BOM-to-ECO & Quote Agent
Live demoFDA QMSR · Mapping & sources
How the Change Control Agent Suite maps to 21 CFR Part 820
21 CFR Part 820, FDA’s Quality Management System Regulation (in force since Feb 2, 2026), incorporates ISO 13485:2016 by reference. Below is what the agent checks on every change, the 7 checks in every ECO, the requirement each comes from, and who decides.
47 change-control requirements tracked
39 required by the QMSR
Intended use BOM-to-ECO compares two BOM versions, flags each change against fixed rules, checks the stock, supplier and ECO-log files you provide, uses AI to explain its findings, and drafts an ECO for your team to review. It is for engineering and quality teams at medical device makers. It is advisory, not a validated system, and your team makes every decision.
AdvisoryMapped, not certified. FDA does not approve or certify QMS software, and this is not a validated system. The agent’s results support, not replace, your quality review: your team makes and records every decision, and remains responsible for compliance.
What the agent checks on every change
When you create an ECO, the agent looks up each change in the files you add: stock and open orders, approved suppliers and your ECO log. It cites the file and row for each finding, and your team decides. A check whose file you didn’t add shows as Not checked, never as a clean result.
| Check | What the agent does | Who decides | Requirement |
|---|---|---|---|
| Approved suppliers | Looks up each new manufacturer part number in your approved supplier list and reports its status. A part with no Approved row is flagged. | Your team | ISO 13485 §7.4.1 |
| Stock and open orders | Looks up stock on hand and open orders for the replaced part or the old revision, so you can decide what happens to them. | Your team | ISO 13485 §7.3.9, product in process |
| Where-used | Finds every assembly in the revised BOM that uses each changed part. | Your team | ISO 13485 §7.3.9, constituent parts |
| ECO log | Looks for other open ECOs on the same part. A conflict goes to you; the agent never picks one. | Your team | Supports the §7.3.9 change review |
The 7 checks in every ECO
Step 3 of the ECO, “Regulatory & impact assessment”. Suggestions come from fixed rules on the included changes; nothing is selected for you.
| Check | What it does | Who decides | Requirement |
|---|---|---|---|
| ASignificance of the change | Asks six yes/no topics (function, performance, usability, safety, regulatory requirements, intended use) and marks the ones the included changes could affect. Nothing is pre-answered; a reason is required. | Your team, or the device maker | ISO 13485 §7.3.9 (via 21 CFR 820.10(c)) |
| BFDA filing decision | Suggests a path when the answers point to one: note to file, new 510(k) or PMA supplement. Choosing a filing marks the rollout as on hold until the clearance number is recorded. | Your regulatory team, or the device maker | 21 CFR 807.81(a)(3) · 814.39(a) |
| CRisk review | Points to the parts that were swapped, added or removed. Requires the risk file reference, or a reason no update is needed. | Your team | ISO 13485 §7.3.9 · §7.1 |
| DTesting (verification and validation) | Suggests activities from the change types, such as design verification or first article inspection. Requires at least one, or a reason none is needed. | Engineering and quality | ISO 13485 §7.3.9 |
| EProcesses, labeling and device ID | Flags soldered or labeling parts and asks about validated processes, labels and a new UDI-DI. A yes lists the release tasks to add. | Your team | ISO 13485 §7.5.6 · 21 CFR 820.45 · 830.50 |
| FDocuments to update | Suggests the documents the change touches, including the design and development file, and asks you to confirm the list is complete. | Document control | ISO 13485 §4.2.4 · §4.2.3 · §7.3.10 |
| GPeople to notify and train | Suggests the roles the change affects. At least one is required. | Your team | ISO 13485 §6.2 · §7.2.2 |
For FDA-regulated products, the ECO can’t be copied, downloaded or printed until all 7 checks are complete.
Product already delivered
ISO 13485 asks you to evaluate a change’s effect on product already delivered. Every ECO has a “Delivered (in the field)” row: no action, update at next service, field correction or removal. For FDA-regulated products, choosing a correction or removal requires a recorded decision on whether FDA must be told.
Corrections or removals that reduce a risk to health are reported to FDA within 10 working days.
All 47 change-control requirements
Every requirement we track, grouped by area, with what the live demo shows today.
- 47change-control requirements tracked
- 39required by the QMSR
- 16in the live demo today
- QMS-01Follow a documented change procedureRequired by the QMSR820.10(c) → ISO 13485 §7.3.9
- QMS-02Identify every changeRequired by the QMSR820.10(c) → ISO 13485 §7.3.9In the live demo
- QMS-03Decide the significance of the changeRequired by the QMSR820.10(c) → ISO 13485 §7.3.9In the live demo
- QMS-04Regulatory impact decisionRequired by the QMSR820.10(c) → ISO 13485 §7.3.9; 21 CFR 807.81(a)(3); 814.39(a)In the live demo
- QMS-05Evaluate effect on constituent partsRequired by the QMSR820.10(c) → ISO 13485 §7.3.9In the live demo · agent check
- QMS-06Evaluate effect on product in process and already deliveredRequired by the QMSR820.10(c) → ISO 13485 §7.3.9; 820.10(b)(4) → Part 806In the live demo
- QMS-07Review risk managementRequired by the QMSR820.10(c) → ISO 13485 §7.3.9; §7.1In the live demo
- QMS-08Review product realization and validated processesRequired by the QMSR820.10(c) → ISO 13485 §7.3.9; §7.5.6In the live demo
- QMS-09Plan and record verification and validationRequired by the QMSR820.10(c) → ISO 13485 §7.3.9In the live demo
- QMS-10Approve before implementingRequired by the QMSR820.10(c) → ISO 13485 §7.3.9
- QMS-11Keep records of the change, review and actionsRequired by the QMSR820.10(c) → ISO 13485 §7.3.9
- QMS-12File the change in the design and development fileRequired by the QMSR820.10(c) → ISO 13485 §7.3.10
“In the live demo” means the step is shown and working in the public demo; “agent check” means the agent’s lookups on every change support it. Neither means the requirement is met for your organization; that depends on your procedures and records. Part 11 rows apply when ECO approvals use electronic signatures.
Sources
Checked Oct 2, 2026. CFR text is quoted word for word in our rule list; ISO 13485 is copyrighted, so its clauses are paraphrased.
Code of Federal Regulations (21 CFR)
- 21 CFR 820.1 Scope
- 21 CFR 820.3 Definitions
- 21 CFR 820.7 Incorporation by reference
- 21 CFR 820.10 Requirements for a QMS
- 21 CFR 820.35 Control of records
- 21 CFR 820.45 Device labeling and packaging controls
- 21 CFR Part 820 table of contents
- 21 CFR 830.50 Changes that require use of a new device identifier
- 21 CFR 806.10 Reports of corrections and removals
- 21 CFR 807.81 When a premarket notification is required
- 21 CFR 814.39 PMA supplements
- 21 CFR 11.10 Controls for closed systems
- 21 CFR 11.50 Signature manifestations
- 21 CFR 11.70 Signature/record linking
- 21 CFR 11.100 General requirements (electronic signatures)
- 21 CFR 11.200 Electronic signature components and controls
Links go to Cornell LII, which republishes the current eCFR text.
FDA
Standard
Read-only copy on the ANSI incorporation-by-reference portal (free account).
Questions about the mapping?
Talk to us about your change process, your device class, or what you’d need validated.