The scope block of a design and development procedure written before 2026 usually cites 21 CFR 820.30, a section of the U.S. Code of Federal Regulations (CFR) that has read “[Reserved]” since 2 February 2026. The work that procedure governs still has to happen under 21 CFR Part 820, which now takes its design and development requirements from International Organization for Standardization (ISO) 13485 Clause 7.3. When the Quality Management System Regulation (QMSR) took effect, the U.S. Food and Drug Administration (FDA) incorporated that standard by reference.
The QMSR transition is mostly a citation job for quality and regulatory leads. Stale citations reach well past the procedure, into traceability matrix column headers and the quality system paragraph of a 510(k). A few requirements changed in substance, and a straight re-citation misses exactly those. This guide covers where each former paragraph now sits, which documents to update and what investigators look at under FDA’s new compliance program.
Does 21 CFR Part 820 Still Apply After the QMSR?
Yes: Part 820 is still the regulation FDA inspects device manufacturers against, including foreign manufacturers whose devices are imported into the United States. Its contents changed on 2 February 2026 under the final rule at 89 Federal Register 7496, published on 2 February 2024, which renamed it the QMSR and rebuilt it around ISO 13485:2016. Section 820.7 incorporates that standard by reference together with Clause 3 of ISO 9000:2015. Incorporated material has the force and effect of law, which means a Clause 7.3 requirement binds every manufacturer that § 820.10(c) brings into scope directly through the CFR.
Only six sections remain in force, and they are the only Part 820 section numbers a current procedure should cite:
- § 820.1 scope: Sets out which device manufacturers Part 820 applies to, so it is the citation for a procedure’s applicability statement.
- § 820.3 definitions: Holds the definitions that apply across Part 820, including the FDA-only terms that ISO 13485 does not define.
- § 820.7 incorporation by reference: Brings ISO 13485:2016 and Clause 3 of ISO 9000:2015 into the regulation by reference.
- § 820.10 requirements for a quality management system: Sets the quality management system requirements, including the design and development requirement in paragraph (c).
- § 820.35 control of records (Subpart B): Keeps FDA’s own record controls, including the content FDA requires in complaint records.
- § 820.45 device labeling and packaging controls (Subpart B): Keeps FDA’s own controls for device labeling and packaging, also in Subpart B.
When we find any other Part 820 section number in a current procedure, it’s a legacy citation that needs a new authority. For design and development work, the new authority is § 820.10(c).
What Happened to the Former Design-Control Sections?
Most of the old regulation is Reserved, including the design-control sections of the 1996 Quality System (QS) regulation. The Reserved block covers § 820.5, §§ 820.20 through 820.30, § 820.40 and Subparts C through O. Section 820.30 was titled “Design Controls”, and the 1997 Design Control Guidance for Medical Device Manufacturers that explained it was withdrawn on the same day the QMSR took effect.
The design and development obligation now arrives through the QMSR requirement in § 820.10(c). Its text reads, “Manufacturers of class II, class III, and those class I devices listed in paragraph (c)(1) of this section and table 1 to paragraph (c)(2) of this section must comply with the requirements in Design and Development, Clause 7.3 and its Subclauses in ISO 13485.” The sentence does the scoping job that § 820.30(a) of the QS regulation used to do, in the standard’s vocabulary.
The QMSR does not use the terms “Design Controls” or “Design Validation”, and FDA’s guidance notices say the elements behind them are described in ISO 13485 Clause 7.3 and its subclauses. FDA’s final rule also eliminated “Design History File (DHF)” along with the other record types of the 1996 QS regulation. The guide to ISO 13485 covers the standard itself and the retained Part 820 sections that sit beside it.
Mapping the Former 21 CFR 820.30 Paragraph by Paragraph
FDA has published no paragraph-by-paragraph crosswalk for the old design-control section. Its own texts still name a specific ISO 13485 subclause for nine of the ten former paragraphs, and (a) became the scope provision in § 820.10(c). For transfer and changes, the subclause numbers come from the Center for Devices and Radiological Health (CDRH) Learn training module on QMSR design and development, presented by Joseph Tartal, acting director of CDRH’s Division of Industry and Consumer Education. Each row of the table pairs a former paragraph with the clause that now carries it and with what FDA’s own material adds.
| Former § 820.30 paragraph (now Reserved) | Subject | Where FDA places it under the QMSR | What FDA’s material adds |
|---|---|---|---|
| (a) | General | 21 CFR 820.10(c), invoking ISO 13485 Clause 7.3 | Scope now set by § 820.10(c); most Class I devices stay outside it |
| (b) | Design and development planning | Clause 7.3.2; plan record in the 7.3.10 file | FDA’s quality management system (QMS) information draft guidance and cybersecurity guidance cite 7.3.2 for the plan; the final rule preamble (Comment 31) puts the plan in the 7.3.10 file |
| (c) | Design input | Clause 7.3.3 | FDA’s February 2026 cybersecurity guidance cites 7.3.3 for inputs; the proposed-rule preamble notes risk management is integrated across ISO 13485 |
| (d) | Design output | Clause 7.3.4 | FDA’s February 2026 cybersecurity guidance cites 7.3.4 for outputs |
| (e) | Design review | Clause 7.3.5 | Independent reviewer requirement not carried forward |
| (f) | Design verification | Clause 7.3.6 | FDA’s February 2026 cybersecurity guidance cites 7.3.6 for verification |
| (g) | Design validation | Clause 7.3.7; risk management spread across ISO 13485 | “Design Validation” no longer a QMSR term |
| (h) | Design transfer | Clause 7.3.8 | FDA’s CDRH Learn module on QMSR design and development names 7.3.8 for transfer |
| (i) | Design changes | Clause 7.3.9 | The CDRH Learn module names Clause 7.3.9 for control of design and development changes. Production changes may also implicate applicable Clause 7.5 requirements, and the medical device file under Clause 4.2.3 may need to reflect updated production specifications |
| (j) | Design History File (DHF) | Clause 7.3.10 design and development file | “DHF” no longer a QMSR term |
How to Read the Paragraph Mapping
Each subclause in the table is cited as the standard’s own, and FDA is cited only where FDA has spoken. We’d write a comparative analysis of pre-QMSR documents the same way, and FDA’s frequently asked questions (FAQ) page on the QMSR suggests that kind of analysis. ISO 13485 numbers the Clause 7.3 subclauses 7.3.1 through 7.3.10, and their subjects broadly follow the order of the old paragraphs (a) through (j). A citation to 7.3.2 for planning or 7.3.6 for verification follows the standard’s own structure.
Design review is the row in this mapping where we’d expect a procedure to need more than a new citation, because the content changed along with the numbering. Section 820.30(e) of the QS regulation required a reviewer “who does not have direct responsibility for the design stage being reviewed”, and the final rule preamble (response to Comment 46) confirms that requirement is not in the QMSR. Clause 7.3.5 requires, in FDA’s summary, that design and development review “include representatives of functions concerned with the stage under review as well as other specialist personnel.”
If your design and development review procedure still mandates an independent reviewer, it asks for more than the QMSR’s text does. Nothing in Clause 7.3.5 stops a manufacturer keeping that reviewer as a stated company requirement. A procedure that still cites § 820.30(e) of the QS regulation as its authority is citing a Reserved section either way. Its review rules need a current basis in Clause 7.3.5 or in that company requirement.
Update Procedures and Templates That Still Cite Removed Sections
Each document that governs work after 2 February 2026 should name its current authority and use current terminology, while records created before that date stay as created. A citation log with one row per document can pair each stale citation with its replacement authority and note any terminology or workflow change it forces.
The general design and development procedure comes first, and teams can “re-index procedures to consolidate design planning, inputs, outputs, review, and change records under Clause 7.3.10,” as an AAMI News guest article from the Association for the Advancement of Medical Instrumentation recommends. Once the procedure is re-indexed, the procedure index and the file index template both point at 7.3.10 for what the file must contain or reference.
Design and development review templates need two edits. The old § 820.30(e) citation becomes Clause 7.3.5, and the participant list records whatever the review procedure decided about the independent reviewer.
Procedures outside design, such as records and complaint handling, cite removed sections too. The general record requirements formerly numbered 820.180 and the complaint-file requirements formerly numbered 820.198 remain in effect, as CDRH explained in its December 2025 QMSR webinar. Section 820.35 and ISO 13485 Clauses 4.2.5 and 8.2.2 now carry them. A complaint procedure should cite Clause 8.2.2 plus § 820.35(a), which adds FDA’s own record content for complaints involving possible failure to meet specifications.
Revise Trace Matrices
If your trace matrix was built under the QS regulation’s § 820.30, its column headers probably carry the old paragraph letters. Design inputs sit under (c), outputs under (d), verification under (f) and validation under (g), and under Clause 7.3 the chain survives while the headers change to the subclause numbers. One column is new, because Clause 7.3.3 requires design inputs to include applicable outputs of risk management, which the QS regulation’s § 820.30(c) did not state as explicitly. The QS regulation “explicitly addresses risk management activities only in the risk analysis requirement within design validation in Sec. 820.30(g); whereas, risk management is more broadly integrated in ISO 13485,” the 2022 proposed-rule preamble explained.
Risk management belongs in the trace matrix by linking applicable risk controls to the design inputs that implement them. Reviewers can then check the Clause 7.3.3 input requirement on its face, and a Traceability Information Model can declare that link as required coverage. A matrix that treats risk as a validation-stage activity reflects how § 820.30(g) of the QS regulation was structured, while an investigator working from the QMSR may look for the input-side link. In early QMSR inspections, the top Form 483 observations “include risk management, outsourcing and purchasing, and complaint handling and feedback,” according to a 14 May 2026 Regulatory Affairs Professionals Society report of remarks by Keisha Thomas, associate director of FDA’s CDRH Office of Product Evaluation and Quality.
Align Submission Text With FDA Guidance
Submission text should cite ISO 13485 subclauses the way FDA’s revised cybersecurity guidance does, because FDA has updated its own guidance unevenly. The June 2023 device software functions premarket guidance still says in its body, citing the now-Reserved section, that software documentation follows “21 CFR 820.30 Subpart C – Design Controls of the Quality System Regulation”. A later FDA disclaimer sits on top of it: “This guidance document was issued prior to the effective date of the final rule. FDA encourages manufacturers to review the current QMSR to ensure compliance with the relevant regulatory requirements.”
FDA revised the February 2026 cybersecurity premarket guidance for the QMSR, and its body cites ISO 13485 subclauses including 7.3.2, 7.3.3, 7.3.4, 7.3.6, 7.3.7 and 8.5, with no reference to 820.30. FDA’s October 2025 QMS-information draft guidance for premarket approval (PMA) and humanitarian device exemption (HDE) submissions sets out the vocabulary for each regulation: “When referring to 21 CFR part 820 as amended, effective on February 2, 2026, FDA uses the term ‘QMSR.’ When referring to the regulation at 21 CFR part 820 in effect before February 2, 2026, FDA uses the term ‘QS regulation.’” A 510(k) that describes design activities “per 21 CFR 820.30” is describing them under the QS regulation.
Where Does the DHF Fit Under 21 CFR Part 820 Now?
“DHF” remains industry usage for records now governed by Clause 7.3.10, which calls them the design and development file. The QMSR addresses what the DHF, Device Master Record (DMR) and Device History Record (DHR) held under the QS regulation through other requirements, and the guide to DHF, DMR and DHR under the QMSR sets out what changed. Section 820.3 no longer defines the three records, and the QMSR has no standalone requirement for them.
“Many of the requirements previously in the DHR are largely required to be in the medical device or batch record, as described in Clause 7.5.1. Similarly, consistent with the former DHF, Clause 7.3.10 requires the design and development file to contain or reference all the records necessary to establish compliance with design and development requirements, including the design and development plan and design and development procedures,” FDA’s response to Comment 31 in the final rule preamble explains. Many of the elements the DMR held are now addressed through ISO 13485 requirements, including the medical device file under Clause 4.2.3, and § 820.3(b)’s definition of “rework” already uses “medical device file (MDF)” as its reference point.
Records created before 2 February 2026 need not be revised or recreated, including to remove 1996 QS regulation terms such as design history file or device master record. Karen Masley-Joseph, senior advisor in the Office of Medical Device and Radiological Health Inspectorate within FDA’s Office of Inspections and Investigations, gave that answer at FDA’s April 2026 town hall on risk-based inspections. She added that FDA does “expect manufacturers to identify where processes might need to change to comply with the QMSR and then develop a plan that addresses any necessary changes.” Work done after the effective date has to follow current procedures and templates.
The final rule amended Parts 4 and 820 and did not amend 21 CFR Part 11, which still governs the electronic records and signatures used to satisfy Part 820, an FDA predicate rule. Entries in a design and development file and an electronic trace matrix are examples of those electronic records. Part 11 controls need to stay in place while the Part 820 citations change.
What Do Investigators Focus On Under Compliance Program (CP) 7382.850?
CP 7382.850 itself organizes an inspection around six QMS areas, including Design and Development and engineering Change Control processes, plus four other applicable FDA requirements. On 2 February 2026 FDA withdrew the Quality System Inspection Technique (QSIT) and retired CP 7382.845 and CP 7383.001, and the updated compliance program CP 7382.850, Inspection of Medical Device Manufacturers, replaced all three. Every inspection on or after 2 February 2026 is conducted to the QMSR, including compliance follow-ups, FDA said at its April 2026 town hall. Inspection preparation should therefore follow the six areas in CP 7382.850.
Investigators may review records created before the effective date to determine QMSR compliance, and a comparative analysis showing pre-QMSR documents meet QMSR requirements may be useful, according to FDA’s QMSR FAQ. Management review, quality audit and supplier audit reports are no longer exempt from inspection, the same FAQ confirms. Design history files (in the industry sense) and traceability are inspection focal points, Medical Device and Diagnostic Industry (MD+DI) reported in February 2026. A team ready for inspection can hand over the design and development file with its trace matrix and risk records on the day the investigator asks.
When design inputs, outputs, verification records and risk items live in separate documents, producing the file means rebuilding the links between them by hand. Jama Connect® is a web-based requirements management and traceability platform for complex, regulated product development, and it holds those links between the items themselves. Convergent Dental reports that with Jama Connect its audit preparation decreased from three weeks to one day.
Describing what the export replaced, Convergent Dental’s Electrical Systems Engineer said: “The fact that I can simply export a PDF for audit preparation saves me three weeks of time. Regulatory bodies don’t need to know that Jama Software exists because it’s exporting the same report that I had to do manually in the past, just instantly.” Convergent Dental’s figure measures audit preparation, and the same linked records serve an FDA inspection under Change Control, one of the six QMS areas in CP 7382.850. A design change that stays linked to every item it affected already holds the impact assessment an investigator may ask to see.
How Jama Connect Supports Design and Development Under 21 CFR Part 820
Jama Connect’s pre-built framework for medical devices is aligned to ISO 13485, International Electrotechnical Commission (IEC) 62304, ISO 14971 and the design and development requirements of 21 CFR 820.10(c). The framework includes workflows for design inputs and design outputs. Its risk management framework ties risk records from failure mode and effects analysis (FMEA) and hazard analysis directly to design inputs and verification. When an engineer edits a design input, every verification record traced to it is flagged as suspect, and Jama Connect keeps an auditable record of how each flag was resolved.
Controlled procedures and templates usually stay in the document control system, while Jama Connect holds the design and development records they govern. Export templates generate DHF and risk management file exports from selected project data, which is how the design and development file that Clause 7.3.10 describes gets assembled as an export or report. The same configurable Word and Excel templates support regulatory submission documentation, and Jama Connect Review Center‘s electronic signatures and audit trail support customers’ 21 CFR Part 11 compliance processes for the records in that file.
Bringing Design Records Current Under 21 CFR Part 820
Current procedure citations should include the edition year so a future ISO edition does not appear adopted before FDA amends the rule. Section 820.7 incorporates ISO 13485:2016 in its third edition, dated 2016-03-01. On later editions, the final rule states that “Any future revisions to these standards would need to be evaluated to determine the impact of the changes and whether this rule should be amended.” The regulation’s core requirements, and the steps to prepare for an inspection under it, are covered in Jama Software®’s guide to the QMSR.
A first pass lists every design and development record that still cites the Reserved 820.30 and pairs each citation with its Clause 7.3 subclause. If that list is long, take the product with the nearest scheduled design change first, and map its design and development file to the new subclause numbers when you start a free 30-day trial.
Frequently Asked Questions About 21 CFR Part 820
Does FDA require ISO 13485 certification under the QMSR?
No. FDA incorporated the standard’s requirements into 21 CFR Part 820 by reference, and it will neither require nor issue a certificate of conformance to ISO 13485. A certificate does not exempt a manufacturer from FDA inspection either. The four other applicable FDA requirements in CP 7382.850, Medical Device Reporting among them, also sit outside what a certificate covers.
Which Class I devices must meet the design and development requirements?
Section 820.10(c)(1) applies Clause 7.3 to Class I devices automated with computer software. Table 1 to § 820.10(c)(2) adds five listed devices: the tracheobronchial suction catheter, the non-powdered surgeon’s glove, the protective restraint, the manual radionuclide applicator system and the radionuclide teletherapy source. Other Class I devices remain outside Clause 7.3, and the guide to medical device requirements management covers how in-scope devices carry user needs into design inputs.
Do ISO 13485 definitions override FDA’s own definitions in Part 820?
The order runs the other way. Section 820.3(b) states that definitions in section 201 of the Federal Food, Drug, and Cosmetic Act (FD&C Act) “shall supersede” the correlating ISO 13485 terms, so “device” and “labeling” carry their FD&C Act meanings and “organization” in the standard is read as “manufacturer.” Section 820.3(a) then adds FDA-only terms such as “component” and “remanufacturer” that neither ISO 13485 nor ISO 9000 defines. Setting a procedure’s definitions section in that order, FD&C Act and § 820.3 first and ISO 13485 second, is part of effective regulatory compliance management.
