Compliance & ContractsFree referencePDF, Excel, Word exportMedical DevicesUnited States

FDA 21 CFR Part 820 to ISO 13485 Clause Crosswalk

Many US device manufacturers wrote their procedures against the old Quality System Regulation and now need to show they meet ISO 13485 as well. This crosswalk lines up the familiar 21 CFR 820 sections with the closest ISO 13485 clause so you can see where each procedure lives.

Download:

21 CFR 820 section (legacy QSR)	Topic	Closest ISO 13485 clause	Note
820.20	Management responsibility	5 Management responsibility	Includes quality policy, planning and management review
820.20(c)	Management review	5.6 Management review	ISO 13485 specifies review inputs and outputs in more detail
820.22	Quality audit	8.2.4 Internal audit	Audit procedure, auditor independence, follow-up
820.25	Personnel, training	6.2 Human resources	Competence, training and awareness
820.30	Design controls	7.3 Design and development	Planning, inputs, outputs, review, verification, validation, transfer, changes
820.40	Document controls	4.2.4 Control of documents	Approval, distribution, change control of documents
820.50	Purchasing controls	7.4 Purchasing	Supplier evaluation, purchasing information, verification of purchased product
820.60	Identification	7.5.8 Identification	Product identification through all stages
820.65	Traceability	7.5.9 Traceability	Required for implants and life-supporting devices in particular
820.70	Production and process controls	7.5.1 Control of production and service provision	Includes environmental control, personnel health, equipment
820.72	Inspection, measuring and test equipment	7.6 Control of monitoring and measuring equipment	Calibration and calibration records
820.75	Process validation	7.5.6 Validation of processes for production and service provision	Validation where results cannot be fully verified by inspection
820.80	Receiving, in-process and finished device acceptance	7.4.3 and 8.2.6 Monitoring and measurement of product	Acceptance criteria and release records
820.86	Acceptance status	7.5.8 and 8.2.6	Status identification through the process
820.90	Nonconforming product	8.3 Control of nonconforming product	Disposition, rework, concessions
820.100	Corrective and preventive action	8.5.2 Corrective action, 8.5.3 Preventive action	Investigation, verification of effectiveness
820.120	Device labeling	7.5.1 and 4.2.3 as applicable	Labeling control requirements are partly regulatory rather than in the standard
820.130	Device packaging	7.5.11 Preservation of product	Packaging and handling that protect product
820.140	Handling	7.5.11 Preservation of product	Handling that prevents mix-ups, damage, contamination
820.150	Storage	7.5.11 Preservation of product	Storage areas and receipt and dispatch authorization
820.160	Distribution	7.5.1 and 7.5.11	Distribution records and review of orders
820.170	Installation	7.5.3 Installation activities	Where installation is a requirement of the device
820.180	General records requirements	4.2.5 Control of records	Retention periods set by device life and regulation
820.181	Device master record	4.2.3 Medical device file	ISO 13485 uses the medical device file concept
820.184	Device history record	7.5.1 Production records	Per batch or unit production record
820.198	Complaint files	8.2.2 Complaint handling	Includes evaluation for reportability
820.200	Servicing	7.5.4 Servicing activities	Service records and analysis
820.250	Statistical techniques	8.1 and 8.4 Analysis of data	Valid statistical methods for sampling and analysis

Since the Quality Management System Regulation (QMSR) took effect, 21 CFR Part 820 incorporates ISO 13485 by reference and keeps some FDA-specific requirements. The legacy section numbers in this table are a familiar index for existing procedures, and the mapping is approximate. Read the current text of Part 820 and ISO 13485 before relying on it in an audit response.

Optional QMSR gap assessment walk-through

We can review how your ERP and QMS records line up against the crosswalk areas.

Optional. The tool and every export work without this. No spam.

How to use it

Search by topic (for example complaint, traceability or calibration) and read across to the matching clause. Export the list to Excel and add columns for your procedure number, current revision, owner and gap status. Reviewing one row at a time during a gap assessment is faster than reading both documents end to end, and it gives auditors a clear map of where each requirement is addressed.

Search by topic, section or clause number
Export and add procedure and gap columns
Treat the mapping as an index, not a conformity claim

Where the two frameworks differ

ISO 13485 is organized by management, resources, realization and measurement, while the legacy QSR was organized by subpart. The content overlaps heavily, but ISO 13485 adds explicit requirements around risk management throughout the life cycle, software validation, and a stronger link to regulatory requirements. FDA retains specific expectations, for example around medical device reporting and certain labeling and unique device identification requirements.

Using the crosswalk for a gap assessment

For each row, locate the procedure that implements the requirement, confirm it cites the right documents and records, and sample recent records to check it is followed. Note any ISO 13485 clause with no procedure, any FDA-specific requirement not covered by the standard, and any procedure that still cites only legacy section numbers. Prioritize gaps by patient risk and audit exposure.

Common mistakes

Teams sometimes assume that holding an ISO 13485 certificate means full compliance with FDA-specific requirements, or rename procedures without updating the underlying content. Others forget records such as the device master and history record, which ISO 13485 handles through the medical device file and production records. Keep a controlled version of the crosswalk and update it when regulations or procedures change.

Frequently Asked Questions

Is this crosswalk an official FDA document?

No. It is an unofficial orientation aid by topic. FDA and ISO publish the authoritative texts, and the mapping here is approximate because some requirements do not align one for one.

Why use legacy section numbers if the regulation changed?

Many procedures, audit findings and training records still use the legacy numbering. A familiar index helps teams find where each topic moved to under the current structure.

What does ISO 13485 add compared with the QSR?

It places more emphasis on risk based approaches across processes, on software validation for quality system tools, on supplier controls and on documenting regulatory requirements. Check the current standard for the details.

Does the crosswalk cover MDSAP or EU MDR?

No. It covers the US regulation and ISO 13485 only. MDSAP and EU MDR add jurisdiction-specific requirements that need separate mapping.

If device history records and complaint data sit in your ERP and a separate QMS, Netray can discuss connecting them so audit evidence is easier to pull.

Talk to an Expert Explore More Free Tools

Related Tools

Compliance & Contracts

More Compliance & Contracts tools

See all

Back to All Tools