GMP vs cGMP for Medical Devices Under FDA QMSR
Understand GMP and cGMP expectations for device manufacturing under FDA QMSR, 21 CFR Part 820, ISO 13485, design controls, production, labeling, and inspections.
Why cGMP Compliance Is Non-Negotiable for Medical Device Manufacturers
On February 2, 2026, the FDA's Quality Management System Regulation (QMSR) became effective, fundamentally reshaping current Good Manufacturing Practice (cGMP) requirements for medical devices. The QMSR amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference, harmonizing U.S. device quality requirements with the international consensus standard used by regulatory authorities worldwide.
This is not a minor update. The FDA replaced the entire Quality System Regulation (QSR) framework that had been in place since 1996 with a system built on ISO 13485:2016, while retaining FDA-specific requirements for labeling controls, UDI compliance, and record access. The old Quality System Inspection Technique (QSIT) has been retired. FDA inspectors now follow Compliance Program 7382.850, a new inspection framework aligned with ISO 13485 structure.
For medical device manufacturers, the message is clear: cGMP compliance now means demonstrating conformity with ISO 13485:2016 plus FDA-specific additions. Companies that fail to adapt face warning letters, Form 483 observations, consent decrees, and product recalls.
This guide covers everything you need to know about GMP and cGMP for medical devices — the history, the regulatory framework, the specific requirements, and how to build a manufacturing quality system that satisfies both FDA and international expectations.
What Is GMP? What Is cGMP?
Good Manufacturing Practice (GMP)
Good Manufacturing Practice is a set of baseline quality assurance principles that govern how products are manufactured and controlled. GMP ensures that products are consistently produced and controlled according to quality standards appropriate for their intended use and as required by marketing authorization or product specification.
GMP covers:
Facility design and maintenance
Equipment qualification and calibration
Personnel training and hygiene
Raw material control
Production and process controls
Quality control testing
Documentation and record keeping
Complaint handling and product recall procedures
The core philosophy of GMP is that quality cannot be tested into a product after manufacture — it must be built into the process. You cannot inspect quality into a finished device. You must design and control the manufacturing process so that quality is inherent in every unit produced.
Current Good Manufacturing Practice (cGMP)
Current Good Manufacturing Practice adds a critical word: current. The "c" in cGMP means that manufacturers must use technologies, systems, and practices that are up-to-date. Equipment and processes that were state-of-the-art ten or twenty years ago may be inadequate by today's standards.
The FDA defines cGMP as systems that assure proper design, monitoring, and control of manufacturing processes and facilities. The regulations are deliberately flexible — they do not prescribe specific technologies or methods. Instead, they establish performance expectations that manufacturers must meet using scientifically sound approaches.
| Dimension | GMP | cGMP |
|---|---|---|
| Focus | Baseline manufacturing quality standards | Continuous improvement with latest technologies and methods |
| Technology | Established, static practices | Up-to-date systems and equipment |
| Risk management | Basic quality control | Proactive, risk-based approach throughout product lifecycle |
| Documentation | Standard record keeping | Comprehensive, real-time, audit-ready documentation |
| Regulatory basis | General quality frameworks | FDA 21 CFR Part 820 (QMSR), 21 CFR Parts 210/211 |
| Evolution | Relatively fixed | Continuously updated to reflect current science |
| Scope | Manufacturing controls | Full product lifecycle including design, production, distribution |
The Regulatory Framework: From 1978 to QMSR 2026
Historical Timeline
| Year | Event | Impact |
|---|---|---|
| 1978 | FDA publishes first cGMP regulation for devices (21 CFR Part 820) | Established baseline manufacturing quality requirements under Section 520(f) of the FD&C Act |
| 1990 | Safe Medical Devices Act (SMDA) | Added preproduction design control authority to FDA |
| 1996 | FDA publishes the Quality System Regulation (QSR) | Major revision adding design controls, CAPA, and comprehensive quality system requirements |
| 1998 | QSIT inspection method introduced | Standardized FDA inspection approach organized by seven quality system elements |
| 2018 | ISO 13485:2016 gains widespread adoption | International harmonization pressure mounts on FDA |
| 2022 | FDA proposes QMSR rule (February) | Notice of Proposed Rulemaking to incorporate ISO 13485:2016 into Part 820 |
| 2024 | FDA publishes final QMSR rule (January 31) | Two-year transition period begins |
| 2026 | QMSR effective date (February 2) | QSR replaced by QMSR; QSIT replaced by CP 7382.850 |
What the QMSR Changed
The QMSR did not eliminate cGMP requirements — it modernized them. The key changes are:
ISO 13485:2016 incorporated by reference: The requirements of ISO 13485:2016 become the baseline cGMP requirements for medical devices. This includes all clauses (4 through 8) of the standard.
FDA-specific additions retained in Part 820: Not everything is delegated to ISO 13485. The FDA retained specific requirements in sections 820.1 (scope), 820.3 (definitions), 820.10 (regulatory requirements identification), 820.35 (complaint handling, servicing, UDI), and 820.45 (labeling and packaging controls).
New definitions: Terms and definitions from Clause 3 of ISO 13485:2016 and ISO 9000:2015 now apply, except where superseded by statutory definitions (e.g., "device," "labeling" from the FD&C Act).
Labeling inspection requirement: ISO 13485 lacks specific requirements for labeling and packaging inspection. The QMSR mandates that manufacturers physically examine device labels for accuracy before release — a direct response to recalls caused by labeling errors missed by automated readers.
No ISO 13485 certification required: The FDA does not require manufacturers to obtain ISO 13485 certification from an accredited body. Compliance with QMSR requirements (which incorporate ISO 13485) is assessed during FDA inspections. However, manufacturers may choose to obtain ISO 13485 certification for business reasons (e.g., EU market access, customer requirements).
New inspection process: QSIT retired. FDA now follows CP 7382.850 for device inspections.
cGMP Requirements Under QMSR: What You Must Do
The QMSR organizes cGMP requirements around the ISO 13485:2016 clause structure. Here is what each area requires:
Clause 4: Quality Management System
| Requirement | What It Means |
|---|---|
| Documented QMS | Establish, document, implement, and maintain a QMS appropriate for your organization |
| Quality manual | Maintain a quality manual defining the scope of your QMS, including exclusions and justification |
| Medical device file | Maintain a file for each device type containing or referencing documentation demonstrating conformity |
| Control of documents | Documented procedures for creating, reviewing, approving, and changing documents |
| Control of records | Records must remain legible, identifiable, and retrievable. Retain for at least the lifetime of the device, minimum two years from release |
Clause 5: Management Responsibility
Top management must demonstrate commitment to the QMS through:
Establishing a quality policy and quality objectives
Conducting management reviews at planned intervals
Ensuring the availability of resources
Communicating the importance of meeting regulatory requirements
Appointing a management representative (though ISO 13485 does not use this exact term, the role is implied)
Clause 6: Resource Management
| Resource Category | cGMP Requirements |
|---|---|
| Human resources | Personnel performing work affecting product quality must be competent based on education, training, skills, and experience. Training must be documented. |
| Infrastructure | Buildings, workspace, process equipment, and supporting services must be adequate to achieve conformity |
| Work environment | Conditions necessary for conformity must be defined, managed, and monitored (e.g., cleanrooms, temperature control) |
| Contamination control | Where product or work environment could be contaminated, requirements must be defined and implemented |
Clause 7: Product Realization
This is the core of cGMP — the manufacturing requirements that directly affect product quality.
7.1 Planning of Product Realization
Plan and document the processes needed for product realization. Planning must be consistent with other QMS processes and include quality objectives, product requirements, verification and validation activities, and records needed.
7.2 Customer-Related Processes
Determine and review requirements related to the product, including specified and intended use requirements, statutory and regulatory requirements, and user training needs.
7.3 Design and Development
Design controls are a critical cGMP requirement:
Design and development planning
Design inputs (functional, performance, and regulatory requirements)
Design outputs (meet input requirements, include acceptance criteria)
Design review (at suitable stages, with qualified reviewers)
Design verification (output meets input)
Design validation (device meets user needs and intended use)
Design transfer (to production)
Design changes (controlled and documented)
Design history file (DHF) maintenance
7.4 Purchasing
Evaluate and select suppliers based on their ability to supply product meeting requirements
Establish purchasing data including product description and requirements
Verify purchased product meets requirements (incoming inspection, CoA review)
7.5 Production and Service Provision
| Sub-requirement | cGMP Details |
|---|---|
| Production control | Plan and carry out production under controlled conditions: documented procedures, controlled environment, compliant equipment, use of suitable monitoring and measuring equipment |
| Cleanliness | If product cleanliness is a requirement, define and document cleanliness requirements |
| Installation | If installation is a specified requirement, document acceptance criteria and verify installation |
| Service | If servicing is a specified requirement, document service procedures and records |
| Sterilization | Sterilization processes must be validated prior to implementation. Records must be traceable to specific lots. |
| Process validation | Processes where output cannot be verified by subsequent monitoring must be validated. Revalidation at appropriate intervals. |
| Traceability | Define the extent of traceability for product, components, and materials. For implantable devices, maintain records of all components and work environment conditions. |
| Product identification | Identify product throughout product realization using appropriate means |
7.6 Control of Monitoring and Measuring Equipment
Determine the monitoring and measurement needed, and provide appropriate equipment. Equipment must be calibrated or verified at specified intervals against measurement standards traceable to international or national standards.
Clause 8: Measurement, Analysis, and Improvement
| Area | cGMP Requirements |
|---|---|
| Feedback | Collect and monitor data on whether requirements are met, including customer feedback and complaint data |
| Complaint handling | Documented procedures for receiving, recording, evaluating, investigating, and determining if complaint reporting to regulatory authorities is required (per 820.35) |
| Reporting to regulatory authorities | Notify regulatory authorities when required by applicable regulations (MDR, vigilance reporting) |
| Internal audit | Conduct audits at planned intervals to determine if the QMS conforms and is effectively implemented |
| Monitoring and measurement of processes | Apply appropriate methods to demonstrate the ability of processes to achieve planned results |
| Monitoring and measurement of product | Measure and monitor product characteristics to verify requirements are met. Evidence of conformity must be maintained. |
| Control of nonconforming product | Identify and control nonconforming product. Documented procedures for identification, documentation, evaluation, segregation, disposition, and notification. |
| CAPA | Documented procedures for corrective action and preventive action. Investigate causes, determine actions needed, implement actions, review effectiveness. |
| Adverse event reporting | Comply with applicable regulatory requirements for reporting adverse events |
FDA-Specific Additions Beyond ISO 13485
| Section | Requirement | Why FDA Added It |
|---|---|---|
| 820.3(b) | Specific FDA definitions that override ISO 13485/ISO 9000 definitions | Terms like "device" and "labeling" have statutory definitions in the FD&C Act |
| 820.10(b) | Manufacturers must identify all applicable regulatory requirements | ISO 13485 alone is not sufficient — country-specific requirements apply |
| 820.35 | Complaint handling procedures, servicing activities documentation, UDI compliance | FDA-specific reporting and tracking requirements beyond ISO 13485 |
| 820.45 | Physical examination of device labeling before release | FDA cited recalls caused by labeling errors missed by automated systems |
GMP Regulations by Product Type
cGMP requirements differ by product category:
| Product Category | Regulation | Key Focus Areas |
|---|---|---|
| Medical devices | 21 CFR Part 820 (QMSR) + ISO 13485:2016 | Design controls, production controls, CAPA, traceability, labeling |
| Drugs/Pharmaceuticals | 21 CFR Parts 210, 211 | Batch records, validated processes, laboratory controls, master production records |
| Biologics | 21 CFR Parts 600, 610 | Sterility testing, potency assays, facility standards, environmental monitoring |
| Combination products | 21 CFR Part 4 | Streamlined cGMP approach covering both device and drug/biologic requirements |
| Dietary supplements | 21 CFR Part 111 | Manufacturing, packaging, labeling, holding operations |
| Food | 21 CFR Part 117 (FSMA) | Hazard analysis, preventive controls, supply chain program |
Building a cGMP-Compliant Manufacturing Operation
Step 1: Gap Analysis Against QMSR Requirements
Before building anything, understand where you are. Compare your current quality system against the QMSR framework:
If you have no ISO 13485: Conduct a comprehensive gap analysis between your current QMS and ISO 13485:2016 requirements plus QMSR additions. This will be a significant effort.
If you have ISO 13485 certification: Focus your gap analysis on QMSR-specific additions — labeling controls (820.45), complaint handling (820.35), UDI integration, and regulatory requirements identification (820.10).
If you have MDSAP certification: Your system likely meets most QMSR requirements already. Verify compliance with FDA-specific additions.
Step 2: Establish Your Quality System Documentation
Your QMS documentation hierarchy should include:
| Document Level | Purpose | Examples |
|---|---|---|
| Level 1: Quality Manual | Defines QMS scope, policy, objectives | Quality policy statement, organizational structure, process maps |
| Level 2: Procedures | Describe how QMS processes are executed | Design control procedure, CAPA procedure, supplier management procedure |
| Level 3: Work Instructions | Step-by-step instructions for specific tasks | Equipment operation instructions, inspection methods, cleaning procedures |
| Level 4: Forms and Records | Capture evidence of compliance | Batch records, inspection forms, training records, audit checklists |
Step 3: Implement Production Controls
For each manufacturing process:
Define the process: Document procedures, equipment, materials, and acceptance criteria
Qualify equipment: IQ/OQ/PQ protocols for all critical manufacturing equipment
Validate processes: For processes where output cannot be fully verified by inspection (e.g., sterilization, injection molding, welding), conduct process validation
Establish in-process controls: Define checkpoints, sampling plans, and acceptance criteria
Implement environmental controls: Cleanrooms, temperature, humidity as required
Calibrate instruments: Establish calibration schedules traceable to national/international standards
Step 4: Build Your Traceability System
cGMP requires product traceability throughout the manufacturing process:
Material traceability: Track raw materials and components from receipt through finished product using lot/batch numbers
Process traceability: Document which equipment, operators, and parameters were used for each production step
Distribution traceability: Track which customers received which lots for potential recall
For implantable devices: Maintain records of all components, materials, and work environment conditions for each unit
Step 5: Train Your Workforce
All personnel performing work affecting product quality must be:
Qualified based on education, training, skills, and experience
Trained on QMS procedures relevant to their role
Assessed for competency
Retrained when procedures change
Documented — training records must be maintained
FDA Inspections Under the New Framework
What Changed on February 2, 2026
QSIT retired: The Quality System Inspection Technique (7382.845) is no longer used
New inspection process: CP 7382.850 provides the framework for device inspections
ISO 13485 structure: Inspections now follow the ISO 13485 clause structure rather than the old seven QSIT elements
No certificate issued: FDA inspections do not result in ISO 13485 certificates of conformance
Inspection authority unchanged: FDA retains full inspection authority regardless of ISO 13485 certification status
Inspection Triggers
| Type | Trigger | Focus |
|---|---|---|
| Pre-approval | PMA or 510(k) submission | Manufacturing readiness, design controls, process validation |
| Routine surveillance | Risk-based scheduling | Full QMS compliance, CAPA effectiveness, complaint handling |
| For-cause | Complaints, adverse events, recalls | Root cause, corrective actions, systemic issues |
| Follow-up | Previous Form 483 or warning letter | Verification of corrective actions |
Common cGMP Inspection Findings
Based on FDA Form 483 data, the most frequent cGMP citations in medical device manufacturing include:
CAPA procedures inadequate — Failure to investigate root causes, implement effective corrections, or verify effectiveness
Complaint handling deficient — Inadequate procedures, failure to evaluate for reportable events, incomplete documentation
Design controls missing or incomplete — No design inputs/outputs, missing verification/validation, incomplete DHF
Document control failures — Outdated procedures, unauthorized changes, missing approvals
Process validation lacking — Manufacturing processes not validated, inadequate validation protocols
Training records incomplete — Personnel not trained on procedures, competency not assessed
Nonconforming product controls — Inadequate segregation, incomplete disposition, failure to investigate
Labeling errors — Incorrect labels applied, labeling not inspected before release
Traceability gaps — Incomplete lot tracking, missing component records
Management review inadequate — Infrequent reviews, incomplete input data, no action items
Paper-Based vs Electronic cGMP Systems
| Dimension | Paper-Based | Electronic (eQMS) |
|---|---|---|
| Document control | Manual routing, signature chasing, version confusion | Automated workflows, electronic signatures, version control |
| Batch records | Manual data entry, 30-40% deviation rate from entry errors | Automated data capture, real-time validation, reduced errors |
| CAPA tracking | Spreadsheets, email chains, lost actions | Centralized tracking, automated escalation, dashboards |
| Training management | Paper files, manual tracking, gaps in retraining | Automated assignments, competency testing, compliance dashboards |
| Audit readiness | Weeks of preparation, paper hunting | Real-time compliance visibility, instant document retrieval |
| 21 CFR Part 11 | Not applicable | Must comply — electronic signatures, audit trails, system validation |
| Cost | Low upfront, high ongoing labor | Higher upfront, lower ongoing cost, faster ROI |
The global electronic batch record (EBR) market was valued at $1.28 billion in 2025 and is projected to reach $9.62 billion by 2040, reflecting the industry's shift from paper to digital systems. Between 2020 and 2023, FDA warning letters referenced batch record deficiencies in 42% of pharmaceutical facility inspections, and manual data entry caused 30-40% of all batch record deviations in paper-based facilities.
Global cGMP Equivalents
cGMP is not unique to the FDA. Every major regulatory jurisdiction has its own manufacturing quality requirements:
| Jurisdiction | Regulation/Standard | Key Differences from FDA cGMP |
|---|---|---|
| European Union | ISO 13485:2016 (via EU MDR Article 10) | Not a standalone regulation — mandated through EU MDR/IVDR. Requires Notified Body assessment. |
| Japan | MHLW Ministerial Ordinance 169 | Closely aligned with ISO 13485, with additional PMDA-specific requirements |
| Canada | Health Canada MDSAP requirement | Canada requires MDSAP certification, which audits against ISO 13485 plus jurisdiction-specific requirements from 5 countries |
| Australia | TGA conformity assessment | ISO 13485-based, with TGA-specific application requirements |
| China | NMPA GMP for Medical Devices (Announcement No. 107 of 2025, effective 1 November 2026; 2014 No. 64 until that date) | Shares ISO 13485 principles but adds China-specific dual-release, key-person, and manufacturing-license rules |
| Brazil | ANvisa RDC 16/2013 | Based on ISO 13485:2003 (older version), with Brazil-specific additions |
Frequently Asked Questions
What is the difference between GMP and cGMP?
GMP (Good Manufacturing Practice) establishes baseline quality standards for manufacturing. cGMP (Current Good Manufacturing Practice) adds the requirement to use the most up-to-date technologies, systems, and practices. The "current" in cGMP means that methods acceptable 10 or 20 years ago may be inadequate today. For medical devices sold in the U.S., cGMP requirements are defined in 21 CFR Part 820 (now the QMSR, effective February 2, 2026).
Is ISO 13485 certification the same as cGMP compliance?
No. ISO 13485 certification and FDA cGMP (QMSR) compliance are separate things. The QMSR incorporates ISO 13485:2016 by reference, but adds FDA-specific requirements for labeling controls, complaint handling, UDI compliance, and regulatory identification. The FDA does not require ISO 13485 certification — it assesses compliance during FDA inspections. However, holding ISO 13485 certification demonstrates substantial alignment with QMSR requirements.
When did the QMSR become effective?
The QMSR became effective on February 2, 2026. After this date, FDA inspections follow Compliance Program 7382.850, and the old QSIT (Quality System Inspection Technique) is no longer used. Companies must comply with the new requirements incorporating ISO 13485:2016.
Does the QMSR apply to all medical device manufacturers?
The QMSR applies to manufacturers of finished devices intended for human use, as well as contract sterilizers, installers, relabelers, remanufacturers, repackers, specification developers, and initial distributors of foreign manufacturers. It also applies to HCT/Ps (human cells, tissues, and cellular and tissue-based products) regulated as devices. Components and parts of finished devices are not included in the scope, though FDA may extend requirements to components if necessary.
What happens if a manufacturer fails cGMP compliance?
FDA enforcement actions for cGMP violations include Form 483 observations (inspection findings), warning letters (formal notice of violations), consent decrees (court-ordered compliance), product seizures, import alerts, and criminal prosecution in severe cases. In FY2025, more than one-third of warning letters cited GMP violations tied to documentation failures, including missing signatures, incomplete batch records, and inconsistent procedures.
How long does it take to implement a cGMP-compliant quality system?
For a startup building a QMS from scratch, implementation typically takes 6-12 months. For established companies transitioning from the old QSR to QMSR, the timeline depends on the gap analysis results — companies already ISO 13485 certified face fewer changes. BSI estimates the full journey from preparation to certification spans 12-24 months for organizations seeking ISO 13485 certification, with the QMS itself taking 6-12 months to implement.
Does the QMSR require a quality manual?
Yes, through ISO 13485 Clause 4.2.2, the QMSR requires organizations to establish and maintain a quality manual that includes the scope of the QMS, details of any exclusions or non-applications with justification, and documented procedures established for the QMS or references to them.
Can a company be cGMP-compliant without ISO 13485 certification?
Yes. The QMSR does not require ISO 13485 certification from an accredited body. FDA inspectors will assess whether your quality system meets the requirements of ISO 13485:2016 (as incorporated by reference) plus FDA-specific additions during their inspection. Certification is voluntary but highly beneficial for market access in the EU, Japan, Canada, Australia, and other jurisdictions.
How do cGMP requirements apply to contract manufacturers?
Contract manufacturers are subject to cGMP requirements for the manufacturing activities they perform. Under ISO 13485 Clause 4.1.5, organizations must control and monitor outsourced processes, and the QMSR extends to contract sterilizers, installers, relabelers, and other contract manufacturers. The contracting firm and the contract manufacturer share responsibility for product quality, documented through quality agreements.
What is the relationship between cGMP and CAPA?
CAPA (Corrective and Preventive Action) is a core cGMP requirement under ISO 13485 Clause 8.5.2 and 8.5.3. CAPA is the mechanism by which manufacturers identify quality problems, determine their root causes, implement corrections, and verify effectiveness. It is consistently one of the most frequently cited areas in FDA inspections, making it essential to cGMP compliance.