Quality System Regulation (21 CFR 820)
The Quality System Regulation (QSR) at 21 CFR Part 820 establishes Current Good Manufacturing Practice (CGMP) requirements for medical device manufacturers. The QSR prescribes requirements for the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of finished devices.
FDA has proposed harmonizing the QSR with ISO 13485:2016 through the Quality Management System Regulation (QMSR) rule. Until that final rule takes effect, 21 CFR 820 remains the binding regulation. Manufacturers should monitor FDA's Federal Register announcements for the QMSR effective date.
Design Controls (820.30)
Design controls are required for Class II and III devices (and Class I devices subject to design controls per 21 CFR 820.30(a)(2)). The design control subsystem includes:
Design Planning (820.30(b))
Establish and maintain plans describing design and development activities and define responsibility for implementation. Plans must be updated as design evolves.
Design Input (820.30(c))
Establish and document design input requirements including intended use, performance requirements, safety requirements, regulatory requirements, and applicable standards. Inputs must be reviewed and approved.
Design Output (820.30(d))
Define and document design outputs in terms that allow adequate evaluation of conformance to design input requirements. Outputs must include acceptance criteria and identify characteristics crucial to safe and proper functioning.
Design Review (820.30(e))
Conduct planned and documented design reviews at appropriate stages. Reviews must include representatives of all functions concerned with the design stage and an independent reviewer.
Design Verification (820.30(f))
Confirm that design output meets design input requirements. Methods include inspections, tests, demonstrations, analyses, and comparison to similar proven designs.
Design Validation (820.30(g))
Confirm that the device conforms to defined user needs and intended uses. Must include testing under actual or simulated use conditions on initial production units or equivalents. Software validation and risk analysis are required where appropriate.
Design Transfer (820.30(h))
Ensure design outputs are correctly translated to production specifications. Verify that manufacturing processes can consistently produce the device per design specifications.
Design Changes (820.30(i))
Identify, document, validate/verify, review, and approve design changes before implementation. Assess changes for their effect on constituent parts and finished devices.
Design History File (820.30(j))
Maintain a DHF for each type of device containing or referencing records demonstrating the design was developed in accordance with the approved design plan.
Production and Process Controls (820.70-820.75)
| Requirement | CFR Section | Description |
|---|---|---|
| Production and Process Controls | 820.70 | Develop, conduct, control, and monitor production processes to ensure device conforms to specifications |
| Environmental Controls | 820.70(c) | Adequate environmental conditions for manufacturing (cleanroom, temperature, humidity as applicable) |
| Personnel | 820.70(d) | Controls for personnel health, cleanliness, and practices where contact or conditions could adversely affect device |
| Automated Processes | 820.70(i) | Validate computer software used in production or QS; validated per established protocol before use and after changes |
| Process Validation | 820.75 | Validate processes where results cannot be fully verified by subsequent inspection/test (e.g., sterilization, sealing, injection molding) |
Corrective and Preventive Actions -- CAPA (820.90)
The CAPA subsystem is one of the most heavily scrutinized areas during FDA inspections. It requires procedures to:
- Analyze processes, work operations, quality audit reports, quality records, service records, complaints, and other data sources to identify existing and potential causes of nonconforming product
- Investigate the cause of nonconformities relating to product, processes, and the quality system
- Identify actions needed to correct and prevent recurrence of nonconforming product
- Verify or validate corrective and preventive actions to ensure they are effective and do not adversely affect the finished device
- Implement and record changes in methods and procedures as needed
- Ensure relevant information is disseminated for management review
- Submit relevant information on identified quality problems to management with executive responsibility
CAPA-related observations are among the most frequently cited FDA Form 483 findings.
Document Controls (820.40)
Manufacturers must establish and maintain procedures to control all documents required by the QSR. Document control requirements include:
- Document approval and distribution (820.40(a)): Documents must be reviewed and approved by designated individuals before issuance. Obsolete documents must be promptly removed or clearly marked.
- Document changes (820.40(b)): Changes must be reviewed and approved by the same function or organization that performed the original review and approval, unless otherwise designated.
- Record requirements (820.180): All records must be legible, identifiable, retrievable, and stored to minimize deterioration and prevent loss. Records must be retained for the lifetime of the device or two years from distribution, whichever is longer.
- Device Master Record (820.181): Contains or references complete device specifications, production processes, quality assurance procedures, and packaging/labeling specifications.
- Device History Record (820.184): Documents the production history of each finished device, demonstrating it was manufactured per the DMR.
Management Responsibility (820.20)
Management with executive responsibility must:
- Establish a quality policy and ensure it is understood and implemented at all levels
- Establish an organizational structure with adequate resources and trained personnel
- Appoint a management representative with authority and responsibility for the quality system
- Conduct management reviews of the quality system at defined intervals to ensure its continued suitability and effectiveness
- Establish quality planning procedures that define quality practices, resources, and activities relevant to devices