What Is Nonconforming Material? Identification, Containment, and Disposition Guide
Nonconforming material is any raw material, component, in-process product, or finished device that fails to meet specified requirements. Under both the FDA's Quality Management System Regulation (QMSR) and ISO 13485:2016, the moment a nonconformance is detected, a documented process must take over — covering how the material is identified, how it is segregated from conforming product, who reviews it, and how it is ultimately dispositioned.
This guide covers what the regulatory requirements actually say, where manufacturers get cited by FDA investigators, and how a properly configured QMS handles nonconforming material without creating documentation gaps.
What constitutes nonconforming material
A nonconforming material event can start at incoming receiving inspection, during in-process manufacturing, or at final product inspection. It can also be identified after product has been released, when a complaint, post-market audit, or field service report reveals that something distributed to customers did not meet specifications.
The scope of what triggers a nonconformance report varies by company procedure, but the regulatory minimum is clear: any product that does not conform to specified requirements must be controlled. This includes deviations from dimensions, materials, documentation requirements, label specifications, sterility requirements, or any other attribute defined in the device master record.
The regulatory framework: 21 CFR 820.90 and ISO 13485 Section 8.3
QMSR and the role of ISO 13485:2016
The QMSR, effective February 2, 2026, incorporates ISO 13485:2016 by reference under 21 CFR 820.10(b). For nonconforming product, this means ISO 13485 Section 8.3 is now legally enforceable FDA requirement in the United States. The old 21 CFR Part 820, Section 820.90, used language that tracked closely with what ISO 13485 Section 8.3 requires, so most manufacturers familiar with the old QSR will find the substantive requirements familiar. The QMSR transition does, however, add some procedural and record-keeping specificity that FDA investigators now check against.
ISO 13485 Section 8.3.1 — documented procedure requirement
Section 8.3.1 requires that the organization establish documented procedures for the control of nonconforming product. This is not a general quality system requirement — it is a specific, auditable procedure that must exist, be implemented, and produce records. FDA investigators ask to see this procedure and then verify that actual nonconformance records reflect the procedure as written.
ISO 13485 Section 8.3.2 — identification and segregation
Section 8.3.2 requires that the organization ensure nonconforming product is identified and controlled to prevent unintended use or delivery. The standard is explicit that the organization must take one of the following actions when nonconforming product is detected: take action to eliminate the detected nonconformity; authorize its use, release, or acceptance under concession; prevent its intended use or application through segregation, return, or destruction; or apply other action appropriate to the effects of the nonconformity when detected after delivery.
The key enforcement point in practice is "prevent unintended use." Physical identification — a quarantine tag, a red hold label, a locked cage — is not optional. FDA warning letters from 2024 and 2025 cite cases where nonconforming product was inadequately segregated and co-mingled with conforming product, or where the physical controls were present but not consistently applied.
ISO 13485 Section 8.3.3 — review authority and documentation
Section 8.3.3 requires that the review of nonconforming product be conducted by personnel with defined authority. The person who makes a disposition decision must have documented authority to do so. It is not enough to have a quality manager sign off generically — the procedure must define who is authorized for what disposition decisions, and the record must show that an authorized person made each specific decision.
Section 8.3.3 also requires that records be maintained describing the nature of the nonconformity, the quantity affected, the disposition decision, and the identity of the person who authorized the disposition.
ISO 13485 Section 8.3.4 — rework
Section 8.3.4 contains specific requirements for product reworked to bring it into conformance. Rework must be performed in accordance with documented instructions. After rework, the product must be re-inspected or re-verified. The potential adverse effects of rework on the product's safety and performance must be documented and reviewed. Rework that affects a device's safety profile without a corresponding safety assessment is a documented finding in multiple FDA warning letters.
Identification: catching nonconformances before product moves
The earlier a nonconformance is detected, the lower the cost and compliance impact. Most manufacturers identify nonconforming material at four points: incoming receiving inspection, in-process inspection during manufacturing, final product inspection before release, and post-release through complaints or field reports.
Incoming receiving inspection is where supplier-related nonconformances surface. Under ISO 13485 Section 7.4.3, receiving inspection records must be maintained, and any nonconformances found at receiving must be documented and dispositioned before the material enters production. Using a supplier's certificate of conformance as a substitute for incoming inspection is acceptable only when the procedure defines specific conditions under which this is permitted — and the procedure must define what happens when a later nonconformance is discovered for material that entered based on a COC.
In-process nonconformances require immediate action to prevent the material from advancing further in the production process. A nonconformance caught at subassembly is cheaper and lower-risk than the same nonconformance discovered at final inspection or after release.
Containment: preventing unintended release
Physical containment is the step most frequently cited in FDA Form 483 observations related to nonconforming material. Containment means the nonconforming material is physically separated from conforming product in a way that prevents accidental release.
Acceptable containment methods include: a dedicated quarantine area with restricted access, locked cages or cabinets for high-risk nonconformances, physical hold tags attached to the material itself, and system-level holds in the QMS that prevent lot release without disposition review. A sticker on a shelf with no physical barrier and no system control does not satisfy containment, nor does a verbal instruction to production staff.
When a nonconformance is detected after product has left the facility, the manufacturer must assess whether the nonconformance poses a risk to patients or users, determine the scope of potentially affected product (lot numbers, date ranges, distribution locations), and decide whether a field action, correction, or removal is warranted. This post-market containment assessment must be documented.
Disposition: the options and what each requires
After containment, the disposition review determines what happens to the nonconforming material. ISO 13485 Section 8.3 recognizes four primary disposition paths.
Rework. The material is brought into conformance through additional processing. Rework requires documented instructions, re-inspection after completion, and a safety assessment if there is any possibility the rework affected the device's safety or performance characteristics.
Concession (accept as-is). The material is accepted for use or release despite the nonconformance, with written authorization. A concession must define the specific nonconformance being accepted, the scope of product involved, the risk basis for accepting it, and the identity of the authorized approver. FDA investigators check that concessions are not being used as a general workaround for recurring process problems.
Return to supplier. For incoming material that does not meet requirements, return to supplier is a documented option. The supplier must be notified, and the return must be documented in the supplier quality management system. Repeated returns from the same supplier without escalation through the supplier qualification process are flagged during audits.
Scrap or destruction. The material is destroyed and removed from the production flow. Destruction must be documented — date, quantity, method, and person responsible. This is particularly important for devices where there is any possibility that scrapped material could be reintroduced into the production stream.
When nonconforming material triggers a CAPA
A single nonconforming material event does not always require a corrective action. The decision to initiate a deviation CAPA should be risk-based: if the nonconformance represents a systemic failure, a recurring pattern, a safety-critical characteristic, or a significant deviation from specification, a CAPA is required.
FDA investigators check the relationship between nonconforming material records and the CAPA system. A manufacturer that has 40 nonconformance records in a year and zero corrective action initiations will have difficulty demonstrating that their corrective action process is functioning as intended. The threshold for CAPA initiation must be defined in the procedure, and the records must show that the threshold is being applied consistently.
When a CAPA is initiated, the nonconformance record should be linked to the corrective action record. This traceability allows investigators to verify that the root cause investigation addressed the actual nonconformance and that the effectiveness check verified the corrective action worked.
What FDA investigators cited in 2024 and 2025
Published FDA warning letters and 483 observation data from 2024 and 2025 show consistent patterns in nonconforming material findings.
Nonconforming product not properly identified. FDA investigators at multiple medical device facilities found nonconforming components that lacked identification tags or hold labels, making it impossible to distinguish them from conforming product in the production area.
Disposition decisions made without documented authority. At several inspected facilities, disposition decisions were made by production supervisors or technicians not identified in the procedure as having disposition authority. The absence of documented authority is a direct Section 8.3.3 violation.
Rework not re-inspected. FDA warning letters from 2024 and 2025 cite rework operations where product was returned to conforming stock without documented re-inspection. In one case involving an orthopedic implant manufacturer, reworked components were released without a safety assessment for the effect of rework on the implant's structural integrity.
Repeat nonconformances without corrective action. FDA investigators consistently flag situations where the same nonconformance appears multiple times within a review period but no corrective action was initiated. The question asked during inspection is typically: "What is your threshold for CAPA initiation, and why was this recurring nonconformance below that threshold?"
Post-market nonconformances not assessed for field action. When complaints or post-market surveillance data revealed nonconformances in distributed product, several manufacturers failed to document a formal assessment of whether a field action was required. FDA expects a documented risk-based evaluation, not an informal determination.
How a QMS system handles nonconforming material at scale
At low volumes, a paper-based or spreadsheet-driven nonconforming material process can be managed, though it is difficult to maintain traceability and even harder to demonstrate consistency during an inspection. As production volume increases, the gaps in manual systems compound.
A well-configured eQMS handles nonconforming material by creating a digital record at the point of detection, automatically flagging the affected lot or batch in the inventory system to prevent release, routing the disposition review to the personnel with defined authority, and generating the required re-inspection task when a rework disposition is selected. The system also provides the trend analysis needed to identify recurring nonconformances that should trigger a CAPA.
Cloudtheapp includes a Nonconforming Material application that manages the full nonconformance workflow — identification, containment, disposition review, rework tracking, and CAPA linkage — within a single validated platform. Lot-level traceability means that when a post-market nonconformance is identified, the system can quickly identify all affected product and its distribution status.
The platform is validated for 21 CFR Part 820 (QMSR) and ISO 13485, with a full validation package provided for every update. If your nonconforming material process relies on spreadsheets, paper logs, or disconnected systems, schedule a demo at Cloudtheapp to see how the platform handles NCM from detection through closed-loop corrective action.
