Section 820.35 establishes FDA-specific record-control requirements that supplement ISO 13485:2016 Section 4.2.5. SPECIFIC REQUIREMENTS: (a) RECORD RETENTION - records must be retained for a period of time equivalent to the design + expected life of the device + IN ANY CASE NOT LESS THAN 2 YEARS FROM THE DATE OF RELEASE FOR COMMERCIAL DISTRIBUTION BY THE MANUFACTURER. (b) AUDIT TRAIL - records must include audit trail meeting the criteria of FDA 21 CFR Part 11 (Electronic Records + Electronic Signatures) where electronic records are maintained - the audit trail must be: secure + computer-generated + time-stamped + tamper-evident + record who-what-when-where-why for every CRUD operation on regulated records. (c) UNIQUE DEVICE IDENTIFICATION (UDI) - records must include UDI per FDA Unique Device Identification Rule (21 CFR Part 830) where applicable - UDI on labelling + linked to records. (d) MEDICAL DEVICE REPORTING (MDR) - records of MDR submissions under 21 CFR Part 803 (Medical Device Reporting) must be maintained as part of QMSR records. (e) CORRECTIONS AND REMOVALS - records of corrections + removals under 21 CFR Part 806 must be maintained. (f) ACCESSIBILITY - records must be ACCESSIBLE TO + READILY AVAILABLE FOR REVIEW BY FDA inspectors during inspections; manufacturers must provide records in human-readable + electronic form within reasonable time upon FDA request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.