AAMI Quality Systems White Paper: Comparison of 21 CFR Part 820 To ISO 13485:2016

AAMI Quality Systems
White Paper
Comparison of 21 CFR Part 820
to ISO 13485:2016
February 2017, Updated February 2018
AUTHORS
Seb Clerkin, GMP Advisory Services
Nicola Martin, Owner, Nicola Martin Consulting
Jack Ward, Owner, Ward Sciences and Consulting LLC
Tina Krenc, Owner, KTA Compliance Consulting
Tonya Wilbon, Quality Systems Specialist, FDA, Center for Devices and Radiological Health,
Office of In Vitro Diagnostics and Radiological Health
A. ISO 13485:2016—What is it?

ANSI/AAMI/ISO 13485:2016, Medical devices—Quality management systems—Requirements
for regulatory purposes, specifies requirements for a Quality Management System when an
organization needs to demonstrate its ability to provide medical devices and related services
that consistently meet customer requirements and regulatory requirements applicable to
medical devices and related services.
This International Standard specifies requirements for a Quality Management System that
can be used by an organization involved in one or more stages of the life-cycle of a medical
device, including design and development, production, storage and distribution, installation,
servicing and final decommissioning and disposal of medical devices, and design and
development, or provision of associated activities (e.g., technical support). The requirements
in this International Standard may also be used by suppliers or other external parties providing
product (e.g., raw materials, components, subassemblies, medical devices, sterilization
services, calibration services, distribution services, maintenance services) to such organizations.
The supplier or external party can voluntarily choose to conform to the requirements of this
International Standard or can be required by contract to conform.
© AAMI AAMI Quality Systems White Paper 1

Note that this 2016 revision to ISO 13485 supersedes and replaces the 2003 revision of
ISO 13485. Medical device manufacturers that were conforming to the 2003 revision of this
standard must achieve conformance to the 2016 revision no later than 3 years after the March
2016 publication of ISO 13485:2016.
B. Significant concept differences between the 21 CFR 820

and ISO 13485:2016
Product realization: Product realization is a set of interrelated processes that support the
design and development, manufacturing, installation, and servicing of finished goods that
meet customer requirements and intended purposes. These interrelated processes must be
consistent with other processes of the Quality Management System, such as those related to
resource management or measurement analysis and improvement. A key requirement for
Planning of product realization is that the organization must document one or more processes
for risk management in product realization. Records of risk management activities must be
maintained.
Risk management: The Standard is very specific on using risk management to make
decisions on activities related to Quality Systems or product realization processes when
the effect of the process or situation could have an effect on the medical device safety or
performance.
Definition of product: The Standard defines product as the “result of a process” with a note
that there are four generic product categories:
• Services (e.g., transport)
• Software (e.g., computer program, dictionary)
• Hardware (e.g., engine mechanical part)
• Processed materials (e.g., lubricant)
The concept of product must be considered when determining the applicability of the clauses
of the Standard.
C. Importance of ISO 13485 to medical device manufacturers

Compliance with ISO 13485 is often seen as the first step in achieving compliance with
European regulatory requirements. The conformity of Medical Devices and In-vitro Diagnostic
Medical Device according to European Union (EU) Regulations—Regulation (EU) 2017/745 of
the European Parliament and of the Council of 5 April 2017 on Medical Devices and Regulation
(EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on In Vitro
Diagnostic Medical Devices—must be assessed before sale is permitted. The preferred method
to prove conformity is the certification of the Quality Management System according ISO 13485
by a Notified Body. The result of a positive assessment is the certificate of conformity allowing
the Conformité Européenne (CE) mark and the permission to sell the medical device in the
European Economic Area (EEA). Compliance to ISO 13485:2016 is also supportive of other
regulatory body requirements for Quality Management Systems. Finally, ISO 13485:2016 is
included as part of the MDSAP Audit Model (2017-01-06 MDSAP AU P0002.004).
2 AAMI Quality Systems White Paper © AAMI

D. Comparing different Quality Management Systems standards and regulations
Comparing which
standards/regulations? Use these references
1. ISO 13485:2003 to ISO 13485:2016 1. Annex A of ISO 13485:2016 (page 27)
2. ISO 13485:2016 to ISO 9001:2015 2. Annex B of ISO 13485:2016 (page 31)
3. ISO 13485:2003 to 21 CFR Part 820 3. AAMI Compendium, 3rd edition (Table 3.1)
4. ISO 13485:2016 to 21 CFR Part 820 4. This AAMI white paper (Table 1)
E. Table 1—Additional information

Note that in several key ISO 13485:2016 clauses in Table 1 (Design Controls and CAPA, for example), the authors have included
an estimate of resources that would be required to update existing 21 CFR Part 820 Quality System procedures and resultant
processes to meet the ISO 13485:2016 Standard. These estimates are provided as initial assumptions only and it is recommended
that each organization should conduct a directed analysis to determine actual resources that would be required for a specific
Quality Management System.
Estimate of effort to update existing

21 CFR Part 820 QS Management
System components to align with
ISO 13485:2016 Level Examples
Minor updates required to existing Minor Clause 8.2.6: New requirement to
documents document test equipment used
Major updates to existing documents or Moderate Clauses 7.3.7: Design Validation
new documents required plans required

Table 1—Comparison of 21 CFR Part 820 to ISO 13485:2016
21 CFR Part 820

Quality System
Regulation sections ISO 13485:2016 clause(s)
(“the Regulation”) (“the Standard”) Similarities, significant differences, and key requirements
N/A 0.1 Introduction, general Section 0.1 addresses:
0.2 Clarification of concepts • Its potential application by suppliers to medical device
0.3 Process approach manufacturers
0.4 Relationship with ISO 9001 • How to use the Standard to meet any quality management
system requirements from regulatory jurisdictions and the
0.5 Compatibility with other expected work by the organization
management systems
• Action required by the organizations related to the standard
definitions and potential for national and regional differences
in definitions
• The complimentary nature of the quality system requirements
and the technical requirements for products
• The strategic determination of an adoption of a Quality
Management System (QMS) and influencers
Section 0.2 describes common term or phrase utilization including:
• As appropriate
• Product
• Risk
• Shall, should, may, and can
Explanations of the meaning of “as appropriate” in the
Standard are similar to “where appropriate” in the Regulation
with the Standard including the necessity to manage risk and
comply with applicable regulatory requirements if a requirement
is deemed appropriate.
Section 0.3 explains the process approach. The Regulation has
no similar explanation.
Section 0.4 explains its relationship with ISO 9001 and
references ISO 9000:2015 with regard to the fundamentals
of Quality Systems. The Regulation does not reference these
standards, although it does use some terms and concepts that
appear in these standards.
Section 0.5 addresses compatibility with management systems
for other types of activities. The Regulation does not.
ISO 13485:2016 places an emphasis on the on the lifecycle of
the medical device.

21 CFR Part 820
Quality System
820.1 Scope 1 Scope The Regulation addresses exemptions, applicability to foreign
(a) Applicability 2 Normative references manufacturers, and the authority under which the Regulation
was promulgated. The Regulation also addresses possible
(b) Alignment with conflicts between compliance with the Regulation and with
other regulations other FDA regulations.
(c ) Authority The Standard addresses regulatory exclusions from design
(d) Foreign controls (based on scope of operations).
manufacturers The Standard includes:
(e) Exemptions or • Distribution in the scope, and although not in this section of
variances the Regulation, is covered in subpart L
• Provision of associated activities (e.g., technical support); this
is not specifically called out in the Regulation
• Applies the Standard to medical devices and associated services
• Specifically states that the processes in the Standard are
the responsibility of the organization regardless of whether
or not they perform the process an ace accounted for in
the organizations QMS by monitoring, maintaining and
controlling the processes
The Regulation and Standard BOTH address:
• Exclusions and exceptions, however the Regulation is very
specific to the types of products where the Regulation is
applicable
• How design and development controls can be excluded from
a QMS
• Actions to take when determining that a specific part of the
requirements is not applicable
820.3 Definitions 3 Terms and definitions The Standard:
• Relies on ISO900:2015, GHTF documents, and additional or
changed definitions within the standard
• Includes definition for advisory notice which is in the 803
section of the CFR
There are numerous differences between terms and definitions
in the CFR and the standard. Two significant definitions are
those of manufacturer and product.
Significant definitions that are only in the CFR or the Standard:
• In the Standard are definitions of: clinical evaluation,
importer, life-cycle, medical device, post-market surveillance.
• In the CFR are definitions of: control number, establish,
finished device.

21 CFR Part 820
Quality System
820.5 Quality system 4 Quality management system The Regulation and the Standard specify that manufacturers or
4.1 General requirements organizations have flexibility in structuring their Quality System
according to their device type, organization size and structure,
4.1.1 needs, and situation that meets the requirements of the
standard or the Quality System regs. Both require maintenance
of the effectiveness of the Quality System. The regulation
terminology is Quality System, the standard terminology is
Quality Management System.
The standard requires that the organization documents the
role(s) undertaken by the organization under the applicable
regulatory requirements.
N/A 4.1 General requirements The Standard requires the organization to determine the
4.1.2 processes needed for the QMS and the application of those
processes throughout the organization based on the role
undertaken by the organization. A risk-based approach must
be applied to control the appropriate processes needed for the
QMS and documentation of the sequence and interactions of
the QMS processes is required.
N/A 4.1 General requirements The Standard requires that for each QMS process, the
4.1.3 organization must:
• Determine criteria and methods required to make sure that
the operation and control of the processes are effective
• Ensure that there are adequate resources and information
necessary to support operation and monitoring of the
processes
• Implement actions required to achieved planned results and
maintain the effectiveness of the processes
• Monitor, measure, as appropriate, and analyze the processes
• Establish and maintain records that demonstrate conformance
to the Standard and compliance with applicable regulatory
requirements.
N/A 4.1 General requirements The Standard requires that the organization manages the QMS
4.1.4 processes according to the Standard and applicable regulatory
requirements. Changes made to the processes must be
controlled as required by the Standard and applicable regulatory
requirements and evaluated for:
• Impact on QMS
• Impacted on the medical devices produced under the QMS

21 CFR Part 820
Quality System
N/A 4.1 General requirements The Standard requires that when an organization outsources any
4.1.5 process that affects product conformity to requirements, it must
monitor and ensure control over that process. The organization
retains responsibility for conformance of that outsourced
process to the Standard, the customer, and applicable regulatory
requirements. The controls are proportionate to the risk involved
and the ability of the external party to meet the requirements
(according to 7.4). Written quality agreements are required.
820.20 Management 5.1 Management commitment The Regulation states that management with executive
responsibility responsibility is responsible for:
• Quality policy
• Appointment and documentation of management
representative
• Management review of the Quality System
The Standard states that top management is responsible for:
• Communication of the importance of meeting customer and
regulatory requirements
• Quality policy
• Ensuring quality objectives are established
• Management reviews
• Availability of resources
Specifics on each topic are further discussed in the individual
clauses of both the Regulation and the Standard.
N/A 5.2 Customer focus The Standard requires that top management ensure that
customer requirements and applicable regulatory requirements
are determined and met.
820.20(a) Quality 5.3 Quality policy The Regulation and the Standard require a quality policy that
policy is communicated and understood by the organization. The
Standard specifies criteria of a quality policy, including review for
continued suitability.
820.20(b) 5.5.1 Responsibility and The Regulation specifies the establishment of an organizational
Organization authority structure. The Standard requires that top management
documents the interrelation of all personnel who perform
work that could impact quality and ensure independence and
authority necessary to perform that work.
820.20(b)(1) 5.5.1 Responsibility and The requirements of the Regulation and the Standard are similar.
Responsibility and authority No significant differences.
authority
820.20(b)(2) 5.1 Management commitment The requirements of the Regulation and Standard are similar.
Resources 6.1 Provision of resources

21 CFR Part 820
Quality System
820.20(b)(3) 5.5.2 Management The requirements for appointment of, documentation of, and
Management representative responsibilities of a management representative are similar. The
representative Regulation requires the management representative to report on
the “performance” of the Quality System. The Standard requires
the management representative to report on the effectiveness
of the QMS and any need for improvement. The Standard also
has an additional requirement for promotion of awareness of
regulatory and QMS requirements throughout the organization.
820.20(c) 5.1 Management commitment Requirements to conduct periodic management reviews are
Management review 5.6 Management review similar. The Regulation specifies conducting management
reviews with sufficient frequency and specifies the
5.6.1 General documentation of the date of the review and the results.
5.6.2 Review input Compliance to the standard requires that specific topics are
covered during management reviews including monitoring
5.6.3 Review output
and measurement of processes in addition to products, CAPA,
assessing opportunities for improvement and the need for
changes to the QMS, including the quality policy and quality
objectives.
The Standard requires specific review output documentation
related to improvements required to maintain all aspects of
the QMS and its processes, improvement to product related
to customer requirements, and changes due to changes in
regulatory requirements and resource needs.
820.20(d) Quality 5.4.2 Quality management Requirements of the Regulation and Standard for quality
planning system planning planning are similar. The Regulation has specific requirements
on how to define the quality plan and requirements to establish
how the requirement for quality will be met.
The Standard requires that quality objectives, including those
required to meet regulatory and product requirements,
are established within relevant functions and levels of the
organization. The quality objectives must be measureable and
link to quality policy. Top management is responsible for making
sure that quality planning is performed to meet the quality
objectives and the general aspects of the QMS and to make
sure that changes to the system are planned, and implemented
without negative impact.
N/A 5.5.3 Internal communication The Standard requires that top management ensures
appropriate communication processes are established for
communication of the effectiveness of the QMS. This is not
specifically stated within the Regulation.

21 CFR Part 820
Quality System
820.20(e) Quality 4.2 Documentation The Regulation requires establishment of procedures
system procedures requirements and instructions and an outline of the structure of the
4.2.1 General documentation used in the Quality System, but does not require
a quality manual.
4.2.2 Quality manual
The Standard requires QMS documentation including quality
policy and objectives, a quality manual, documented procedures
and records that the standard requires, documents and records
required by the organization to effectively plan, operate and
control processes, and other documents required by regulatory
requirements.
The Standard also requires that the quality manual includes
the scope of the QMS as well as details and justifications of
exclusions or non-application; documented or referenced
procedures the QMS; a description of how the QMS processes
interact , and an outline of the structure of the quality manual
system documents.
820.22 Quality audit 8.2.4 Internal audit Requirements of the Regulation and the Standard for quality
audits are similar. The Regulation includes specific requirements
for management having responsibility for the area audited to
review the audit reports and specific requirements to document
the dates of the quality audit.
The Standard specifically requires a planned audit program that
considers status and importance of the processes and areas
under audit, as well as results of previous audits.
The Standard also requires that the audit criteria, scope,
interval and methods are defined and documented. The
Standard includes specifics related to the audit report to include
identification of the processes and areas audited and the
conclusions.
The Standard includes specific requirements that management
responsible for the audited area ensure corrections and
corrective actions be taken without undue delay and any
follow-up activities include verification of the actions taken and
reporting verification results.
820.25 Personnel 6.2 Human resources, general Requirements of the Regulation and the Standard for personnel
(a) General are similar. The Standard references establishing competence,
providing needed training, and ensuring awareness of
personnel.

21 CFR Part 820
Quality System
820.25(b) Training 6.2. Human resources, general Requirements of the Regulation and Standard are similar. The
Regulation has additional requirements to make personnel
aware of the device defects that could result from improper job
performance, and to make personnel who perform verification
and validation activities aware of defects and errors they may
encounter in performing their jobs.
The Regulation specifies requirement of procedures for
identifying training needs.
The Standard specifies requirements for documenting the
process to establish competency, provide training and ensure
personnel awareness. The Standard requires a documented
risk-based evaluation of the effectiveness of the training actions
taken. The Standard expands the training needs to include
employee awareness of how their activities contribute to the
achievement of quality objectives.
N/A 7.2 Customer-related processes The Standard requires that the organization shall determine:
7.2.1 Determination of a) requirements specified by the customer, including the
requirements related to product requirements for delivery and post-delivery activities;
b) requirements not stated by the customer but necessary for
specified or intended use, as known;  
c) applicable regulatory requirements related to the product;  
d) any user training needed to ensure specified performance and
safe use of the medical device;  
e) any additional requirements determined by the organization.  
N/A 7.2 Customer-related processes The Standard requires that the organization reviews the
7.2.2 Review of requirements requirements related to product prior to the organization’s
related to product commitment to supply product to the customer (e.g.,
submission of tenders, acceptance of contracts or orders,
acceptance of changes to contracts or orders) and that:
a) product requirements are defined and documented;  
b) contract or order requirements differing from those previously
expressed are resolved;  
c) applicable regulatory requirements are met;  
d) any user training identified in accordance with 7.2.1 is
available or planned to be available, and;  
e) the organization has the ability to meet the defined requirements.  
Records of the results of the review and actions arising from the
review shall be maintained (see 4.2.5).
When the customer provides no documented statement of
requirement, the customer requirements shall be confirmed by
the organization before acceptance.
When product requirements are changed, the organization shall
ensure that relevant documents are amended and that relevant
personnel are made aware of the changed requirements.

21 CFR Part 820
Quality System
N/A 7.2 Customer-related processes The Standard requires that the organization plans and documents
7.2.3 Communication arrangements for communicating with customers related to:
product information; inquiries, contracts or order handling;
customer feedback and complaints; and, advisory notices.
The Standard requires that the organization communicates with
regulatory authorities in accordance with applicable regulatory
requirements.
820.30 Design 7.3 Design and development The Regulation requires design and development procedures for
controls 7.3.1 General design of Class III, Class II, and certain Class I devices in order to
(a) General ensure that specified design requirements are met.
The Standard requires that the organization shall document
procedures for design and development of product. The
definition of product in 3.15 is “result of a process.” Note 1
to this definition lists 4 generic product categories: services,
software, hardware, processed materials.
Refer to previous information on exclusion of design and
development requirements (820.1 and Clauses 1 & 2).
820.30(b) Design 7.3.2 Design and development The requirements for design and development planning
and development planning are similar between the Regulation and the Standard. The
planning Effort required to update Regulation requires interfaces between groups or activities
existing 21 CFR Part 820 that provide or result in input to the design and development
Quality System procedures and process be identified in the plan. The Standard requires that the
resultant processes to meet documented design and development plans include:
the ISO 13485:2016 Standard: 7.3.2 a) The design and development stages;
Minor 7.3.2 b) the review(s) needed at each design and development
stage;
7.3.2 c) the verification, validation and design transfer activities
that are appropriate at each design and development stage;
7.3.2 d) the responsibilities and authorities for design and
development;
7.3.2 e) the methods to ensure traceability of design and
development outputs to design and development inputs;
7.3.2 f) the resources needed, including necessary competence
of personnel.
Comments: Design and development planning procedures
should be reviewed to ensure adequate compliance with
7.3.2(c), 7.3.2(e), and 7.3.2(f), which are not explicitly required
in the Regulation.

21 CFR Part 820
Quality System
820.30(c) Design 7.3.3 Design and development The requirements for design inputs are similar. The Regulation
input inputs includes explicit requirement that the design input address
Effort required to update the intended use of the device and the needs of the user and
existing 21 CFR Part 820 patient and that design input requirements are approved with
Quality System procedures and a dated approval, this requirement is in the Standard in the
resultant processes to meet general area of 4.2.4 Control of documents. The Regulation also
the ISO 13485:2016 Standard: requires that the procedure includes a mechanism for addressing
Minor to Moderate incomplete, ambiguous or conflicting requirements, not required
in the Standard.
The Standard requires that design and development inputs
include:
7.3.3 a) functional, performance, usability and safety
requirements, according to intended use;
7.3.3 b) applicable regulatory requirements and standards;
7.3.3 c) applicable output(s) of risk management;
7.3.3 d) as appropriate, information derived from previous
similar designs;
7.3.3 e) other requirements essential for design and
development of the product and processes.
The Standard requires that product requirements are able to be
verified or validated.
The Standard also refers the users to IEC 62366-1, Medical
devices—Part 1: Application of usability engineering to medical
devices.
Comments: Design and development inputs procedures should
be reviewed to ensure adequate compliance with 7.3.3(a),
7.3.3(b), and 7.3.3(c), 7.3.3(d), and 7.3.3(e), which are not
explicitly required in the Regulation.
820.30(d) Design 7.3.4 Design and development Requirements for design output are similar. The Regulation
output outputs requires that design outputs are documented, reviewed and
Effort required to update approved prior to release with a dated signature.
existing 21 CFR Part 820 The Standard requires that design outputs shall:
Quality System procedures and 7.3.4 a) meet the input requirements for design and
resultant processes to meet development;
the ISO 13485:2016 Standard:
Minor 7.3.4 b) provide appropriate information for purchasing,
production and service provision;
7.3.4 c) contain or reference product acceptance criteria;
7.3.4 d) specify the characteristics of the product that are
essential for its safe and proper use.
The Standard also requires the outputs of design and development
are in a form suitable for verification against the design and
development inputs and are approved before release.

21 CFR Part 820
Quality System
The requirement identification of essential design outputs is
slightly different between the Regulation and the Standard. The
Regulation requires that outputs essential to the proper functioning
of the device are identified. The Standard requires that the
design and development outputs specify the characteristics of
the product that are essential for its safe and proper use.
Comments: Design and development outputs procedures should
be reviewed to ensure adequate compliance with 7.3.4(b),
which is not explicitly required in the Regulation.
820.30(e) Design 7.3.5 Design and development Requirements for design review are similar. The Regulation
review review requires the use of an independent reviewer, and also that the
Effort required to update results of a design review, including identification of the design,
existing 21 CFR Part 820 the date and the individual(s) performing the review shall be
Quality System procedures and documented in the design history file (DHF).
resultant processes to meet The Standard requires that design and development reviews:
the ISO 13485:2016 Standard: 7.3.5 a) evaluate the ability of the results of design and
Minor development to meet requirements;
7.3.5 b) identify and propose necessary actions.
Comments: Design and development review procedures should
be reviewed to ensure adequate compliance with 7.3.5(b),
which is not explicitly required in the Regulation.
820.30(f) Design 7.3.6 Design and development Requirements for design verification are similar. The Regulation
verification verification includes specific documentation requirements, specifically that
Effort required to update the results of the design verification, including identification of
existing 21 CFR Part 820 the design, method(s), the date, and the individual(s) performing
Quality System procedures and the verification shall be documented in the design history file
resultant processes to meet (DHF).
the ISO 13485:2016 Standard: The Standard requires planned and documented arrangements
Minor to Moderate for design verification. The plans must include methods,
acceptance criteria, and, as appropriate, statistical techniques.
The Standard also requires that when the intended use of a
medical device requires that it is connected to, or is interfaced
with, other medical device(s), the verification includes
confirmation that the design outputs meet design inputs in that
configuration.
Comments: Design and development verification procedures
should be reviewed to ensure adequate compliance with 7.3.6.

21 CFR Part 820
Quality System
820.30(g) Design 7.3.7 Design and development Requirements for design validation are similar. Both require that
validation validation the design validation is conducted on representative product.
Effort required to update Representative product includes initial production units, batches
existing 21 CFR Part 820 or their equivalent. The Standard goes further to require that
Quality System procedures and the rationale for the choice of product for design validation be
resultant processes to meet documented.
the ISO 13485:2016 Standard: The Regulation has additional requirements for risk analysis
Moderate and software validation and includes specific documentation
requirements, specifically that the results of the design
validation, including identification of the design, method(s), the
date, and the individual(s) performing the validation shall be
documented in the design history file (DHF).
The Standard requires that design and development validation
is planned and has documented arrangements to ensure that
the product can meet the requirements of the application or
intended use. The validation plans must also include methods,
acceptance criteria and, as appropriate, statistical techniques
with rationale for sample size.
The Standard requires that as part of design validation, the
organization shall perform clinical evaluations or performance
evaluations of the medical device in accordance with applicable
Similar to design and development verification the Standard
requires that if the intended use requires that the medical
device be connected to, or have an interface with, other
medical device(s), validation shall include confirmation that the
requirements for the specified application or intended use have
been met when so connected or interfaced.
The Standard requires that validation is completed prior to release
for use of the product to the customer. Because of this, and the
requirement for Clinical or performance evaluations be part of
design and development validation, the standard states that
a medical device used for clinical evaluation or performance
evaluation is not considered to be released for use to the customer.
Records of the results and conclusions of the validation and
necessary actions shall be maintained (see 4.2.4 and 4.2.5).
The requirement for Clinical Evaluation/Performance Evaluation
is very different from the Regulation, but not different from
what is done for FDA submissions.

21 CFR Part 820
Quality System
820.30(h) Design 7.3.8 Design and development Requirements for design transfer are similar for transition of
transfer transfer design outputs to production specifications.
Effort required to update The Standard also requires that the procedures for design
existing 21 CFR Part 820 transfer ensure that design and development outputs are
Quality System procedures and verified as suitable for manufacturing before becoming final
resultant processes to meet production specifications and that production capability can
the ISO 13485:2016 Standard: meet product requirements. Recorded results and conclusions of
Minor to Moderate the transfer is also a requirement of the Standard.
Comments: Design and development transfer procedures should
be reviewed to ensure adequate compliance with 7.3.8, and
specifically with “These procedures shall ensure that design and
development outputs are verified as suitable for manufacturing
before becoming final production specifications and that
production capability can meet product requirements,” which
are not explicitly required in the Regulation.
820.30(i) Design 7.3.9 Control of design and Requirements for design changes are similar.
changes development changes The Standard requires that the organization determines the
Effort required to update significance of the change to function, performance, usability,
existing 21 CFR Part 820 safety and applicable regulatory requirements for the medical
Quality System procedures and device and its intended use.
resultant processes to meet The Standard also requires that review of design and
the ISO 13485:2016 Standard: development changes includes evaluation of the effect of the
Minor to Moderate changes on constituent parts and product in process or already
delivered, inputs or outputs of risk management and product
realization processes.
820.30(j) Design 7.3.10 Design and development The Standard has a general requirement for maintaining design
history file files and development files as follows:
Effort required to update The organization shall maintain a design and development file
existing 21 CFR Part 820 for each medical device type or medical device family. This file
Quality System procedures and shall include or reference records generated to demonstrate
resultant processes to meet conformity to the requirements for design and development and
the ISO 13485:2016 Standard: records for design and development changes.
Minor to Moderate The Regulation explicitly identifies the Design History File (DHF)
as the compilation of records which describes the design history
of a finished device. There may be country specific requirements
the design records. For example, the EU Medical Device Directive
requires a Technical File or Design Dossier.

21 CFR Part 820
Quality System
820.40 Document 4.2 Documentation Requirements are similar for documents and control of changes,
controls requirements including having procedure(s).
4.2.1 General The Regulation requires specific document change records,
4.2.4 Control of documents which include a description of the change to the document,
identification of the affected documents and the signature of
Effort required to update the approving individual, the date of approval and the date
existing 21 CFR Part 820 the change becomes effective. The Regulation also requires
Quality System procedures and that approved changes are communicated to the appropriate
resultant processes to meet personnel in a timely manner.
Minor to Moderate The Standard has additional requirements for control of
documents of “external origin,” and for the protection of
confidential health information.
The Standard includes requirements for prevention of loss or
deterioration and legibility and identifiability of documents.
The Standard also requires that a defined period of retention
for at least one copy of obsolete documents are retained is
documented. This period for retention of the documents to
which medical devices have been manufactured and tested
are available for at least the lifetime of the medical device as
defined by the organization, but not less than the retention
period of any resulting record, or as specified by regulatory
requirements.
820.50 Purchasing 7.4.1 Purchasing process Requirements for evaluation of suppliers are similar. The
controls Effort required to update Regulation has an explicit requirement to evaluate, select, and
(a) Evaluation of existing 21 CFR Part 820 control contractors and consultants. The level of control is based
suppliers, contractors Quality System procedures and on the evaluation performed and documented.
and consultants resultant processes to meet The Standard requires that supplier evaluation and selection
the ISO 13485:2016 Standard: criteria is based on; the suppliers ability to provide product
Minor to Moderate that meets the organizations requirements; performance of
the supplier; effect of the purchased product on the quality of
the medical device; and be proportionate to the risk associated
with the medical device. The Standard also requires that the
suppliers are monitored and re-evaluated, including monitoring
the performance of the suppliers in meeting requirements for
purchased product. This monitoring output is to be used as
input into the supplier re-evaluation process.

21 CFR Part 820
Quality System
820.50(b) Purchasing 7.4.2 Purchasing information Requirements for purchasing data in the Regulation and
data Effort required to update purchasing information in the Standard are similar. The
existing 21 CFR Part 820 Regulation and the Standard require that manufacturers pursue
Quality System procedures and an agreement with suppliers to provide notification of any
resultant processes to meet changes to the product or service.
the ISO 13485:2016 Standard: The Standard requires that the documented purchasing
Minor information includes requirements for product acceptance,
procedures, processes and equipment, requirements for
qualification of supplier personnel and QMS requirements. The
Standard also requires that the organization must ensure the
adequacy of the specified purchasing requirements prior to
communicating to the supplier.
The Standard also requires that if traceability is required, based
on 7.5.9, then the traceability follows through to relevant
purchasing documentation.
820.60 Identification 7.5.8 Identification Requirements for identification are similar. The Standard
explicitly addresses identification of returned devices.
The Standard also requires that if required by regulatory
requirements, that the organization documents a system to
assign Unique Device Identification to the medical device.
820.65 Traceability 7.4.2 Purchasing information The Regulation has traceability requirements for life supporting,
7.5.9.1 Traceability, general life sustaining, and implantable devices through distribution to
the initial consignee (820.160). It achieves general traceability of
7.5.9.2 Particular requirements devices through Device History Records.
for implantable medical devices
The Standard explicitly requires traceability records for
components, materials, and conditions for the work
environment used, if they could cause the medical device to
not satisfy its specified safety and performance requirements.
The Standard has additional traceability requirements for
implantable medical devices for traceability beyond distributors
or distribution services. This traceability includes maintaining the
name and address of the shipping package consignee.
The Standard requires that if traceability is required, based
on 7.5.9, then the traceability follows through to relevant
purchasing documentation (7.4.2).
N/A 7.5.10 Customer property The Standard requires that the organization shall identify,
verify, protect and safeguard customer property provided for
use or incorporation into the product while it is under the
organizations control or being used by the organization. If
customers product is lost, damaged, or otherwise found to
be unsuitable for use, the organization shall report this to the
customer and maintain records.
The Regulation has no corresponding requirement related to
customer property.

21 CFR Part 820
Quality System
820.70 Production 7.1 Planning of product Requirements for developing, controlling and monitoring
and process controls realization production processes are similar. The Regulation explicitly
(a) General 7.5.1 Control of production and requires verification or validation of changes to specifications,
service provision methods, processes and procedures. The Regulation also
(b) Production and requires compliance with specified reference standards or codes
process changes 4.2.4 Control of documents and the approval of processes and process equipment.
Effort required to update The Standard requires that the organization establishes one or more
existing 21 CFR Part 820 processes for risk management in product realization and that
Quality System procedures and records arising from risk management shall be maintained (see
resultant processes to meet 4.2.5). The Standard references ISO 14971 for further information.
Minor to Moderate The Standard covers change control of documented production
and process procedures in 4.2.4 Control of Documents.
Comments: Standard requires qualification of “infrastructure.”
820.70(c) 6.4.1 Work environment Requirements for documenting environmental requirements for
Environmental control the work environment are similar between the Regulation and
the Standard.
The Regulation requires periodical inspections of the
environmental system.
The Standard requires procedures for monitoring and controlling
the work environment and refers to ISO 14644, Cleanrooms and
associated controlled environments, and ISO 14698, Cleanrooms
and associated controlled environments—Bio contamination
control.
820.70(d) Personnel 6.4.1 (a) and (b) The requirements in the Regulation and Standard are similar.
820.70(e) 6.4.2 Contamination control The Regulation requires procedures to prevent contamination of
Contamination equipment of product by substances that could reasonably be
control expected to have an adverse effect on product quality.
The Standard requires that the organization has planned and
documented arrangements for contaminated or potentially
contaminated product to prevent contamination of the work
environment, personnel or product.
The Standard requires that the organization documents
requirements for control of contamination with microorganisms
or particulate matter and maintain the required cleanliness
during assembly or packaging process for sterile medical devices.
820.70(f) Buildings 6.3 Infrastructure The Regulation requirements for buildings and the Standard
7.5.1 Control of production and requirements for infrastructure, which includes buildings, are
service provision similar.
Effort required to update The Standard requires qualification of infrastructure.

existing 21 CFR Part 820 The Standard specifies that infrastructure requirements shall
Quality System procedures and also include requirements to prevent product mix-up and ensure
resultant processes to meet orderly product handling.
Moderate

21 CFR Part 820
Quality System
820.70(g) Equipment 6.3 Infrastructure The Regulation requirements for equipment and The Standard
7.5.1 Control of production and requirements for infrastructure, which includes equipment are
service provision similar.
Effort required to update The Regulation has additional requirements for adherence to
existing 21 CFR Part 820 maintenance schedules, periodic inspections to ensure that
Quality System procedures and maintenance is being performed as scheduled, and making
resultant processes to meet equipment adjustment limitations readily available to personnel
the ISO 13485:2016 Standard: making adjustments.
Minor to Moderate The Standard has an additional requirement pertaining to
supporting services such as transport, communication, or
information systems.
820.70(h) 7.5.2 Cleanliness of product The Regulation requirements for manufacturing materials and
Manufacturing Effort required to update The Standard requirements for cleanliness of product are similar.
material existing 21 CFR Part 820 The Standard includes a provision for documented requirements
Quality System procedures and for product which cannot be cleaned prior to sterilization
resultant processes to meet the or use, but its cleanliness is of significance in use and when
ISO 13485:2 016 Standard: product is supplied to be used non-sterile and its cleanliness is of
Minor significance in use.
The Standard also list two situations where product is cleaned
prior to sterilization where the requirements for documented
work environment in 6.4.1 are not required, prior to the cleaning.
820.70(i) Automated 7.5.6 Validation of processes Requirements are similar between the Regulation and the
processes for production and service Standard. The Regulation includes specific documentation
provision requirements. The Regulation includes production software and
4 Quality management system Quality System software. The Standard covers this requirement
in 4.1.6.
4.1.6
The Standard states that the level of software validation is
“proportionate” to the risk associated with the software
including the effect on the ability of the product to conform to
specifications.
In 4.1.6 the Standard requires that a procedure is documented
for the validation of the application of computer software used
in the Quality Management System. Such software is validated
prior to initial use and, as appropriate, after changes to the
software or its application. The specific approach and activities
associates with the original validation and revalidation is
proportionate to the risk associated with the use of the software.

21 CFR Part 820
Quality System
820.72 Inspection, 7.6 Control of monitoring and The Regulation requirements for inspection, measuring and test
measuring and test measuring devices equipment, including the use of standards for calibration or
equipment documented methods when no standards exist, of monitoring
and measuring devices are similar to the Standard requirements.
The Standard requires that the measuring equipment
be safeguarded from adjustments that would invalidate
measurement results.
The Standard has more detailed requirements for assessing
the impact of out-of-calibration equipment on product, and
addresses software validation requirements when used in
monitoring and measurement applications, proportionate to the
risk associated with the use of the software, including the effect
on the ability of the product to conform to specifications. The
Standard also refers to ISO 10012, Measurement management
systems—Requirements for measurement processes and
measuring equipment.
The Regulation requires specific requirements for calibration
records, and that the records be displayed on or near each piece
of equipment or be readily available to personnel using the
equipment.
820.75 Process 7.5.6 Validation of processes Requirements for process validation are similar. The Regulation
validation for production and service has additional explicit requirements for monitoring, controlling,
provision and documenting validated processes during routine production
Effort required to update and having qualified operators perform validated processes.
existing 21 CFR Part 820 The Regulation requires procedures for monitoring and
Quality System procedures and controlling validated processes to ensure that specified
resultant processes to meet requirements continue to be met.
the ISO 13485:2016 Standard: The Standard lists specific items that shall be contained within
Moderate validation procedures including:
a) defined criteria for review and approval of the processes;  
b) equipment qualification and qualification of personnel;  
c) use of specific methods, procedures and acceptance criteria;  
d) as appropriate, statistical techniques with rationale for sample
sizes;  
e) requirements for records (see 4.2.5);  
f) revalidation, including criteria for revalidation;  
g) approval of changes to the processes.  

21 CFR Part 820
Quality System
N/A 7.5.7 Particular requirements The Standard requires documented procedures for the validation
for validation of processes for of processes for sterilization and sterile barrier systems, that
sterilization and sterile barrier they are validated prior to use and following product or process
systems changes, as appropriate. The Standard also requires records of
the results and conclusions of validation and any necessary actons.
The Standard refers to ISO 11607-1, Packaging for terminally
sterilized medical devices—Part 1: Requirements for materials,
sterile barrier systems and packaging systems, and ISO 11607-2,
Packaging for terminally sterilized medical devices—Part 2:
Validation requirements for forming, sealing and assembly
processes.
820.80 Receiving, 7.1 (c) Planning of product General: The Regulation requires a procedure be established
in-process, and realization and maintained for acceptance activities including inspections,
finished device 7.4.3 Verification of purchased tests or other verification activities. Both the Regulation and the
acceptance product Standard require, as applicable, identification of of equipment
(a) General used for acceptance (measurement) activities
7.5.10 Customer property
Receiving activities: The Regulation requires procedures for
(b) Receiving 8.2.6 Monitoring and acceptance of incoming product. This includes inspection testing,
acceptance activities measurement of product or otherwise some verification that the incoming product is
(c) In-process Effort required to update conforming to specified requirements. Acceptance or rejection
acceptance activities existing 21 CFR Part 820 must be documented. The Standard requires that this incoming
(d) Final acceptance Quality System procedures and product verification is based on the supplier evaluation results and
activities resultant processes to meet proportionate to the risks associated with the purchased product.
the ISO 13485:2016 Standard: The Standard requires that when the organization becomes
Minor to Moderate aware of any changes to purchased product, the organization
shall determine whether these changes affect the product
realization process or the medical device
In process acceptance activities: The Regulation requires
devices to be controlled until the required inspections, tests or
other verification activities are complete, or necessary approvals
are received and documented. The Standard requires that
the organization monitors and measures the characteristics
of the product to verify that product requirements are met at
applicable stages or product realization in accordance with
planned and documented arrangements and procedures.
Final acceptance activities: The Regulation has requirements
that procedures for finished device acceptance to ensure that
each production run, lot or batch of finished devices meets
acceptance criteria. The Regulation also requires that finished
devices be held in quarantine or otherwise adequacy controlled
until released. In addition to several other requirements, the
Regulation requires dated authorization of release by designated
individual(s). The Standard explicitly requires satisfactory
completion of all planned and documented arrangements
before product release and service delivery.
Customer property: The Standard also specifically addresses
the care and control of customer property; the Regulation has
no corresponding requirement.

21 CFR Part 820
Quality System
820.80(e) Acceptance 7.1 (d) Planning of product Requirements are similar. The Regulation has specific
records realization requirements for completion and documentation, review, and
8.2.6 Monitoring and approval of acceptance activities within the DHR prior to release
measurement of product of a finished device. Both require the documentation of the
individual responsible for release of the product.
Effort required to update
existing 21 CFR Part 820
Quality System procedures and
resultant processes to meet
Minor to Moderate
820.86 Acceptance 7.5.8 Identification Requirements for identifying product acceptance status
status (Regulation) throughout the manufacturing, packaging, labeling,
installation and servicing, of the product and product status
identification throughout product realization (Standard) are similar.
The Standard has reference to UDI requirements (see 820.60
Identification).
820.90 8.3 Control of nonconforming General: The Regulation and the Standard requirements for
Nonconforming product control of nonconforming product are similar. Both require that
product 8.3.1 General product that does not conform to specified requirements are
(a) Control of identified and controlled. Both require document procedure(s)
8.3.2 Actions in response to define the controls, identification, segregation, evaluation
nonconforming to nonconforming product
product and disposition of the nonconforming product. The Regulation
detected before delivery requires notification of the person or organization responsible
(b) Nonconformity 8.3.3 Actions in response for the nonconformance. The Standard requires notification
review and disposition to nonconforming product of any external party responsible for the nonconformity. The
detected after delivery Standard specifically requires that the procedure includes related
responsibilities and authorities for the activities. The Regulation
requires that the procedures define the responsibility for the
existing 21 CFR Part 820
review and authority for the disposition of the product. Both
require records of the activities and outcomes of investigations
and rationale for decisions.
Minor Nonconformity identified before delivery: The Standard
describes how an organization can deal with nonconforming
product detected before delivery in one or more of the following
ways:
a) Taking action to eliminate the detected nonconformity
b) Taking action to preclude its original intended use or
application
c) Authorizing its use, release or acceptance under concession
The Standard requires that concession can only occur if
justification is provided, approval is obtained and applicable
regulatory requirements are met. Both the Standard and the
Regulation require record of use of nonconforming product,
including justification and the signature of the person
authorizing its use.

21 CFR Part 820
Quality System
Nonconformity identified after delivery: The Standard
requires that when the organization becomes aware of
nonconforming product identified after delivery or use has
started that they take action appropriate to the effects or
potential effects of the nonconformity.
The Standard also requires that procedures be established for
issuing advisory notices in accordance with applicable regulatory
requirements.
Records for all activities are required to be maintained.
820.90 8.3.4 Rework The Regulation and the Standard are similar in the requirements
Nonconforming for performance and documentation of rework of product,
product including evaluation of any adverse effect of the rework
(2) rework on the product. The Standard requires that procedures for
rework undergo the same review and approval as the original
procedure.
820.100 Corrective 8.4 Analysis of data General: The Standard requires that the organization identifies
and preventive action 8.5 Improvement and implements changes necessary to ensure and maintain the
(a) procedures continued suitability, adequacy, and effectiveness of the QMS
8.5.2 Corrective action as well as medical device safety and performance through the
(1) data analysis 8.5.3 Preventive action use of the quality policy and objectives, audit results, analysis
(2) investigation of data, corrective actions, preventive actions and management
review.
(3) identification of existing 21 CFR Part 820
actions Quality System procedures and Procedures and records: The Regulation and the Standard are
resultant processes to meet similar in procedural requirements and records.
(4) verification or
validation of CAPA the ISO 13485:2016 Standard: Analysis of data: The Standard focuses on all data available
actions Moderate from, at a minimum, feedback, conformity to product
requirements, characteristics and trends of processes and
(5) implement
product, including opportunities for improvement, suppliers,
changes
audits, and service reports, as appropriate. If analysis of data
(6) communicate shows that the QMS is not suitable, adequate or effective, the
(7) management organization shall use this data as input for improvement (8.5).
review The Regulation requires analysis of similar areas for identification
of existing or potential causes of nonconforming product or
(b) records other quality products. Both the Regulation and the Standard
require appropriate statistical techniques are included in the
procedures and utilized.

21 CFR Part 820
Quality System
820.100 Corrective Corrective and preventive action: The Regulation and the
and preventive action Standard are similar in requirements for review, investigation of
(continued from causes, determination of required actions to prevent recurrence
previous page) or occurrence, implementing actions, verification or validation
that the actions are effective and do not adversely affect
the ability to meet applicable regulatory requirements or the
safety and performance of the medical device and reviewing
the effectiveness of the corrective or preventive action taken
The Regulation includes specific procedural requirements. The
Standard requires that any corrective action be taken without
undue delay and that corrective actions are proportionate to
the effects of the nonconformities encountered. The Standard
requires that preventive action taken is proportionate to the
effects of potential problems.
Communication: The Regulation requires dissemination
of information related to quality problems to those directly
responsible for assuring the quality of the product or the
prevention of such problems. The Regulation also requires
relevant information of identified quality problems, as well as
CAPA actions be submitted for management review.
820.120 Device 7.5 Production and service Both the Regulation and the Standard have similar requirements
labeling provision for production controls of labeling operations.
7.5.1 (e) Control of production The Regulation has requirements for label integrity, inspection,
and service provision storage, operations, and control numbers, which are more
Effort required to update explicit and detailed than the Standard. The Regulation requires
existing 21 CFR Part 820 a specific, documented label release prior to use of the label.
Minor
820.130 Device 7.5 Production and service The Regulation requires that packaging and shipping containers
packaging provision be designed to protect devices during customary conditions of
7.5.1 (e) Control of production processing, storage, handling and distribution.
and service provision The Standard requires implementation of defined operations for
7.5.11 Preservation of product packaging (7.5.1).
Effort required to update The Standard requires that the organization shall protect
existing 21 CFR Part 820 product from alteration, contamination or damage when
Quality System procedures and exposed to expected conditions during processing, handling and
resultant processes to meet distribution. The Standard also requires that suitable packaging
the ISO 13485:2016 Standard: and shipping containers are designed and constructed and
Moderate requirements for special conditions be documented if packaging
alone cannot provide preservation. If special conditions are
required, they shall be controlled and recorded.

21 CFR Part 820
Quality System
820.140 Handling 4.2.3 Medical device file Requirements for handling and storage in the Regulation and
820.150 Storage 7.1 Planning of product preservation of product in the Standard are similar.
realization The Standard requires that the medical device file includes
7.5.11 Preservation of product specifications for storage and handling and that in the planning
of product realization, plans for handling and storage are
developed.
The Regulation specifically addresses stock rotation for product
that may deteriorate over time, as well as procedures that
describe the methods of authorizing receipt from and dispatch
to storage areas and stock rooms.
820.160 Distribution 4.2.3 Medical device file The Standard requires that the medical device file includes
7.1 Planning of product specifications for distribution and that in the planning of
realization process product realization, plans for distribution are developed.
7.5.9.2 Particular requirements The Regulation requires distribution procedures and records of
for implantable medical devices distribution. The Procedures must cover:
• Control and distribution of finished devices to ensure that
only those devices approved for release are distributed
• Review of purchase orders to ensure that ambiguities and
errors are resolved before devices are released for distribution
• Processes to ensure that when a products quality or fitness
for use deteriorates over time, expired devices, or devices
deteriorated beyond acceptable fitness for are not distributed
The Standard specifically requires distribution records for
implantable devices through to the name and address of
shipping package consignee. Purchase orders and contracts are
covered in the Standard under 7.2 Customer related processes.
The Regulation requires distribution records which include
or reference: the name and address of initial consignee;
identification and quantity of devices shipped, date shipped, and
any control numbers used.
820.170 Installation 4.2.3 Medical device file In general, the Regulation and Standard are similar.
7.5.3 Installation activities The Regulation requires test procedures, where appropriate, for
7.5.8 Identification installation. The Standard requires that the Medical device file
includes requirements or installation, as applicable.
The Standard requires that if the agreed customer requirements
allow installation of the medical device to be performed by an
external party other than the manufacturers, or its supplier, then
the organization shall provide documented requirements for the
medical device installation and verification of installation. The
addition of “agreed customer requirements” is different than
the Regulation.
The Standard requires that the product status is maintained
through installation.

21 CFR Part 820
Quality System
820.180 Records, 4.2.5 Control of records The regulation and standard have similar requirements for
general requirements record legibility and storage. The Regulation specifically
requires back up of records stored in data processing systems.
The Regulation also requires manufacturers to make records
available to company officials and FDA employees. The Standard
has no corresponding requirement.
820.180(a) 4.2.5 Control of records The Regulation has a provision for manufacturers to mark
Confidentiality records during an inspection to identify those containing
confidential information.
The Standard requires that the organization define and
implements methods for protecting confidential health
information contained in records in accordance with applicable
820.180(b) Record 4.2.5 Control of records Requirements for retention of documents and records are
retention period similar.
820.180(c) Exceptions N/A The Regulation exempts reports of internal audits, supplier
audits, and management reviews from review during FDA
inspections. The Standard has no comparable exemptions.
820.181 Device 4.2.1 Documentation Requirements are similar for maintaining a record or file for
master record requirements, general each type or model of device which includes procedures and
4.2.3 Medical device file specifications for production processes, packaging, labeling and
quality assurance. The Regulation assigns the name “Device
Effort required to update Master Record” to these records/files. The standard assigns the
existing 21 CFR Part 820 name Medical device file.
resultant processes to meet The Regulation and the Standard have slightly different
the ISO 13485:2016 Standard: requirements for the documents included or referenced to
Minor maintain the product throughout its lifecycle.
The Device Master Record and Medical device file can be the
same series of documents, once the requirements from both the
regulation and the Standard are incorporated.
820.184 Device 7.5.1 Control of production and The Regulation and the Standard have similar requirements
history record service provision for maintaining records of production history for each medical
device, batch of medical devices. The Regulation assigns the
name “Device History Record” to these records. In addition,
the Standard includes explicit requirements for documenting
sterilization processes for each sterilization batch. The
Regulation has no comparable explicit requirement; however,
the expectation is that sterilization processes batches will
be documented. The Regulation requires that the Device
History Record includes the primary identification label and
labeling used for each production unit, as well as the dates of
manufacture, the quantity manufacture, the quantity released
for distribution and the acceptance records.

21 CFR Part 820
Quality System
820.186 Quality The Standard does not require a Quality System record (QSR) but
system record does require the types of records and documents that could be
kept in the QSR.
820.198 Complaint 8.2.2 Complaint handling The requirements for complaint handling activities are similar.
files Effort required to update In addition, the Regulation requires that certain complaints be
existing 21 CFR Part 820 investigated and that complaints reportable under 21 CFR Part
Quality System procedures and 803 be identified. The Regulation’s record-keeping requirements
resultant processes to meet are more stringent.
the ISO 13485:2016 Standard: The Standard requires that the documented procedures include
Moderate timely complaint handling in accordance with applicable
regulatory requirements. It also requires that the procedure
includes requirements and responsibilities for:
• Determining the need to report complaint information to the
appropriate regulatory authorities
• Handling of complaint related product
• Determining the need to initiate corrections or corrective
actions
The Standard also requires that if an investigation determine
activities outside the organization contributed to the complaint,
relevant information must be exchanged between the
organization and the external party involved.
820.200 Servicing 7.5.4 Servicing activities Requirements are similar. Both require Service records to be
8.4 Analysis of data analyzed to determine if they meet the definition of a compliant.
In addition, the Regulation has more detailed requirements for
information to be included in service records.
820.250 Statistical 8.1 Measurement, analysis, and Requirements are similar. In addition, the Regulation requires
techniques improvement, general establishing procedures for using statistical techniques and
sampling methods, and for basing sampling plans on valid
statistical rationale.
N/A 8.2 Monitoring and The Standard requires that that as part of measuring the
measurement effectiveness of the QMS, the organization gathers and
8.2.1 Feedback monitors information related to whether or not the organization
has met the customer requirements. Method(s) used must be
documented.
There must be a procedure for the feedback process and it shall
ensure that data from production as well as post-production
activities are gathered as part of the feedback process.
The information gathered from the feedback process must be
considered as potential input for risk management, monitoring
and maintaining product requirements as well as the product
realization or improvement process.
If there are regulatory requirements for gaining specific
experience from post-production activities, this information must
be part of the feedback process.

21 CFR Part 820
Quality System
21 CFR Part 820 does 8.2 Monitoring and The Standard requires that if applicable regulatory requirements
not cover this topic; measurement require notification of complaints related to specific criteria,
however, other areas 8.2.3 Reporting to regulatory or the issuance of advisory notices, then the organization
of the CFR include authorities must have a documented procedure(s) for notification to the
requirements for appropriate authorities, and maintain records of such reporting.
these activities.
N/A 8.2 Monitoring and The Standard requires that the organization applies suitable
measurement methods for monitoring and, as appropriate measuring the QMS
8.2.5 Monitoring and processes. The methods chosen are required to demonstrate
measurement of processes the ability of the processes to achieved planned results. When
they are not achieved, correction and corrective action must be
taken, as appropriate.

AAMI Quality Systems White Paper: Comparison of 21 CFR Part 820 To ISO 13485:2016

Uploaded by

Copyright:

Available Formats

AAMI Quality Systems White Paper: Comparison of 21 CFR Part 820 To ISO 13485:2016

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AAMI Quality Systems White Paper: Comparison of 21 CFR Part 820 To ISO 13485:2016

Uploaded by

Copyright:

Available Formats

AAMI Quality Systems

A. ISO 13485:2016—What is it?

© AAMI AAMI Quality Systems White Paper 1

B. Significant concept differences between the 21 CFR 820

• Services (e.g., transport)

• Software (e.g., computer program, dictionary)

• Hardware (e.g., engine mechanical part)

• Processed materials (e.g., lubricant)

C. Importance of ISO 13485 to medical device manufacturers

2 AAMI Quality Systems White Paper © AAMI

E. Table 1—Additional information

Estimate of effort to update existing

© AAMI AAMI Quality Systems White Paper 3

21 CFR Part 820

4 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 5

6 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 7

8 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 9

10 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 11

12 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 13

14 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 15

16 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 17

Effort required to update The Standard requires qualification of infrastructure.

18 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 19

20 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 21

22 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 23

24 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 25

26 AAMI Quality Systems White Paper © AAMI

© AAMI AAMI Quality Systems White Paper 27

28 AAMI Quality Systems White Paper © AAMI

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.