CAPA Under QMSR: How Clause 8.5 Changed the Rules

The CAPA subpart most quality engineers memorized no longer exists. Section 820.100 was one of the largest casualties of the transition to the Quality Management System Regulation (QMSR), which took effect February 2, 2026 and amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference (FDA QMSR final rule). The obligation didn't disappear. It moved. Corrective and preventive action now flows through ISO 13485:2016 Clause 8.5, and the shift is not cosmetic.

If you run an OEM quality function and you outsource manufacturing, this matters twice over. Your own CAPA process answers to Clause 8.5 now, and so does your contract manufacturer's. When you audit a CM under Clause 7.4, the CAPA records you pull are being evaluated against a different clause structure than the QSIT-era checklist you may still have in your audit binder. This piece traces where the requirements landed, what investigators now look for in root-cause and effectiveness documentation, and what to verify in a CM's CAPA files before you sign off on the supplier.

Where 820.100 Went

Under the QMSR, 21 CFR 820.3 was revised so definitions defer to ISO 13485:2016 and ISO 9000, and Part 820 kept only a limited set of FDA-specific sections layered on top of the incorporated standard, including 820.35 for control of records and 820.45 for device labeling and packaging controls (FDA QMSR final rule). The standalone CAPA subpart is not among the retained sections. Its requirements now live in two clauses.

ISO 13485:2016 Clause 8.5.2 governs corrective action. It requires a documented procedure covering the review of nonconformities including complaints, determination of causes, evaluation of the need for action to prevent recurrence, planning and documenting the action taken, verification that the action does not adversely affect the ability to meet regulatory requirements or device safety and performance, and a review of the effectiveness of the corrective action taken (ISO 13485:2016 Clause 8.5.2). Clause 8.5.3 carries the parallel structure for preventive action: determine potential nonconformities and their causes, evaluate the need to prevent occurrence, plan and document the action, verify no adverse regulatory or safety effect, and review effectiveness (ISO 13485:2016 Clause 8.5.3).

On paper this reads a lot like the old QSR CAPA elements. The difference shows up in emphasis, in two specific places, and in how FDA now inspects against them.

Root-Cause Documentation Is No Longer a Fill-In Field

Both clauses require the organization to determine the causes of the nonconformity before evaluating action. That word was in the QSR too. What changed is the surrounding machinery. Clause 8.4 (Analysis of data) requires the organization to determine, collect, and analyze data from defined sources, including feedback, complaint handling, process and product conformity, supplier performance, and audit results, to demonstrate the suitability and effectiveness of the QMS (ISO 13485:2016 Clause 8.4). Clause 8.4 is the feeder. It defines the inputs that should be triggering and informing your corrective actions.

The practical consequence: a root-cause investigation that names a cause without showing the data path from a Clause 8.4 input reads as an assertion, not an analysis. Investigators working under the current inspection approach are looking for the trace. What data surfaced the problem? What analysis narrowed a symptom to a cause? Does the documented cause actually explain the nonconformity, or is it a restatement of the symptom with the word "cause" attached to it?

FDA also retired the Quality System Inspection Technique (QSIT) and replaced its inspection approach with Compliance Program 7382.850 (FDA QMSR FAQ). Teams that built their CAPA files to survive the QSIT approach now have a different inspection posture to prepare for. The record still has to tell a complete story on its own, and the story starts with a defensible cause.

Effectiveness Review Is a Closure Requirement, Not an Optional Step

Here is the change most worth internalizing. Both Clause 8.5.2 and Clause 8.5.3 require the organization to review the effectiveness of the action taken (ISO 13485:2016 Clauses 8.5.2 and 8.5.3). This is not the verification-or-validation step that confirmed you implemented the fix. It is a separate, mandatory closure element: after the action is in place, you go back and confirm it actually prevented recurrence.

Under Clause 8.5, the effectiveness review is baked into the required procedure for every corrective and every preventive action (ISO 13485:2016 Clauses 8.5.2 and 8.5.3). A CAPA that closes without a documented effectiveness review, with objective evidence and a defined interval or sample that supports the conclusion, is missing a required element. Not a nice-to-have. A required element.

The second sharpened expectation is timeliness. Clause 8.5.2 requires that corrective action be taken without undue delay and be proportionate to the effects of the nonconformities encountered (ISO 13485:2016 Clause 8.5.2). That ties CAPA velocity to risk. A high-severity nonconformity that sits open for months while a low-risk one closes in a week is now a direct nonconformance against the clause language, not just a metrics problem. If your CAPA aging report doesn't correlate cycle time with risk, expect questions.

What to Verify in a CM's CAPA Records

Clause 7.4 (Purchasing) puts the obligation on you. It requires establishing supplier evaluation and re-evaluation criteria, monitoring supplier performance, and taking action when a supplier fails to meet purchasing requirements (ISO 13485:2016 Clause 7.4). Reviewing how a contract manufacturer runs CAPA is squarely inside that duty. The CM's own CAPA obligations still derive from Clause 8.5; your job is to confirm they meet them.

When you pull a sample of a CM's CAPA records during a supplier audit, verify these against the clause structure above, not against a legacy QSIT script:

• The cause traces to data, not to a guess. Ask to see the Clause 8.4 input that opened the CAPA and the analysis that led from symptom to cause. - Effectiveness review is present and closed with evidence. For each closed CAPA in your sample, find the documented effectiveness review, the objective evidence behind it, and the rationale for the interval or sample size. A file that stops at "implemented" is incomplete under Clause 8.5.2.
• Cycle time correlates with risk. Pull the CAPA log and check whether higher-effect nonconformities close faster than trivial ones. The requirement to act without undue delay, proportionate to the effects, gives you a clean basis to challenge a CM whose aging is flat across risk levels.
• Verification of no adverse effect is documented. Both clauses require confirming the action does not compromise regulatory compliance or device safety and performance. On a CM's line, that often means a change to a process or work instruction. Confirm the record shows that check was made and by whom.
• The procedure itself reflects Clause 8.5, not the retired subpart. A CM still running a procedure that cites 820.100 as its governing requirement hasn't finished the transition. That is a finding worth raising, and a signal to look harder at the rest of the QMS.

One caution on scope. The QMSR incorporation-by-reference and FDA's specific additions apply to U.S. finished-device manufacturers subject to CGMP (FDA QMSR final rule). ISO 13485:2016 has broader international reach, so a CM operating across jurisdictions may frame its CAPA system around the standard directly. That is fine. The clause requirements are the same either way. What you are verifying is that the CM's records satisfy Clause 8.5 in substance, whatever the procedure's cover page cites.

The CAPA record is one of the fastest reads on a CM's quality culture. A file that traces cause to data, documents an effectiveness conclusion with evidence, and moves at a speed matched to risk tells you the system works when no one is auditing it. That is the read worth getting right before you consolidate volume onto a partner.