FDA GMP Document Controls

ISO 13485:2016, Clause 4.2 (Documentation requirements), which covers the control of documents
(4.2.4) and the control of records (4.2.5)

21 CFR Part 820GMP ComplianceQMSR RequirementSince 2009

Document Control Under the FDA QMSR (ISO 13485:2016, Clause 4.2)

Effective February 2, 2026, 21 CFR Part 820 was overhauled — the former Quality System Regulation (QSR) is now the Quality Management System Regulation (QMSR). Under the revised 21 CFR Part 820, document control requirements — previously found in Subpart D (§820.40) — are now governed by ISO 13485:2016, Clause 4.2 (Documentation requirements), which covers the control of documents (4.2.4) and the control of records (4.2.5), incorporated by reference through §820.10. Medical device manufacturers who commercially distribute finished devices in the U.S. must maintain a document control system that complies with ISO 13485:2016, along with the additional FDA-specific requirements the QMSR layers on top.

A well-controlled documentation system remains foundational to an effective quality management system. LMG provides expert QMS and CGMP consulting to help you build, document, and maintain a compliant document control process under the QMSR and ISO 13485:2016, including:

Document approval, issue, and distribution procedures
Controlled document identification and version control
Document and record change control procedures
Periodic document review and updates
Control of obsolete documents and retention of records

LMG assists medical device manufacturers with QMSR and ISO 13485:2016 gap assessments, procedure and document development, quality manual and document hierarchy support, and audit and inspection readiness — helping you transition from the legacy QSR and stay compliant under the new Quality Management System Regulation.

Frequently Asked Questions

Common questions about this FDA QMSR compliance service.

Where are document control requirements found under the new QMSR?

Document control is no longer in Subpart D (§820.40) of the old Quality System Regulation. Under the QMSR, effective February 2, 2026, documentation requirements are governed by ISO 13485:2016 Clause 4.2 — including 4.2.4 (control of documents) and 4.2.5 (control of records) — incorporated into 21 CFR Part 820 by reference through §820.10. The “21 CFR Part 820” citation still applies, but the substance now comes from ISO 13485.

Does the QMSR change how I have to control records versus documents?

The main change is structural. The old QSR addressed document control (§820.40) and records (§820.180) somewhat separately, while ISO 13485:2016 brings both under one documentation clause (4.2), distinguishing the control of documents (4.2.4) from the control of records (4.2.5). The underlying expectations — approval, distribution, version control, change control, retention, and protection of records — remain, but procedures should be restructured and re-referenced to align with ISO 13485.

We already have a compliant QSR document control system. How much needs to change?

For most manufacturers, the fundamentals carry over, since ISO 13485:2016 Clause 4.2 covers the same ground as the former §820.40. The work is mainly aligning terminology, updating procedures to reference ISO 13485 instead of Subpart D, ensuring records control under 4.2.5 is clearly addressed, and confirming any FDA-specific requirements layered on by the QMSR are met. Companies already certified to ISO 13485:2016 typically have a smaller gap than those that complied only with the U.S. QSR.