21 CFR Part 820 QMSR — FDA-Specific Delta Rubric (US Medical Devices)

What this is: On February 2, 2024, FDA published the Quality Management System Regulation (QMSR) final rule (89 FR 7496, Feb. 2, 2024, docket FDA-2021-N-1288), which took effect February 2, 2026 and replaced the old, standalone Quality System Regulation (QSR) text in 21 CFR Part 820. The QMSR works by incorporating ISO 13485:2016 by reference (new §820.10(a), via new §820.7) as the substantive core of US device manufacturing quality requirements, rather than restating quality-system requirements independently the way the old QSR did. Regscribe's iso13485-rubric.md already covers that substantive core in full.

This document is the residual, FDA-only layer that sits on top of ISO 13485 — not a second copy of it. A small number of specific §820 sections were deliberately retained or newly added because FDA judged ISO 13485 alone inadequate or silent on points the US statutory/regulatory scheme requires. A document reviewed only against Regscribe's ISO 13485 rubric would miss every requirement in this file. A document reviewed only against this file, without also being checked against ISO 13485, would miss nearly everything else in Part 820 — the two rubrics are meant to be applied together for a US device manufacturer, never as alternatives.

Why this rubric exists now: Regscribe previously excluded 21 CFR Part 820 entirely from its knowledge base, on the reasoning that QMSR "subsumed" it into ISO 13485. Re-verification this session found that framing overstated the case — the exclusion note itself (and the ISO 13485 rubric's own "FDA QSR → QMSR harmonization" section) already named four FDA-specific retained areas, but never turned them into a scoreable rubric, and the sourcing behind that note was search-snippet-only (NSF/AAMI/BSI pages that 403'd on direct fetch), not primary-source-verified. This document exists to close that gap: primary-source verification of the actual current §820.10/§820.35/§820.45 text, plus enough grounding on the four cross-referenced parts (803/806/821/830) to cite them correctly.

Sourcing note — read before using this in production scoring

What was fetched directly from a primary source this session:

• eCFR's own Versioner API (ecfr.gov/api/versioner/v1/full/{date}/title-21.xml?part=820) — this is eCFR's structured-data endpoint for the actual current regulatory text of 21 CFR Part 820, fetched for the version dated 2026-07-01 (i.e., the live text as of this session, five months after the Feb 2, 2026 QMSR effective date — not a stale pre-effective-date snapshot). This is a genuine primary-source fetch, distinct from and stronger than the ISO 13485 rubric's FDA QMSR section, which relied entirely on search-result snippets after direct fetches 403'd/404'd. Section text below (§820.10, §820.35, §820.45, and the confirmed presence of new §820.3, §820.7) is drawn from this fetch.
• A note on quote fidelity: the tool used to fetch and read this content applies a hard per-quote length cap (independent of copyright status — CFR text is public domain), so what appears below is a faithful structural paraphrase, paragraph-by-paragraph and sub-item-by-sub-item, not a verbatim reproduction of the full regulatory text. Every lettered/numbered subparagraph identified in the fetch is represented below; nothing was skipped or invented. Where a short verbatim phrase was returned by the fetch, it's quoted in quotation marks; everything else is paraphrase clearly presented as paraphrase. Before this goes into a customer-facing citation that needs word-for-word regulatory language, re-verify the exact wording directly against eCFR or the printed CFR — this document is reliable on structure, requirement substance, and citation accuracy, but should not be treated as a substitute for the primary text when exact phrasing matters (e.g., a legal dispute).
• Federal Register final rule (89 FR 7496, Feb. 2, 2024) — direct fetch of federalregister.gov's own page redirected through a bot-protection gateway (unblock.federalregister.gov) that the fetch tool could not get past; govinfo.gov's hosted copy of the same Federal Register document was successfully fetched instead (govinfo.gov/content/pkg/FR-2024-02-02/html/2024-01709.htm) and confirmed: publication date February 2, 2024; effective date February 2, 2026; FR citation Volume 89, Number 23, pages 7496–7525, docket 2024-01709. This is a primary-source confirmation of the rule's existence, dates, and citation — not a snippet.
• Current-status verification (via WebSearch, multiple independent industry-compliance sources — Greenlight Guru, Morgan Lewis, MedAcuity, Gardner Law, QT9 — cross-checked against each other, not a single source): FDA did not provide any transition/grace period from QSR to QMSR compliance, either in the rulemaking itself or via subsequent enforcement discretion. As of this session (2026-07-30, roughly six months after the Feb 2, 2026 effective date), no source found reports any delay, extension, or further amendment to the rule. The old QSR text has been fully removed from 21 CFR Part 820; FDA's updated device-establishment inspection process (Compliance Program 7382.850) has been in use since the effective date. This is WebSearch-sourced secondary confirmation, not a direct fetch of FDA's own QMSR status page — a direct fetch of fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr was attempted and returned HTTP 404 (the URL may have moved or the page restructured) — flagged as a gap below, same honesty standard as the ISO 13485 rubric's own FDA-page 404s.
• 21 CFR Parts 803 (MDR), 806 (Corrections and Removals), 821 (Device Tracking), 830 (UDI) — not independently fetched from eCFR this session (out of scope per the task: "just enough to correctly cite them as the §820.10 cross-references require," not full separate rubrics). What appears below for each is drawn from WebSearch results only, cross-checked across 2-4 independent sources per part (a mix of law-firm/consultancy summaries and, for Part 806, a direct quote-bearing summary that appears to draw on the actual regulatory text of §806.10). This is weaker sourcing than the §820.10/820.35/820.45 sections above and is flagged explicitly in each row below — treat the core-requirement summaries for these four parts as directionally reliable (right ballpark for timelines/triggers) but re-verify against eCFR directly before citing a specific paragraph letter/number from Parts 803, 806, 821, or 830 to a customer, the same discipline applied to every other search-snippet-sourced item in Regscribe's rubrics.

Nothing below is fabricated. Every requirement, citation, and paraphrase is traceable to one of the sources above; where sourcing is weak, that is stated in the row itself, not smoothed over.

0. READ THIS FIRST — this is a DELTA rubric, not a full Part 820 rubric

Do not use this document as a standalone Part 820 review. As of February 2, 2026, the substantive core of US device-manufacturer quality-system compliance is ISO 13485:2016 — new §820.10(a) requires manufacturers to "document a quality management system that complies with the applicable requirements of ISO 13485." Regscribe's iso13485-rubric.md is the document that reviews that core. This rubric covers only what's layered on top of that core: the sections FDA explicitly retained, added, or modified because it judged ISO 13485 alone insufficient for the US regulatory scheme. Applying this rubric alone to a device-QMS document and calling it "Part 820-compliant" would produce a dangerously incomplete review — the overwhelming majority of Part 820's actual substance (design controls, CAPA, production controls, purchasing controls, management responsibility, etc.) is inside ISO 13485 now, not restated here.

The four areas covered here, and why each survives ISO 13485 incorporation:

1. §820.10's cross-references to Parts 803, 806, 821, 830 — ISO 13485 is a generic international standard with no US-statute-specific reporting mechanics; it does not itself require MDR adverse-event reporting, corrections/removals reporting, device tracking, or UDI assignment. These are US-only regulatory obligations that a device manufacturer must meet regardless of ISO 13485 conformance.
2. §820.35 (Control of records) — layered on top of ISO 13485's own record-control clause (§4.2.5), with US-specific additions: mandatory minimum data elements for complaint records and servicing records, UDI recording requirements, and a confidentiality-marking provision tied to FDA's public-information regulations (21 CFR Part 20).
3. §820.45 (Device labeling and packaging controls) — FDA explicitly stated it did not find ISO 13485's own labeling/packaging provisions (Clause 7.5.1) adequate, and added supplemental pre-release inspection and mixup-prevention requirements that have no ISO 13485 equivalent.
4. Statutory/definitional precedence — ISO 13485's Clause 3 definitions (plus ISO 9000:2015's) generally govern under new §820.3, except where 21 CFR 820.3(b) or the FD&C Act §201(h) statutory definitions differ, in which case the US statutory definition controls. This matters for terms like "device" itself, which has FD&C Act-specific legal weight ISO 13485's generic definitions don't carry.

How to use this alongside iso13485-rubric.md: for any US-market device-QMS document, run both rubrics. ISO 13485 covers the substantive quality-system content; this rubric covers the four items above. A document can pass ISO 13485 cleanly and still fail this rubric (e.g., a labeling-control SOP that doesn't document the §820.45(a) pre-release inspection elements), and that failure would be invisible to an ISO 13485-only review.

Rubric legend

Each row: Requirement (plain language / structural paraphrase) → Citation → Evidence that demonstrates compliance → Common failure pattern

Part A — §820.10's cross-referenced requirements (Parts 803, 806, 821, 830)

New §820.10(b) requires manufacturers to comply with additional FDA-specific regulatory requirements beyond ISO 13485 itself, cross-referencing four other parts by number. Sourcing for §820.10 itself is primary (eCFR Versioner API fetch, per the sourcing note above); the core-requirement summaries for the four cross-referenced parts below are WebSearch-sourced and weaker — flagged per row.

A.1 — §820.10(b) itself: the cross-reference clause

A.2 — Part 803 (Medical Device Reporting) — core requirement, cited as required by §820.10(b)(3)

A.3 — Part 806 (Corrections and Removals) — core requirement, cited as required by §820.10(b)(4)

A.4 — Part 821 (Device Tracking) — core requirement, cited as required by §820.10(b)(2)

A.5 — Part 830 (Unique Device Identification) — core requirement, cited as required by §820.10(b)(1)

Part B — §820.35 (Control of records)

Sourcing: primary (eCFR Versioner API fetch, 2026-07-01 version).

B.1 — Complaint records (§820.35(a))

B.2 — Servicing records (§820.35(b))

B.3 — UDI recording (§820.35(c))

B.4 — Confidentiality marking (§820.35(d))

Part C — §820.45 (Device labeling and packaging controls)

Sourcing: primary (eCFR Versioner API fetch, 2026-07-01 version), cross-checked against a WebSearch-sourced Greenlight Guru summary that independently corroborates the same structure and explicitly states FDA's stated rationale ("FDA did not find ISO 13485's requirements for device labeling and packaging controls to be adequate").

C.1 — Documented labeling/packaging control procedures (chapeau)

C.2 — Pre-release examination for accuracy (§820.45(a))

C.3 — Documentation of labeling release (§820.45(b))

C.4 — Mixup prevention and pre-use inspection (§820.45(c))

Part D — Statutory/definitional precedence (§820.3(b) / FD&C Act §201(h))

Gaps / follow-ups before this goes into production scoring

1. Parts 803, 806, 821, and 830 were not independently fetched from eCFR this session — as scoped by the task ("just enough to correctly cite them... not full separate rubrics"), the core-requirement summaries in Part A above rely on WebSearch snippets, cross-checked across 2-4 sources each but not primary-source-verified the way §820.10/820.35/820.45 were. If Regscribe's product direction ever needs full standalone rubrics for MDR reporting, corrections/removals, device tracking, or UDI (as opposed to just correctly citing them from within this delta rubric), each would need its own direct-eCFR-fetch pass, following this document's own sourcing bar rather than its Part A bar.
2. §820.3(b)/FD&C Act §201(h) definitional divergence (Part D) is confirmed structurally but not itemized — the fetch confirmed the "ISO definitions apply except where §820.3(b)/§201(h) differ" structure exists, but did not enumerate which specific terms actually diverge. A follow-up eCFR fetch of §820.3(b) specifically, cross-referenced against ISO 13485:2016 Clause 3's own definitions (which the ISO 13485 rubric itself also doesn't reproduce verbatim, per that document's own copyright-driven sourcing constraint), would be needed to make Part D independently scoreable rather than a manual-review flag.
3. FDA's own QMSR status/FAQ page returned HTTP 404 to a direct fetch attempt this session (fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr) — current-status confirmation (no delay, no further amendment) rests on WebSearch-sourced industry-compliance summaries (Greenlight Guru, Morgan Lewis, MedAcuity, Gardner Law, QT9), cross-checked against each other but not against FDA's own primary status page directly. Worth a follow-up fetch via a different URL or federalregister.gov's own document-history page for the docket, to confirm no further Federal Register notices have been published against docket FDA-2021-N-1288 since Feb 2024.
4. No FDA Form 483/Warning Letter data specific to §820.35 or §820.45 deficiencies was sourced this session — unlike some of Regscribe's other FDA-facing rubrics (e.g., the Part 11 rubric's named Warning Letter quotes), the "common failure pattern" rows above are reasoned from the regulatory text and FDA's own stated rationale (the labeling/packaging "not adequate" language), not from real inspection deficiency data. A follow-up pass through FDA's public Form 483/Warning Letter database, filtered to post-Feb-2026 device-establishment inspections citing §820.35/§820.45 specifically, would materially strengthen this rubric's evidentiary grounding once enough post-QMSR inspection history exists to search (the rule is only ~6 months into effect as of this session).
5. The eCFR fetch used a hard per-quote length cap, so §820.10/§820.35/§820.45 above are faithful structural paraphrase, not verbatim regulatory text — re-verify exact wording directly against eCFR before using any row above in a context where word-for-word phrasing carries legal weight (see Sourcing note above).

Suggested lib/rubrics.ts registry entry (not implemented — flagging for a decision, not doing it unasked)

This rubric is not yet wired into lib/rubrics.ts. If it should become a selectable framework in the product, two changes would be needed:

1. Add a new RubricId union member (e.g. "cfr820-qmsr") and a new RUBRICS entry:

"cfr820-qmsr": {
  label: "21 CFR Part 820 QMSR — FDA-Specific Delta (US Medical Devices)",
  filename: "cfr820-qmsr-delta-rubric.md",
  category: "FDA",
  oneLiner: "The residual FDA-specific requirements (MDR/corrections/tracking/UDI cross-references, US-specific records and labeling controls) layered on top of ISO 13485 under FDA's Feb 2026 QMSR rule — use alongside, not instead of, the ISO 13485 rubric.",
},

2. Remove the existing EXCLUDED_FRAMEWORKS entry for 21 CFR Part 820, whose exact current wording (to remove precisely) is:

{
  label: "21 CFR Part 820 (Quality System Regulation)",
  reason:
    "Effectively subsumed — FDA's Feb 2026 QMSR rule incorporates ISO 13485:2016 by reference into 21 CFR 820, so device manufacturers now need ISO 13485 compliance rather than a separate QSR-only system. See the ISO 13485 rubric.",
  docFilename: "iso13485-rubric.md",
},

This entry's own reasoning is what this session's re-verification found to be an overstatement — it should be removed (not merely edited), since the corrected position is that Part 820 is not fully excluded, it now has a real, scoreable delta rubric of its own.

Both changes touch app code (lib/rubrics.ts) and would need whatever test coverage lib/__tests__/rubrics.test.ts expects for registry changes (per the same precedent noted in the ISO 13485 rubric's own integration note) — flagged, not implemented, since it wasn't asked for in this task.