Updated: 22nd June 2026
Reviewed by: David Small, BSc (Hons), MSc, MTOPRA (Founder & CEO)
Patient Guard Ltd is fully ISO 13485:2016 Certified by BSI — View Our Official Certificate Here.
ISO 13485 & CFR 21 Part 820 QSR
Medical device manufacturers selling internationally often need to comply with multiple quality management requirements. While the United States has traditionally relied on the FDA’s Quality System Regulation (21 CFR Part 820), manufacturers supplying Europe, the UK, Canada, Australia and many other international markets typically implement ISO 13485 as the recognised global standard for medical device Quality Management Systems.
Although the two frameworks share many common principles, they differ in their structure, terminology and approach to areas such as risk management, documentation and regulatory compliance. Understanding these differences is essential for organisations developing a single Quality Management System that supports multiple markets.
Before exploring the technical differences between ISO 13485 and the FDA’s Quality System Regulation, it is helpful to understand what ISO 13485 is, why it has become the international benchmark for medical device quality management and how it supports regulatory approval throughout the product lifecycle.
New to ISO 13485?
This article compares ISO 13485 and the FDA's Quality System Regulation (QSR). If you're looking for a complete overview of ISO 13485 requirements, implementation, certification and quality management system obligations for medical device manufacturers, read our Complete Guide to ISO 13485.
1. Scope & Applicability
ISO 13485
ISO 13485 is the internationally recognised Quality Management System (QMS) standard for the medical device industry. It specifies the requirements organisations must meet to consistently design, manufacture and supply safe, effective medical devices and related services while complying with applicable regulatory requirements.
The standard is intended for organisations involved in any stage of the medical device lifecycle, including design and development, manufacturing, installation, servicing, storage, distribution and post-market activities. It can also be applied by suppliers and subcontractors providing products or services to medical device manufacturers.
Although ISO 13485 certification is technically voluntary, it has become the recognised global benchmark for medical device quality management. In many markets, including the European Union, United Kingdom, Canada and Australia, certification is either expected or effectively required to demonstrate regulatory compliance and gain market access.
CFR Part 820 (Quality System Regulation)
The FDA’s Quality System Regulation (21 CFR Part 820) established the legal Quality Management System requirements for manufacturers placing medical devices on the United States market. Unlike ISO 13485, compliance with Part 820 was a federal legal requirement and formed the basis of FDA inspections and enforcement activities.
Part 820 covered many of the same quality system elements as ISO 13485, including management responsibility, design controls, purchasing controls, production and process controls, corrective and preventive action (CAPA), complaint handling and document controls. However, it was written as a US regulation rather than an international consensus standard.
The FDA has now introduced the Quality Management System Regulation (QMSR), which incorporates ISO 13485 by reference. This significantly harmonises US quality system requirements with international expectations while retaining additional FDA-specific regulatory obligations.
Difference
The most significant historical difference was that ISO 13485 is an internationally recognised consensus standard used by regulators around the world, whereas 21 CFR Part 820 was a legally enforceable FDA regulation that applied only to manufacturers marketing medical devices in the United States.
Today, these differences are becoming much smaller. The FDA’s adoption of the Quality Management System Regulation (QMSR) aligns US quality system requirements much more closely with ISO 13485, making it easier for manufacturers to operate a single Quality Management System that supports compliance across multiple international markets while still meeting FDA-specific requirements.
2. Focus on Risk Management
ISO 13485
ISO 13485 places a strong emphasis on risk management throughout the entire medical device lifecycle. Rather than viewing risk management as a standalone activity, the standard integrates risk-based thinking into many aspects of the Quality Management System, including design and development, supplier management, manufacturing, validation, complaint handling and post-market surveillance.
Manufacturers are expected to establish systematic processes for identifying hazards, estimating and evaluating risks, implementing appropriate risk control measures, and monitoring the effectiveness of those controls throughout the lifetime of the device. Risk management should be a continuous process that evolves as new information becomes available from production, customer feedback, vigilance activities and post-market surveillance.
Although ISO 13485 defines the quality management requirements, it does not prescribe a specific methodology for managing risk. Instead, manufacturers are expected to apply ISO 14971, the internationally recognised standard for the application of risk management to medical devices. Together, ISO 13485 and ISO 14971 provide a comprehensive framework for ensuring medical devices remain safe and effective from initial concept through to end of life.
CFR 21 Part 820 (Quality System Regulation)
Historically, FDA 21 CFR Part 820 addressed risk management differently. Rather than requiring a dedicated, lifecycle-based risk management process, risk considerations were embedded throughout individual quality system requirements such as design controls, production and process controls, process validation, purchasing controls, complaint handling, corrective and preventive action (CAPA) and servicing.
For example, manufacturers were required to perform design validation, validate manufacturing processes where results could not be fully verified by inspection, investigate complaints, implement corrective actions and maintain production controls that reduced the likelihood of defects. While these activities clearly involved risk management principles, the regulation did not explicitly require manufacturers to implement ISO 14971 or maintain a formal risk management file throughout the product lifecycle.
With the introduction of the FDA’s Quality Management System Regulation (QMSR), the FDA has aligned its quality system requirements much more closely with ISO 13485. This harmonisation encourages manufacturers to adopt a consistent, internationally recognised approach to lifecycle risk management while continuing to meet FDA-specific regulatory obligations.
Difference
The key historical difference was that ISO 13485 explicitly promotes a structured, lifecycle-based approach to risk management and is designed to work alongside ISO 14971, whereas FDA 21 CFR Part 820 incorporated risk management principles within individual quality system requirements rather than requiring a comprehensive, standalone risk management framework.
As the FDA transitions to the Quality Management System Regulation (QMSR), these differences are becoming significantly smaller. Manufacturers can now develop a single integrated Quality Management System that combines ISO 13485 with ISO 14971 to satisfy both international regulatory expectations and FDA quality system requirements, reducing duplication while improving consistency across global markets.
Understanding ISO 14971 Risk Management
Risk management is a fundamental requirement of both ISO 13485 and the FDA Quality System Regulation. If you'd like to learn how manufacturers identify hazards, evaluate risks, implement risk controls and maintain compliant Risk Management Files throughout the product lifecycle, explore our Complete Guide to ISO 14971 Risk Management for Medical Devices.
3. Design and Development Requirements
ISO 13485
ISO 13485 includes comprehensive requirements for the design and development of medical devices, ensuring that products are developed in a controlled and systematic manner. The standard requires manufacturers to establish documented procedures covering every stage of the design and development process, from initial concept through to commercial release.
This includes:
- Design and development planning.
- Design inputs.
- Design outputs.
- Design reviews.
- Design verification.
- Design validation.
- Design transfer.
- Design changes.
- Design and development records.
Throughout the process, manufacturers must ensure that design outputs satisfy design inputs, risks are appropriately managed, and the finished medical device meets its intended purpose, user needs and applicable regulatory requirements.
ISO 13485 also promotes cross-functional collaboration between engineering, quality, regulatory affairs, manufacturing and clinical teams to ensure design decisions are fully documented, reviewed and traceable throughout the product lifecycle.
CFR 21 Part 820 (Quality System Regulation)
Historically, FDA 21 CFR Part 820 also required manufacturers to establish comprehensive design controls for Class II and Class III medical devices, with some Class I devices also subject to design control requirements.
The regulation specified detailed requirements for:
- Design and development planning.
- Design inputs.
- Design outputs.
- Design reviews.
- Design verification.
- Design validation.
- Design transfer.
- Design changes.
- Design history files (DHF).
Unlike many international standards, Part 820 prescribed these requirements within federal regulations, making them directly enforceable during FDA inspections. Manufacturers were expected to maintain objective evidence demonstrating that design activities had been properly planned, reviewed, verified and validated before commercial release.
The FDA has now introduced the Quality Management System Regulation (QMSR), aligning US quality system requirements much more closely with ISO 13485 while continuing to maintain certain FDA-specific regulatory obligations.
Difference
Both ISO 13485 and FDA 21 CFR Part 820 require robust design controls to ensure medical devices are safe, effective and suitable for their intended use. Both frameworks cover the entire design and development process, including planning, verification, validation and design change management.
Historically, the primary difference was that ISO 13485 established an internationally recognised quality management framework that allowed manufacturers flexibility in how they demonstrated compliance, whereas FDA 21 CFR Part 820 prescribed specific regulatory requirements that were directly enforceable by the FDA during inspections.
With the introduction of the FDA’s Quality Management System Regulation (QMSR), these differences are becoming significantly smaller. Manufacturers can now establish a single integrated design and development process that satisfies both ISO 13485 and FDA expectations, reducing duplication while supporting global regulatory compliance.
Design Controls Are the Foundation of a Compliant QMS
Both ISO 13485 and the FDA's Quality System Regulation require manufacturers to implement structured design controls throughout the product lifecycle. Learn more about the medical device design and development process, including design planning, design inputs and outputs, verification, validation, design transfer and change management to support global regulatory compliance.
Why Validation Is Essential for ISO 13485 Compliance
Validation is a fundamental requirement of both ISO 13485 and the FDA Quality System Regulation, providing objective evidence that processes, equipment and systems consistently achieve their intended results. Discover our Complete Guide to Medical Device Validation, covering process validation, software validation, cleaning validation, packaging validation, sterilisation validation and regulatory expectations throughout the medical device lifecycle.
4. Documentation and Record-Keeping
ISO 13485
ISO 13485 places significant emphasis on documented information and maintaining objective evidence that a Quality Management System (QMS) is operating effectively. Documentation provides the foundation for demonstrating regulatory compliance, supporting product quality and ensuring traceability throughout the medical device lifecycle.
Manufacturers are required to establish, implement and maintain documented procedures appropriate to the size and complexity of their organisation. Documents must be reviewed, approved, controlled and kept up to date, while obsolete documents should be removed from use or clearly identified to prevent unintended application.
Typical documentation required under ISO 13485 includes:
- Quality Manual (where applicable)
- Quality Policy and Quality Objectives
- Standard Operating Procedures (SOPs)
- Work Instructions
- Risk Management documentation
- Design and Development records
- Validation protocols and reports
- Internal audit records
- CAPA records
- Supplier evaluations
- Training records
- Complaint files
- Post-Market Surveillance documentation
- Technical Documentation
Records must be retained for defined periods and provide objective evidence that products consistently meet customer, regulatory and quality requirements. Effective document control also supports change management, traceability and continual improvement throughout the Quality Management System.
CFR 21 Part 820 (Quality System Regulation)
Historically, FDA 21 CFR Part 820 also required comprehensive documentation but prescribed several specific record types that manufacturers were legally required to establish and maintain.
These included:
- Device Master Record (DMR)
- Device History Record (DHR)
- Design History File (DHF)
- Quality System Records (QSR)
- Complaint files
- CAPA documentation
- Process validation records
- Purchasing controls
- Acceptance activities
- Calibration and maintenance records
The regulation required manufacturers to maintain these records in a manner that ensured they were complete, accurate and readily available during FDA inspections.
FDA investigators routinely review documentation during inspections to verify that quality system activities have been performed as required and that objective evidence exists to demonstrate compliance.
Under the FDA’s Quality Management System Regulation (QMSR), documentation requirements are now much more closely aligned with ISO 13485, allowing manufacturers to adopt internationally recognised document control practices while continuing to meet FDA-specific regulatory expectations.
Difference
Both ISO 13485 and FDA 21 CFR Part 820 require comprehensive documentation and effective document control to demonstrate that medical devices are developed, manufactured and maintained in accordance with applicable quality and regulatory requirements.
Historically, the principal difference was that ISO 13485 established broad document control requirements within an international Quality Management System framework, while FDA 21 CFR Part 820 prescribed several specific record types—including the Design History File (DHF), Device Master Record (DMR) and Device History Record (DHR)—that manufacturers were required to maintain for FDA inspection.
With the introduction of the FDA’s Quality Management System Regulation (QMSR), documentation practices are becoming increasingly harmonised. Manufacturers can now implement a single, well-controlled documentation system that satisfies both ISO 13485 and FDA quality system requirements, reducing duplication while improving consistency, traceability and regulatory compliance across international markets.
Ready to Implement ISO 13485?
Understanding the differences between ISO 13485 and the FDA Quality System Regulation is only the first step. If you're ready to build or improve your Quality Management System, explore our ISO 13485:2016 Requirements & Implementation Guide, providing a practical, clause-by-clause walkthrough covering documentation, leadership, design controls, supplier management, risk management, validation, internal audits and certification readiness.
5. Supplier Management
ISO 13485
ISO 13485 requires manufacturers to establish robust processes for the selection, evaluation, monitoring and re-evaluation of suppliers to ensure that externally provided products and services consistently meet specified quality and regulatory requirements.
Rather than treating every supplier equally, the standard promotes a risk-based approach to supplier management. The level of oversight should be proportionate to the potential impact a supplier could have on the safety, performance and regulatory compliance of the finished medical device.
Manufacturers are expected to define criteria for supplier approval, monitor supplier performance and take appropriate action where performance falls below acceptable levels. Typical supplier controls may include:
- Supplier qualification and approval.
- Supplier audits.
- Performance monitoring.
- Incoming inspection.
- Supplier scorecards.
- Corrective action requests.
- Change notification procedures.
- Periodic supplier re-evaluation.
ISO 13485 also encourages manufacturers to establish Quality Agreements with critical suppliers. These agreements help define responsibilities, communication pathways, documentation requirements and change control processes, ensuring both organisations clearly understand their obligations throughout the supply chain.
CFR 21 Part 820 (Quality System Regulation)
Historically, FDA 21 CFR Part 820 addressed supplier management through Purchasing Controls (Section 820.50).
Manufacturers were required to establish procedures ensuring that all purchased or otherwise received products and services conformed to specified requirements before being incorporated into finished medical devices.
This included:
- Evaluating and selecting suppliers.
- Defining purchasing requirements.
- Maintaining supplier records.
- Monitoring supplier performance.
- Ensuring purchased products met established specifications.
Unlike ISO 13485, Part 820 did not explicitly require a formal risk-based supplier management programme. Instead, it required manufacturers to implement purchasing controls sufficient to ensure conformity with established requirements regardless of supplier type.
With the introduction of the FDA’s Quality Management System Regulation (QMSR), supplier management requirements are becoming more closely aligned with ISO 13485, encouraging manufacturers to adopt internationally recognised, risk-based supplier management processes while continuing to satisfy FDA purchasing control requirements.
Difference
Both ISO 13485 and FDA 21 CFR Part 820 recognise that suppliers play a critical role in ensuring the quality and safety of medical devices.
Historically, the principal difference was that ISO 13485 promotes a risk-based supplier management approach, allowing manufacturers to apply increased oversight to suppliers whose products or services have a greater impact on device safety and regulatory compliance. This often includes supplier segmentation, performance monitoring, supplier audits and formal Quality Agreements for critical suppliers.
By comparison, FDA 21 CFR Part 820 focused primarily on purchasing controls, requiring manufacturers to establish procedures that ensured purchased products consistently met specified requirements, without explicitly requiring a lifecycle-based risk management approach.
As the FDA transitions to the Quality Management System Regulation (QMSR), these differences are becoming increasingly harmonised. Manufacturers can now establish a single supplier management programme based on ISO 13485 principles that satisfies both international quality management expectations and FDA regulatory requirements while improving supply chain resilience and reducing compliance complexity.
The New FDA QMSR Framework: Harmonization is Here
The FDA has officially transitioned from the old QSR to the new Quality Management System Regulation (QMSR), incorporating ISO 13485:2016 by reference into 21 CFR Part 820. This historic transition streamlines compliance requirements for international manufacturers by addressing five major areas:
1. Incorporation of Risk Management Principles:
The QMSR explicitly integrates risk management concepts directly from ISO 13485, emphasizing the absolute necessity of identifying, managing, and controlling safety risks throughout the entire product lifecycle.
2. Adopted Supplier Controls:
The regulation now utilizes a comprehensive approach to supplier management, reflecting the standard’s strict emphasis on supplier evaluation, selection criteria, and continuous performance monitoring.
3. Harmonized Documentation Requirements:
By aligning record-keeping parameters with international expectations, the FDA has reduced the historical double-documentation burden on manufacturers operating in multiple global jurisdictions.
4. Aligned Design Controls:
Design and development planning, input, output, and validation requirements now closely mirror the workflows found within ISO 13485, promoting a unified approach to design files.
5. Enhanced Global Compatibility:
With the QMSR active, it is structurally cleaner for international manufacturers to expand into the U.S. market, and significantly easier for established U.S. companies to export devices globally.
Summary
Understanding the differences between ISO 13485 and CFR 21 Part 820 is crucial for medical device manufacturers aiming to ensure compliance and maintain high-quality standards in the US and wider international markets. While ISO 13485 provides an international framework focusing on risk management and flexibility, the old QSR offered a highly prescriptive path specific only to the U.S. market.
The FDA’s official transition to the QMSR framework marks a monumental step toward true global harmonization. By integrating ISO 13485 into 21 CFR Part 820, these changes effectively streamline international compliance, strip away historical double-documentation burdens, and enhance the competitive agility of modern device manufacturers.
As the global regulatory landscape evolves, staying informed about these intersections is essential. By understanding and adapting to these standards, manufacturers can ensure their products meet the highest quality and safety standards, fostering trust and reliability across all borders.
Frequently Asked Questions about ISO 13485 & FDA 21 CFR Part 820
ISO 13485 is an international standard for Quality Management Systems (QMS) specific to medical devices, while 21 CFR Part 820 is the FDA’s Quality System Regulation (QSR) governing medical devices in the United States.
- ISO 13485: Focuses on globally harmonized QMS requirements for medical devices.
- 21 CFR Part 820: Enforces regulatory requirements for devices sold in the US market.
Key insight: While they overlap in many areas, ISO 13485 is voluntary unless required by specific regulations, whereas 21 CFR Part 820 is mandatory for US market access.
No, but they are closely aligned. Both emphasize quality management for medical devices but differ in focus:
- ISO 13485: Geared towards general medical device QMS, emphasizing global applicability and harmonization.
- 21 CFR Part 820: A regulatory requirement with specific directives for FDA compliance, including premarket and postmarket considerations.
Pro tip: Compliance with ISO 13485 often makes it easier to meet 21 CFR Part 820 requirements, but it does not guarantee FDA approval.
Both frameworks share core principles, including:
- Documented QMS: Requirement for structured quality systems.
- Risk Management: Integration of risk-based approaches to processes and product development.
- Design Controls: Comprehensive design and development processes.
- Supplier Management: Oversight of suppliers to ensure quality.
- Complaint Handling: Procedures for addressing complaints and adverse events.
- Post-Market Surveillance: Monitoring device performance after commercialization.
Key takeaway: Manufacturers targeting both global and US markets can leverage the overlap to streamline compliance efforts.
Some notable differences include:
| Aspect | ISO 13485 | 21 CFR Part 820 (QSR) |
|---|---|---|
| Scope | International standard | US-specific regulatory requirement |
| Focus | General QMS for global compliance | Specific to FDA regulations |
| Risk Management | Emphasized but less prescriptive | Embedded in device design controls |
| Flexibility | Provides general guidelines | FDA enforces strict compliance |
| Terminology | Uses terms like “validation” | More regulatory-specific terms like “verification” |
Key insight: ISO 13485 is more flexible and adaptable, while 21 CFR Part 820 is highly prescriptive for FDA compliance.
No, ISO 13485 certification is not a substitute for compliance with 21 CFR Part 820. However, the FDA recognizes ISO 13485 as a harmonized standard and is working towards aligning the QSR with ISO 13485.
Pro tip: Manufacturers planning to market devices globally should implement ISO 13485 alongside compliance with 21 CFR Part 820.
Yes! Patient Guard provides expert support for both frameworks, including:
- Developing ISO 13485-compliant Quality Management Systems.
- Aligning existing systems with 21 CFR Part 820 requirements.
- Preparing for FDA inspections and ISO audits.
- Training teams on regulatory differences and best practices.
Why choose Patient Guard: With experience supporting over 500 manufacturers, we help streamline compliance for both US and global markets, ensuring seamless regulatory approvals.
References
This guide is based on the following international standards, legislation and official regulatory guidance relating to Quality Management Systems (QMS), ISO 13485 and the U.S. Food and Drug Administration's Quality Management System Regulation (QMSR).
| Organisation | Reference | Why it's relevant |
|---|---|---|
| International Organization for Standardization (ISO) | ISO 13485:2016 – Medical Devices – Quality Management Systems – Requirements for Regulatory Purposes | Defines the internationally recognised Quality Management System requirements for organisations involved in the design, manufacture and lifecycle management of medical devices. |
| U.S. Food and Drug Administration (FDA) | Quality Management System Regulation (QMSR) | Explains the FDA's Quality Management System Regulation, including its incorporation of ISO 13485:2016 and its implementation for medical device manufacturers. |
| U.S. Food and Drug Administration (FDA) | Medical Devices; Quality System Regulation Amendments (Final Rule) | Publishes the final rule establishing the FDA's Quality Management System Regulation (QMSR) and aligning U.S. quality system requirements more closely with ISO 13485. |
| International Organization for Standardization (ISO) | ISO 14971:2019 – Medical Devices – Application of Risk Management to Medical Devices | Provides the internationally recognised framework for medical device risk management, which is closely integrated with ISO 13485 and reflected within the FDA's quality system expectations. |
| European Union | Regulation (EU) 2017/745 on Medical Devices (MDR) | Provides the European regulatory framework that relies on an appropriate Quality Management System throughout the medical device lifecycle, making ISO 13485 the recognised international benchmark. |
| U.S. Food and Drug Administration (FDA) | Overview of Device Regulation | Provides an overview of the FDA's medical device regulatory framework, including the role of the Quality Management System Regulation within the broader U.S. regulatory system. |
Quality management standards and regulatory requirements continue to evolve. Manufacturers should always consult the latest published standards, legislation and official regulatory guidance when implementing or maintaining Quality Management Systems for global medical device compliance.
Patient Guards Recent Posts
Cosmetic Product Safety Report (CPSR): A Complete Guide to UK Cosmetic Compliance
Before a cosmetic product can legally be placed on the UK market, manufacturers and Responsible Persons must demonstrate that it is safe for human use under normal or reasonably foreseeable conditions. The Cosmetic Product Safety Report (CPSR) is one of the most important regulatory documents required under the UK Cosmetics Regulation. This guide explains what a CPSR is, who can prepare one, what information it must contain, how it relates to the Product Information File (PIF) and how it supports legal cosmetic compliance.
IVDR PMPF Explained: A Complete Guide to Post-Market Performance Follow-up
Post-Market Performance Follow-up (PMPF) is a fundamental requirement under the EU In Vitro Diagnostic Regulation (IVDR), ensuring that manufacturers continually monitor the scientific validity, analytical performance and clinical performance of their in vitro diagnostic medical devices after CE marking. This guide explains IVDR PMPF requirements, PMPF Plans, PMPF Reports, Annex XIII expectations and how ongoing performance monitoring supports continued regulatory compliance throughout the device lifecycle.
IVDR Scientific Validity Explained: A Complete Guide for Manufacturers
Scientific Validity is the first pillar of IVDR Performance Evaluation and provides the scientific foundation demonstrating that an analyte or biomarker is associated with a specific clinical condition or physiological state. This guide explains Scientific Validity under Regulation (EU) 2017/746, including literature reviews, Scientific Validity Reports, Annex XIII requirements, evidence appraisal and how Scientific Validity supports successful CE marking.
Patient Guards Related Services
Patient Guards Regulatory Tools
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
