Practice·August 1, 2026 · 4 min read

21 CFR 820 didn't move. Its contents did.

FDA's Quality Management System Regulation, effective February 2, 2026, left the address unchanged and emptied most of what used to live there. A citation to Part 820 written last year and one written this year can point at the identical number and mean two different things.

By Connor Griggs — Regulatory & Quality Strategist

21 CFR 820.30 is a citation a device quality engineer has typed for decades without looking it up — design controls, the section a warning letter reached for whenever a firm shipped something its own design history couldn’t defend. As of February 2, 2026, that number is mostly a placeholder. The address didn’t move. What used to be filed under it did.

What the rule actually did

FDA’s final rule, published February 2, 2024, retitled Part 820 the Quality Management System Regulation and amended it to incorporate the international standard ISO 13485:2016 by reference — the harmonization the device industry had been asking for since long before this product existed. The rule carried a two-year runway: manufacturers had until February 2, 2026 to comply. That date is six months behind today, which means the version of Part 820 currently in force is not the one most people in this industry learned the numbering of.

What is actually left at the old addresses

The restructuring is not cosmetic. Subpart A now holds the scope, the definitions, the incorporation-by-reference itself, and one substantive operative section — 21 CFR 820.10, which requires a manufacturer to document a quality management system complying with the applicable requirements of ISO 13485 plus whatever else this part separately requires. Subpart B adds exactly two more sections: 820.35, control of records, and 820.45, device labelling and packaging controls. That is close to the entire regulation. The sections that used to carry their own detailed, standalone requirements — design controls at 820.30, corrective and preventive action at 820.100, complaint files at 820.198 — are reserved: the number still exists in the part, and there is no longer a rule written under it. The substance those numbers used to hold now lives in ISO 13485’s own clauses, reachable only by going through 820.10 first.

A citation to a CFR section is usually a citation to a fixed piece of text. For most of Part 820, as of this year, it is a citation to an empty room with a sign pointing somewhere else.

The same number, a different rule depending on when you ask

That makes a Part 820 citation carry something most regulation numbers don’t: a vintage. A warning letter issued in 2023 citing 820.30(g) was citing a specific, self-contained design-validation requirement, spelled out in the CFR text at that address. A finding issued after February 2026 cannot cite that same requirement the same way — it has to reach it through 820.10 and name the ISO 13485 clause the finding actually turns on. The regulation’s name for “design controls” didn’t disappear from the industry’s vocabulary. It disappeared from the one place a citation used to be able to stop and mean something on its own.

The practice

Anyone building a pattern out of historical Part 820 citations — the same exercise this blog has described for warning-letter subject lines, tallying a quarter’s worth of enforcement themes — now has to split that corpus at February 2, 2026 before trusting any trend across it. A count of “820.30” citations that drops to zero after that date is not evidence that design-control findings stopped. It is evidence that the citation moved to 820.10 with an ISO clause number doing the work 820.30 used to do alone. Reading the two eras as one continuous series, without accounting for the rewrite in between, would manufacture a trend that is really just a renumbering.

FDA Radar’s Federal Register filter lists “quality system regulation” and “qmsr” among the terms it checks before an item reaches the device-relevant feed at all, and every Federal Register item we ingest carries its cfr_references at the same part-level granularity as any other citation we handle — “21 CFR 820,” not the section beneath it. That catches a QMSR-related notice the same way it catches any other Part 820 document; what it changed underneath is still a person’s job to read. Whether a specific historical citation still means what it used to, for a specific finding you’re assessing, is a determination for whoever is reading that file — this is a description of what changed in the regulation’s own structure, never regulatory advice about a given citation’s current force.

Method
The PMA clock starts at the last module
Practice
The Q-Sub that doesn't buy you more time
Method
Lapsed and revoked end an EUA differently
Practice
A recall strategy has a grade. openFDA doesn't.
Method
A granted De Novo becomes a predicate.
Practice
Least burdensome changes the ask, not the bar.
Method
The lab is accredited. Not the device.
Practice
Breakthrough is law. STeP is a guidance.
Practice
MDSAP replaces routine. Not for-cause.
Method
No field on a 510(k) says what it treats
Method
Discretion is a policy. Exclusion is a statute.
Practice
Designated by one office. Approved by another.
Method
MedSun sits beside MAUDE, not inside it
Practice
The five-unit device never gets a K-number
Practice
Meeting the criteria isn't a tracking order
Method
The PMA clock doesn't stop at approval
Practice
The K-number doesn't track today's device
Method
A MAUDE report proves it was filed
Practice
Not every MDR starts with the manufacturer
Method
Completed. Not terminated.
Practice
The device-ban list has three entries
Method
The UDI exception has its own deadline
Method
MDUFA VI is being negotiated in public
Practice
The inspection manual changed, not the rule
Method
The count Congress had to legislate
Practice
The small-business rate isn't retroactive
Method
A detention order has no docket to read
Practice
PMA approvals moved off the Federal Register
Method
A citizen petition names names
Practice
A market withdrawal isn't a recall
Method
Not every device letter comes from CDRH
Practice
Closed on one device. Open on the rest.
Method
No IDE is confirmed until the PMA is
Practice
The remedial-action call sets the clock
Method
Jurisdiction is a letter, not a field
Practice
An address is not a footprint
Method
The final rule that isn't final yet
Practice
The special controls aren't in the record
Method
Exempt from GMP. Not from complaints.
Practice
The notify list isn't the shortage list
Method
A constraint can't be skipped. A script can.
Practice
No cron sends this. A person does.
Method
Corrected, not rewritten
Practice
Quiet is a finding, not a default
Method
The summary is public. The statement isn't.
Practice
A competitor's 513(g) leaves no trace
Practice
An empty response field proves nothing
Method
A petition is public. Its outcome isn't.
Practice
The panel is a category, not a meeting
Method
An accessory carries its own classification
Method
A TPLC report is a category, not a device
Practice
A 522 order is a question, not a verdict
Method
A PCCP change leaves no new record
Practice
Not every signal becomes a recall
Method
eSTAR did not remove the acceptance check
Practice
An early alert has no recall number yet
Practice
A consent decree isn't a database row
Method
The record has no cybersecurity field
Practice
Classification Change is not one event
Method
Publication date is not effective date
Method
One event. Many recall numbers.
Practice
Quantity is a sentence, not a number
Practice
How a firm told you is a field too
Method
A RIN outlives the document number
Method
The docket ID is not the comments
Practice
The 510(k) record doesn't name the predicate
Practice
The 510(k) FDA didn't review first
Method
The letter FDA doesn't have to post
Practice
Cleared doesn't say which track it took
Method
The clock stops. The calendar doesn't.
Method
Why a guessed match never reaches you
Practice
The standards list never names a device
Method
The guidance isn't in the Federal Register.
Practice
Filtered. Not discarded.
Method
There are two recall databases, not one
Practice
Breakthrough status is confidential by law
Practice
One MAUDE report is not one malfunction
Method
A supplement number is not a track
Method
Cleared is not approved
Practice
Nationwide doesn't mean your building
Practice
Not every correction reaches FDA
Method
Registered. Not reviewed.
Method
Contact ODE is not a pathway
Practice
Almost no recall is FDA-mandated
Method
FDA's device names read like a card catalog
Practice
openFDA is free. It is not unlimited.
Method
GUDID stores the model. Not the box.
Practice
Detention doesn't need a warning letter
Method
A Class I device, a Class I recall
Method
The product code that doesn't exist yet
Practice
The classification posts. The 483 behind it doesn't.
Method
A recall has three dates, and the pipeline had to pick one
Practice
The count is real. The rate is not.
Method
The firm on the record is not the firm on the box
Practice
Low confidence is an instruction, not a hedge
Method
The same company, spelled three ways
Practice
A device that was never a medical device
Method
FDA's warning letters, addressed by column number
Practice
Your regulation has a decimal. FDA's watch doesn't.
Method
Three letters is too short to search for
Practice
Most warning letters never close
Method
The guidance that skipped the draft
Practice
Ongoing, as of when?
Method
The least interesting fact in a 510(k)
Practice
No recall arrives with a product code attached
Practice
The deadline that doesn't email you
Method
The warning letter has two dates
Method
How to monitor FDA without drowning
Practice
Your predicate was recalled. Now what?
Method
Why no item reaches you without a human