures. Each manufacturer shall
establish quality system procedures and instructions. An
outline of the structure of the documentation used in the
quality system shall be established where appropriate.
5.2 Customer Focus No specific equivalent in 21 CFR Part 820 related to “Customer
Focus.”
Top management shall ensure that customer requirements
and applicable regulatory requirements are determined and
met.
5.3 Quality Policy Subpart B--Quality System Requirements

Top management shall ensure that the quality policy: Sec. 820.20 Management Responsibility.

a) is applicable to the purpose of the organization; (a) Quality Policy. Management with executive responsibility
shall establish its policy and objectives for, and commitment
b) includes a commitment to comply with requirements to, quality. Management with executive responsibility shall
and to maintain the effectiveness of the quality ensure that the quality policy is understood, implemented, and
management system; maintained at all levels of the organization.

c) provides a framework for establishing and reviewing

quality objectives;

d) is communicated and understood within the

organization;

e) is reviewed for continuing suitability.

5.4 Planning Subpart B--Quality System Requirements

5.4.1 Quality Objectives Sec. 820.20 Management Responsibility.

Top management shall ensure that quality objectives, (a) Quality Policy. Management with executive responsibility
including those needed to meet applicable regulatory shall establish its policy and objectives for, and commitment
requirements and requirements for product, are established at to, quality. Management with executive responsibility shall
relevant functions and levels within the organization. The ensure that the quality policy is understood, implemented, and
quality objectives shall be measurable and consistent with the maintained at all levels of the organization.
quality policy.
(d) Quality Planning. Each manufacturer shall establish a
quality plan which defines the quality practices, resources, and
activities relevant to devices that are designed and
manufactured. The manufacturer shall establish how the
requirements for quality will be met.
5.4.2 Quality Management System Planning Subpart B--Quality System Requirements

Top management shall ensure that: Sec. 820.20 Management Responsibility.

a) the planning of the quality management system is (d) Quality Planning. Each manufacturer shall establish a
carried out in order to meet the requirements given in quality plan which defines the quality practices, resources, and
4.1, as well as the quality objectives; activities relevant to devices that are designed and
manufactured. The manufacturer shall establish how the
b) the integrity of the quality management system is requirements for quality will be met.
maintained when changes to the quality
management system are planned and implemented.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 14

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
5.5 Responsibility, Authority, and Communication Subpart B--Quality System Requirements

5.5.1 Responsibility and Authority Sec. 820.20 Management Responsibility.

Top management shall ensure that responsibilities and (b) Organization. Each manufacturer shall establish and
authorities are defined, documented, and communicated maintain an adequate organizational structure to ensure that
within the organization. Top management shall document the devices are designed and produced in accordance with the
interrelation of all personnel who manage, perform, and verify requirements of this part.
work affecting quality, and shall ensure the independence and
authority necessary to perform these tasks. (1) Responsibility and Authority. Each manufacturer shall
establish the appropriate responsibility, authority, and
interrelation of all personnel who manage, perform, and assess
work affecting quality, and provide the independence and
authority necessary to perform these tasks.
5.5.2 Management Representative Subpart B--Quality System Requirements

Top management shall appoint a member of management Sec. 820.20 Management Responsibility.
who, irrespective of other responsibilities, has responsibility
and authority that includes: (b) Organization. Each manufacturer shall establish and
maintain an adequate organizational structure to ensure that
a) ensuring that processes needed for the quality devices are designed and produced in accordance with the
management system are documented; requirements of this part.

b) reporting to top management on the effectiveness of (3) Management Representative. Management with executive
the quality management system and any need for responsibility shall appoint, and document such appointment
improvement; of, a member of management who, irrespective of other
responsibilities, shall have established authority over and
c) ensuring the promotion of awareness of applicable responsibility for:
regulatory requirements and quality management
system requirements throughout the organization. (i) Ensuring that quality system requirements are effectively
established and effectively maintained in accordance with this
part; and

(ii) Reporting on the performance of the quality system to

management with executive responsibility for review.
5.5.3 Internal Communication Subpart B--Quality System Requirements

Top management shall ensure that appropriate Sec. 820.20 Management Responsibility.
communication processes are established within the
organization and that communication takes place regarding (b) Organization. Each manufacturer shall establish and
the effectiveness of the quality management system. maintain an adequate organizational structure to ensure that
devices are designed and produced in accordance with the
requirements of this part.

(1) Responsibility and Authority. Each manufacturer shall

establish the appropriate responsibility, authority, and
interrelation of all personnel who manage, perform,
and assess work affecting quality, and provide the
independence and authority necessary to perform
these tasks.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 15

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
5.6 Management Review Subpart B--Quality System Requirements

5.6.1 General Sec. 820.20 Management Responsibility.

The organization shall document procedures for management (c) Management Review. Management with executive
review. Top management shall review the organization’s responsibility shall review the suitability and effectiveness of
quality management system at documented planned intervals the quality system at defined intervals and with sufficient
to ensure its continuing suitability, adequacy and frequency according to established procedures to ensure that
effectiveness. The review shall include assessing the quality system satisfies the requirements of this part and
opportunities for improvement and the need for changes to the manufacturer's established quality policy and objectives.
the quality management system, including the quality policy The dates and results of quality system reviews shall be
and quality objectives. documented.

Records from management reviews shall be maintained (see

4.2.5).
5.6.2 Review Input Subpart B--Quality System Requirements

The input to management review shall include, but is not Sec. Management Responsibility.
limited to, information arising from:
(c) Management Review. Management with executive
a) feedback; responsibility shall review the suitability and effectiveness of
the quality system at defined intervals and with sufficient
b) complaint handling; frequency according to established procedures to ensure that
the quality system satisfies the requirements of this part and
c) reporting to regulatory authorities; the manufacturer's established quality policy and objectives.
The dates and results of quality system reviews shall be
d) audits; documented.

e) monitoring and measurement of processes;

f) monitoring and measurement of product;

g) corrective action;

h) preventive action;

i) follow-up actions from previous management

reviews;

j) changes that could affect the quality management

system;

k) recommendations for improvement;

l) applicable new or revised regulatory requirements.

5.6.3 Review Output Subpart B--Quality System Requirements

The output from management review shall be recorded (see Sec. 820.20 Management Responsibility
4.2.5) and include the input reviewed and any decisions and
actions related to: (c) Management Review. Management with executive
responsibility shall review the suitability and effectiveness of
a) improvement needed to maintain the suitability, the quality system at defined intervals and with sufficient
adequacy, and effectiveness of the quality frequency according to established procedures to ensure that
management system and its processes; the quality system satisfies the requirements of this part and
the manufacturer's established quality policy and objectives.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 16

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
b) improvement of product related to customer The dates and results of quality system reviews shall be
requirements; documented.

c) changes needed to respond to applicable new or

revised regulatory requirements;

d) resource needs.
6 Resource Management Subpart B--Quality System Requirements

6.1 Provision of Resources Sec. 820.20 Management Responsibility

The organization shall determine and provide the resources
needed to: (b) Organization. Each manufacturer shall establish and
maintain an adequate organizational structure to ensure that
a) implement the quality management system and to devices are designed and produced in accordance with the
maintain its effectiveness; requirements of this part.

b) meet applicable regulatory and customer (1) Responsibility and Authority. Each manufacturer shall
requirements. establish the appropriate responsibility, authority, and
interrelation of all personnel who manage, perform, and assess
work affecting quality, and provide the independence and
authority necessary to perform these tasks.

(2) Resources. Each manufacturer shall provide adequate

resources, including the assignment of trained personnel, for
management, performance of work, and assessment activities,
including internal quality audits, to meet the requirements of
this part.

Sec. 820.25 Personnel.

(a) General. Each manufacturer shall have sufficient personnel

with the necessary education, background, training, and
experience to assure that all activities required by this part are
correctly performed.

6.2 Human Resources Subpart B--Quality System Requirements

Personnel performing work affecting product quality shall be Sec. 820.25 Personnel.
competent on the basis of appropriate education, training,
skills, and experience. (a) General. Each manufacturer shall have sufficient personnel
with the necessary education, background, training, and
The organization shall document the process(es) for experience to assure that all activities required by this part are
establishing competence, providing needed training, and correctly performed.
ensuring awareness of personnel.

The organization shall: (b) Training. Each manufacturer shall establish procedures for
identifying training needs and ensure that all personnel are
a) determine the necessary competence for personnel trained to adequately perform their assigned responsibilities.
Training shall be documented.
performing work affecting product quality;

b) provide training or take other actions to achieve or (1) As part of their training, personnel shall be made aware of
maintain the necessary competence; device defects which may occur from the improper
performance of their specific jobs.
c) evaluate the effectiveness of the actions taken;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 17

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
d) ensure that its personnel are aware of the relevance (2) Personnel who perform verification and validation activities
and importance of their activities and how shall be made aware of defects and errors that may be
encountered as part of their job functions.
e) they contribute to the achievement of the quality
objectives; Subpart G--Production and Process Controls

Sec. 820.70 Production and Process Controls.

f) maintain appropriate records of education, training,
skills and experience (see 4.2.5). (d) Personnel. Each manufacturer shall establish and maintain
requirements for the health, cleanliness, personal practices,
NOTE. The methodology used to check effectiveness is and clothing of personnel if contact between such personnel
proportionate to the risk associated with the work for which and product or environment could reasonably be expected to
the training or other action is being provided. have an adverse effect on product quality. The manufacturer
shall ensure that maintenance and other personnel who are
required to work temporarily under special environmental
conditions are appropriately trained or supervised by a trained
individual.

6.3 Infrastructure Subpart G--Production and Process Controls

The organization shall document the requirements for the Sec. 820.70 Production and Process Controls
infrastructure needed to achieve conformity to product
requirements, prevent product mix-up and ensure orderly (b) Production and Process Changes. Each manufacturer shall
handling of product. establish and maintain procedures for changes to a
specification, method, process, or procedure. Such changes
Infrastructure includes, as appropriate: shall be verified or where appropriate validated according to
820.75, before implementation and these activities shall be
a) buildings, workspace and associated utilities; documented. Changes shall be approved in accordance with
820.40.
b) process equipment (both hardware and software);
(f) Buildings. Buildings shall be of suitable design and contain
c) supporting services (such as transport, sufficient space to perform necessary operations, prevent mix-
communication, or information systems). ups, and assure orderly handling.

The organization shall document requirements for the (g) Equipment. Each manufacturer shall ensure that all
maintenance activities, including the interval of performing the equipment used in the manufacturing process meets specified
maintenance activities, when such maintenance activities, or requirements and is appropriately designed, constructed,
lack thereof, can affect placed, and installed to facilitate maintenance, adjustment,
product quality. As appropriate, the requirements shall apply cleaning, and use.
to equipment used in production, the control of the work
environment and monitoring and measurement. (1) Maintenance Schedule. Each manufacturer shall establish
and maintain schedules for the adjustment, cleaning, and other
Records of such maintenance shall be maintained (see 4.2.5). maintenance of equipment to ensure that manufacturing
specifications are met. Maintenance activities, including the
date and individual(s) performing the maintenance activities,
shall be documented.

(2) Inspection. Each manufacturer shall conduct periodic

inspections in accordance with established procedures to
ensure adherence to applicable equipment maintenance
schedules. The inspections, including the date and individual(s)
conducting the inspections, shall be documented.

(3) Adjustment. Each manufacturer shall ensure that any

inherent limitations or allowable tolerances are visibly posted

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 18

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
on or near equipment requiring periodic adjustments or are
readily available to personnel performing these adjustments.

(h) Manufacturing Material. Where a manufacturing material

could reasonably be expected to have an adverse effect on
product quality, the manufacturer shall establish and maintain
procedures for the use and removal of such manufacturing
material to ensure that it is removed or limited to an amount
that does not adversely affect the device's quality. The removal
or reduction of such manufacturing material shall be
documented.

(i) Automated Processes. When computers or automated data

processing systems are used as part of production or the
quality system, the manufacturer shall validate computer
software for its intended use according to an established
protocol. All software changes shall be validated before
approval and issuance. These validation activities and results
shall be documented.
6.4 Work Environment and Contamination Control Subpart G--Production and Process Controls

6.4.1 Work Environment Sec. 820.70 Production and Process Controls.

The organization shall document the requirements for the (b) Production and Process Changes. Each manufacturer shall
work environment needed to achieve conformity to product establish and maintain procedures for changes to a
requirements. specification, method, process, or procedure. Such changes
shall be verified or where appropriate validated according to
If the conditions for the work environment can have an 820.75, before implementation and these activities shall be
adverse effect on product quality, the organization shall documented. Changes shall be approved in accordance with
document the requirements for the work environment and the 820.40.
procedures to monitor and control the work environment.

The organization shall: (c) Environmental Control. Where environmental conditions

could reasonably be expected to have an adverse effect on
a) document requirements for health, cleanliness and product quality, the manufacturer shall establish and maintain
clothing of personnel if contact between such procedures to adequately control these environmental
personnel and the product or work environment conditions. Environmental control system(s) shall be
could affect medical device safety or performance; periodically inspected to verify that the system, including
necessary equipment, is adequate and functioning properly.
b) ensure that all personnel who are required to work These activities shall be documented and reviewed.
temporarily under special environmental conditions
within the work environment are competent or (e) Contamination Control. Each manufacturer shall establish
supervised by a competent person. and maintain procedures to prevent contamination of
equipment or product by substances that could reasonably be
NOTE. Further information can be found in ISO 14644 and ISO expected to have an adverse effect on product quality.
14698.
(f) Buildings. Buildings shall be of suitable design and contain
sufficient space to perform necessary operations, prevent mix-
ups, and assure orderly handling.
6.4.2 Contamination Control Subpart G--Production and Process Controls

As appropriate, the organization shall plan and document Sec. 820.70 Production and Process Controls.
arrangements for the control of contaminated or potentially
contaminated product in order to prevent contamination of the (e) Contamination Control. Each manufacturer shall establish
work environment, personnel, or product. and maintain procedures to prevent contamination of

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 19

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
For sterile medical devices, the organization shall document equipment or product by substances that could reasonably be
requirements for control of contamination with expected to have an adverse effect on product quality.
microorganisms or particulate matter and maintain the
required cleanliness during assembly or packaging processes.
7 Product Realization Subpart C—Design Controls

7.1 Planning of Product Realization Sec. 820.30 Design Controls.

The organization shall plan and develop the processes needed (b) Design and Development Planning. Each manufacturer
for product realization. Planning of product realization shall be shall establish and maintain plans that describe or reference
consistent with the requirements of the other processes of the the design and development activities and define responsibility
quality management system. for implementation. The plans shall identify and describe the
interfaces with different groups or activities that provide, or
The organization shall document one or more processes for result in, input to the design and development process. The
risk management in product realization. plans shall be reviewed, updated, and approved as design and
Records of risk management activities shall be maintained development evolves.
(see 4.2.5).
Subpart H--Acceptance Activities
In planning product realization, the organization shall
determine the following, as appropriate: Sec. 820.80 Receiving, In-Process, and Finished Device
Acceptance.
a) quality objectives and requirements for the product;
(a) General. Each manufacturer shall establish and maintain
b) the need to establish processes and documents (see procedures for acceptance activities. Acceptance activities
4.2.4) and to provide resources specific to the include inspections, tests, or other verification activities.
product, including infrastructure and work
environment; (c) In-Process Acceptance Activities. Each manufacturer shall
establish and maintain acceptance procedures, where
c) required verification, validation, monitoring, appropriate, to ensure that specified requirements for in-
measurement, inspection and test, handling, storage, process product are met. Such procedures shall ensure that in-
distribution and traceability activities specific to the process product is controlled until the required inspection and
product together with the criteria for product tests or other verification activities have been completed, or
acceptance; necessary approvals are received, and are documented.

d) records needed to provide evidence that the (d) Final Acceptance Activities. Each manufacturer shall
realization processes and resulting product meet establish and maintain procedures for finished device
requirements (see 4.2.5). acceptance to ensure that each production run, lot, or batch of
finished devices meets acceptance criteria. Finished devices
e) The output of this planning shall be documented in a shall be held in quarantine or otherwise adequately controlled
form suitable for the organization’s method of until released. Finished devices shall not be released for
operations. distribution until:

NOTE. Further information can be found in ISO 14971. (1) The activities required in the DMR are completed;

(2) the associated data and documentation is reviewed;

(3) the release is authorized by the signature of a designated

individual(s); and

(4) the authorization is dated.

(e) Acceptance Records. Each manufacturer shall document

acceptance activities required by this part. These records shall
include:

(1) The acceptance activities performed;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 20

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)

(2) the dates acceptance activities are performed;

(3) the results;

(4) the signature of the individual(s) conducting the

acceptance activities; and

(5) where appropriate the equipment used. These records shall

be part of the DHR.

Subpart L--Handling, Storage, Distribution, and Installation

Sec. 820.140 Handling.

Each manufacturer shall establish and maintain procedures to

ensure that mix-ups, damage, deterioration, contamination, or
other adverse effects to product do not occur during handling.

Sec. 820.150 Storage.

(a) Each manufacturer shall establish and maintain procedures

for the control of storage areas and stock rooms for product to
prevent mix-ups, damage, deterioration, contamination, or other
adverse effects pending use or distribution and to ensure that
no obsolete, rejected, or deteriorated product is used or
distributed. When the quality of product deteriorates over time,
it shall be stored in a manner to facilitate proper stock rotation,
and its condition shall be assessed as appropriate.

(b) Each manufacturer shall establish and maintain procedures

that describe the methods for authorizing receipt from and
dispatch to storage areas and stock rooms.

Sec. 820.160 Distribution.

(a) Each manufacturer shall establish and maintain procedures

for control and distribution of finished devices to ensure that
only those devices approved for release are distributed and
that purchase orders are reviewed to ensure that ambiguities
and errors are resolved before devices are released for
distribution. Where a device's fitness for use or quality
deteriorates over time, the procedures shall ensure that expired
devices or devices deteriorated beyond acceptable fitness for
use are not distributed.

(b) Each manufacturer shall maintain distribution records

which include or refer to the location of:

(1) The name and address of the initial consignee;

(2) The identification and quantity of devices shipped;

(3) The date shipped; and

(4) Any control number(s) used.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 21

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)

Subpart M--Records

Sec. 820.180 General Requirements.

All records required by this part shall be maintained at the

manufacturing establishment or other location that is
reasonably accessible to responsible officials of the
manufacturer and to employees of FDA designated to perform
inspections. Such records, including those not stored at the
inspected establishment, shall be made readily available for
review and copying by FDA employee(s). Such records shall be
legible and shall be stored to minimize deterioration and to
prevent loss. Those records stored in automated data
processing systems shall be backed up.

(a) Confidentiality. Records deemed confidential by the

manufacturer may be marked to aid FDA in determining
whether information may be disclosed under the public
information regulation in part 20 of this chapter.

(b) Record Retention Period. All records required by this part

shall be retained for a period of time equivalent to the design
and expected life of the device, but in no case less than 2 years
from the date of release for commercial distribution by the
manufacturer.

(c) Exceptions. This section does not apply to the reports

required by 820.20(c) Management review, 820.22 Quality
audits, and supplier audit reports used to meet the
requirements of 820.50(a) Evaluation of suppliers, contractors,
and consultants, but does apply to procedures established
under these provisions. Upon request of a designated
employee of FDA, an employee in management with executive
responsibility shall certify in writing that the management
reviews and quality audits required under this part, and supplier
audits where applicable, have been performed and
documented, the dates on which they were performed, and that
any required corrective action has been undertaken.

Sec. 820.184 Device History Record.

Each manufacturer shall maintain device history records

(DHR's). Each manufacturer shall establish and maintain
procedures to ensure that DHR's for each batch, lot, or unit are
maintained to demonstrate that the device is manufactured in
accordance with the DMR and the requirements of this part.
The DHR shall include, or refer to the location of, the following
information:

(a) The dates of manufacture;

(b) The quantity manufactured;

(c) The quantity released for distribution;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 22

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(d) The acceptance records which demonstrate the device is
manufactured in accordance with the DMR;

(e) The primary identification label and labeling used for each
production unit; and

(f) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used.

Sec. 820.186 Quality System Record.

Each manufacturer shall maintain a quality system record

(QSR). The QSR shall include, or refer to the location of,
procedures and the documentation of activities required by this
part that are not specific to a particular type of device(s),
including, but not limited to, the records required by 820.20.
Each manufacturer shall ensure that the QSR is prepared and
approved in accordance with 820.40.

Subpart N--Servicing

Sec. 820.200 Servicing.

(a) Where servicing is a specified requirement, each

manufacturer shall establish and maintain instructions and
procedures for performing and verifying that the servicing
meets the specified requirements.

(b) Each manufacturer shall analyze service reports with

appropriate statistical methodology in accordance with
820.100.

(c) Each manufacturer who receives a service report that

represents an event which must be reported to FDA under part
803 of this chapter shall automatically consider the report a
complaint and shall process it in accordance with the
requirements of 820.198.

(d) Service reports shall be documented and shall include:

(1) The name of the device serviced;

(2) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(3) The date of service;

(4) The individual(s) servicing the device;

(5) The service performed; and

(6) The test and inspection data.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 23

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
7.2 Customer-Related Processes Subpart C--Design Controls

7.2.1 Determination of Requirements Related to Product Sec. 820.30 Design Inputs

The organization shall determine: (c) Design Input. Each manufacturer shall establish and
maintain procedures to ensure that the design requirements
a) requirements specified by the customer, including relating to a device are appropriate and address the intended
the requirements for delivery and post-delivery use of the device, including the needs of the user and patient.
activities; The procedures shall include a mechanism for addressing
incomplete, ambiguous, or conflicting requirements. The
b) requirements not stated by the customer but design input requirements shall be documented and shall be
necessary for specified or intended use, as known; reviewed and approved by a designated individual(s). The
approval, including the date and signature of the individual(s)
c) applicable regulatory requirements related to the approving the requirements, shall be documented.
product;

d) any user training needed to ensure specified

performance and safe use of the medical device;

e) any additional requirements determined by the

organization.
7.2.2 Review of Requirements Related to Product Subpart C--Design Controls

The organization shall review the requirements related to Sec. 820.30 Design Inputs
product. This review shall be conducted prior to the
organization’s commitment to supply product to the customer (c) Design Input. Each manufacturer shall establish and
(e.g. submission of tenders, acceptance of contracts or maintain procedures to ensure that the design requirements
orders, acceptance of changes to contracts or orders) and relating to a device are appropriate and address the intended
shall ensure that: use of the device, including the needs of the user and patient.
The procedures shall include a mechanism for addressing
a) product requirements are defined and documented; incomplete, ambiguous, or conflicting requirements. The
design input requirements shall be documented and shall be
b) contract or order requirements differing from those reviewed and approved by a designated individual(s). The
previously expressed are resolved; approval, including the date and signature of the individual(s)
approving the requirements, shall be documented.
c) applicable regulatory requirements are met;
(d) Design Output. Each manufacturer shall establish and
d) any user training identified in accordance with 7.2.1 maintain procedures for defining and documenting design
is available or planned to be available; output in terms that allow an adequate evaluation of
conformance to design input requirements. Design output
e) the organization has the ability to meet the defined procedures shall contain or make reference to acceptance
requirements. criteria and shall ensure that those design outputs that are
essential for the proper functioning of the device are identified.
Records of the results of the review and actions arising from Design output shall be documented, reviewed, and approved
the review shall be maintained (see 4.2.5). before release. The approval, including the date and signature
When the customer provides no documented statement of of the individual(s) approving the output, shall be documented.
requirement, the customer requirements shall be confirmed by
the organization before acceptance. (e) Design Review. Each manufacturer shall establish and
maintain procedures to ensure that formal documented
When product requirements are changed, the organization reviews of the design results are planned and conducted at
shall ensure that relevant documents are amended and that appropriate stages of the device's design development. The
relevant personnel are made aware of the changed procedures shall ensure that participants at each design review
requirements. include representatives of all functions concerned with the
design stage being reviewed and an individual(s) who does not
have direct responsibility for the design stage being reviewed,
as well as any specialists needed. The results of a design

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 24

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
review, including identification of the design, the date, and the
individual(s) performing the review, shall be documented in the
design history file (the DHF).
7.2.3 Communication Refer to Subpart M—Records, Sec. 820.198 Complaint Files.

The organization shall plan and document arrangements for

communicating with customers in relation to:

a) product information;

b) enquiries, contracts or order handling, including

amendments;

c) customer feedback, including complaints;

d) advisory notices.

The organization shall communicate with regulatory

authorities in accordance with applicable regulatory
requirements.
7.3 Design and Development Subpart C--Design Controls

7.3.1 General Sec. 820.30 Design Controls.

The organization shall document procedures for design and (a) General.
development.
(1) Each manufacturer of any class III or class II device, and the
class I devices listed in paragraph (a)(2) of this section, shall
establish and maintain procedures to control the design of the
device in order to ensure that specified design requirements
are met.

(2) The following class I devices are subject to design controls:

(i) Devices automated with computer software; and

(ii) The devices listed in the following chart.

Section Device
868.6810 Catheter, Tracheobronchial Suction.
878.4460 Glove, Surgeon's.
880.6760 Restraint, Protective.
892.5650 System, Applicator, Radionuclide, Manual.
892.5740 Source, Radionuclide Teletherapy.

7.3.2 Design and Development Planning Subpart C--Design Controls

The organization shall plan and control the design and Sec. 820.30 Design Controls.
development of product. As appropriate, design and
development planning documents shall be maintained and (b) Design and Development Planning. Each manufacturer
updated as the design and development progresses. shall establish and maintain plans that describe or reference
the design and development activities and define responsibility
During design and development planning, the organization for implementation. The plans shall identify and describe the
shall document: interfaces with different groups or activities that provide, or

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 25

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
result in, input to the design and development process. The
a) the design and development stages; plans shall be reviewed, updated, and approved as design and
development evolves.
b) the review(s) needed at each design and
development stage;

c) the verification, validation, and design transfer

activities that are appropriate at each design and
development stage;

d) the responsibilities and authorities for design and

development;

e) the methods to ensure traceability of design and

development outputs to design and development
inputs;

f) the resources needed, including necessary

competence of personnel.
7.3.3 Design and Development Inputs Subpart C--Design Controls

Inputs relating to product requirements shall be determined Sec. 820.30 Design Controls.
and records maintained (see 4.2.5). These inputs shall
include: (c) Design Input. Each manufacturer shall establish and
maintain procedures to ensure that the design requirements
a) functional, performance, usability and safety relating to a device are appropriate and address the intended
requirements, according to the intended use; use of the device, including the needs of the user and patient.
The procedures shall include a mechanism for addressing
b) applicable regulatory requirements and standards; incomplete, ambiguous, or conflicting requirements. The
design input requirements shall be documented and shall be
c) applicable output(s) of risk management; reviewed and approved by a designated individual(s). The
approval, including the date and signature of the individual(s)
d) as appropriate, information derived from previous approving the requirements, shall be documented.
similar designs;

e) other requirements essential for design and

development of the product and processes.

These inputs shall be reviewed for adequacy and approved.

Requirements shall be complete, unambiguous, able to be

verified or validated, and not in conflict with each other.

NOTE. Further information can be found in IEC 62366–1.

7.3.4 Design and Development Outputs Subpart C--Design Controls

Design and development outputs shall: Sec. 820.30 Design Controls.

a) meet the input requirements for design and (d) Design Output. Each manufacturer shall establish and
development; maintain procedures for defining and documenting design
output in terms that allow an adequate evaluation of
b) provide appropriate information for purchasing, conformance to design input requirements. Design output
production and service provision; procedures shall contain or make reference to acceptance
criteria and shall ensure that those design outputs that are
c) contain or reference product acceptance criteria; essential for the proper functioning of the device are identified.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 26

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
Design output shall be documented, reviewed, and approved
d) specify the characteristics of the product that are before release. The approval, including the date and signature
essential for its safe and proper use. of the individual(s) approving the output, shall be documented.

The outputs of design and development shall be in a form

suitable for verification against the design and development
inputs and shall be approved prior to release.

Records of the design and development outputs shall be

maintained (see 4.2.5).
7.3.5 Design and Development Review Subpart C--Design Controls

At suitable stages, systematic reviews of design and Sec. 820.30 Design Controls.
development shall be performed in accordance with planned
and documented arrangements to: (e) Design Review. Each manufacturer shall establish and
maintain procedures to ensure that formal documented
a) evaluate the ability of the results of design and reviews of the design results are planned and conducted at
development to meet requirements; appropriate stages of the device's design development. The
procedures shall ensure that participants at each design review
b) identify and propose necessary actions. include representatives of all functions concerned with the
design stage being reviewed and an individual(s) who does not
Participants in such reviews shall include representatives of have direct responsibility for the design stage being reviewed,
functions concerned with the design and development stage as well as any specialists needed. The results of a design
being reviewed, as well as other specialist personnel. review, including identification of the design, the date, and the
individual(s) performing the review, shall be documented in the
Records of the results of the reviews and any necessary design history file (the DHF).
actions shall be maintained and include the identification of
the design under review, the participants involved and the date
of the review (see 4.2.5).
7.3.6 Design and Development Verification Subpart C--Design Controls

Design and development verification shall be performed in Sec. 820.30 Design Controls.
accordance with planned and documented arrangements to
ensure that the design and development outputs have met the (f) Design Verification. Each manufacturer shall establish and
design and development input requirements. maintain procedures for verifying the device design. Design
verification shall confirm that the design output meets the
The organization shall document verification plans that design input requirements. The results of the design
include methods, acceptance criteria and, as appropriate, verification, including identification of the design, method(s),
statistical techniques with rationale for sample size. the date, and the individual(s) performing the verification, shall
be documented in the DHF.
If the intended use requires that the medical device be
connected to, or have an interface with, other medical
device(s), verification shall include confirmation that the
design outputs meet design inputs when so connected or
interfaced.

Records of the results and conclusions of the verification and

necessary actions shall be maintained
(see 4.2.4 and 4.2.5).
7.3.7 Design and Development Validation Subpart C--Design Controls

Design and development validation shall be performed in Sec. 820.30 Design Controls.
accordance with planned and documented arrangements to
ensure that the resulting product is capable of meeting the (g) Design Validation. Each manufacturer shall establish and
requirements for the specified application or intended use. maintain procedures for validating the device design. Design

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 27

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
validation shall be performed under defined operating
The organization shall document validation plans that include conditions on initial production units, lots, or batches, or their
methods, acceptance criteria and, as appropriate, statistical equivalents. Design validation shall ensure that devices
techniques with rationale for sample size. conform to defined user needs and intended uses and shall
include testing of production units under actual or simulated
Design validation shall be conducted on representative use conditions. Design validation shall include software
product. Representative product includes initial production validation and risk analysis, where appropriate. The results of
units, batches or their equivalents. The rationale for the choice the design validation, including identification of the design,
of product used for validation shall be recorded (see 4.2.5). method(s), the date, and the individual(s) performing the
validation, shall be documented in the DHF.
As part of design and development validation, the organization
shall perform clinical evaluations or performance evaluations
of the medical device in accordance with applicable regulatory
requirements.

A medical device used for clinical evaluation or performance

evaluation is not considered to be released for use to the
customer.

If the intended use requires that the medical device be

connected to, or have an interface with, other medical
device(s), validation shall include confirmation that the
requirements for the specified application or intended use
have been met when so connected or interfaced.

Validation shall be completed prior to release for use of the

product to the customer. Records of the results and
conclusion of validation and necessary actions shall be
maintained (see 4.2.4 and 4.2.5).
7.3.8 Design and Development Transfer Subpart C--Design Controls

The organization shall document procedures for transfer of Sec. 820.30 Design Controls.
design and development outputs to manufacturing. These
procedures shall ensure that design and development outputs (h) Design Transfer. Each manufacturer shall establish and
are verified as suitable for manufacturing before becoming maintain procedures to ensure that the device design is
final production specifications and that production capability correctly translated into production specifications.
can meet product requirements.

Results and conclusions of the transfer shall be recorded (see

4.2.5).
7.3.9 Control of Design and Development Changes Subpart C--Design Controls

The organization shall document procedures to control design Sec. 820.30 Design Controls.
and development changes. The organization shall determine
the significance of the change to function, performance, (i) Design Changes. Each manufacturer shall establish and
usability, safety, and applicable regulatory requirements for maintain procedures for the identification, documentation,
the medical device and its intended use. validation or where appropriate verification, review, and
approval of design changes before their implementation.
Design and development changes shall be identified. Before
implementation, the changes shall be:

a) reviewed;

b) verified;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 28

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
c) validated, as appropriate;

d) approved.

The review of design and development changes shall include

evaluation of the effect of the changes on constituent parts
and product in process or already delivered, inputs or outputs
of risk management and product realization processes.

Records of changes, their review, and any necessary actions

shall be maintained (see 4.2.5).
7.3.10 Design and Development Files Subpart C--Design Controls

The organization shall maintain a design and development file Sec. 820.30 Design Controls.
for each medical device type or medical device family. This
file shall include or reference records generated to (j) Design History File. Each manufacturer shall establish and
demonstrate conformity to the requirements for design and maintain a DHF for each type of device. The DHF shall contain
development and records for design and development or reference the records necessary to demonstrate that the
changes. design was developed in accordance with the approved design
plan and the requirements of this part.

7.4 Purchasing Subpart E—Purchasing Controls

7.4.1 Purchasing Process Sec. 820.50 Purchasing Controls.

The organization shall document procedures (see 4.2.4) to Each manufacturer shall establish and maintain procedures to
ensure that purchased product conforms to specified ensure that all purchased or otherwise received product and
purchasing information. services conform to specified requirements.

The organization shall establish criteria for the evaluation and (a) Evaluation of Suppliers, Contractors, and Consultants.
selection of suppliers. The criteria shall be: Each manufacturer shall establish and maintain the
requirements, including quality requirements, that must be met
a) based on the supplier’s ability to provide product that by suppliers, contractors, and consultants. Each manufacturer
meets the organization’s requirements; shall:

b) based on the performance of the supplier; (1) Evaluate and select potential suppliers, contractors, and
consultants on the basis of their ability to meet specified
c) based on the effect of the purchased product on the requirements, including quality requirements. The evaluation
quality of the medical device; shall be documented.

d) proportionate to the risk associated with the medical (2) Define the type and extent of control to be exercised over
device. the product, services, suppliers, contractors, and consultants,
based on the evaluation results.
The organization shall plan the monitoring and re-evaluation
of suppliers. Supplier performance in meeting requirements (3) Establish and maintain records of acceptable suppliers,
for the purchased product shall be monitored. The results of contractors, and consultants.
the monitoring shall provide an input into the supplier re-
evaluation process. (b) Purchasing Data. Each manufacturer shall establish and
maintain data that clearly describe or reference the specified
Non-fulfilment of purchasing requirements shall be addressed requirements, including quality requirements, for purchased or
with the supplier proportionate to the risk associated with the otherwise received product and services. Purchasing
purchased product and compliance with applicable regulatory documents shall include, where possible, an agreement that
requirements. the suppliers, contractors, and consultants agree to notify the
manufacturer of changes in the product or service so that
manufacturers may determine whether the changes may affect

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 29

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
Records of the results of evaluation, selection, monitoring, and the quality of a finished device. Purchasing data shall be
re-evaluation of supplier capability or performance and any approved in accordance with 820.40.
necessary actions arising from these activities shall be
maintained (see 4.2.5).
7.4.2 Purchasing Information Subpart E--Purchasing Controls

Purchasing information shall describe or reference the Sec. 820.50 Purchasing Controls.
product to be purchased, including as appropriate:
(b) Purchasing Data. Each manufacturer shall establish and
a) product specifications; maintain data that clearly describe or reference the specified
requirements, including quality requirements, for purchased or
b) requirements for product acceptance, procedures, otherwise received product and services. Purchasing
processes and equipment; documents shall include, where possible, an agreement that
the suppliers, contractors, and consultants agree to notify the
c) requirements for qualification of supplier personnel; manufacturer of changes in the product or service so that
manufacturers may determine whether the changes may affect
d) quality management system requirements. the quality of a finished device. Purchasing data shall be
approved in accordance with 820.40.
The organization shall ensure the adequacy of specified
purchasing requirements prior to their communication to the
supplier.

Purchasing information shall include, as applicable, a written

agreement that the supplier notify the organization of changes
in the purchased product prior to implementation of any
changes that affect the ability of the purchased product to
meet specified purchase requirements.

To the extent required for traceability given in 7.5.9, the

organization shall maintain relevant purchasing information in
the form of documents (see 4.2.4) and records (see 4.2.5).
7.4.3 Verification of Purchased Product Subpart H--Acceptance Activities

The organization shall establish and implement the inspection Sec. 820.80 Receiving, In-Process, and Finished Device
or other activities necessary for ensuring that purchased Acceptance.
product meets specified purchasing requirements. The extent
of verification activities shall be based on the supplier (a) General. Each manufacturer shall establish and maintain
evaluation results and proportionate to the risks associated procedures for acceptance activities. Acceptance activities
with the purchased product. include inspections, tests, or other verification activities.

When the organization becomes aware of any changes to the (b) Receiving Acceptance Activities. Each manufacturer shall
purchased product, the organization shall determine whether establish and maintain procedures for acceptance of incoming
these changes affect the product realization process or the product. Incoming product shall be inspected, tested, or
medical device. otherwise verified as conforming to specified requirements.
Acceptance or rejection shall be documented.
When the organization or its customer intends to perform
verification at the supplier’s premises, the organization shall Subpart E--Purchasing Controls
state the intended verification activities and method of
product release in the purchasing information. Sec. 820.50 Purchasing Controls.

Records of the verification shall be maintained (see 4.2.5). Each manufacturer shall establish and maintain procedures to
ensure that all purchased or otherwise received product and
services conform to specified requirements.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 30

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(b) Purchasing Data. Each manufacturer shall establish and
maintain data that clearly describe or reference the specified
requirements, including quality requirements, for purchased or
otherwise received product and services. Purchasing
documents shall include, where possible, an agreement that
the suppliers, contractors, and consultants agree to notify the
manufacturer of changes in the product or service so that
manufacturers may determine whether the changes may affect
the quality of a finished device. Purchasing data shall be
approved in accordance with 820.40.

7.5 Production and Service Provision Subpart G--Production and Process Controls

7.5.1 Control of Production and Service Provision Sec. 820.70 Production and Process Controls.

Production and service provision shall be planned, carried out, (a) General. Each manufacturer shall develop, conduct, control,
monitored. and controlled to ensure that product conforms to and monitor production processes to ensure that a device
specification. As appropriate, production controls shall include conforms to its specifications. Where deviations from device
but are not limited to: specifications could occur as a result of the manufacturing
process, the manufacturer shall establish and maintain
a) documentation of procedures and methods for the process control procedures that describe any process controls
control of production (see 4.2.4); necessary to ensure conformance to specifications. Where
process controls are needed they shall include:
b) qualification of infrastructure;
(1) Documented instructions, standard operating procedures
c) implementation of monitoring and measurement of (SOP's), and methods that define and control the manner of
process parameters and product characteristics; production;

d) availability and use of monitoring and measuring (2) Monitoring and control of process parameters and
equipment; component and device characteristics during production;

e) implementation of defined operations for labelling (3) Compliance with specified reference standards or codes;
and packaging;
(4) The approval of processes and process equipment; and
f) implementation of product release, delivery and post-
delivery activities. (5) Criteria for workmanship which shall be expressed in
documented standards or by means of identified and approved
The organization shall establish and maintain a record (see representative samples.
4.2.5) for each medical device or batch of medical devices
that provides traceability to the extent specified in 7.5.9 and Subpart G--Production and Process Controls
identifies the amount manufactured and amount approved for
distribution. The record shall be verified and approved. Sec. 820.70 Production and Process Controls.

(a) General. Each manufacturer shall develop, conduct, control,

and monitor production processes to ensure that a device
conforms to its specifications. Where deviations from device
specifications could occur as a result of the manufacturing
process, the manufacturer shall establish and maintain
process control procedures that describe any process controls
necessary to ensure conformance to specifications. Where
process controls are needed they shall include:

(1) Documented instructions, standard operating procedures

(SOP's), and methods that define and control the manner of
production;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 31

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(2) Monitoring and control of process parameters and
component and device characteristics during production;

(3) Compliance with specified reference standards or codes;

(4) The approval of processes and process equipment; and

(5) Criteria for workmanship which shall be expressed in

documented standards or by means of identified and approved
representative samples.

(b) Production and Process Changes. Each manufacturer shall

establish and maintain procedures for changes to a
specification, method, process, or procedure. Such changes
shall be verified or where appropriate validated according to
820.75, before implementation and these activities shall be
documented. Changes shall be approved in accordance with
820.40.

(g) Equipment. Each manufacturer shall ensure that all

equipment used in the manufacturing process meets specified
requirements and is appropriately designed, constructed,
placed, and installed to facilitate maintenance, adjustment,
cleaning, and use.

(1) Maintenance Schedule. Each manufacturer shall establish

and maintain schedules for the adjustment, cleaning, and other
maintenance of equipment to ensure that manufacturing
specifications are met. Maintenance activities, including the
date and individual(s) performing the maintenance activities,
shall be documented.

(2) Inspection. Each manufacturer shall conduct periodic

inspections in accordance with established procedures to
ensure adherence to applicable equipment maintenance
schedules. The inspections, including the date and individual(s)
conducting the inspections, shall be documented.

(3) Adjustment. Each manufacturer shall ensure that any

inherent limitations or allowable tolerances are visibly posted
on or near equipment requiring periodic adjustments or are
readily available to personnel performing these adjustments.

7.5.2 Cleanliness of Product Subpart G--Production and Process Controls

The organization shall document requirements for cleanliness Sec. 820.70 Production and Process Controls.
of product or contamination control of product if:
(c) Environmental Control. Where environmental conditions
a) product is cleaned by the organization prior to could reasonably be expected to have an adverse effect on
sterilization or its use; product quality, the manufacturer shall establish and maintain
b) product is supplied non-sterile and is to be subjected procedures to adequately control these environmental
to a cleaning process prior to sterilization or its use; conditions. Environmental control system(s) shall be
periodically inspected to verify that the system, including
c) product cannot be cleaned prior to sterilization or its necessary equipment, is adequate and functioning properly.
use, and its cleanliness is of significance in use; These activities shall be documented and reviewed.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 32

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
d) product is supplied to be used non-sterile, and its (d) Personnel. Each manufacturer shall establish and maintain
cleanliness is of significance in use; requirements for the health, cleanliness, personal practices,
and clothing of personnel if contact between such personnel
e) process agents are to be removed from product and product or environment could reasonably be expected to
during manufacture. have an adverse effect on product quality. The manufacturer
shall ensure that maintenance and other personnel who are
If product is cleaned in accordance with a) or b) above, the required to work temporarily under special environmental
requirements contained in 6.4.1 do not apply prior to the conditions are appropriately trained or supervised by a trained
cleaning process. individual.

(e) Contamination Control. Each manufacturer shall establish

and maintain procedures to prevent contamination of
equipment or product by substances that could reasonably be
expected to have an adverse effect on product quality.
7.5.3 Installation Activities Subpart L--Handling, Storage, Distribution, and Installation

The organization shall document requirements for medical Sec. 820.170 Installation.
device installation and acceptance criteria for verification of
installation, as appropriate. (a) Each manufacturer of a device requiring installation shall
establish and maintain adequate installation and inspection
If the agreed customer requirements allow installation of the instructions, and where appropriate test procedures.
medical device to be performed by an external party other Instructions and procedures shall include directions for
than the organization or its supplier, the organization shall ensuring proper installation so that the device will perform as
provide documented requirements for medical device intended after installation. The manufacturer shall distribute
installation and verification of installation. the instructions and procedures with the device or otherwise
make them available to the person(s) installing the device.
Records of medical device installation and verification of
installation performed by the organization or its supplier shall (b) The person installing the device shall ensure that the
be maintained (see 4.2.5). installation, inspection, and any required testing are performed
in accordance with the manufacturer's instructions and
procedures and shall document the inspection and any test
results to demonstrate proper installation.
7.5.4 Servicing Activities Subpart N—Servicing

If servicing of the medical device is a specified requirement, Sec. 820.200 Servicing.

the organization shall document servicing procedures,
reference materials, and reference measurements, as (a) Where servicing is a specified requirement, each
necessary, for performing servicing activities and verifying manufacturer shall establish and maintain instructions and
that product requirements are met. procedures for performing and verifying that the servicing
meets the specified requirements.
The organization shall analyze records of servicing activities
carried out by the organization or its supplier: (b) Each manufacturer shall analyze service reports with
appropriate statistical methodology in accordance with
a) to determine if the information is to be handled as a 820.100.
complaint;
(c) Each manufacturer who receives a service report that
b) as appropriate, for input to the improvement process. represents an event which must be reported to FDA under part
803 of this chapter shall automatically consider the report a
Records of servicing activities carried out by the organization complaint and shall process it in accordance with the
or its supplier shall be maintained requirements of 820.198.
(see 4.2.5).
(d) Service reports shall be documented and shall include:

(1) The name of the device serviced;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 33

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(2) Any unique device identifier (UDI) or universal product code
(UPC), and any other device identification(s) and control
number(s) used;

(3) The date of service;

(4) The individual(s) servicing the device;

(5) The service performed; and

(6) The test and inspection data.

7.5.5 Particular Requirements for Sterile Medical Devices 21 CFR Part 820 does not specifically address sterilization
controls.
The organization shall maintain records of the sterilization
process parameters used for each sterilization batch (see
4.2.5). Sterilization records shall be traceable to each
production batch of medical devices.
7.5.6 Validation of Processes for Production and Service Subpart G—Production and Process Controls
Provision
Sec. 820.75 Process Validation
The organization shall validate any processes for production
and service provision where the resulting output cannot be or (a) Where the results of a process cannot be fully verified by
is not verified by subsequent monitoring or measurement and, subsequent inspection and test, the process shall be validated
as a consequence, deficiencies become apparent only after with a high degree of assurance and approved according to
the product is in use or the service has been delivered. established procedures. The validation activities and results,
including the date and signature of the individual(s) approving
Validation shall demonstrate the ability of these processes to the validation and where appropriate the major equipment
achieve planned results consistently. The organization shall validated, shall be documented.
document procedures for validation of processes, including:
(b) Each manufacturer shall establish and maintain procedures
a) defined criteria for review and approval of the for monitoring and control of process parameters for validated
processes; processes to ensure that the specified requirements continue
to be met.
b) equipment qualification and qualification of
personnel; (1) Each manufacturer shall ensure that validated processes
are performed by qualified individual(s).
c) use of specific methods, procedures and acceptance
criteria; (2) For validated processes, the monitoring and control
methods and data, the date performed, and, where appropriate,
d) as appropriate, statistical techniques with rationale the individual(s) performing the process or the major
for sample sizes; equipment used shall be documented.

e) requirements for records (see 4.2.5); (c) When changes or process deviations occur, the
manufacturer shall review and evaluate the process and
f) revalidation, including criteria for revalidation; perform revalidation where appropriate. These activities shall
be documented.
g) approval of changes to the processes.
Subpart G—Production and Process Controls
The organization shall document procedures for the validation
of the application of computer software used in production Sec. 820.70 Production and Process Controls.
and service provision. Such software applications shall be
validated prior to initial use and, as appropriate, after changes (a) General. Each manufacturer shall develop, conduct, control,
to such software or its application. The specific approach and and monitor production processes to ensure that a device

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 34

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
activities associated with software validation and revalidation conforms to its specifications. Where deviations from device
shall be proportionate to the risk associated with the use of specifications could occur as a result of the manufacturing
the software, including the effect on the ability of the product process, the manufacturer shall establish and maintain
to conform to specifications. process control procedures that describe any process controls
necessary to ensure conformance to specifications. Where
Records of the results and conclusion of validation and process controls are needed they shall include:
necessary actions from the validation shall be maintained
(see 4.2.4 and 4.2.5). (1) Documented instructions, standard operating procedures
(SOP's), and methods that define and control the manner of
production;

(2) Monitoring and control of process parameters and

component and device characteristics during production;

(3) Compliance with specified reference standards or codes;

(4) The approval of processes and process equipment; and

(5) Criteria for workmanship which shall be expressed in

documented standards or by means of identified and approved
representative samples.

(b) Production and Process Changes. Each manufacturer shall

establish and maintain procedures for changes to a
specification, method, process, or procedure. Such changes
shall be verified or where appropriate validated according to
820.75, before implementation and these activities shall be
documented. Changes shall be approved in accordance with
820.40.

(g) Equipment. Each manufacturer shall ensure that all

equipment used in the manufacturing process meets specified
requirements and is appropriately designed, constructed,
placed, and installed to facilitate maintenance, adjustment,
cleaning, and use.

(1) Maintenance Schedule. Each manufacturer shall establish

and maintain schedules for the adjustment, cleaning, and other
maintenance of equipment to ensure that manufacturing
specifications are met. Maintenance activities, including the
date and individual(s) performing the maintenance activities,
shall be documented.

(2) Inspection. Each manufacturer shall conduct periodic

inspections in accordance with established procedures to
ensure adherence to applicable equipment maintenance
schedules. The inspections, including the date and individual(s)
conducting the inspections, shall be documented.

(3) Adjustment. Each manufacturer shall ensure that any

inherent limitations or allowable tolerances are visibly posted
on or near equipment requiring periodic adjustments or are
readily available to personnel performing these adjustments.

(i) Automated Processes. When computers or automated data

processing systems are used as part of production or the

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 35

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
quality system, the manufacturer shall validate computer
software for its intended use according to an established
protocol. All software changes shall be validated before
approval and issuance. These validation activities and results
shall be documented.

7.5.7 Particular Requirements for Validation of Processes for 21 CFR Part 820 does not specifically address sterilization
Sterilization and Sterile Barrier Systems controls.

The organization shall document procedures (see 4.2.4) for

the validation of processes for sterilization and sterile barrier
systems.

Processes for sterilization and sterile barrier systems shall be

validated prior to implementation and following product or
process changes, as appropriate.

Records of the results and, conclusion of validation and

necessary actions from the validation shall be maintained
(see 4.2.4 and 4.2.5).

NOTE. Further information can be found in ISO 11607-1 and

ISO 11607-2.
7.5.8 Identification Subpart F--Identification and Traceability

The organization shall document procedures for product Sec. 820.60 Identification.
identification and identify product by suitable means
throughout product realization. Each manufacturer shall establish and maintain procedures for
identifying product during all stages of receipt, production,
The organization shall identify product status with respect to distribution, and installation to prevent mix-ups.
monitoring and measurement requirements throughout
product realization. Identification of product status shall be Subpart H—Acceptance Activities
maintained throughout production, storage, installation and
servicing of product to ensure that only product that has Sec. 820.86 Acceptance Status.
passed the required inspections and tests or released under
an authorized concession is dispatched, used, or installed. Each manufacturer shall identify by suitable means the
acceptance status of product, to indicate the conformance or
If required by applicable regulatory requirements, the nonconformance of product with acceptance criteria. The
organization shall document a system to assign unique device identification of acceptance status shall be maintained
identification to the medical device. throughout manufacturing, packaging, labeling, installation, and
servicing of the product to ensure that only product which has
The organization shall document procedures to ensure that passed the required acceptance activities is distributed, used,
medical devices returned to the organization are identified and or installed.
distinguished from conforming product.
Subpart K--Labeling and Packaging Control

Sec. 820.120 Device Labeling.

Each manufacturer shall establish and maintain procedures to

control labeling activities.

(a) Label Integrity. Labels shall be printed and applied so as to

remain legible and affixed during the customary conditions of

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 36

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
processing, storage, handling, distribution, and where
appropriate use.

(b) Labeling Inspection. Labeling shall not be released for

storage or use until a designated individual(s) has examined
the labeling for accuracy including, where applicable, the
correct unique device identifier (UDI) or universal product code
(UPC), expiration date, control number, storage instructions,
handling instructions, and any additional processing
instructions. The release, including the date and signature of
the individual(s) performing the examination, shall be
documented in the DHR.

(c) Labeling Storage. Each manufacturer shall store labeling in

a manner that provides proper identification and is designed to
prevent mix-ups.

(d) Labeling Operations. Each manufacturer shall control

labeling and packaging operations to prevent labeling mix-ups.
The label and labeling used for each production unit, lot, or
batch shall be documented in the DHR.

(e) Control Number. Where a control number is required by

820.65, that control number shall be on or shall accompany the
device through distribution.

Sec. 820.130 Device Packaging.

Each manufacturer shall ensure that device packaging and

shipping containers are designed and constructed to protect
the device from alteration or damage during the customary
conditions of processing, storage, handling, and distribution.

Subpart L--Handling, Storage, Distribution, and Installation

Sec. 820.140 Handling.

Each manufacturer shall establish and maintain procedures to

ensure that mix-ups, damage, deterioration, contamination, or
other adverse effects to product do not occur during handling.

Sec. 820.150 Storage.

(a) Each manufacturer shall establish and maintain procedures

for the control of storage areas and stock rooms for product to
prevent mix-ups, damage, deterioration, contamination, or other
adverse effects pending use or distribution and to ensure that
no obsolete, rejected, or deteriorated product is used or
distributed. When the quality of product deteriorates over time,
it shall be stored in a manner to facilitate proper stock rotation,
and its condition shall be assessed as appropriate.

(b) Each manufacturer shall establish and maintain procedures

that describe the methods for authorizing receipt from and
dispatch to storage areas and stock rooms.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 37

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
Sec. 820.160 Distribution.

(a) Each manufacturer shall establish and maintain procedures

for control and distribution of finished devices to ensure that
only those devices approved for release are distributed and
that purchase orders are reviewed to ensure that ambiguities
and errors are resolved before devices are released for
distribution. Where a device's fitness for use or quality
deteriorates over time, the procedures shall ensure that expired
devices or devices deteriorated beyond acceptable fitness for
use are not distributed.

(b) Each manufacturer shall maintain distribution records

which include or refer to the location of:

(1) The name and address of the initial consignee;

(2) The identification and quantity of devices shipped;

(3) The date shipped; and

(4) Any control number(s) used.

Sec. 820.170 Installation.

(a) Each manufacturer of a device requiring installation shall

establish and maintain adequate installation and inspection
instructions, and where appropriate test procedures.
Instructions and procedures shall include directions for
ensuring proper installation so that the device will perform as
intended after installation. The manufacturer shall distribute
the instructions and procedures with the device or otherwise
make them available to the person(s) installing the device.

(b) The person installing the device shall ensure that the
installation, inspection, and any required testing are performed
in accordance with the manufacturer's instructions and
procedures and shall document the inspection and any test
results to demonstrate proper installation.

Subpart M—Records

Sec. 820.184 Device History Record.

Each manufacturer shall maintain device history records

(DHR's). Each manufacturer shall establish and maintain
procedures to ensure that DHR's for each batch, lot, or unit are
maintained to demonstrate that the device is manufactured in
accordance with the DMR and the requirements of this part.
The DHR shall include, or refer to the location of, the following
information:

(a) The dates of manufacture;

(b) The quantity manufactured;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 38

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(c) The quantity released for distribution;

(d) The acceptance records which demonstrate the device is

manufactured in accordance with the DMR;

(e) The primary identification label and labeling used for each
production unit; and

(f) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used.

Subpart N--Servicing

Sec. 820.200 Servicing.

(a) Where servicing is a specified requirement, each

manufacturer shall establish and maintain instructions and
procedures for performing and verifying that the servicing
meets the specified requirements.

(b) Each manufacturer shall analyze service reports with

appropriate statistical methodology in accordance with
820.100.

(c) Each manufacturer who receives a service report that

represents an event which must be reported to FDA under part
803 of this chapter shall automatically consider the report a
complaint and shall process it in accordance with the
requirements of 820.198.

(d) Service reports shall be documented and shall include:

(1) The name of the device serviced;

(2) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(3) The date of service;

(4) The individual(s) servicing the device;

(5) The service performed; and

(6) The test and inspection data.

7.5.9 Traceability Subpart F--Identification and Traceability=

7.5.9.1 General Sec. 820.65 Traceability

The organization shall document procedures for traceability. Each manufacturer of a device that is intended for surgical
These procedures shall define the extent of traceability in implant into the body or to support or sustain life and whose
accordance with applicable regulatory requirements and the failure to perform when properly used in accordance with
records to be maintained (see 4.2.5). instructions for use provided in the labeling can be reasonably

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 39

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
expected to result in a significant injury to the user shall
establish and maintain procedures for identifying with a control
number each unit, lot, or batch of finished devices and where
appropriate components. The procedures shall facilitate
corrective action. Such identification shall be documented in
the DHR.
7.5.9.2 Particular Requirements for Implantable Medical 21 CFR Part 820 does not specifically address implantable
Devices Medical Devices

The records required for traceability shall include records of Subpart H—Acceptance Activities
components, materials, and conditions for the work
environment used, if these could cause the medical device not Sec. 820.80 Receiving, In-Process, and Finished Device
to satisfy its specified safety and performance requirements. Acceptance

(e) Acceptance Records. Each manufacturer shall document

acceptance activities required by this part. These records shall
The organization shall require that suppliers of distribution include:
services or distributors maintain records of the distribution of
medical devices to allow traceability and that these records (1) The acceptance activities performed;
are available for inspection.
(2) the dates acceptance activities are performed;
Records of the name and address of the shipping package
consignee shall be maintained (see 4.2.5). (3) the results;

(4) the signature of the individual(s) conducting the

acceptance activities; and

(5) where appropriate the equipment used. These records shall

be part of the DHR.
7.5.10 Customer Property 21 CFR Part 820 does not have an equivalent “Customer
Property” provision.
The organization shall identify, verify, protect, and safeguard
customer property provided for use or incorporation into the
product while it is under the organization’s control or being
used by the organization. If any customer property is lost,
damaged, or otherwise found to be unsuitable for use, the
organization shall report this to the customer and maintain
records (see 4.2.5).
7.5.11 Preservation of Product Subpart K--Labeling and Packaging Control

The organization shall document procedures for preserving Sec. 820.120 Device Labeling.
the conformity of product to requirements during processing,
storage, handling, and distribution. Preservation shall apply to Each manufacturer shall establish and maintain procedures to
the constituent parts of a medical device. control labeling activities.

The organization shall protect product from alteration, (a) Label Integrity. Labels shall be printed and applied so as to
contamination or damage when exposed to expected remain legible and affixed during the customary conditions of
conditions and hazards during processing, storage, handling, processing, storage, handling, distribution, and where
and distribution by: appropriate use.

a) designing and constructing suitable packaging and (b) Labeling Inspection. Labeling shall not be released for
shipping containers; storage or use until a designated individual(s) has examined
the labeling for accuracy including, where applicable, the
correct unique device identifier (UDI) or universal product code
(UPC), expiration date, control number, storage instructions,

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 40

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
b) documenting requirements for special conditions handling instructions, and any additional processing
needed if packaging alone cannot provide instructions. The release, including the date and signature of
preservation. the individual(s) performing the examination, shall be
documented in the DHR.
If special conditions are required, they shall be controlled and
recorded (see 4.2.5). (c) Labeling Storage. Each manufacturer shall store labeling in
a manner that provides proper identification and is designed to
prevent mix-ups.

(d) Labeling Operations. Each manufacturer shall control

labeling and packaging operations to prevent labeling mix-ups.
The label and labeling used for each production unit, lot, or
batch shall be documented in the DHR.

(e) Control Number. Where a control number is required by

820.65, that control number shall be on or shall accompany the
device through distribution.

Sec. 820.130 Device Packaging.

Each manufacturer shall ensure that device packaging and

shipping containers are designed and constructed to protect
the device from alteration or damage during the customary
conditions of processing, storage, handling, and distribution.

Subpart L—Handling, Storage, Distribution, and Installation

Sec. 820.140 Handling.

Each manufacturer shall establish and maintain procedures to

ensure that mix-ups, damage, deterioration, contamination, or
other adverse effects to product do not occur during handling.

Sec. 820.150 Storage.

(a) Each manufacturer shall establish and maintain procedures

for the control of storage areas and stock rooms for product to
prevent mix-ups, damage, deterioration, contamination, or other
adverse effects pending use or distribution and to ensure that
no obsolete, rejected, or deteriorated product is used or
distributed. When the quality of product deteriorates over time,
it shall be stored in a manner to facilitate proper stock rotation,
and its condition shall be assessed as appropriate.

(b) Each manufacturer shall establish and maintain procedures

that describe the methods for authorizing receipt from and
dispatch to storage areas and stock rooms.

Sec. 820.160 Distribution.

(a) Each manufacturer shall establish and maintain procedures

for control and distribution of finished devices to ensure that
only those devices approved for release are distributed and
that purchase orders are reviewed to ensure that ambiguities
and errors are resolved before devices are released for
distribution. Where a device's fitness for use or quality

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 41

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
deteriorates over time, the procedures shall ensure that expired
devices or devices deteriorated beyond acceptable fitness for
use are not distributed.

(b) Each manufacturer shall maintain distribution records

which include or refer to the location of:

(1) The name and address of the initial consignee;

(2) The identification and quantity of devices shipped;

(3) The date shipped; and

(4) Any control number(s) used.

Sec. 820.170 Installation.

(a) Each manufacturer of a device requiring installation shall

establish and maintain adequate installation and inspection
instructions, and where appropriate test procedures.
Instructions and procedures shall include directions for
ensuring proper installation so that the device will perform as
intended after installation. The manufacturer shall distribute
the instructions and procedures with the device or otherwise
make them available to the person(s) installing the device.

(b) The person installing the device shall ensure that the
installation, inspection, and any required testing are performed
in accordance with the manufacturer's instructions and
procedures and shall document the inspection and any test
results to demonstrate proper installation.

Subpart G--Production and Process Controls

Sec. 820.70 Production and Process Controls.

(h) Manufacturing Material. Where a manufacturing material

could reasonably be expected to have an adverse effect on
product quality, the manufacturer shall establish and maintain
procedures for the use and removal of such manufacturing
material to ensure that it is removed or limited to an amount
that does not adversely affect the device's quality. The removal
or reduction of such manufacturing material shall be
documented.

7.6 Control of Monitoring and Measuring Equipment Subpart G--Production and Process Controls

The organization shall determine the monitoring and Sec. 820.72 Inspection, Measuring, and Test Equipment.
measurement to be undertaken and the monitoring and
measuring equipment needed to provide evidence of (a) Control of Inspection, Measuring, and Test Equipment.
conformity of product to determined requirements. Each manufacturer shall ensure that all inspection, measuring,
and test equipment, including mechanical, automated, or
The organization shall document procedures to ensure that electronic inspection and test equipment, is suitable for its
monitoring and measurement can be carried out and are intended purposes and is capable of producing valid results.
carried out in a manner that is consistent with the monitoring Each manufacturer shall establish and maintain procedures to
and measurement requirements. ensure that equipment is routinely calibrated, inspected,

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 42

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
checked, and maintained. The procedures shall include
As necessary to ensure valid results, measuring equipment provisions for handling, preservation, and storage of
shall: equipment, so that its accuracy and fitness for use are
maintained. These activities shall be documented.
a) be calibrated or verified, or both, at specified
intervals, or prior to use, against measurement (b) Calibration. Calibration procedures shall include specific
standards traceable to international or national directions and limits for accuracy and precision. When
measurement standards: when no such standards accuracy and precision limits are not met, there shall be
exist, the basis used for calibration or verification provisions for remedial action to reestablish the limits and to
shall be recorded (see 4.2.5); evaluate whether there was any adverse effect on the device's
quality. These activities shall be documented.
b) be adjusted or re-adjusted as necessary: such
adjustments or re-adjustments shall be recorded (see (1) Calibration Standards. Calibration standards used for
4.2.5); inspection, measuring, and test equipment shall be traceable to
national or international standards. If national or international
c) have identification in order to determine its standards are not practical or available, the manufacturer shall
calibration status; use an independent reproducible standard. If no applicable
standard exists, the manufacturer shall establish and maintain
d) be safeguarded from adjustments that would an in-house standard.
invalidate the measurement result;
(2) Calibration Records. The equipment identification,
e) be protected from damage and deterioration during calibration dates, the individual performing each calibration,
handling, maintenance and storage. and the next calibration date shall be documented. These
records shall be displayed on or near each piece of equipment
The organization shall perform calibration or verification in or shall be readily available to the personnel using such
accordance with documented procedures. In addition, the equipment and to the individuals responsible for calibrating the
organization shall assess and record the validity of the equipment.
previous measuring results when the equipment is found not
to conform to requirements. The organization shall take
appropriate action in regard to the equipment and any product
affected.

Records of the results of calibration and verification shall be

maintained (see 4.2.5).

The organization shall document procedures for the validation

of the application of computer software used for the
monitoring and measurement of requirements. Such software
applications shall be validated prior to initial use and, as
appropriate, after changes to such software or its application.

The specific approach and activities associated with software

validation and revalidation shall be proportionate to the risk
associated with the use of the software, including the effect
on the ability of the product to conform to specifications.
Records of the results and conclusion of validation and
necessary actions from the validation shall be maintained
(see 4.2.4 and 4.2.5).

NOTE. Further information can be found in ISO 10012.

8 Measurement, Analysis, and Improvement Subpart O--Statistical Techniques

8.1 General Sec. 820.250 Statistical Techniques.

(a) Where appropriate, each manufacturer shall establish and

maintain procedures for identifying valid statistical techniques

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 43

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
The organization shall plan and implement the monitoring, required for establishing, controlling, and verifying the
measurement, analysis, and improvement processes needed acceptability of process capability and product characteristics.
to:
(b) Sampling plans, when used, shall be written and based on a
a) demonstrate conformity of product; valid statistical rationale. Each manufacturer shall establish
and maintain procedures to ensure that sampling methods are
b) ensure conformity of the quality management adequate for their intended use and to ensure that when
system; changes occur the sampling plans are reviewed. These
activities shall be documented.
c) maintain the effectiveness of the quality
management system.

This shall include determination of appropriate methods,

including statistical techniques, and the extent of their use.
8.2 Monitoring and measurement Subpart M – Records

8.2.1 Feedback Sec. 820.198 Complaint Files.

As one of the measurements of the effectiveness of the (a) Each manufacturer shall maintain complaint files. Each
quality management system, the organization shall gather and manufacturer shall establish and maintain procedures for
monitor information relating to whether the organization has receiving, reviewing, and evaluating complaints by a formally
met customer requirements. The methods for obtaining and designated unit. Such procedures shall ensure that:
using this information shall be documented.
(1) All complaints are processed in a uniform and timely
The organization shall document procedures for the feedback manner;
process. This feedback process shall include provisions to
gather data from production as well as post-production (2) Oral complaints are documented upon receipt; and
activities.
(3) Complaints are evaluated to determine whether the
The information gathered in the feedback process shall serve complaint represents an event which is required to be reported
as potential input into risk management for monitoring and to FDA under part 803 of this chapter, Medical Device
maintaining the product requirements as well as the product Reporting.
realization or improvement processes.
(b) Each manufacturer shall review and evaluate all complaints
If applicable regulatory requirements require the organization to determine whether an investigation is necessary. When no
to gain specific experience from postproduction activities, the investigation is made, the manufacturer shall maintain a record
review of this experience shall form part of the feedback that includes the reason no investigation was made and the
process. name of the individual responsible for the decision not to
investigate.

(c) Any complaint involving the possible failure of a device,

labeling, or packaging to meet any of its specifications shall be
reviewed, evaluated, and investigated, unless such
investigation has already been performed for a similar
complaint and another investigation is not necessary.

(d) Any complaint that represents an event which must be

reported to FDA under part 803 of this chapter shall be
promptly reviewed, evaluated, and investigated by a designated
individual(s) and shall be maintained in a separate portion of
the complaint files or otherwise clearly identified. In addition to
the information required by 820.198(e), records of investigation
under this paragraph shall include a determination of:

(1) Whether the device failed to meet specifications;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 44

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(2) Whether the device was being used for treatment or
diagnosis; and

(3) The relationship, if any, of the device to the reported

incident or adverse event.

(e) When an investigation is made under this section, a record

of the investigation shall be maintained by the formally
designated unit identified in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was received;

(3) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(4) The name, address, and phone number of the complainant;

(5) The nature and details of the complaint;

(6) The dates and results of the investigation;

(7) Any corrective action taken; and

(8) Any reply to the complainant.

(f) When the manufacturer's formally designated complaint

unit is located at a site separate from the manufacturing
establishment, the investigated complaint(s) and the record(s)
of investigation shall be reasonably accessible to the
manufacturing establishment.

(g) If a manufacturer's formally designated complaint unit is

located outside of the United States, records required by this
section shall be reasonably accessible in the United States at
either:

(1) A location in the United States where the manufacturer's

records are regularly kept; or

(2) The location of the initial distributor.

8.2.2 Complaint Handling Subpart M – Records

The organization shall document procedures for timely Sec. 820.198 Complaint Files.
complaint handling in accordance with applicable regulatory
requirements. (a) Each manufacturer shall maintain complaint files. Each
manufacturer shall establish and maintain procedures for
These procedures shall include at a minimum requirements receiving, reviewing, and evaluating complaints by a formally
and responsibilities for: designated unit. Such procedures shall ensure that:

a) receiving and recording information; (1) All complaints are processed in a uniform and timely
manner;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 45

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
b) evaluating information to determine if the feedback
constitutes a complaint; (2) Oral complaints are documented upon receipt; and

c) investigating complaints; (3) Complaints are evaluated to determine whether the

complaint represents an event which is required to be reported
d) determining the need to report the information to the to FDA under part 803 of this chapter, Medical Device
appropriate regulatory authorities; Reporting.

e) handling of complaint-related product; (b) Each manufacturer shall review and evaluate all complaints
to determine whether an investigation is necessary. When no
f) determining the need to initiate corrections or investigation is made, the manufacturer shall maintain a record
corrective actions. that includes the reason no investigation was made and the
name of the individual responsible for the decision not to
If any complaint is not investigated, justification shall be investigate.
documented. Any correction or corrective action resulting
from the complaint handling process shall be documented. (c) Any complaint involving the possible failure of a device,
labeling, or packaging to meet any of its specifications shall be
If an investigation determines activities outside the reviewed, evaluated, and investigated, unless such
organization contributed to the complaint, relevant investigation has already been performed for a similar
information shall be exchanged between the organization and complaint and another investigation is not necessary.
the external party involved. Complaint handling records shall
be maintained (see 4.2.5). (d) Any complaint that represents an event which must be
reported to FDA under part 803 of this chapter shall be
promptly reviewed, evaluated, and investigated by a designated
individual(s) and shall be maintained in a separate portion of
the complaint files or otherwise clearly identified. In addition to
the information required by 820.198(e), records of investigation
under this paragraph shall include a determination of:

(1) Whether the device failed to meet specifications;

(2) Whether the device was being used for treatment or

diagnosis; and

(3) The relationship, if any, of the device to the reported

incident or adverse event.

(e) When an investigation is made under this section, a record

of the investigation shall be maintained by the formally
designated unit identified in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was received;

(3) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(4) The name, address, and phone number of the complainant;

(5) The nature and details of the complaint;

(6) The dates and results of the investigation;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 46

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)

(7) Any corrective action taken; and

(8) Any reply to the complainant.

(f) When the manufacturer's formally designated complaint

unit is located at a site separate from the manufacturing
establishment, the investigated complaint(s) and the record(s)
of investigation shall be reasonably accessible to the
manufacturing establishment.

(g) If a manufacturer's formally designated complaint unit is

located outside of the United States, records required by this
section shall be reasonably accessible in the United States at
either:

(1) A location in the United States where the manufacturer's

records are regularly kept; or

(2) The location of the initial distributor.

8.2.3 Reporting to Regulatory Authorities Subpart M – Records

If applicable regulatory requirements require notification of Sec. 820.198 Complaint Files.

complaints that meet specified reporting criteria of adverse
events or issuance of advisory notices, the organization shall (a) Each manufacturer shall maintain complaint files. Each
document procedures for providing notification to the manufacturer shall establish and maintain procedures for
appropriate regulatory authorities. receiving, reviewing, and evaluating complaints by a formally
designated unit. Such procedures shall ensure that:
Records of reporting to regulatory authorities shall be
maintained (see 4.2.5). (1) All complaints are processed in a uniform and timely
manner;

(2) Oral complaints are documented upon receipt; and

(3) Complaints are evaluated to determine whether the

complaint represents an event which is required to be reported
to FDA under part 803 of this chapter, Medical Device
Reporting.

(b) Each manufacturer shall review and evaluate all complaints

to determine whether an investigation is necessary. When no
investigation is made, the manufacturer shall maintain a record
that includes the reason no investigation was made and the
name of the individual responsible for the decision not to
investigate.

(c) Any complaint involving the possible failure of a device,

labeling, or packaging to meet any of its specifications shall be
reviewed, evaluated, and investigated, unless such
investigation has already been performed for a similar
complaint and another investigation is not necessary.

(d) Any complaint that represents an event which must be

reported to FDA under part 803 of this chapter shall be
promptly reviewed, evaluated, and investigated by a designated
individual(s) and shall be maintained in a separate portion of

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 47

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
the complaint files or otherwise clearly identified. In addition to
the information required by 820.198(e), records of investigation
under this paragraph shall include a determination of:

(1) Whether the device failed to meet specifications;

(2) Whether the device was being used for treatment or

diagnosis; and

(3) The relationship, if any, of the device to the reported

incident or adverse event.

(e) When an investigation is made under this section, a record

of the investigation shall be maintained by the formally
designated unit identified in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was received;

(3) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(4) The name, address, and phone number of the complainant;

(5) The nature and details of the complaint;

(6) The dates and results of the investigation;

(7) Any corrective action taken; and

(8) Any reply to the complainant.

(f) When the manufacturer's formally designated complaint

unit is located at a site separate from the manufacturing
establishment, the investigated complaint(s) and the record(s)
of investigation shall be reasonably accessible to the
manufacturing establishment.

(g) If a manufacturer's formally designated complaint unit is

located outside of the United States, records required by this
section shall be reasonably accessible in the United States at
either:

(1) A location in the United States where the manufacturer's

records are regularly kept; or

(2) The location of the initial distributor.

8.2.4 Internal Audit Subpart B--Quality System Requirements

The organization shall conduct internal audits at planned Sec. 820.22 Quality Audit.
intervals to determine whether the quality management
system: Each manufacturer shall establish procedures for quality audits
and conduct such audits to assure that the quality system is in

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 48

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
a) conforms to planned and documented arrangements, compliance with the established quality system requirements
requirements of this International Standard, quality and to determine the effectiveness of the quality system.
management system requirements established by Quality audits shall be conducted by individuals who do not
the organization, and applicable regulatory have direct responsibility for the matters being audited.
requirements; Corrective action(s), including a reaudit of deficient matters,
shall be taken when necessary. A report of the results of each
b) is effectively implemented and maintained. quality audit, and reaudit(s) where taken, shall be made and
such reports shall be reviewed by management having
The organization shall document a procedure to describe the responsibility for the matters audited. The dates and results of
responsibilities and requirements for planning and conducting quality audits and reaudits shall be documented.
audits and recording and reporting audit results.

An audit program shall be planned, taking into consideration

the status and importance of the processes and area to be
audited, as well as the results of previous audits. The audit
criteria, scope, interval and methods shall be defined and
recorded (see 4.2.5). The selection of auditors and conduct of
audits shall ensure objectivity and impartiality of the audit
process. Auditors shall not audit their own work.

Records of the audits and their results, including identification

of the processes and areas audited and the conclusions, shall
be maintained (see 4.2.5).

The management responsible for the area being audited shall

ensure that any necessary corrections and corrective actions
are taken without undue delay to eliminate detected
nonconformities and their causes. Follow-up activities shall
include the verification of the actions taken and the reporting
of verification results.

NOTE. Further information can be found in ISO 19011.

8.2.5 Monitoring and Measurement of Processes Subpart G--Production and Process Controls

The organization shall apply suitable methods for monitoring Sec. 820.70 Production and Process Controls.
and, as appropriate, measurement of the quality management
system processes. These methods shall demonstrate the (a) General. Each manufacturer shall develop, conduct, control,
ability of the processes to achieve planned results. When and monitor production processes to ensure that a device
planned results are not achieved, correction and corrective conforms to its specifications. Where deviations from device
action shall be taken, as appropriate. specifications could occur as a result of the manufacturing
process, the manufacturer shall establish and maintain
process control procedures that describe any process controls
necessary to ensure conformance to specifications. Where
process controls are needed they shall include:

(1) Documented instructions, standard operating procedures

(SOP's), and methods that define and control the manner of
production;

(2) Monitoring and control of process parameters and

component and device characteristics during production;

(3) Compliance with specified reference standards or codes;

(4) The approval of processes and process equipment; and

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 49

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(5) Criteria for workmanship which shall be expressed in
documented standards or by means of identified and approved
representative samples.

Subpart O--Statistical Techniques

Sec. 820.250 Statistical Techniques.

(a) Where appropriate, each manufacturer shall establish and

maintain procedures for identifying valid statistical techniques
required for establishing, controlling, and verifying the
acceptability of process capability and product characteristics.

(b) Sampling plans, when used, shall be written and based on a

valid statistical rationale. Each manufacturer shall establish
and maintain procedures to ensure that sampling methods are
adequate for their intended use and to ensure that when
changes occur the sampling plans are reviewed. These
activities shall be documented.
8.2.6 Monitoring and Measurement of Product Subpart H--Acceptance Activities

The organization shall monitor and measure the Sec. 820.80 Receiving, In-Process, and Finished Device
characteristics of the product to verify that product Acceptance.
requirements have been met. This shall be carried out at
applicable stages of the product realization process in (a) General. Each manufacturer shall establish and maintain
accordance with the planned and documented arrangements procedures for acceptance activities. Acceptance activities
and documented procedures. include inspections, tests, or other verification activities.

Evidence of conformity to the acceptance criteria shall be (b) Receiving Acceptance Activities. Each manufacturer shall
maintained. The identity of the person authorizing release of establish and maintain procedures for acceptance of incoming
product shall be recorded (see 4.2.5). As appropriate, records product. Incoming product shall be inspected, tested, or
shall identify the test equipment used to perform otherwise verified as conforming to specified requirements.
measurement activities. Acceptance or rejection shall be documented.

Product release and service delivery shall not proceed until the (c) In-Process Acceptance Activities. Each manufacturer shall
planned and documented arrangements have been establish and maintain acceptance procedures, where
satisfactorily completed. appropriate, to ensure that specified requirements for in-
process product are met. Such procedures shall ensure that in-
For implantable medical devices, the organization shall record process product is controlled until the required inspection and
the identity of personnel performing any inspection or testing. tests or other verification activities have been completed, or
necessary approvals are received, and are documented.

(d) Final Acceptance Activities. Each manufacturer shall

establish and maintain procedures for finished device
acceptance to ensure that each production run, lot, or batch of
finished devices meets acceptance criteria. Finished devices
shall be held in quarantine or otherwise adequately controlled
until released. Finished devices shall not be released for
distribution until:

(1) The activities required in the DMR are completed;

(2) the associated data and documentation is reviewed;

(3) the release is authorized by the signature of a designated

individual(s); and

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 50

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)

(4) the authorization is dated.

(e) Acceptance Records. Each manufacturer shall document

acceptance activities required by this part. These records shall
include:

(1) The acceptance activities performed;

(2) the dates acceptance activities are performed;

(3) the results;

(4) the signature of the individual(s) conducting the

acceptance activities; and

(5) where appropriate the equipment used. These records shall

be part of the DHR.
8.3 Control of Nonconforming Product Subpart I--Nonconforming Product

8.3.1 General Sec. 820.90 Nonconforming Product.

The organization shall ensure that product which does not (a) Control of Nonconforming Product. Each manufacturer
conform to product requirements is shall establish and maintain procedures to control product that
identified and controlled to prevent its unintended use or does not conform to specified requirements. The procedures
delivery. The organization shall document a procedure to shall address the identification, documentation, evaluation,
define the controls and related responsibilities and authorities segregation, and disposition of nonconforming product. The
for the identification, documentation, segregation, evaluation, evaluation of nonconformance shall include a determination of
and disposition of nonconforming product. the need for an investigation and notification of the persons or
organizations responsible for the nonconformance. The
The evaluation of nonconformity shall include a determination evaluation and any investigation shall be documented.
of the need for an investigation and notification of any
external party responsible for the nonconformity. (b) Nonconformity Review and Disposition.

Records of the nature of the nonconformities and any (1) Each manufacturer shall establish and maintain procedures
subsequent action taken, including the evaluation, any that define the responsibility for review and the authority for
investigation, and the rationale for decisions shall be the disposition of nonconforming product. The procedures
maintained (see 4.2.5). shall set forth the review and disposition process. Disposition
of nonconforming product shall be documented.
Documentation shall include the justification for use of
nonconforming product and the signature of the individual(s)
authorizing the use.

(2) Each manufacturer shall establish and maintain procedures

for rework, to include retesting and reevaluation of the
nonconforming product after rework, to ensure that the product
meets its current approved specifications. Rework and
reevaluation activities, including a determination of any
adverse effect from the rework upon the product, shall be
documented in the DHR.
8.3.2 Actions in Response to Nonconforming Product Subpart I--Nonconforming Product
detected before Delivery
Sec. 820.90 Nonconforming Product.
The organization shall deal with nonconforming product by
one or more of the following ways:

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 51

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(a) Control of Nonconforming Product. Each manufacturer
a) taking action to eliminate the detected shall establish and maintain procedures to control product that
nonconformity; does not conform to specified requirements. The procedures
shall address the identification, documentation, evaluation,
b) taking action to preclude its original intended use or segregation, and disposition of nonconforming product. The
application; evaluation of nonconformance shall include a determination of
the need for an investigation and notification of the persons or
c) authorizing its use, release or acceptance under organizations responsible for the nonconformance. The
concession. evaluation and any investigation shall be documented.

The organization shall ensure that nonconforming product is (b) Nonconformity Review and Disposition.
accepted by concession only if the justification is provided,
approval is obtained and applicable regulatory requirements (1) Each manufacturer shall establish and maintain procedures
are met. Records of the acceptance by concession and the that define the responsibility for review and the authority for
identity of the person authorizing the concession shall be the disposition of nonconforming product. The procedures
maintained (see 4.2.5). shall set forth the review and disposition process. Disposition
of nonconforming product shall be documented.
Documentation shall include the justification for use of
nonconforming product and the signature of the individual(s)
authorizing the use.

(2) Each manufacturer shall establish and maintain procedures

for rework, to include retesting and reevaluation of the
nonconforming product after rework, to ensure that the product
meets its current approved specifications. Rework and
reevaluation activities, including a determination of any
adverse effect from the rework upon the product, shall be
documented in the DHR.
8.3.3 Actions in Response to Nonconforming Product Subpart I--Nonconforming Product
detected after Delivery
Sec. 820.90 Nonconforming Product.
When nonconforming product is detected after delivery or use
has started, the organization shall take action appropriate to (a) Control of Nonconforming Product. Each manufacturer
the effects, or potential effects, of the nonconformity. Records shall establish and maintain procedures to control product that
of actions taken shall be maintained (see 4.2.5). does not conform to specified requirements. The procedures
shall address the identification, documentation, evaluation,
The organization shall document procedures for issuing segregation, and disposition of nonconforming product. The
advisory notices in accordance with applicable regulatory evaluation of nonconformance shall include a determination of
requirements. These procedures shall be capable of being put the need for an investigation and notification of the persons or
into effect at any time. Records of actions relating to the organizations responsible for the nonconformance. The
issuance of advisory notices shall be maintained (see 4.2.5). evaluation and any investigation shall be documented.

(b) Nonconformity Review and Disposition.

(1) Each manufacturer shall establish and maintain procedures

that define the responsibility for review and the authority for
the disposition of nonconforming product. The procedures
shall set forth the review and disposition process. Disposition
of nonconforming product shall be documented.
Documentation shall include the justification for use of
nonconforming product and the signature of the individual(s)
authorizing the use.

(2) Each manufacturer shall establish and maintain procedures

for rework, to include retesting and reevaluation of the
nonconforming product after rework, to ensure that the product

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 52

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
meets its current approved specifications. Rework and
reevaluation activities, including a determination of any
adverse effect from the rework upon the product, shall be
documented in the DHR.
8.3.4 Rework Subpart I--Nonconforming Product

The organization shall perform rework in accordance with Sec. 820.90 Nonconforming Product.
documented procedures that takes into account the potential
adverse effect of the rework on the product. These procedures (2) Each manufacturer shall establish and maintain procedures
shall undergo the same review and approval as the original for rework, to include retesting and reevaluation of the
procedure. nonconforming product after rework, to ensure that the product
meets its current approved specifications. Rework and
After the completion of rework, product shall be verified to reevaluation activities, including a determination of any
ensure that it meets applicable acceptance criteria and adverse effect from the rework upon the product, shall be
regulatory requirements. documented in the DHR.

Records of rework shall be maintained (see 4.2.5).

8.4 Analysis of Data Subpart O--Statistical Techniques

The organization shall document procedures to determine, Sec. 820.250 Statistical Techniques
collect, and analyze appropriate data to demonstrate the
suitability, adequacy and effectiveness of the quality (a) Where appropriate, each manufacturer shall establish and
management system. The procedures shall include maintain procedures for identifying valid statistical techniques
determination of appropriate methods, including statistical required for establishing, controlling, and verifying the
techniques and the extent of their use. acceptability of process capability and product characteristics.

The analysis of data shall include data generated as a result (b) Sampling plans, when used, shall be written and based on a
of monitoring and measurement and from other relevant valid statistical rationale. Each manufacturer shall establish
sources and include, at a minimum, input from: and maintain procedures to ensure that sampling methods are
adequate for their intended use and to ensure that when
a) feedback; changes occur the sampling plans are reviewed. These
activities shall be documented.
b) conformity to product requirements;

c) characteristics and trends of processes and product,

including opportunities for improvement;

d) suppliers;

e) audits;

f) service reports, as appropriate.

If the analysis of data shows that the quality management

system is not suitable, adequate or effective, the organization
shall use this analysis as input for improvement as required in
8.5.

Records of the results of analyses shall be maintained (see

4.2.5).

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 53

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
8.5 Improvement Subpart B – Quality System Requirements

8.5.1 General Sec. 820.20 Management Responsibility.

The organization shall identify and implement any changes (c) Management Review. Management with executive
necessary to ensure and maintain the continued suitability, responsibility shall review the suitability and effectiveness of
adequacy, and effectiveness of the quality management the quality system at defined intervals and with sufficient
system as well as medical device safety and performance frequency according to established procedures to ensure that
through the use of the quality policy, quality objectives, audit the quality system satisfies the requirements of this part and
results, post-market surveillance, analysis of data, corrective the manufacturer's established quality policy and objectives.
actions, preventive actions, and management review. The dates and results of quality system reviews shall be
documented.

Subpart B – Quality System Requirements

Sec. 820.22 Quality Audit.

Each manufacturer shall establish procedures for quality audits

and conduct such audits to assure that the quality system is in
compliance with the established quality system requirements
and to determine the effectiveness of the quality system.
Quality audits shall be conducted by individuals who do not
have direct responsibility for the matters being audited.
Corrective action(s), including a reaudit of deficient matters,
shall be taken when necessary. A report of the results of each
quality audit, and reaudit(s) where taken, shall be made and
such reports shall be reviewed by management having
responsibility for the matters audited. The dates and results of
quality audits and reaudits shall be documented.

Subpart M – Records

Sec. 820.198 Complaint Files.

(a) Each manufacturer shall maintain complaint files. Each

manufacturer shall establish and maintain procedures for
receiving, reviewing, and evaluating complaints by a formally
designated unit. Such procedures shall ensure that:

(1) All complaints are processed in a uniform and timely

manner;

(2) Oral complaints are documented upon receipt; and

(3) Complaints are evaluated to determine whether the

complaint represents an event which is required to be reported
to FDA under part 803 of this chapter, Medical Device
Reporting.

(b) Each manufacturer shall review and evaluate all complaints

to determine whether an investigation is necessary. When no
investigation is made, the manufacturer shall maintain a record
that includes the reason no investigation was made and the
name of the individual responsible for the decision not to
investigate.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 54

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(c) Any complaint involving the possible failure of a device,
labeling, or packaging to meet any of its specifications shall be
reviewed, evaluated, and investigated, unless such
investigation has already been performed for a similar
complaint and another investigation is not necessary.

(d) Any complaint that represents an event which must be

reported to FDA under part 803 of this chapter shall be
promptly reviewed, evaluated, and investigated by a designated
individual(s) and shall be maintained in a separate portion of
the complaint files or otherwise clearly identified. In addition to
the information required by 820.198(e), records of investigation
under this paragraph shall include a determination of:

(1) Whether the device failed to meet specifications;

(2) Whether the device was being used for treatment or

diagnosis; and

(3) The relationship, if any, of the device to the reported

incident or adverse event.

(e) When an investigation is made under this section, a record

of the investigation shall be maintained by the formally
designated unit identified in paragraph (a) of this section. The
record of investigation shall include:

(1) The name of the device;

(2) The date the complaint was received;

(3) Any unique device identifier (UDI) or universal product code

(UPC), and any other device identification(s) and control
number(s) used;

(4) The name, address, and phone number of the complainant;

(5) The nature and details of the complaint;

(6) The dates and results of the investigation;

(7) Any corrective action taken; and

(8) Any reply to the complainant.

(f) When the manufacturer's formally designated complaint

unit is located at a site separate from the manufacturing
establishment, the investigated complaint(s) and the record(s)
of investigation shall be reasonably accessible to the
manufacturing establishment.

(g) If a manufacturer's formally designated complaint unit is

located outside of the United States, records required by this
section shall be reasonably accessible in the United States at
either:

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 55

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
(1) A location in the United States where the manufacturer's
records are regularly kept; or

(2) The location of the initial distributor.

Subpart J--Corrective and Preventive Action

Sec. 820.100 Corrective and Preventive Action.

(a) Each manufacturer shall establish and maintain procedures

for implementing corrective and preventive action. The
procedures shall include requirements for:

(1) Analyzing processes, work operations, concessions, quality

audit reports, quality records, service records, complaints,
returned product, and other sources of quality data to identify
existing and potential causes of nonconforming product, or
other quality problems. Appropriate statistical methodology
shall be employed where necessary to detect recurring quality
problems;

(2) Investigating the cause of nonconformities relating to

product, processes, and the quality system;

(3) Identifying the action(s) needed to correct and prevent

recurrence of nonconforming product and other quality
problems;

(4) Verifying or validating the corrective and preventive action

to ensure that such action is effective and does not adversely
affect the finished device;

(5) Implementing and recording changes in methods and

procedures needed to correct and prevent identified quality
problems;

(6) Ensuring that information related to quality problems or

nonconforming product is disseminated to those directly
responsible for assuring the quality of such product or the
prevention of such problems; and

(7) Submitting relevant information on identified quality

problems, as well as corrective and preventive actions, for
management review.

(b) All activities required under this section, and their results,
shall be documented.
8.5.2 Corrective Action Subpart J--Corrective and Preventive Action

The organization shall take action to eliminate the cause of Sec. 820.100 Corrective and Preventive Action.
nonconformities in order to prevent
recurrence. Any necessary corrective actions shall be taken (a) Each manufacturer shall establish and maintain procedures
without undue delay. Corrective actions shall be proportionate for implementing corrective and preventive action. The
to the effects of the nonconformities encountered. procedures shall include requirements for:

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 56

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
The organization shall document a procedure to define (1) Analyzing processes, work operations, concessions, quality
requirements for: audit reports, quality records, service records, complaints,
returned product, and other sources of quality data to identify
a) reviewing nonconformities (including complaints); existing and potential causes of nonconforming product, or
other quality problems. Appropriate statistical methodology
b) determining the causes of nonconformities; shall be employed where necessary to detect recurring quality
problems;
c) evaluating the need for action to ensure that
nonconformities do not recur; (2) Investigating the cause of nonconformities relating to
product, processes, and the quality system;
d) planning and documenting action needed and
implementing such action, including, as appropriate, (3) Identifying the action(s) needed to correct and prevent
updating documentation; recurrence of nonconforming product and other quality
problems;
e) verifying that the corrective action does not adversely
affect the ability to meet applicable regulatory (4) Verifying or validating the corrective and preventive action
requirements or the safety and performance of the to ensure that such action is effective and does not adversely
medical device; affect the finished device;

f) reviewing the effectiveness of corrective action (5) Implementing and recording changes in methods and
taken. procedures needed to correct and prevent identified quality
problems;
Records of the results of any investigation and of action taken
shall be maintained (see 4.2.5). (6) Ensuring that information related to quality problems or
nonconforming product is disseminated to those directly
responsible for assuring the quality of such product or the
prevention of such problems; and

(7) Submitting relevant information on identified quality

problems, as well as corrective and preventive actions, for
management review.

(b) All activities required under this section, and their results,
shall be documented.
8.5.3 Preventive Action Subpart J--Corrective and Preventive Action

The organization shall determine action to eliminate the Sec. 820.100 Corrective and Preventive Action.
causes of potential nonconformities in order
to prevent their occurrence. Preventive actions shall be (a) Each manufacturer shall establish and maintain procedures
proportionate to the effects of the potential problems. for implementing corrective and preventive action. The
The organization shall document a procedure to describe procedures shall include requirements for:
requirements for:
(1) Analyzing processes, work operations, concessions, quality
a) determining potential nonconformities and their audit reports, quality records, service records, complaints,
causes; returned product, and other sources of quality data to identify
b) evaluating the need for action to prevent occurrence existing and potential causes of nonconforming product, or
of nonconformities; other quality problems. Appropriate statistical methodology
shall be employed where necessary to detect recurring quality
c) planning and documenting action needed and problems;
implementing such action, including, as appropriate,
updating documentation; (2) Investigating the cause of nonconformities relating to
product, processes, and the quality system;
d) verifying that the action does not adversely affect the
ability to meet applicable regulatory requirements or (3) Identifying the action(s) needed to correct and prevent
the safety and performance of the medical device; recurrence of nonconforming product and other quality
problems;

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158
Correspondence Between ISO 13485:2016 and 21 CFR 820 57

US FDA Quality System Regulation

ISO 13485:2016
(QSR - 21 CFR 820)
e) reviewing the effectiveness of the preventive action
taken, as appropriate. (4) Verifying or validating the corrective and preventive action
to ensure that such action is effective and does not adversely
Records of the results of any investigations and of action affect the finished device;
taken shall be maintained (see 4.2.5).
(5) Implementing and recording changes in methods and
procedures needed to correct and prevent identified quality
problems;

(6) Ensuring that information related to quality problems or

nonconforming product is disseminated to those directly
responsible for assuring the quality of such product or the
prevention of such problems; and

(7) Submitting relevant information on identified quality

problems, as well as corrective and preventive actions, for
management review.

(b) All activities required under this section, and their results,
shall be documented.

Regulatory Compliance Associates® Inc., 10411 Corporate Drive, Suite 102, Pleasant Prairie, WI 53158