FDA Quality System Regulation (QSR) Compliance

FDA Quality System Regulation (QSR) compliance governs how medical device manufacturers in the United States design, manufacture, package, label, store, and distribute their products. Codified at 21 CFR Part 820 (U.S. Code of Federal Regulations, Title 21, Part 820), QSR establishes enforceable quality system requirements that apply across the full device lifecycle. Non-compliance exposes manufacturers to Warning Letters, import alerts, consent decrees, and product recalls administered by the U.S. Food and Drug Administration (FDA). This page covers the regulation's definition, structural mechanics, classification boundaries, key tensions, and the verification steps that compliance programs must address.

Definition and scope

21 CFR Part 820, the Quality System Regulation, requires that medical device manufacturers establish and maintain a quality system that ensures finished devices conform to specified requirements. The FDA finalized the original QSR in 1996 and published a significant revision in 2024 that aligns it structurally with ISO 13485:2016, the international standard for medical device quality management systems (FDA, Quality System Regulation—21st Century Final Rule, 2024).

The regulation's scope encompasses every domestic manufacturer and every foreign manufacturer that exports devices to the United States. "Manufacturer" under 21 CFR 820.3(o) includes any entity that designs, fabricates, assembles, or processes a finished device, as well as specification developers — entities that do not physically build devices but define the product's design and performance requirements. Contract manufacturers, repackagers, and relabelers are drawn into scope under specific subsections.

The QSR does not apply to component manufacturers, distributors (unless they also manufacture or repackage), or to most blood and blood products, which fall under separate FDA regulations. Combination products — those that combine a device with a drug or biologic — may be subject to QSR and additional regulations simultaneously, requiring careful boundary analysis.

Enforcement authority rests with the FDA's Center for Devices and Radiological Health (CDRH) and, for combination products, the Office of Combination Products (OCP). Inspections are conducted under FDA's Quality System Inspection Technique (QSIT), a subsystem-based inspection methodology published in the FDA Investigations Operations Manual.

Core mechanics or structure

The QSR organizes compliance obligations into seven primary subsystems identified by QSIT: Management Controls, Design Controls, Corrective and Preventive Action (CAPA), Production and Process Controls, Records/Documents/Change Controls, Material Controls, and Facility and Equipment Controls. Each subsystem has its own set of written procedure requirements, records requirements, and defined responsibilities.

Management Controls require a quality policy, organizational structure with documented authority and responsibility, a designated Management Representative, and formal management review. FDA inspectors frequently begin inspections with this subsystem because deficiencies here signal systemic risk across the entire quality system.

Design Controls apply to Class II and Class III devices and require documented design and development planning, design inputs, design outputs, design review, design verification, design validation, design transfer, and design changes (21 CFR 820.30). A device that reaches manufacturing without compliant design controls has no auditable basis for demonstrating that the manufactured product meets user needs.

CAPA under 21 CFR 820.100 is the single most frequently cited subsystem in FDA Warning Letters. Manufacturers must identify the root cause of nonconformances, implement corrections, verify that corrective actions are effective, and document the entire process. The CAPA compliance requirements framework is treated by FDA as a leading indicator of quality system health.

Production and Process Controls cover process validation, in-process and finished device testing, environmental controls, and equipment calibration. Processes whose output cannot be fully verified by subsequent inspection — such as sterilization or heat sealing — must be validated before production begins (21 CFR 820.75).

Document and Change Controls require that documents be reviewed, approved, distributed, and controlled so that only current versions are in use. Change control compliance procedures must ensure that device changes are reviewed for regulatory impact before implementation.

Causal relationships or drivers

QSR non-compliance does not occur randomly. Three structural drivers account for the majority of FDA enforcement actions.

Inadequate CAPA closure is the dominant driver. When manufacturers close CAPA records without verified effectiveness checks, the underlying problem recurs. The FDA's QSIT methodology specifically tests whether effectiveness checks are defined, time-bound, and documented.

Design Control gaps in legacy products arise when a device was designed before the 1996 QSR took effect and was never subjected to retrospective design history file construction. FDA does not require manufacturers to retroactively redesign legacy devices, but it does require documented evidence that the device meets current user needs — a burden that gaps in original design documentation make difficult to satisfy.

Supplier qualification failures cascade into finished device nonconformances. Under 21 CFR 820.50, manufacturers are responsible for the quality of components, materials, and services purchased from suppliers. Without a structured supplier quality compliance program, incoming nonconformances are often detected only after finished devices have been assembled, triggering expensive rework or rejection.

A fourth driver is inadequate training documentation. 21 CFR 820.25 requires that personnel be trained to perform their assigned responsibilities, and that training be documented. FDA investigators request training records as standard practice; missing or generic records are treated as evidence of a broken quality system.

Classification boundaries

QSR requirements scale with device classification under 21 CFR Part 862–892.

Class I devices (lowest risk) are generally exempt from Design Controls but remain subject to all other QSR subsystems unless they are also exempt from 21 CFR Part 820 entirely. The FDA maintains a published list of Class I exemptions at 21 CFR Part 862 through Part 892.

Class II devices (moderate risk) are subject to full QSR requirements including Design Controls. Most Class II devices reach market through the 510(k) premarket notification pathway, and the design history file generated under Design Controls provides the documentary foundation for the 510(k) submission.

Class III devices (highest risk) require Premarket Approval (PMA) and are subject to full QSR requirements. PMA applicants must submit manufacturing information as part of their application, meaning QSR compliance is evaluated before market authorization, not only during post-market inspections.

Combination products follow a "primary mode of action" assignment. If the primary mode is the device component, CDRH has jurisdiction and QSR applies. If the primary mode is the drug or biologic component, the Center for Drug Evaluation and Research (CDER) or Center for Biologics Evaluation and Research (CBER) has jurisdiction, and 21 CFR Part 211 (drug GMPs) or 21 CFR Part 600 may apply in addition to or instead of Part 820.

Custom devices manufactured for individual patients under 21 USC 360d(b) are exempt from premarket approval requirements but remain subject to QSR.

Tradeoffs and tensions

Alignment with ISO 13485 vs. legacy QSR compliance: The 2024 FDA rule restructures Part 820 to mirror ISO 13485:2016. Manufacturers already certified to ISO 13485 gain partial harmonization benefits, but the FDA's enforcement posture and inspection methodology differ from ISO third-party audits. A facility may hold an ISO 13485 certificate and still receive an FDA 483 observation because QSIT and ISO audit criteria are not identical.

Documentation burden vs. operational agility: QSR requires documented procedures, records, and change history at granular levels. In early-stage or small manufacturers, this documentation burden can slow design iteration and process improvements. The regulation does not prescribe document format, creating room for risk-based scoping, but inspectors expect evidence of actual system operation, not templates.

Risk-based thinking vs. prescriptive rule-following: Risk-based compliance QA approaches, encouraged by ISO 14971 (the medical device risk management standard), push manufacturers to calibrate controls to hazard severity. QSR's subsystem structure is not explicitly risk-tiered, creating situations where manufacturers apply the same procedural rigor to low-risk activities as to high-risk ones, inefficient in both directions.

Global regulatory divergence: A device manufacturer exporting to the European Union must comply with the EU Medical Device Regulation (MDR 2017/745), which references EN ISO 13485 as the quality management standard. Satisfying both FDA QSR and EU MDR simultaneously requires deliberate system design because the two frameworks overlap but do not fully align on post-market surveillance, clinical evaluation, and unique device identification requirements.

Common misconceptions

Misconception: ISO 13485 certification substitutes for FDA QSR compliance.
Correction: ISO 13485 certification is issued by an accredited notified body or certification body and has no formal recognition in U.S. law. FDA conducts its own inspections under 21 CFR Part 820 and QSIT. A certificate does not preclude a Warning Letter.

Misconception: Class I devices are entirely exempt from QSR.
Correction: Most Class I devices exempt from 510(k) premarket notification retain QSR obligations, including complaint handling (21 CFR 820.198), record requirements, and CAPA. Only a defined subset of Class I devices appears on FDA's explicit exemption list.

Misconception: Contract manufacturers bear no QSR responsibility if the specification developer holds the 510(k).
Correction: Both the specification developer and the contract manufacturer may be subject to QSR requirements. FDA can inspect and cite both entities. Quality agreements between parties do not transfer regulatory obligation; they only allocate internal responsibility.

Misconception: A CAPA record is closed when a correction is implemented.
Correction: Under 21 CFR 820.100(a)(7), effectiveness checks are a required element. A CAPA that documents a correction but lacks a defined, executed effectiveness check is incomplete under FDA's standard and is a common source of 483 observations.

Misconception: Software used in manufacturing is not subject to QSR.
Correction: Software used as part of production and process controls, including manufacturing execution systems, is subject to computer and automated data processing controls under 21 CFR 820.70(i). Software quality assurance compliance requirements extend into manufacturing environments, not only into finished device software.

Checklist or steps (non-advisory)

The following sequence describes the structural elements an FDA QSR compliance program must address, organized by QSIT subsystem order of inspection priority.

1. Management Controls verification
- Quality policy documented, approved by executive management, and communicated
- Organizational chart defining authority and responsibility for quality functions
- Management Representative formally designated in writing
- Management review records demonstrating periodic system evaluation with documented outputs

2. Design Controls documentation
- Design and Development Plan for each applicable device
- Design Input record capturing user needs and intended use
- Design Output documentation meeting Design Input requirements
- Design Review records with participants identified
- Design Verification protocols and results
- Design Validation protocols, results, and linkage to user needs
- Design History File (DHF) assembled and controlled

3. CAPA system elements
- Procedure for receiving and processing nonconformance data from all sources
- Root cause analysis methodology documented and applied
- Corrective and preventive action records with defined owner and due date
- Effectiveness check criteria defined before closure
- Trend analysis feeding into management review

4. Document and Change Controls
- Document approval, distribution, and obsolescence procedure
- Change request, review, and approval procedure including regulatory impact assessment
- Master Device Record (MDR) with controlled links to all device specifications

5. Production and Process Controls
- Validated procedures for all processes where output cannot be fully verified
- Equipment calibration and maintenance records
- In-process and finished device inspection and test records

6. Complaint Handling
- Complaint intake and evaluation procedure
- MDR (Medical Device Report) determination documented for each complaint
- Complaint file records maintained and accessible

7. Records and Record Retention
- Device History Record (DHR) for each production lot or unit
- Record retention period consistent with 21 CFR 820.180 (2 years minimum beyond device expected life)
- Quality assurance recordkeeping compliance controls ensuring accessibility and legibility

Reference table or matrix

QSR Subsystem CFR Citation Primary Records Required QSIT Priority Key Failure Mode
Management Controls 21 CFR 820.20 Quality policy, org chart, management review records 1st Missing management review outputs
Design Controls 21 CFR 820.30 DHF, Design Inputs, Outputs, Verification, Validation 2nd Incomplete DHF; no validation for intended use
CAPA 21 CFR 820.100 CAPA records with root cause, action, effectiveness check 3rd Closed CAPAs lacking effectiveness verification
Production & Process Controls 21 CFR 820.70, 820.75 Process validation records, calibration logs 4th Unvalidated critical processes
Records/Documents/Change Controls 21 CFR 820.40, 820.181–820.186 DMR, DHR, change records 5th Outdated documents in use; unapproved changes
Material Controls 21 CFR 820.50, 820.80–820.86 Supplier qualifications, receiving inspection records 6th Unqualified suppliers; no incoming inspection
Facility & Equipment Controls 21 CFR 820.70(a)–(h) Equipment maintenance, calibration, environmental records 7th Expired calibration; no environmental monitoring
Device Class Design Controls Required Premarket Pathway Post-Market Inspections
Class I (non-exempt) No 510(k) exempt (most) Yes — all QSR subsystems except Design Controls
Class I (exempt list) No Exempt Limited; GMP requirements reduced
Class II Yes 510(k) Yes — full QSR
Class III Yes PMA Yes — full QSR; pre-approval inspections
Combination Product (device primary) Yes PMA or 510(k) Yes — QSR + potentially 21 CFR Part 211

References

📜 2 regulatory citations referenced  ·  🔍 Monitored by ANA Regulatory Watch  ·  View update log

Explore This Site

Services & Options Compliance: Standards Overview Regulations & Safety Regulatory References Tools & Calculators Contractor License Fee Calculator