MDSAP · Medium · 15 min lesson
United States - 21 CFR 820 (QMSR), 803, 806, 807 and 830, and how FDA uses MDSAP reports
21 CFR parts 820 (QMSR, effective 2 February 2026), 803, 806, 807 and 830; MDSAP FAQ on FDA use of audit reports; ISO 13485:2016
What you will learn
- Map the Quality Management System Regulation, effective 2 February 2026, to the MDSAP audit tasks.
- Apply the medical device reporting, corrections and removals, registration and listing, and unique device identification rules.
- Explain how FDA uses MDSAP audit reports and where the 510(k) context fits.
Key takeaways
- QMSR took effect on 2 February 2026; part 820 incorporates ISO 13485:2016 by reference with a few FDA specific additions.
- Part 803 reports: 30 calendar days from awareness, 5 work days when remedial action is needed to prevent unreasonable risk.
- Part 806 corrections and removals to reduce a risk to health: written report within 10 working days.
- Part 807 covers annual registration and listing and the 510(k); part 830 covers UDI and GUDID.
- FDA accepts MDSAP reports in place of routine inspections, with grade 4 and 5 responses due in one month, but a 510(k) is separate.
Free practice question
A complaint says a pump overheated and the patient needed treatment for a burn. The complaint handler closes it as minor without any reportability assessment.
What is the best finding basis?
No documented assessment of reportability under 21 CFR part 803, linked to ISO 13485 clause 8.2.2 complaint handling.
Correct. Part 803 and clause 8.2.2 together require complaints to be evaluated for reporting, which MDSAP Chapter 4 tests.
Clause 7.5.9 on traceability.
Not quite. Traceability may help the investigation, but the missing reportability decision falls under complaint handling and 21 CFR part 803.
No finding, since the patient recovered.
Not quite. Recovery does not remove the duty to assess whether an event is reportable under 21 CFR part 803.
Only an observation about the form layout.
Not quite. The missing decision affects regulatory reporting, which is a requirement in MDSAP Chapter 4 and part 803, not a layout matter.
Key terms
- QMSR: FDA's amended part 820, effective 2 February 2026, which incorporates ISO 13485:2016 by reference.
- medical device reporting: Reporting of deaths, serious injuries and certain malfunctions to FDA under 21 CFR part 803.
- correction or removal: Action to reduce a risk to health or remedy a violation; reported to FDA within 10 working days (21 CFR part 806).
- premarket notification (510(k)): Submission to FDA showing a device is substantially equivalent to a legally marketed device (21 CFR part 807 subpart E).
- unique device identifier (UDI): A code made of a device identifier and a production identifier on the label and package (21 CFR part 830).
- GUDID: FDA's Global Unique Device Identification Database, to which labelers submit device information.
Official sources
- MDSAP AU P0002.009 MDSAP Audit Approach (FDA)
- Medical Device Single Audit Program (MDSAP) Frequently Asked Questions (FDA)
- Quality Management System Regulation: Final Rule Amending the Quality System Regulation - Frequently Asked Questions (FDA)
- 21 CFR Part 820 - Quality Management System Regulation (eCFR)
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.