Pre-QMSR Part 820 §820.180

Pre-QMSR Part 820: §820.180 General requirements.

ISO 13485: §4.2.5 Control of records

FDA QMSR (2026): §820.35 Control of records.

Records control is the foundation of auditability: every quality system requirement generates records, and those records must be retrievable, legible, and authentic to serve as evidence of conformance during regulatory inspections, customer audits, or post-market reviews. The specific retention floor — at least the lifetime of the medical device, and not less than two years from device release (ISO 13485 4.2.5, incorporated through QMSR 820.10) — reflects the temporal mismatch between device use and regulatory review: adverse events and liability claims often surface years after distribution, and records that have been disposed of prematurely cannot support investigation or defense. Former §820.180(c) exempted management-review, quality-audit, and supplier-audit reports from FDA inspection, permitting an executive certification of completion in lieu of report access; the QMSR does not carry that exemption forward, so those reports now fall under the general records-control requirements of ISO 13485 Clause 4.2.5 (incorporated through §820.10(a)) — retention, legibility, authenticity — like any other QMS record. §820.35 itself never names audit or management-review reports; it supplements only complaint, servicing, and UDI record content, so the records-control floor that now reaches these reports is ISO 13485 4.2.5's — the same instrument that carries the retention floor. FDA removed the exemption to align with global inspection practice (other regulators and MDSAP auditing organizations grant no such exemption) and reasoned that its investigators already access the underlying data — nonconformances, complaints, and resulting corrective actions (89 FR 7511, Comment 55). It did not, however, declare the reports themselves inspectable in this rule: FDA expressly deferred any change to its inspectional processes to future implementation, and — as one commenter noted, uncontested by FDA — the Quality System Inspection Technique (QSIT) guide still described these records as exempt from inspection. Whether FDA reviews the reports on inspection therefore turns on that forthcoming inspectional-process change, not on the records-control obligation itself. Electronic record protection requirements — audit trail capability, protection against unauthorized access or alteration — close the gap that electronic systems otherwise introduce: a paper record's authenticity is relatively transparent, while an electronic record can be silently altered without visible evidence unless the system maintains an audit trail. The UDI-in-records requirement reflects the FDA's post-market surveillance strategy: UDI enables linkage of device-specific records across complaint files, service records, and MDR reports, supporting population-level signal detection that individual record-by-record review cannot accomplish.

QMSR section 820.35 is one of the provisions where FDA deliberately retained requirements beyond what ISO 13485 section 4.2.5 requires. While ISO 13485 section 4.2.5 establishes general controls for records (identification, storage, protection, retrieval, retention, disposition), QMSR 820.35 adds FDA-specific requirements that reflect the agency's enforcement priorities around record integrity and traceability.

The most notable QMSR-specific addition is the requirement to include the Unique Device Identifier (UDI) or equivalent device identification in complaint records and servicing records where applicable. This links the records control requirement directly to FDA's UDI system and ensures that when FDA reviews complaint or service records during an inspection, they can trace individual records to specific device production lots or individual devices. ISO 13485 has no UDI-specific requirement because UDI is an FDA regulatory construct.

The retention floor itself is not an FDA-plus: former §820.180(b)'s lifetime-plus-two-years rule was repealed with the rest of Subpart M, and ISO 13485 4.2.5's own text requires records to be retained for at least the lifetime of the medical device as defined by the organization, but not less than two years from medical device release. The preamble's enumeration of what 820.35 carries names the Part 803 information, UDI documentation per Part 830, and the confidentiality clarification from former §820.180 — never retention periods. What FDA did retain verbatim is the confidentiality provision: former §820.180(a) reappears as §820.35(d).

The separation of records control (820.35) from document control (820.40 / ISO 13485 4.2.4) reinforces the structural distinction described in the document control atom. Records are evidence of activities performed — they are created once and must be preserved in their original state. Documents are instructions for future activities — they are revised over time. Companies must have distinct controls for each, even if managed within the same SOP.