FDA Quality System Regulation (QSR) Compliance

The FDA Quality System Regulation establishes mandatory quality management requirements for manufacturers of medical devices sold in the United States. Codified at 21 CFR Part 820, QSR compliance is enforced by the U.S. Food and Drug Administration and applies across the full device lifecycle — from design through distribution and complaint handling. Non-compliance carries consequences ranging from warning letters to facility-wide injunctions and product recalls.

Definition and scope

21 CFR Part 820, commonly referred to as the Quality System Regulation or QSR, was originally established by the FDA in 1996 to replace the earlier Good Manufacturing Practice (GMP) regulation for medical devices. The regulation applies to manufacturers of finished medical devices and components that are distributed in the United States, including foreign establishments that export devices to U.S. markets (21 CFR Part 820, FDA).

The scope encompasses Class I, Class II, and Class III devices, with certain exemptions for Class I devices that present minimal risk. Manufacturers subject to QSR must establish, document, and maintain a quality system that covers all phases of device production. The regulation is structured around 13 primary subparts addressing the quality system structure, design controls, document controls, purchasing controls, production processes, corrective and preventive action (CAPA), labeling, distribution, installation, servicing, and statistical techniques.

In 2024, the FDA finalized a rule to harmonize 21 CFR Part 820 with ISO 13485:2016, the international standard for medical device quality management systems. This revision — known as the Quality Management System Regulation (QMSR) — aligns U.S. requirements with global standards, reducing duplicative compliance burdens for manufacturers operating across multiple markets. The quality-assurance-regulatory-framework page addresses the broader federal compliance architecture within which QSR sits.

How it works

QSR compliance operates through a structured quality management system that must be documented, implemented, and continuously maintained. The FDA conducts inspections — both announced and unannounced — at manufacturing facilities to assess conformance. Inspections are conducted under the authority of Section 704 of the Federal Food, Drug, and Cosmetic Act (FD&C Act).

The compliance mechanism follows a closed-loop structure built on these discrete components:

1. Quality System Procedures: Manufacturers must establish written procedures for each regulated activity. Procedures must be reviewed, approved, and accessible to relevant personnel.
2. Design Controls (21 CFR 820.30): Required for Class III devices, Class II devices, and select Class I devices. Design controls mandate planning, input/output documentation, design review, verification, validation, and transfer protocols.
3. Document and Record Controls (21 CFR 820.40 / 820.180): All documents must be version-controlled and approved prior to issuance. Device History Records (DHRs), Device Master Records (DMRs), and Quality System Records (QSRs) must be retained for a period equivalent to the design and expected life of the device, or two years from the date of release, whichever is greater.
4. CAPA (21 CFR 820.100): Corrective and Preventive Action procedures must identify, investigate, and eliminate the root cause of nonconformances. CAPA remains among the most frequently cited deficiencies in FDA 483 inspection observations.
5. Complaint Handling (21 CFR 820.198): Every complaint must be evaluated for whether it constitutes a Medical Device Report (MDR) trigger under 21 CFR Part 803.
6. Supplier Controls (21 CFR 820.50): Manufacturers must qualify and monitor suppliers of components and services that affect device quality — a process described in detail under quality-assurance-supplier-qualification.

FDA Form 483 observations and Warning Letters are the primary enforcement instruments. Warning Letters are publicly posted on the FDA's database and represent formal notice of significant QSR violations requiring corrective response within 15 working days.

Common scenarios

Startup device manufacturers entering FDA-regulated markets for the first time must build a QSR-compliant quality system prior to commercial distribution. The FDA does not pre-approve quality systems before market entry, but inspections typically occur within 2 years of a facility's first 510(k) clearance or PMA approval.

Contract manufacturers producing components or finished devices on behalf of original equipment manufacturers (OEMs) bear independent QSR obligations. The OEM cannot transfer its regulatory responsibility for device quality to the contract manufacturer — both entities may be subject to inspection.

Foreign manufacturers exporting to U.S. markets must comply with 21 CFR Part 820 in full. The FDA has the authority to inspect foreign facilities under the Food Safety Modernization Act and the FD&C Act, and denial of inspection access constitutes grounds for import refusal.

Software-driven devices require design control documentation that addresses software lifecycle processes consistent with FDA guidance on software validation, including alignment with IEC 62304 for software as a medical device (SaMD).

Decision boundaries

QSR applies to the manufacturer of record — the entity legally responsible for device compliance. Distributors, importers, and repackagers who do not alter the device or labeling are generally outside QSR scope, though they may be subject to separate FDA regulations.

The distinction between finished device manufacturer and component supplier determines QSR applicability. A company supplying unfinished components to a device manufacturer is not automatically subject to 21 CFR Part 820, but the device manufacturer must impose quality requirements on that supplier contractually and through documented purchasing controls.

Class I devices exempt from design controls include those verified under 21 CFR 820.30(a)(2). However, exemption from design controls does not relieve Class I manufacturers from all other QSR requirements — purchasing controls, production controls, and complaint handling obligations remain in force.

The transition from QSR (21 CFR Part 820 pre-2024) to QMSR (the ISO 13485-aligned revision) represents a classification boundary in compliance documentation. Manufacturers maintaining ISO 13485 certification from a Notified Body may satisfy overlapping QMSR requirements through existing certification evidence, subject to FDA review. The structural alignment between these frameworks is covered under quality-assurance-iso-9001-alignment, which addresses cross-standard harmonization logic relevant to device quality programs.