A recent internal audit gave me the answer I did not want. I sampled a CAPA opened after a repeated supplier non-conformance. Its procedure had been retitled, its header cited ISO 13485:2016, clause 9.2, and its appendix mapped the former 21 CFR 820.100 to the new requirement.
The underlying record was still essentially the old document. Supplier correspondence doubled as the investigation, there was no documented method for testing recurrence, and the CAPA was not explicitly linked to complaint trends, process-monitoring data or risk reviews.
The procedure had been re-labelled. The process had not been re-mapped.
The QMSR did not just renumber Part 820
Since 2 February 2026, the FDA Quality Management System Regulation has incorporated ISO 13485:2016 by reference. It also retains FDA-specific requirements in 21 CFR 820.35, covering control of and access to records, and 21 CFR 820.45, covering device labelling and packaging controls.
That makes a transition crosswalk necessary. It does not make a crosswalk sufficient.
The former provisions were not simply renumbered:
- The management responsibilities in former §820.22 now sit across ISO 13485 clauses 5.1 to 5.6.
- Former design controls in §820.30 need to be considered against design and development in ISO 13485 clause 7.3.
- Purchasing, production and nonconforming product controls must now be assessed against clauses 7.4, 7.5 and 8.5 respectively.
- Complaint handling belongs within clause 8.2 and the relevant FDA provisions in §820.35.
- CAPA requires an approach aligned with clause 9.2, not merely a new clause number in a document header.
Putting old §820.40 into a table beside ISO 13485 clause 4.2.4 tells us where the requirement appears to have moved. It does not demonstrate that our documented procedures, forms, approvals and records actually satisfy it.
That distinction is where a lot of supposedly completed transitions become weak.
Where label-changing fails
Our CAPA procedure was the clearest example. Former §820.100 and ISO 13485 clause 9.2 both concern corrective action, so changing the references appeared straightforward.
In practice, we had to define what should trigger an investigation and how data would be gathered from:
- Complaints and adverse-event information;
- Nonconforming product and acceptance-test results;
- Supplier and process-performance trends;
- Internal audit findings; and
- Outputs from risk management.
We also had to define the investigation method, root-cause approach, decision about extent of impact, effectiveness check and criteria for closure. Without those elements, CAPA becomes a documented correction followed by a cheerful statement that the issue appears resolved.
The same problem appears in design records. ISO 13485 clause 4.3 uses the concept of a medical device file rather than relying on the former DMR and DHF terminology. Renaming those records does not establish that design inputs, outputs, reviews, verification, validation, transfer and design changes remain linked and reviewable.
We also had to avoid pretending that every associated standard had been incorporated by reference. ISO 14971 remains relevant, but the QMSR did not incorporate it wholesale simply because our procedure mentioned risk management. The design-risk file therefore needed an explicit, defensible relationship to the QMSR and ISO 13485 requirements.
The FDA-specific provisions need equal attention
It would be easy to focus entirely on ISO 13485 and assume that updating the old QSR text was sufficient.
For us, that meant revisiting two areas directly:
- Under §820.35, we had to establish how FDA record requests and complaint records would be handled, including access, copying and internal routing.
- Under §820.45, we needed procedures for labelling and packaging controls rather than treating these as administrative tasks detached from QMS risk and release decisions.
Those are not side notes to the ISO transition. They are part of the QMSR itself.
How I would test a real migration
I would not begin with another polished clause matrix. I would begin with the processes that create regulatory risk.
For each process, I would document:
- The controlling requirement: ISO 13485, an FDA-specific provision or another applicable regulation.
- The trigger: What starts the process, and why?
- Ownership and escalation: Who decides, who reviews and when does management become involved?
- Required evidence: Which forms, records and approvals demonstrate completion?
- Linked risks and interfaces: How does the process connect to complaints, CAPA, risk management, purchasing or release?
- Verification: How will subsequent audits confirm that the process works consistently?
I would then test several vertical pathways rather than isolated documents. A complaint should be traceable from receipt through evaluation, investigation, regulatory-reporting decision, CAPA and closure. A design change should be traceable through impact assessment, risk review, verification or validation, approval and release. A supplier non-conformance should reach the supplier, product-impact assessment and CAPA process without relying on one person knowing where every record lives.
Only after those pathways work should I update the crosswalk. At that point, the crosswalk becomes a navigation aid rather than evidence of compliance.
The practical test
The quickest way I know to expose a cosmetic transition is to ask an engineer:
- Why is this step required?
- Which current requirement drives it?
- Where is the evidence recorded?
- What does it connect to?
- What happens if it is missed?
If the answer is only, “The old 21 CFR procedure has been renamed”, the migration has not reached the working process.
For organisations already through the transition, which process did you genuinely redesign, and what evidence would convince an auditor that it was more than a re-labelled procedure?
