FDA calibration requirements: QMSR (ISO 13485 7.6), 21 CFR 211.68, 211.160 and Part 11

FDA has no single calibration rule. Each FDA regulation that touches measurement asks for the same core: a written program or procedure, calibration or checks at intervals you set and can justify, limits the equipment must meet, records, and action when equipment fails. Which text applies depends on what you make. For medical devices, it is now ISO 13485:2016 clause 7.6, incorporated into 21 CFR 820 by the Quality Management System Regulation (QMSR), in force since February 2, 2026; the old 21 CFR 820.72 no longer exists. For drugs, it is 21 CFR 211.68(a) and 211.160(b)(4). For nonclinical (GLP) labs, 21 CFR 58.63. If you keep any of those records electronically, Part 11 applies as well.

None of these rules sets a calibration interval, and none of their texts requires an ISO/IEC 17025 accredited lab. What FDA investigators look at is whether your program is written, followed, traceable and documented, and what you did when an instrument was found out of tolerance.

A note on sources: the FDA regulations are quoted from the current eCFR text (up to date as of October 13, 2026) and paraphrased. ISO 13485 is a paid standard: we do not reproduce it, we cite clause numbers and describe clause 7.6 from the audit guidance that regulators publish (the MDSAP Audit Approach, which FDA hosts) and from FDA’s own inspection program. FDA points to a read-only copy of ISO 13485:2016 on ANSI’s Incorporated by Reference portal, at no cost to the user (QMSR FAQ 12; 89 FR 7500, 7505).

Which FDA calibration rule applies to you

Combination products (21 CFR Part 4) and contract manufacturers can fall under more than one column. If your organization also follows ISO 9001 clause 7.1.5 or runs an internal lab under ISO/IEC 17025, one calibration program can serve all of them; the calibration program guide shows how to set one up.

Medical devices: what happened to 21 CFR 820.72

On February 2, 2024, FDA published the final rule that turned 21 CFR 820 into the Quality Management System Regulation (QMSR); it took effect on February 2, 2026 (89 FR 7496). The new Part 820 incorporates by reference ISO 13485:2016 and clause 3 of ISO 9000:2015 (21 CFR 820.7), and requires manufacturers to document a quality management system that complies with the applicable requirements of ISO 13485 and of Part 820 (820.10(a)).

What that means for calibration:

• 820.72 is gone. The current Part 820 has only six sections: 820.1, 820.3, 820.7, 820.10, 820.35 and 820.45. None of them mentions calibration or measuring equipment. The requirement now comes from ISO 13485 clause 7.6, Control of monitoring and measuring equipment (eCFR, October 13, 2026).
• FDA inspects clause 7.6. Since February 2, 2026, investigators follow Compliance Program 7382.850. Its list of inspection elements maps “Control of Monitoring and Measuring Equipment” to clause 7.6, and “Software Changes” to clauses 4.1.6, 7.5.6 and 7.6 (CP 7382.850, Attachment A, pp. 71 and 76). FDA stopped using QSIT and the old device program 7382.845 the same day (FDA QMSR page; QMSR FAQ 9).
• The final rule does not discuss calibration. It judges ISO 13485 to be, taken as a whole, “substantially similar” to the old Quality System regulation (89 FR 7496), and mentions clause 7.6 only in a list of clauses where the standard builds in risk management (89 FR 7505). The paragraph-by-paragraph mapping below is ours, built from the old text and the MDSAP audit guidance, whose 2024 revision paired 820.72 with clause 7.6 (MDSAP Audit Approach AU P0002.009, Tasks 13–14).

Two details deserve attention. The old rule allowed an independent reproducible standard or an in-house standard when national or international standards were not practical or available (former 820.72(b)(1)); clause 7.6, as MDSAP describes it, asks for traceability to national or international standards where they exist (see the note on unconfirmed wording below for what happens when none does). And the old rule’s list of record fields (equipment ID, dates, who calibrated, next due date, on or near the equipment) is no longer written into the regulation. It is still a sensible minimum, and our calibration records guide uses it.

ISO 13485 clause 7.6, requirement by requirement

Clause 7.6 kept the number and title that ISO 9001 used before 2015, which is why it reads like the older ISO 9001 clause; the ISO 9001 equivalent is now clause 7.1.5. What the clause requires, as described in the MDSAP Audit Approach (rev. .009, Tasks 13–15, pp. 107–109), and what an investigator or auditor can be shown:

Points the audit guidance makes that are easy to miss:

• Out-of-tolerance results. You assess and record the validity of earlier measurement results and act on the equipment and any affected product; the auditor checks that the assessment covered in-process, finished or already released devices, based on risk (MDSAP Task 13 and Task 14). The old rule also required a documented evaluation of adverse effect on device quality, so the change is mostly in framing: earlier results and released product are named explicitly. Our out-of-tolerance guide walks through the assessment.
• Outside labs. When a supplier calibrates for you, supplier controls apply so the work is done competently (MDSAP Task 14). Accreditation is not demanded, but it is the simplest evidence; see ISO/IEC 17025.
• Software. Software used in the quality system, including off-the-shelf quality system software such as a calibration database, must be validated for its intended use against a protocol with predetermined acceptance criteria; you do not have to review the vendor’s code (MDSAP Task 15).
• Wording we could not confirm in a primary source: that equipment is calibrated or verified at specified intervals or before use, and that you record the basis used when no national or international standard exists. Secondary descriptions of clause 7.6 by calibration labs and ISO trainers say both, and both mirror the pre-2015 ISO 9001 clause, but neither appears in the regulator guidance we used. Treat them as likely (medium confidence) and check the read-only copy on ANSI’s portal.

If you want a structured, auditable system around these requirements, ISO 10012 describes one built around metrological confirmation.

Drugs: 21 CFR 211.68 and 211.160(b)(4)

The drug CGMP rule has two calibration requirements, one for production equipment and one for the laboratory. Neither changed with the QMSR.

21 CFR 211.68(a), automatic, mechanical and electronic equipment. Equipment of these kinds, computers included, may be used in making, processing, packing and holding drugs, but it must be routinely calibrated, inspected or checked under a written program designed to assure proper performance, and written records of those calibration checks and inspections must be kept. Paragraph (b) adds controls for computer systems: only authorized people may change master production and control records or other records, inputs and outputs are checked for accuracy, and backup data must be exact, complete and protected from alteration, erasure or loss (211.68(b)).

21 CFR 211.160(b)(4), laboratory controls. Instruments, apparatus, gauges and recording devices must be calibrated at suitable intervals under an established written program that contains:

1. specific directions;
2. schedules;
3. limits for accuracy and precision;
4. provisions for remedial action when the limits are not met.

Equipment that does not meet its established specifications must not be used (211.160(b)(4)). The lab must keep complete records of that periodic calibration (211.194(d)). The rule sets no separate retention period for calibration records; batch-related records are kept at least one year after the batch’s expiration date (211.180(a)), so a calibration record that supports a batch decision is worth keeping at least that long. That last point is our recommendation, not a stated rule.

What this looks like in an FDA case: in 2018, FDA sent a warning letter to an over-the-counter drug manufacturer whose densitometer, used to calculate fill volumes, was not calibrated and had no calibration procedure (FDA Warning Letter 320-18-71, observation 3, citing 211.160(a) and (b)(4)).

Active pharmaceutical ingredients. FDA’s guidance ICH Q7 recommends calibrating equipment critical to quality under written procedures and an established schedule, with standards traceable to certified standards if they exist, records, a current calibration status that can be verified, no use of instruments that fail, and an investigation of the possible effect on product made since the last successful calibration (ICH Q7, 5.30–5.35). It is guidance, not a regulation, but it is how FDA describes CGMP for APIs.

GLP labs: 21 CFR 58.63

Nonclinical laboratories that run studies under FDA’s Good Laboratory Practice rule have a short, specific requirement (21 CFR 58.63):

• (a) Equipment is adequately inspected, cleaned and maintained, and equipment used to generate, measure or assess data is adequately tested, calibrated and/or standardized.
• (b) Written SOPs set out, in enough detail, the methods, materials and schedules for routine inspection, cleaning, maintenance, testing, calibration and standardization, specify remedial action for failures where appropriate, and name the person responsible for each operation.
• (c) Written records of every inspection, maintenance, testing, calibration and standardization, dated, stating whether the work was routine and followed the SOP. Non-routine repairs are recorded with the nature of the defect, how and when it was found, and the remedial action.

Part 58 does not mention traceability. The OECD GLP principles do, “where appropriate”, as FDA’s own comparison of FDA, EPA and OECD GLP rules shows (FDA BIMO, Equipment). The EPA’s equivalent, 40 CFR 792.63, uses almost the same words as 58.63.

How often does the FDA require calibration?

FDA regulations do not set calibration intervals. The texts ask for calibration “routinely” under a written program (211.68(a)), “at suitable intervals” with schedules (211.160(b)(4)), on schedules written into SOPs (58.63(b)), and, for devices, under procedures you define in your ISO 13485 system. You choose the interval and must be able to justify it.

Two official sources give a little more guidance:

• For balances with built-in auto-calibration, FDA says the internal feature cannot replace an external performance check (211.68). External checks can be less frequent than for a balance without that feature, and their frequency depends on how often the balance is used and how critical and tight the process step is. If the auto-calibrator check reveals a problem, every batch made between the two successive verifications is affected. FDA adds that the auto-calibrator itself should be verified periodically, “a common frequency is once a year”, with NIST-traceable standards (FDA Q&A on Laboratory Controls, question 1). That is described as common practice, not a requirement.
• For devices, MDSAP auditors expect the initial interval to come from the manufacturer’s recommendation and to be adjusted with experience and a documented rationale (MDSAP Task 13).

The balance answer shows why the interval matters: the longer it is, the more product you have to review when a calibration fails. Our calibration intervals guide covers how to set and adjust intervals with the recognized methods, and the label generator prints due-date labels for the instruments.

Electronic calibration records and Part 11

Part 11 applies when records that FDA regulations require are kept in electronic form (21 CFR 11.1(b)). Calibration records under 211.68(a), 211.194(d), 58.63(c) or the QMSR qualify, so a calibration database or a spreadsheet that holds them falls within Part 11. Paper records sent by email do not (11.1(b)).

For a closed system, Part 11 lists controls that include validation, accurate and complete copies, protection of records throughout the retention period, access limited to authorized people, and secure, computer-generated, time-stamped audit trails that do not obscure earlier entries and are kept as long as the records (11.10(a)–(e)), plus authority checks and training (11.10(g), (i)). Electronic signatures must show the signer’s name, the date and time, and the meaning of the signature, and be linked to their records (11.50, 11.70).

In its 2003 guidance, FDA said it intends to exercise enforcement discretion over the Part 11 requirements for validation, audit trails, record copying and record retention, while the underlying record requirements still apply in full and controls such as limited access, authority checks and electronic signatures are still enforced. It recommends basing those decisions on a documented risk assessment (FDA Part 11 guidance, §III). For device inspections, the compliance program tells investigators to follow agency procedures for electronic records and signatures (CP 7382.850, p. 43).

Two more layers apply by sector:

• Drugs: 211.68(b) requires its own computer controls (authorized changes only, checked inputs and outputs, secure backups), whatever Part 11 enforcement policy says.
• Devices: calibration software used in the quality system must be validated for its intended use (ISO 13485 7.6 and 4.1.6; MDSAP Task 15). FDA’s Computer Software Assurance guidance (February 2026) describes a risk-based way to provide that assurance for production and quality system software.

No software is “Part 11 compliant” on its own; compliance depends on how you configure, validate and use it. Our comparison of calibration management software shows what to ask vendors, and the calibration records guide covers paper, spreadsheet and software options. Part 11 does not apply to records kept only for ISO 9001 or ISO/IEC 17025.

What FDA investigators cite: Form 483 data

FDA publishes, by fiscal year, how often each regulation was cited on the Form 483s its investigators issue. These are the calibration-related citations in the two latest data sets:

How to read the table:

• The data sets cover only 483s generated with FDA’s electronic inspection tools; some 483s are prepared by hand and are not included (FDA Inspection Observations page).
• Fiscal year 2025 ended on September 30, 2025, before the QMSR took effect, so device citations still use 820.72. FY2025 is the latest data set FDA has published; the first QMSR-era figures will come with FY2026.
• For scale, FDA’s electronic system issued 791 device 483s and 713 drug 483s in FY2025 (Summary tab). We do not convert the counts into percentages, because one 483 can cite several sections.
• The most frequent problem is not a bad instrument but a missing or inadequate procedure, or calibration that simply was not done. Records and programs, not metrology, drive most citations.

Audit-ready checklist

Use this before an FDA inspection or an internal audit. It applies to all four rules; drop what does not apply to your sector.

For the program behind the checklist, see the calibration program guide, how to read a calibration certificate and what to do when a calibration fails.