How to Review a Supplier's Production and Process-Control File After QMSR: Why 21 CFR 820.70, 820.75 and 820.80 Are Reserved, What ISO 13485 Clause 7.5 and 21 CFR 820.45 Require, What Compliance Program 7382.850 Inspects under Production and Service Provision, and Why a DHR Binder or Contract-Sterilizer Listing Is Not the File

When an international distributor qualifies a Chinese sterile single-use device manufacturer, an OEM buyer audits a contract manufacturing facility, or a hospital procurement engineering committee updates its vendor onboarding questionnaire, the production and process-control file is where clinical safety meets manufacturing reality. Historically, commercial buyers issued audit questionnaires centered on the United States Food and Drug Administration (FDA) Quality System Regulation (QSR) under 21 CFR Part 820—specifically demanding documented compliance with 21 CFR 820.70 for production and process controls, 820.72 for inspection equipment, 820.75 for process validation, 820.80 for acceptance activities, and 820.184 for the Device History Record (DHR). However, on 2 February 2026, the FDA's Quality Management System Regulation (QMSR) final rule took full effect.⁵

Under QMSR, the entire regulatory architecture shifted: Subparts C through O of 21 CFR Part 820 were officially reserved.¹ Citations to 820.70, 820.72, 820.75, 820.80, 820.86, 820.120, and 820.184 no longer represent active federal regulations. Instead, the FDA incorporated by reference the international quality standard ISO 13485:2016 (specifically Clause 7.5 and its related operational clauses), while establishing a vital, non-negotiable United States supplemental requirement in 21 CFR 820.45 for device labeling and packaging controls.³ This technical guide provides distributors, private-label brand owners, and quality auditors with a field-by-field protocol to review a supplier's production and process-control file, navigate FDA Compliance Program 7382.850, and avoid common commercial and regulatory traps before accepting the first commercial lot.

Table of Contents

1. Does a questionnaire that still cites 21 CFR 820.70, 820.75 or 820.80 ask for current QMSR law, or for reserved Quality System Regulation sections?
2. What ISO 13485 clauses actually carry production duties, and why does CP 7382.850 put infrastructure, contamination control and measuring equipment inside Production and Service Provision?
3. What 21 CFR 820.45 adds on top of Clause 7.5.1, and why FDA kept labeling inspection after incorporating ISO 13485
4. When is Clause 7.5.6 process validation required, and why IQ/OQ/PQ slogans are not a substitute for 7.5.5/7.5.7 sterile-device and sterile-barrier validation
5. What 820.10(b)(1) and (b)(2) add for UDI and tracking, and why 820.10(d) life-supporting traceability is not a default for a circumcision ring or laser fiber
6. Is a Device History Record labelled to 820.184 the same thing as records against the medical device file?
7. Does a public FEI listed as Manufacturer, Contract Manufacturer or Contract Sterilizer prove the production file?
8. Does an MDSAP certificate, including leftover 820.70 cites in AU P0002.009, replace a QMSR production inspection?
9. Worked examples: a CE-marked circumcision ring, an NMPA-only laser fiber, and an NPWT dressing kit — what production evidence to request without inventing a 510(k)
10. Distributor checklist, red flags, and the pack to request before the first commercial lot
11. Where VEMERIX fits—and where due diligence still begins
12. Frequently Asked Questions

Does a questionnaire that still cites 21 CFR 820.70, 820.75 or 820.80 ask for current QMSR law, or for reserved Quality System Regulation sections?

When medical device distributors and private-label buyers issue standard vendor onboarding questionnaires or supplier audit checklists, many continue to copy the legacy regulatory citations of the 1996 FDA Quality System Regulation (QSR). These questionnaires routinely demand that a foreign manufacturer certify compliance with "21 CFR 820.70 for Production and Process Controls," "21 CFR 820.75 for Process Validation," "21 CFR 820.80 for Receiving, In-Process, and Finished Device Acceptance," and "21 CFR 820.184 for the Device History Record." However, as of 2 February 2026, every one of these regulatory sections has been formally reserved by the FDA.¹

In the final rule amending 21 CFR Part 820 into the Quality Management System Regulation (QMSR, 89 FR 7496), the FDA systematically eliminated Subparts C through O.¹,⁵ Today, if an auditor or quality manager attempts to navigate to https://www.ecfr.gov/current/title-21/section-820.70 or .../section-820.75 on the live electronic Code of Federal Regulations, the government server returns an HTTP 404 error.¹ The active substantive sections in 21 CFR Part 820 are strictly limited to Section 820.1 (Scope), Section 820.3 (Definitions), Section 820.7 (Incorporation by Reference), Section 820.10 (Requirements for a Quality Management System), Section 820.35 (Control of Records), and Section 820.45 (Device Labeling and Packaging Controls).¹

Under QMSR, 21 CFR 820.70, 820.72, 820.75, 820.80, 820.86, 820.120, and 820.184 are reserved. A supplier questionnaire that demands compliance with 820.70 is asking for a retired 1996 regulation. Production duties now sit in ISO 13485:2016 Clause 7.5, augmented by mandatory labeling inspection under 21 CFR 820.45 and mapped under Compliance Program 7382.850.— Editorial restatement of eCFR 21 CFR Part 820 and 21 CFR 820.45; not a verbatim Federal Register quotation.

Why does the market still suffer from obsolete citations? The primary reason is a persistent search engine and artificial intelligence indexing baseline. As of 4 September 2026, entering "21 CFR 820.70 production and process controls" into search engines reveals a striking failure pattern: the top organic search result remains the Cornell Law School Legal Information Institute (LII) webpage, which continues to print the 1996 shall-text under the obsolete heading "§ 820.70 Production and process controls." The second organic result is an FDA-hosted QSIT-era training PDF (media/118200) authored decades ago that still lists 820.70, 820.72, and 820.75 as active legal requirements. Compounding the confusion, Google's 4 September 2026 AI Overview explicitly tells researchers that 21 CFR 820.70 is the governing federal regulation, reciting paragraphs 820.70(a) through (e) as current law.

For a commercial buyer, relying on these outdated search results creates immediate legal and operational liability. When a distributor files an RFQ or vendor agreement that still cites 820.70, a sophisticated Chinese manufacturer’s regulatory team must either push back to correct the legal framework or sign an unexecutable declaration. More critically, when FDA investigators enter a facility under Compliance Program 7382.850, they will not open 820.70. They will inspect the facility against ISO 13485:2016 Clause 7.5 and evaluate the supplemental US labeling inspection requirements under 21 CFR 820.45.⁸

What ISO 13485 clauses actually carry production duties, and why does CP 7382.850 put infrastructure, contamination control and measuring equipment inside Production and Service Provision?

With the retirement of 21 CFR 820.70, the substantive duties for production and process control are incorporated directly from ISO 13485:2016 Clause 7.5 (Production and service provision) through 21 CFR 820.7 and 820.10(a).¹,² Clause 7.5 contains eleven distinct subclauses that govern the physical transformation of raw materials into finished, sterile medical devices:

• Clause 7.5.1 (Control of production and service provision): Requires planned, established, monitored, and controlled production, including documented procedures, validated work instructions, monitoring equipment, and batch records providing traceability and quantities released.
• Clause 7.5.2 (Cleanliness of product): Governs requirements for product cleanliness prior to sterilization, cleaning agents, bioburden reduction, and particulate control.
• Clause 7.5.3 & 7.5.4 (Installation and Servicing): Specific requirements for on-site installation and maintenance activities (which are typically non-applicable for sterile single-use surgical consumables).
• Clause 7.5.5 (Particular requirements for sterile medical devices): Mandates that the organization maintain records of the sterilization process parameters for each sterilization batch, providing traceability to each production lot.
• Clause 7.5.6 (Validation of processes for production and service provision): Mandates validation of any process whose output cannot be verified by subsequent monitoring or measurement, establishing statistical methods, parameter limits, and revalidation protocols.
• Clause 7.5.7 (Particular requirements for validation of processes for sterilization and sterile barrier systems): Requires full validation of sterilization cycles (ISO 11135 / 11137) and sterile barrier packaging systems (ISO 11607-1 and 11607-2) prior to routine production.
• Clause 7.5.8 (Identification): Mandates identification of product by suitable means throughout product realization, bridged by 21 CFR 820.10(b)(1) to Unique Device Identification (UDI) under 21 CFR Part 830.
• Clause 7.5.9 (Traceability): Divided into Clause 7.5.9.1 for general lot/batch traceability, and Clause 7.5.9.2 for implantable and life-supporting medical devices.
• Clause 7.5.10 (Customer property): Requires identification, verification, protection, and safeguarding of customer property (such as customer-owned tooling, OEM molds, or private-label packaging artwork).
• Clause 7.5.11 (Preservation of product): Mandates preservation of conformity of product during processing, storage, handling, and distribution, including shelf-life controls and environmental barrier integrity.

Understanding how the FDA operationalizes these clauses requires examining Compliance Program 7382.850 (Inspection of Medical Device Manufacturers), implemented on 2 February 2026.⁶,⁸ In CP 7382.850, the FDA retired the four QSIT inspection subsystems (Management, Design, P&PC, and CAPA) and inspects six named Quality Management System (QMS) areas: Change Control; Design and Development; Management Oversight; Measurement, Analysis, and Improvement; Outsourcing and Purchasing; and Production and Service Provision.⁶,⁸ Reviewing the purchasing file or the complaint and CAPA file is not a substitute for reviewing production and process-control records. In Attachment A, page 76, the header prints "Product and Service Provision QMS Area", while the inspection models throughout the document designate it "Production and Service Provision".⁸

Crucially, the FDA did not restrict this QMS area to Clause 7.5. Instead, CP 7382.850 Attachment A page 76 explicitly incorporates three foundational operational clauses: Clause 6.3 (Infrastructure and Maintenance), Clauses 6.4.1 and 6.4.2 (Work Environment and Contamination Control), and Clause 7.6 (Control of Monitoring and Measuring Equipment).⁸ For a sterile single-use device, those clauses sit inside the same inspectable QMS area because they control the environment and instruments that actually release the lot:

• Infrastructure (Clause 6.3): A cleanroom HVAC air handling system, purified water generation system, or compressed dry air line is not a peripheral facility matter. If HVAC maintenance lapses, cleanroom pressure cascades fail, introducing environmental particulates into open blister packs.
• Contamination Control (Clauses 6.4.1 & 6.4.2): For sterile consumables, bioburden baseline directly dictates sterilization cycle lethality. If cleanroom personnel gowning, air velocity, or surface disinfection controls fail under Clause 6.4, bioburden spikes can exceed the validated spore-log reduction of the sterilization cycle, compromising the Sterility Assurance Level (SAL 10⁻⁶).
• Measuring Equipment (Clause 7.6): The heat-sealing machines sealing Tyvek pouches or blister lids rely on calibrated thermocouples, pressure transducers, and digital timers. If calibration lapses under Clause 7.6, the sealing process drifts outside its validated parameters, producing seal micro-channels that cause post-market sterility failures.

What 21 CFR 820.45 adds on top of Clause 7.5.1, and why FDA kept labeling inspection after incorporating ISO 13485

The most consequential United States–specific requirement in the entire QMSR architecture is 21 CFR 820.45 (Device labeling and packaging controls).³ In the rulemaking preamble (89 FR 7496), numerous industry stakeholders submitted comments asking why the FDA did not simply rely on ISO 13485 Clause 7.5.1(e), which already requires organizations to implement "defined operations for labelling and packaging."⁵

The FDA's response in Comment 64 established the legal and clinical justification for retaining explicit federal labeling controls. The FDA stated that while ISO 13485 Clause 7.5.1(e) addresses general labeling and packaging operations, it does not specifically mandate the detailed inspection of labeling prior to commercial release or storage.⁵ FDA retained those QS-regulation labeling and packaging controls as 820.45 because, in its words, many device recalls are related to labeling and packaging. That preamble statement is a qualitative rationale for keeping 820.45, not a recount of recall incidence.⁵ Consequently, the FDA ruled that regulated manufacturers must meet both ISO 13485 Clause 7.5.1 and the specific, prescriptive inspection duties of 21 CFR 820.45.³,⁵

21 CFR 820.45 establishes three strict operational mandates that every distributor, OEM buyer, and auditor must verify in a supplier's file:

• 820.45(a) Pre-release examination: In addition to Clause 7.5.1, manufacturers must ensure labeling and packaging have been examined for accuracy prior to release or storage where applicable, including: (1) the correct Unique Device Identifier (UDI) or Universal Product Code (UPC), or any other device identification; (2) expiration date; (3) storage instructions; (4) handling instructions; and (5) any additional processing instructions.
• 820.45(b) Documented labeling release: The release of labeling for use must be documented in accordance with ISO 13485 Clause 4.2.5 (Control of records). 820.45(b) does not itself enumerate inspector identity, date, or lot fields; those details, if present, come from the manufacturer's Clause 4.2.5 procedure, not from leftover 21 CFR 820.120 text.
• 820.45(c) Mix-Up Prevention & MDF Inspection: Manufacturers must implement operations to prevent labeling and packaging mix-ups. Labeling and packaging operations must be controlled to prevent mix-ups, and labels must be inspected against the approved Medical Device File (MDF). Results of these inspections must be documented under Clause 4.2.5.

When is Clause 7.5.6 process validation required, and why IQ/OQ/PQ slogans are not a substitute for 7.5.5/7.5.7 sterile-device and sterile-barrier validation

Under ISO 13485 Clause 7.5.6, process validation is triggered by an unambiguous legal and physical standard: an organization must validate any process for production where the resulting output cannot be or is not verified by subsequent monitoring or measurement, and as a consequence, deficiencies become apparent only after the device is in use or the service has been delivered.⁸ For sterile surgical consumables, destructive testing is inherently required to verify seal strength or sterility; inspecting every unit would destroy the commercial batch. Therefore, these processes must be fully validated.

However, distributors frequently encounter suppliers who treat process validation as a superficial slogan, presenting an engineering binder stamped "IQ/OQ/PQ completed per 820.75." The acronyms Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) originate from Global Harmonization Task Force (GHTF/SG3/N99-10) guidance; they are not statutory phrases in 21 CFR Part 820 or ISO 13485.⁸ More importantly, an auditor under CP 7382.850 will reject validation files that merely present nominal parameter runs without challenging worst-case boundary conditions:

• Installation Qualification (IQ): Verifies that equipment was installed according to manufacturer specifications, electrical utilities are stable, pneumatic air pressures meet spec, software/firmware versions are verified, and calibration status (Clause 7.6) is documented.
• Operational Qualification (OQ): Challenges the process parameter boundaries (e.g. minimum and maximum sealing temperatures, pressures, and dwell times; injection molding melt temperatures and injection speeds). OQ must demonstrate that the process produces conforming product across the entire allowable process window, not just at nominal settings.
• Performance Qualification (PQ): Demonstrates process repeatability and consistency across multiple consecutive production runs (typically a minimum of three consecutive commercial-scale lots) using production personnel, actual raw materials, and routine cleanroom environmental conditions, supported by rigorous statistical confidence and reliability intervals.

The most dangerous blind spot in supplier qualification is confusing general process validation (Clause 7.5.6) with the specialized sterile-device and sterile-barrier validation requirements under Clauses 7.5.5 and 7.5.7.⁸ In CP 7382.850 Attachment A page 76, FDA lists these as separate, distinct compliance elements. A supplier who contracts sterilization to a third-party facility often provides an Ethylene Oxide (EO) sterilization cycle certificate (ISO 11135) and assumes that production validation is closed. This is a severe compliance failure.

An EO sterilization certificate proves only that the contract chamber achieved microbial lethality (SAL 10⁻⁶) on a validated bioburden load.⁸ It does not prove that the device manufacturer's heat-sealing process formed an intact microbial barrier. The manufacturer must hold an independent ISO 11607-1 and ISO 11607-2 validation file for the sterile packaging line: validating the heat-sealing machine parameters, conducting seal peel tensile testing (ASTM F88), performing dye penetration testing (ASTM F1929) to detect micro-channel leaks, conducting bubble emission leak testing (ASTM F2096), and establishing shelf-life sterility through accelerated and real-time aging.⁸ For a complete technical walkthrough of sterilization and sterile barrier acceptance, see our companion guides on how to read an EO sterilization validation file, when radiation-sterilization validation is the 7.5.7 file rather than EO, and how sterile-barrier sealing validation differs from general process validation.

What 820.10(b)(1) and (b)(2) add for UDI and tracking, and why 820.10(d) life-supporting traceability is not a default for a circumcision ring or laser fiber

In incorporating ISO 13485, the FDA established specific statutory bridges in 21 CFR 820.10(b) to connect international quality clauses to United States statutory tracking and identification systems.² Auditors and distributors must understand the exact legal boundaries of these provisions to avoid imposing irrelevant requirements on sterile single-use devices:

• 21 CFR 820.10(b)(1) — Unique Device Identification (UDI): Explicitly mandates that the system for identifying devices under ISO 13485 Clause 7.5.8 must include a system for Unique Device Identification in accordance with 21 CFR Part 830.² An internal serial number, lot code, or enterprise resource planning (ERP) traveler number satisfies ISO 13485, but under QMSR, it does not satisfy FDA requirements unless the product label, individual sterile packaging, and carton carry a compliant UDI consisting of a Device Identifier (DI) and Production Identifier (PI) formatted to GS1, HIBCC, or ICCBBA standards.
• 21 CFR 820.10(b)(2) — Medical Device Tracking: Connects ISO 13485 Clause 7.5.9.1 (Traceability) to 21 CFR Part 821 (Medical Device Tracking Requirements).² However, this bridge applies only if the specific device is subject to a formal FDA tracking order issued under Section 519(e) of the Federal Food, Drug, and Cosmetic (FD&C) Act. Part 821 tracking applies to high-risk, life-sustaining, permanently implantable devices such as cardiac pacemakers, vascular grafts, or mechanical heart valves.
• 21 CFR 820.10(d) — Traceability for Life-Supporting Devices: Mandates that manufacturers of devices that "support or sustain life" must also comply with the stringent requirements of ISO 13485 Clause 7.5.9.2 (Particular requirements for traceability of implantable medical devices).² Clause 7.5.9.2 requires organizations to maintain records of all components, materials, and environmental conditions used, along with complete distribution records down to the individual patient level.

A frequent error in distributor audit checklists is mechanically checking the box for "implantable traceability" on disposable surgical consumables. A disposable circumcision device (whether an auto-circumcision ring or surgical stapler), an endovenous laser fiber, and a negative pressure wound therapy (NPWT) dressing kit are sterile single-use devices. None of these devices is a permanently implanted, life-supporting product by default. Consequently, neither 21 CFR 820.10(d) nor Clause 7.5.9.2 is a default duty for those SKUs, and 21 CFR Part 821 applies only if FDA has issued a tracking order. Copying implantable-traceability or Part 821 tracking onto a circumcision ring or laser fiber without that order is an audit defect, not extra safety.

Is a Device History Record labelled to 820.184 the same thing as records against the medical device file?

Under the legacy Quality System Regulation, medical device manufacturers compiled a physical binder known as the Device History Record (DHR) under 21 CFR 820.184. The DHR was designed to demonstrate that a specific lot was manufactured in accordance with the Device Master Record (DMR) under 21 CFR 820.181. Under QMSR, both 820.181 and 820.184 were formally reserved.¹

In their place, the FDA adopted the harmonized architecture of ISO 13485:2016. Under ISO 13485 Clause 4.2.3, the organization must establish and maintain a Medical Device File (MDF) for each medical device type or family.⁴ The MDF contains complete product specifications, intended use, manufacturing and assembly procedures, packaging and labeling specifications, and procedures for measuring and monitoring. Under Clause 7.5.1, the organization must maintain a record for each batch of medical devices that provides traceability and identifies the exact quantity manufactured and quantity approved for release.⁸

The distinction between an obsolete DHR binder and modern MDF-aligned batch records is not semantic; it directly impacts rework and release authorization. In 21 CFR 820.3, the FDA added an explicit definition of rework under QMSR: "Rework means action taken on a nonconforming product so that it will fulfill the specified requirements in the medical device file before distribution."⁴ Under the old QSR, rework was frequently conducted against informal engineering change orders or ad-hoc instructions filed in the DHR. Under QMSR, rework cannot occur without formal evaluation against the approved Medical Device File, documented risk reassessment, and re-verification under ISO 13485 Clause 8.3.⁴

When an auditor or distributor reviews a supplier's batch records, they should verify six specific elements to ensure conformity with Clause 7.5.1, 21 CFR 820.35, and 21 CFR 820.45:

• Bill of Materials (BOM) Reconciliation: Verification that all raw polymers, optical fibers, adhesives, and packaging foils were issued from approved, qualified vendor lots with incoming inspection sign-offs.
• Critical Process Parameter (CPP) Records: Documented process logs verifying that machines operated within their validated windows (e.g. injection molding barrel temperatures and cycle times, heat-sealer temperature and dwell time logs).
• Environmental Monitoring Records: In-process cleanroom particle counts and microbial settle-plate records corresponding to the specific dates and shifts of production.
• Sterilization Batch Release: Third-party or in-house sterilization cycle printouts showing temperature, humidity, gas concentration, and vacuum curves, accompanied by biological indicator (BI) incubation clearance (zero growth at 7 days or validated rapid readout).
• 21 CFR 820.45 Labeling Inspection Sign-Off: Pre-release labeling inspection records documenting verification of UDI, expiration date, storage symbols, and lack of mix-up against the MDF, signed by authorized QA personnel.
• Formal Lot Release Authorization: A final release certificate signed by the designated Quality Assurance authority confirming that all batch records fulfill the specified requirements of the Medical Device File.

Does a public FEI listed as Manufacturer, Contract Manufacturer or Contract Sterilizer prove the production file?

When qualifying overseas medical device suppliers, commercial distributors often accept a screenshot of the supplier's FDA Establishment Registration and Device Listing from the public openFDA database as definitive proof of compliance. If the database displays a valid FDA Establishment Identifier (FEI) and lists the company's establishment type as "Manufacturer", "Contract Manufacturer", or "Contract Sterilizer", buyers frequently assume the facility has been audited and approved by the FDA. This assumption is completely false.

An independent recomputation of the FDA establishment registration and device listing bulk extract (snapshot export date 22 July 2026; 419,651 listing rows; 25,405 unique non-empty FEIs) shows the administrative nature of these listings. Of those 25,405 unique registered establishments (including 10,141 in the United States and 4,957 in China), thousands carry commercial manufacturing tokens:¹⁶

• 7,231 unique non-empty FEIs register with the token "Manufacture Medical Device for Another Party (Contract Manufacturer)", including 1,918 facilities in China.
• 5,098 unique non-empty FEIs register as "Develop Specifications But Do Not Manufacture At This Facility" (Specification Developers).
• 3,854 unique non-empty FEIs register as "Repack or Relabel" (including 316 in China).
• 571 unique non-empty FEIs register as "Contract Sterilizer" (including 143 in China).
• The listing form's leftover QS section number remains a complaint-file token printing 21 CFR 820.198; that leftover is owned by the CAPA and complaint file-review and is not a production-section leftover. Do not treat it as 820.70 hygiene.
• Zero listing-type strings in the entire FDA database contain 820.70, 820.75, or 820.80, confirming that production sections were never part of the establishment registration taxonomy.

FDA establishment registration under 21 CFR Part 807 is an annual administrative declaration accompanied by payment of the Medical Device User Fee (MDUFA). The FDA does not inspect a facility or review its technical files before issuing an FEI or publishing an establishment listing. A facility can appear in that public directory as a "Contract Manufacturer" or "Contract Sterilizer" without FDA having verified whether its cleanrooms comply with Clause 6.4, whether its heat sealers are validated under Clause 7.5.7, or whether its labeling inspections comply with 21 CFR 820.45.¹⁶ Relying on an FDA listing screenshot as proof of production compliance is a critical audit error; the buyer must independently demand and inspect the underlying production records.

Does an MDSAP certificate, including leftover 820.70 cites in AU P0002.009, replace a QMSR production inspection?

Suppliers holding certificates under the Medical Device Single Audit Program (MDSAP) frequently assure international buyers that because MDSAP audits cover the United States, their production processes are officially validated for FDA compliance. This belief is contradicted by official FDA policy.

In the official FDA QMSR Frequently Asked Questions (current as of 2 February 2026), Question 13 addresses this exact issue with absolute clarity: "FDA inspections under the QMSR will not follow the MDSAP audit plan... FDA will not require or issue ISO 13485 certificates... A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection."⁷ FDA investigators conducting inspections under Section 704 of the FD&C Act operate under statutory compliance programs—specifically CP 7382.850—not the MDSAP companion document.⁷,⁸

Furthermore, an examination of MDSAP audit guidance reveals an evolving regulatory transition. In the FDA-hosted MDSAP Audit Approach document AU P0002.009 (revision date 2024-08-06, media/166672), the Production and Service Controls chapter still contains legacy country-specific citations: 21 CFR 820.70 appears 18 times, and 21 CFR 820.75 appears 9 times in the FDA jurisdictional column.⁹ These leftover references represent transitional drafting artifacts, not active law. In the current MDSAP Audit Approach document, AU P0002.011 (version date 3 August 2026), an independent extract of the official PDF on 4 September 2026 finds labeling accuracy and mix-up tasks citing 21 CFR 820.45(a)–(c) and no leftover 21 CFR 820.70 or 820.75 section cites.¹⁰ Those MDSAP column cites are still an audit model, not the legal test under CP 7382.850.

While an MDSAP audit report provides valuable third-party evidence that an authorized Auditing Organization (AO) reviewed the supplier's ISO 13485 system, it does not guarantee immunity from FDA Form 483 inspection observations. An FDA investigator inspecting under CP 7382.850 can and will scrutinize specific production parameter records, cleanroom bioburden logs, and 820.45 labeling release documentation regardless of whether an MDSAP certificate hangs in the supplier's lobby.⁷,⁸ For guidance on evaluating certificate authenticity, see our guide on how to verify an ISO 13485 certificate.

Worked examples: a CE-marked circumcision ring, an NMPA-only laser fiber, and an NPWT dressing kit — what production evidence to request without inventing a 510(k)

To understand how the intersection of ISO 13485 Clause 7.5, CP 7382.850, and 21 CFR 820.45 applies in practice, consider three concrete product-family scenarios representing distinct manufacturing technologies: precision polymer molding, optoelectronic fiber assembly, and multi-component dressing kit packaging. In each scenario, an international buyer must establish exactly what production evidence must be present in the supplier's file without inventing fictitious United States 510(k) clearances or premature regulatory claims.

Worked Example 1: Disposable Circumcision Device (Self-Detaching Ring)

The public VEMERIX Circumcision Device page records an NMPA Class II medical device (Lu Mech Reg. 20172020238) with a CE mark, EO sterilization, and 14 size codes, supplied sterile in individual blister packs.¹² The page describes a biodegradable, self-detaching circumcision ring. This article does not invent a US 510(k) or an FDA inspection classification for that SKU. When an international distributor or private-label buyer audits this production file, the review must examine four interconnected evidence streams:

• Process validation for forming operations (Clause 7.5.6): Forming and assembly steps whose output cannot be fully verified belong in the Clause 7.5.6 file. Ask for the actual process window, worst-case runs, and revalidation triggers against the dimensional specifications in the medical device file — not an IQ/OQ/PQ stamp labelled to reserved 820.75.
• Sterile-barrier sealing validation (Clause 7.5.7): The public page records individual sterile blister packs. Ask for the ISO 11607-1/-2 validation for that pack system, including sealing-process limits and integrity tests such as seal peel and dye penetration. Do not accept a generic EO certificate as the blister-seal file.
• Ethylene oxide sterilization validation (Clauses 7.5.5 and 7.5.7): Ask for the ISO 11135 validation and routine batch records for this family, plus residual evidence against the currently recognized ISO 10993-7 limits for the applicable contact category.¹¹ FDA recognition 2-275 still lists the 2008 edition including Corrigendum 1 and Amendment 1; do not silently upgrade residual limits to a later edition.
• 21 CFR 820.45 pre-release labeling inspection: Because the device is supplied in 14 size codes, size-code mix-up is a serious labeling failure mode. The batch record should include 820.45(a) examination evidence for the printed size code, lot identification, expiration date, applicable storage instructions, and the UDI, documented under Clause 4.2.5.

Worked Example 2: Disposable Medical Laser Fiber (1470 nm Vascular)

The public VEMERIX Disposable Medical Laser Fiber page records an NMPA Class II medical device (Lu Mech Reg. 20192010517) for 1470 nm endovenous workflows, supplied sterile for single-patient use, with no Medison CE claim and a partner-supplied diode laser source.¹³ Multiple tip geometries are published; connector model, core diameter, and transmission percentages are not published on that page and are not restated here. A production-file audit for this vascular consumable focuses on process validation, sterile-barrier integrity, identification, and labeling inspection:

• Fiber termination and assembly (Clause 7.5.6): Connector termination, cleaving, and related assembly steps whose output cannot be fully verified by subsequent inspection belong in the Clause 7.5.6 file. Ask for the actual validated process window and revalidation triggers for the SKU, not a connector-model slogan.
• Monitoring and measuring equipment (Clause 7.6): Optical power meters, microscopes, and other measuring equipment used to accept the fiber must be in the Clause 7.6 calibration file. This article does not invent a transmission-efficiency specification for the SKU.
• Sterile-pouch sealing (Clause 7.5.7): Ask for ISO 11607 sealing validation for the actual sterile pack used with this fiber, including evidence that the pack remains intact through handling and distribution. Do not invent a connector, core-diameter, or tip-sleeve specification that the public product page does not publish.
• 21 CFR 820.45 and 820.10(b)(1) identification: Primary-pack labeling should be examined, where applicable, for the published 1470 nm workflow identity, single-use status, and a Part 830 UDI. Assigning a UDI is not the same as inspecting the printed UDI before release; see the UDI assignment guide for issuance, and keep 820.45 inspection in this file.

Worked Example 3: Disposable NPWT Drainage Dressing Kit

The public VEMERIX Disposable NPWT Drainage Dressing Kit page describes a side-suction multi-chamber (S.O.M.T) cup, PVA/PU foam, a biological semi-permeable membrane, and a 400–600 µm pore structure.¹⁴ That page does not publish an NMPA registration number for the dressing kit; Lu Mech Reg. 20182140303 belongs to the NPWT pump, not this SKU. Because this is a multi-component procedure kit, the production-file review centers on mix-up prevention, process validation of joining steps, and sterile-barrier integrity:

• Multi-Component Packaging Mix-Up Prevention (21 CFR 820.45(c)): A complete kit requires the exact combination of foam sponge (specified pore size 400–600 µm), silicone drainage cup, tubing, and polyurethane drape. The manufacturer must document physical line clearance procedures between shifts, verified component counting, and visual inspection against the Medical Device File to prevent missing connectors or mismatched foam densities.
• Joining-process validation (Clause 7.5.6): Tubing-to-cup joining whose output cannot be fully verified belongs in the Clause 7.5.6 file. Ask for the actual process window and leak/integrity evidence for that joint. Do not copy the NPWT pump's published −50 to −450 mmHg operating range onto the dressing weld as if it were a packaging-validation specification.
• Sterile Barrier & Vacuum Retention (Clause 7.5.7): The kit is packaged in a large-format sterile barrier pouch. Sealing validation must ensure seal integrity across the wide pouch perimeter, backed by dye penetration and vacuum integrity testing after simulated distribution transit.

Distributor checklist, red flags, and the pack to request before the first commercial lot

To ensure thorough quality due diligence, international distributors, procurement authorities, and OEM buyers should adopt a systematic incoming file-review protocol before authorizing commercial shipments or making milestone payments.

The 8-Point Production and Process-Control File Audit Checklist

1. Regulatory Citation Hygiene: Confirm that the supplier's Standard Operating Procedures (SOPs) and Quality Manual have purged all active citations to 21 CFR 820.70, 820.75, and 820.80, and correctly reference ISO 13485:2016 Clause 7.5 and 21 CFR 820.45.
2. 21 CFR 820.45 Labeling SOP: Verify the existence of a dedicated procedure mandating pre-release examination of labeling and packaging accuracy, explicitly checking UDI, expiration date, storage conditions, handling instructions, and processing instructions.
3. Documented Label Release & Mix-Up Logs: Inspect batch production records to confirm physical label inspection sign-offs under Clause 4.2.5, line clearance logs between production lots, and documented label quantity reconciliation.
4. Process Validation Reports (Clause 7.5.6): Demand complete IQ/OQ/PQ validation reports for all unverified production processes (injection molding, automated assembly, welding, adhesive bonding) demonstrating challenged parameter limits and statistical sample rationales.
5. Sterile Barrier Packaging Validation (Clause 7.5.7): Confirm the existence of an independent ISO 11607-1/-2 packaging validation file, including heat-sealing process parameter limits, seal peel strength (ASTM F88), dye penetration testing (ASTM F1929), and accelerated shelf-life aging data.
6. Sterilization Validation & Batch Records (Clause 7.5.5): Verify the ISO 11135 EO or ISO 11137 Radiation sterilization validation report (SAL 10⁻⁶), routine batch sterilization certificates with parameter printouts, biological indicator clearance, and ISO 10993-7 residual test reports.
7. Batch Records Aligned with Medical Device File: Verify that finished batch production records demonstrate 100% component traceability and conformity against the approved Medical Device File (Clause 4.2.3), with all rework formally evaluated under 21 CFR 820.3.
8. Infrastructure & Contamination Control Records: Confirm preventive maintenance logs for cleanroom HVAC systems (Clause 6.3), routine non-viable particulate and microbial viable settle-plate monitoring logs (Clause 6.4), and calibration records for monitoring equipment (Clause 7.6).

Fatal Red Flags That Warrant Immediate Document Rejection

• Red Flag 1: Obsolete QSR Questionnaire Sign-Off: The supplier returns an onboarding questionnaire that certifies compliance with 21 CFR 820.70 or claims that 820.70 is current law. This demonstrates that the supplier's regulatory affairs team has not transitioned to QMSR.
• Red Flag 2: ISO Certificate Offered as Sole Production Proof: The supplier provides an ISO 13485 or MDSAP certificate and refuses to disclose batch records or process validation summaries. Under FDA QMSR FAQ Q13, a certificate does not prove lot compliance or exempt a site from inspection.
• Red Flag 3: Sterilizer Registration Substituted for Packaging Validation: The supplier provides an openFDA listing screenshot showing their contract sterilizer is registered, but possesses no in-house ISO 11607 sealing validation data for their blister or pouch lines.
• Red Flag 4: Missing 21 CFR 820.45 Labeling Controls: The supplier's packaging SOP merely states that "labels are applied per customer requirements" without documented pre-release examination of UDI, expiration date, storage symbols, or mix-up line clearance.
• Red Flag 5: Unvalidated Rework: Batch records show that nonconforming lots were disassembled, re-molded, or re-sterilized without formal nonconformance disposition against the Medical Device File under 21 CFR 820.3.

The Exact Production and Labeling Document Pack to Request

Before authorizing commercial distribution or accepting the initial production batch, the buyer should formally request the following five-part technical dossier from the legal manufacturer:

1. Production Control Procedure: The supplier's current SOP governing production and process controls mapped to ISO 13485:2016 Clause 7.5.1 and 21 CFR 820.45.
2. Device Labeling & Packaging SOP: The procedure governing label printing, 21 CFR 820.45(a) pre-release examination, label inventory reconciliation, and line clearance.
3. Sterile Barrier & Sterilization Validation Summary: Executive summaries of the ISO 11607-1/-2 sealing validation and ISO 11135 EO sterilization validation for the exact product code.
4. Critical Process Validation Reports: Validation reports for unverified core processes (e.g. injection molding, welding, fiber cleaving) demonstrating challenged operational boundaries.
5. Redacted Master Batch Record: A complete, executed batch record from a recent commercial lot demonstrating BOM traceability, in-process parameter logs, cleanroom monitoring, BI clearance, and QA lot release.

Where VEMERIX fits—and where due diligence still begins

VEMERIX is the international brand of Weihai Medison Medical Equipment Co., Ltd., positioned as a Minimally Invasive Surgery Total Solution Platform serving urology, vascular surgery and perioperative care.

Public company pages describe Medison's Weihai manufacturing base as a 2,000-square-meter Class-100K operation with EO sterilization and ISO 9001 / ISO 13485 quality systems.¹⁵ Those statements describe the facility the buyer would audit. They are not an FDA QMSR inspection classification under CP 7382.850.

For international production-file discussions, VEMERIX can walk a distributor or OEM buyer through the current technical pack for the sterile families this file typically touches — without claiming that a certificate, a listing screenshot, or a sales conversation closes Clause 7.5 or 21 CFR 820.45:

• Urology surgical consumables: The CE-marked Circumcision Device is publicly described as EO-sterilized, individually blister-packed, and offered in 14 size codes.¹² The production question is still the legal manufacturer's Clause 7.5.1 procedure, 820.45 labeling inspection for those size codes, and the 7.5.5 / 7.5.7 sterile-device and sterile-barrier files — not a slogan that EO is covered.
• Vascular laser energy consumables: Medison's NMPA-registered single-use medical laser fiber (Lu Mech Reg. 20192010517) is the registered consumable; it pairs with a partner-supplied diode laser source.¹³ The partner-supplied NOVACURE console is not a Medison-manufactured capital system. Identification, sterile-pouch integrity, and 820.45 inspection belong in this file if a US legal manufacturer places the fiber.
• Perioperative care consumables: Disposable NPWT drainage dressing kits are publicly described with PVA/PU foam variants and a 400–600 µm pore structure.¹⁴ Multi-component line clearance and 820.45(c) mix-up controls are the usual production questions; do not copy the pump's NMPA number onto the dressing kit.

VEMERIX does not claim that its production files have been inspected or approved by the US FDA under Compliance Program 7382.850, and an ISO 13485 certificate does not eliminate the distributor's duty to verify batch records against the medical device file. Distributors, OEM buyers, and clinical-engineering teams can request the current production procedure, 820.45 labeling-inspection records, sterile-barrier and sterilization summaries, and a redacted master batch record through the quality portal or technical enquiry channel. Due diligence still begins with the buyer's own eCFR and CP 7382.850 checks.

Frequently Asked Questions

Is 21 CFR 820.70 still valid after 2 February 2026?
No. On 2 February 2026, the FDA Quality Management System Regulation (QMSR, 89 FR 7496) took full effect, officially reserving Subparts C through O of 21 CFR Part 820. Section 820.70 (Production and process controls) no longer exists as an active federal regulation. Production duties are now incorporated by reference from ISO 13485:2016 Clause 7.5 under 21 CFR 820.10(a), audited under FDA Compliance Program 7382.850, and supplemented by 21 CFR 820.45.

Does ISO 13485 Clause 7.5.1 replace 21 CFR 820.45 labeling and packaging controls?
No. In Federal Register 89 FR 7496 Comment 64, the FDA explicitly ruled that manufacturers must comply with both Clause 7.5.1 and 21 CFR 820.45. While Clause 7.5.1(e) requires defined labeling and packaging operations, it does not mandate specific pre-release inspection. 21 CFR 820.45 requires examination of labeling and packaging for accuracy prior to release or storage where applicable (UDI, expiration date, storage, handling, and additional processing instructions) and documented mix-up prevention operations under Clause 4.2.5.

If the supplier has validated EO sterilization, do I still need process validation and sterile-barrier evidence?
Yes. Sterilization validation (ISO 11135) only demonstrates microbial lethality (SAL 10⁻⁶). It does not validate the physical integrity of the heat-sealed blister or pouch. The supplier must hold separate validation evidence for general unverified processes under Clause 7.5.6 (such as injection molding or RF welding) and sterile barrier system packaging validation under Clause 7.5.7 and ISO 11607-1/-2 (seal peel strength, dye penetration, bubble leak testing, and aging).

Is a Device History Record the same as the medical device file under QMSR?
No. 21 CFR 820.184 (Device History Record) was reserved under QMSR. Under ISO 13485, batch/lot records compiled under Clause 7.5.1 must demonstrate conformity and traceability against the Medical Device File (MDF, Clause 4.2.3). Furthermore, under 21 CFR 820.3, any rework performed on nonconforming product must be specifically evaluated and authorized to ensure it fulfills the requirements in the Medical Device File.

Does an FDA listing as Contract Sterilizer prove the sterilizer's process is validated for my device family?
No. An openFDA establishment registration listing as 'Contract Sterilizer' (571 unique non-empty FEIs on the 22 July 2026 extract) is an administrative directory filing under 21 CFR Part 807.¹⁶ It does not indicate that FDA has inspected or approved the sterilizer's facility, nor does it prove that the sterilizer has validated a cycle specifically for the buyer's device load, packaging configuration, and bioburden profile.

Do I need 21 CFR part 821 tracking records for a disposable circumcision device or laser fiber?
No. Under 21 CFR 820.10(b)(2), Part 821 tracking applies only to devices subject to a formal FDA tracking order under Section 519(e) of the FD&C Act (typically permanent, life-sustaining implants). Under 21 CFR 820.10(d), ISO 13485 Clause 7.5.9.2 applies only to devices that support or sustain life. Single-use circumcision rings, surgical staplers, laser fibers, and NPWT dressings are not, by default, devices that support or sustain life under 820.10(d), and they are not subject to Part 821 unless FDA has issued a tracking order for that device.

Does an MDSAP certificate mean FDA will not inspect production?
No. FDA QMSR Frequently Asked Questions Question 13 explicitly states that FDA inspections under QMSR do not follow the MDSAP audit plan and that holding an ISO 13485 or MDSAP certificate will not exempt a manufacturer from an FDA inspection. FDA investigators audit facilities under Compliance Program 7382.850 under independent statutory authority.

Does VEMERIX claim its production file has already been inspected under CP 7382.850?
No. VEMERIX can discuss a current technical pack for its sterile families. It does not claim that those production files have already been inspected or classified under CP 7382.850. Commercial buyers still have to review the primary records.