21 CFR Part 820 Quality System Requirements for Peptide API Manufacturers: 2026 Compliance Guide

The FDA's Quality Management System Regulation (QMSR), which became effective in February 2026 and aligns 21 CFR Part 820 with ISO 13485:2016, represents one of the most significant changes to the US medical device quality system regulatory framework in over two decades. While 21 CFR Part 820 has historically been a medical device regulation with limited direct applicability to pharmaceutical manufacturers, the growing intersection of peptide APIs with drug-device combination products, autoinjectors, prefilled syringes, patch pumps, and inhaled delivery devices, means that many peptide manufacturers and their CDMO partners need to understand and address QMSR compliance requirements.

Why Peptide Manufacturers Need to Know About Part 820 / QMSR

The FDA regulates combination products, products that combine a drug and a device, under the authority of both 21 CFR Part 4 (combination products) and the individual regulations for each component. For a peptide drug in an autoinjector or prefilled syringe, the drug product is regulated under pharmaceutical GMP (21 CFR Part 211), but the device constituent (the autoinjector mechanism) is regulated under the medical device quality system requirements.

The practical implications for peptide drug manufacturers include:

Prefilled syringe peptide drug products. GLP-1 analogs, fertility drugs, and many other peptide therapeutics are commercialized in prefilled autoinjector formats. The drug product filling and finish component requires cGMP compliance (Part 211), but the device assembly, labeling, and distribution functions may require QMSR compliance for the device constituent. Companies that handle the full fill-finish and device assembly in-house must address both regulatory frameworks.

Inhaled peptide delivery. Inhaled peptide formulations, including insulin analogs and inhaled GLP-1 candidates in development, are delivered by inhalers that are medical devices. The inhaled drug product developer must address drug quality system requirements for the peptide API and drug formulation, and device quality system requirements for the inhaler.

Drug-eluting implantable devices. Peptide-releasing implantable devices (such as subcutaneous depot systems releasing GnRH agonists or growth hormone) are regulated as combination products with both drug and device constituent requirements.

Key QMSR Requirements That Differ From Pharmaceutical GMP

Companies already operating under pharmaceutical GMP (21 CFR Part 211 and ICH Q10) who need to extend compliance to cover device constituent requirements will encounter several areas where QMSR / ISO 13485 requirements differ meaningfully:

Design Controls. ISO 13485 (incorporated by reference in QMSR) places strong emphasis on formal design and development procedures, design inputs and outputs documentation, design verification and validation, and design transfer procedures for medical devices. These requirements are more prescriptive than the development controls typically implemented under pharmaceutical QMS frameworks. For drug-device combination product developers, design controls must cover both the drug formulation development (under ICH Q8-Q10) and the device constituent design.

Risk Management. ISO 14971 (medical device risk management standard) is referenced in ISO 13485 and QMSR, requiring a systematic risk management process covering device hazard identification, risk estimation, risk evaluation, risk control, and residual risk acceptance criteria. While pharmaceutical risk management (ICH Q9) covers similar concepts, the device risk management standard has different scope and documentation requirements that must be addressed separately.

Customer Feedback and Complaint Handling. Medical device regulations have well-established requirements for adverse event reporting (MDR reporting under 21 CFR Part 803) that differ from pharmaceutical adverse event reporting. For combination products, both pharmaceutical adverse event reporting (through the NDA or BLA safety reporting system) and medical device MDR reporting may apply to the same product, and the company must have systems to address both.

Traceability Requirements. ISO 13485 and QMSR have strong requirements for device component traceability, particularly for implantable devices. These requirements go beyond standard pharmaceutical batch record traceability to encompass serial number traceability of device components and linkage of device constituent history records to drug product batch records.

QMSR Implementation Timeline and FDA Enforcement

The QMSR became effective in February 2026, replacing the prior 21 CFR Part 820 Quality System Regulation with an ISO 13485-aligned framework. FDA has indicated that inspections will assess QMSR compliance for medical device manufacturers beginning in the second half of 2026, with a transition period for legacy quality systems to be updated.

For pharmaceutical manufacturers with combination product exposure:

• Drug product operations regulated under 21 CFR Part 211 are not directly subject to QMSR for the pharmaceutical constituent
• The device constituent of combination products is subject to QMSR
• Companies must determine how their quality management system addresses both sets of requirements, typically through an integrated QMS that maps activities to both 21 CFR Part 211 / ICH Q10 requirements and QMSR / ISO 13485 requirements

FDA's Office of Combination Products has published guidance on quality system application for combination products, and consultation with this office during product development is strongly recommended for complex cases.

Practical Compliance Steps for Peptide Manufacturers With Combination Product Exposure

Assess combination product applicability. Confirm the regulatory classification of the product (drug, device, or combination product) and the assigned lead center (CDER, CDRH, or CBER). FDA's Office of Combination Products provides formal regulatory status determination through the RFD (Request for Designation) process when classification is uncertain.

Gap assess current QMS against QMSR / ISO 13485. Conduct a formal gap analysis comparing the current pharmaceutical QMS documentation and procedures against QMSR requirements, identifying areas where the existing QMS does not address device-specific requirements (design controls, risk management per ISO 14971, MDR reporting, device component traceability).

Integrate or supplement QMS documentation. Options include: (1) integrating QMSR requirements into the existing pharmaceutical QMS framework with device-specific procedures and sections; (2) maintaining separate but cross-referenced QMS documentation sets for pharmaceutical and device constituent requirements; or (3) implementing a fully integrated ISO 13485-certified QMS that encompasses both pharmaceutical and device quality requirements. Each approach has tradeoffs in implementation complexity and regulatory review risk.

Train personnel on QMSR-specific requirements. Quality systems, operations, and regulatory personnel who were previously focused exclusively on pharmaceutical GMP will need training on QMSR-specific concepts: device risk management, design controls, MDR reporting, and the differences between pharmaceutical and device adverse event reporting frameworks.

Engage regulatory affairs support with QMSR expertise. For sponsors without internal QMSR expertise, engaging consultants or regulatory affairs professionals who have specific experience with FDA combination product regulation and QMSR implementation is recommended during the transition period.

The Broader Compliance Landscape

The QMSR update is one component of an evolving regulatory landscape for combination products that is becoming more complex as more peptide drugs are commercialized in device-based delivery formats. The trend toward combination product development, prefilled autoinjectors, patch pumps, smart devices with digital health features, is driven by patient convenience, adherence, and market differentiation considerations that will continue to expand the combination product universe in the peptide space.

Peptide manufacturers who invest in robust QMSR compliance infrastructure now, rather than addressing gaps reactively during regulatory submissions or inspections, will be better positioned for the combination product commercial landscape that is increasingly the norm for injected and inhaled peptide therapeutics.

The complexity of combination product regulation should not be viewed as a barrier but as a quality and safety framework that, when implemented effectively, supports the development of drug-device combinations that genuinely improve patient experience and therapeutic outcomes.