21 CFR 820 Nonconforming Product: Everything You Need to Know

When people hear "nonconforming product" under 21 CFR 820, the first thing that comes to mind is a consumer who's been hurt by a defective product. But here's the thing: most nonconforming products aren't defective at all. A nonconformance is simply any deviation from specified requirements — your own specs, a customer requirement, or a regulatory one. So with every shipment that lands in your warehouse, there's a chance something gets flagged because it doesn't meet spec, not because it's dangerous. When that happens, how do you handle it? And how do you make sure it never reaches the market?

A quick but important update: Part 820 is now the QMSR

Before we go further, one thing worth knowing. As of February 2, 2026, the FDA replaced the old Quality System Regulation (QSR) with the Quality Management System Regulation (QMSR). Part 820 still exists, but it now incorporates ISO 13485:2016 by reference. In plain terms, most of the detailed requirements you used to read directly in Part 820 now point you to ISO 13485 instead, with a small set of FDA-specific additions layered on top.

For nonconforming product, that means the core requirements now live in ISO 13485 Clause 8.3 (Control of nonconforming product), with FDA's specific expectations retained in 820.90. If your procedures still reference the old QSR subparts, this is a good moment to check them.

What is a nonconforming product under 21 CFR 820?

It helps to separate a few terms that often get used interchangeably:

• Nonconforming product: Any product (or component, or material) that does not meet its specified requirements — whether those come from your internal specs, a customer, or a regulation.
• Defective product: A product with a flaw that affects safety or prevents it from performing its intended purpose. A defect is one type of nonconformance, but not all nonconformances are defects.
• Substandard product: Product that falls short of expected quality levels for its intended use, even if it isn't strictly unsafe.

Nonconformity can show up at any stage of the product lifecycle: design and development, incoming/receiving inspection, in-process production, final inspection, packaging and storage, shipping and delivery, and even installation or servicing after the device is in the field.

Process flow for handling a nonconforming product

How are nonconforming products handled — by "class" or by disposition?

This is a common point of confusion, so let's clear it up. Nonconforming product is not sorted into risk "classes." What you actually do is decide on a disposition — the documented decision about what happens to the nonconforming item — based on the risk and the results of your evaluation.

Under ISO 13485 Clause 8.3 (now incorporated into Part 820), the typical dispositions are:

• Use-as-is / accept by concession — allowed only when justification is provided, authorization is obtained and recorded, and applicable regulatory requirements are met. Concessions should be the exception, closely monitored, and never routine.
• Rework — bring the product back into conformance. Under 820.90, rework must include retesting and reevaluation to confirm the product meets its currently approved specs, and any adverse effect of the rework must be documented in the Device History Record (DHR).
• Repair — correct the item so it's acceptable for use, even if not restored to original spec.
• Return to supplier — common for materials or components that fail receiving inspection.
• Scrap / reject — dispose of the product so it can't re-enter the supply chain.

One quick clarification, since it trips people up: medical device classification (Class I, II, III) is a separate concept governed by 21 CFR Part 860. It determines the regulatory controls and premarket pathway for a device — it is not how you categorize a nonconformance. Don't conflate the two.

Who is responsible for handling nonconforming products?

The manufacturer carries the primary responsibility for making sure a nonconforming product doesn't cause harm to people or the environment. Distributors and importers share responsibility for products under their control as well. If you've received a recall notice tied to a violation of Part 820, it's critical to get all affected product back under your control for proper disposition. If you genuinely can't act within an FDA deadline, you can request an extension from regulators rather than cutting corners on consumer safety.

How should you segregate a nonconforming product?

Keep nonconforming product physically separate from the rest of your inventory. The cleanest approach is a clearly designated quarantine area or a dedicated, labeled container used only for nonconforming items. Don't share that space with conforming product — it's the easiest way to prevent an accidental mix-up.

When should you reject a nonconforming product?

As a manufacturer, you should reject (or otherwise dispose of, rather than release) a nonconforming product when:

• It presents a health or safety hazard.
• It doesn't meet legal or regulatory requirements.
• It violates contract or customer specifications.
• Rework or repair isn't feasible or wouldn't reliably restore conformance.

How to keep rejected product out of the market

• Scrap or dispose of rejected product in a way that prevents it from re-entering commerce.
• Document the disposition decision and rationale, per your procedures and applicable requirements.
• Keep rejected product segregated from conforming product until disposal is complete.
• Maintain traceability — record every action taken on the nonconforming lot (evaluation, disposition, authorization, and who approved it).
• Feed patterns back into monitoring. If nonconformances cluster around a process, material, or supplier, that's a signal for investigation and potentially CAPA.

Proactive steps to reduce nonconformance

Handling nonconformance well is good; reducing it is better. A few practical moves:

• Talk to your customers directly. Surveys, interviews, or focus groups can surface where they run into quality issues before those issues show up as returns or complaints.
• Mine your own data. Trends across past products or lots — recurring returns, repeat defect codes, rising reject rates at a given step — often point straight at the root cause. For example, if a molding process with a normal 5% reject rate suddenly jumps to 10%, that shift is worth investigating.
• Link nonconformity data to your CAPA and risk management processes so recurring problems actually get designed out.

Key requirements related to nonconforming product

• 21 CFR 820.90 — Nonconforming Product. FDA's requirements for identifying, documenting, evaluating, segregating, and dispositioning nonconforming product. Evaluation must include whether an investigation is needed and notification of those responsible for the nonconformance. Rework requires retesting/reevaluation and DHR documentation.
• ISO 13485:2016 Clause 8.3 — Control of nonconforming product. Now incorporated into Part 820 by reference. Requires documented procedures to identify and control nonconforming product before and after delivery, and sets the rules for concession, rework, and re-verification.
• 21 CFR 820.100 — Corrective and Preventive Action (CAPA). The downstream link. When nonconformances signal a systemic issue, CAPA is where you investigate root cause, act, and verify the fix so the problem doesn't recur.

The FDA also publishes helpful reference material on this topic. This slide deck from the FDA website is a solid overview worth a look.

Bottom line: how you handle nonconforming product affects your whole company

Your handling of nonconforming product under Part 820 has real consequences. Falling short on 820.90 or 820.100 — and then experiencing a recall after an FDA inspection — can expose your company to significant civil or criminal penalties. The way to manage that risk is to understand your obligations, document your disposition decisions, and connect nonconformance data to investigation and CAPA. With the shift to the QMSR and ISO 13485, now is a particularly good time to confirm your procedures reflect the current requirements.

Conclusion

When it comes to Part 820, how you respond to nonconforming product plays a real role in your company's future. If you need help managing nonconforming products, Isolocity can help. Get in touch and we'll walk you through a live demo of how our software supports it.