One retention floor is a judgment; the other's a date

This blog has already covered how the Quality Management System Regulation's February 2, 2026 effective date retired the free-standing citation everyone knew as 21 CFR 820.100, the old corrective-and-preventive-action rule. A quieter repeal took effect the same day, in the same subpart the CAPA clause used to sit inside: 820.180(b), the section that set how long a device record had to be kept. Its replacement isn't a like-for-like swap of one citation for another. ISO 13485:2016 Clause 4.2.5 answers the retention question on different terms entirely, and a records-retention policy still built around 820.180(b)'s own wording is citing a paragraph the regulation no longer contains — the same failure mode this blog has already traced for the DMR, the DHF, and the DHR.

What the old rule said, and what replaced it

Former 820.180(b) set a two-part test: a manufacturer had to retain records for a period equivalent to the design and expected life of the device, but in no case less than two years from the date of release for commercial distribution. QMSR's final rule repealed that paragraph along with the rest of Subpart M, and the retention duty it carried moved into the incorporated standard instead. ISO 13485 Clause 4.2.5 requires records to be retained for at least the lifetime of the medical device as defined by the organization, or as specified by applicable regulatory requirements, but not less than two years from the medical device's release. The two-year floor survived the move almost word for word. What changed sits in the clause governing everything above that floor.

The lifetime is now something you define, not something the rule states

Former 820.180(b) asked for a period equivalent to the device's design and expected life — a figure the regulation treated as already fixed by the engineering, whatever a manufacturer's own retention policy happened to say about it. Clause 4.2.5 asks for the lifetime the organization itself defines. That isn't simply a stricter or looser number; it's a different kind of number. It moves the retention floor from a fact the regulation assumed existed on its own into a determination a manufacturer's own quality system now has to make, document, and be able to defend to an inspector reading the file against Compliance Program 7382.850's own QMS areas. A retention schedule that just writes “lifetime of device” without pointing to the internal determination behind that phrase is citing a standard for a number it never actually derived.

MDR doesn't ask what the device's lifetime is at all

Article 10(8) of the EU Medical Device Regulation runs on a wholly different anchor. A manufacturer has to keep the technical documentation, the EU declaration of conformity, and any related certificates for at least ten years after the last device covered by that declaration has been placed on the market — fifteen years for an implantable device. Nothing in Article 10(8) asks what the device's expected working life actually is; the clock is a fixed span set by statute, and it doesn't start on a device's own release date at all. It starts on the last device released under that declaration — which, for a product still in active production, hasn't happened yet, meaning the true floor for an actively sold device family is always at least ten or fifteen years past whatever date that family eventually stops shipping, not ten years past today.

One file, two clocks that don't share a starting line

A quality system selling into both markets runs two retention regimes with different anchors: a US floor tied to a lifetime the organization itself has to define and document, counted from each device's own release, against a two-year backstop; and an EU floor fixed by statute at ten or fifteen years, counted from the last device the current declaration of conformity covers, whenever that turns out to be. This blog has already covered what a Declaration of Conformity actually claims, and Article 10(8) is what keeps that claim's own supporting file alive years after the claim itself stops being renewed. A retention policy that states one number and applies it to both regimes has picked whichever figure happened to be longer on the day it was written, not the one either regulator actually requires.

Where this meets the file

A records-retention procedure needs the organization's own device-lifetime determination written down as its own artifact, not folded silently into a retention-schedule number, sitting next to the EU floor's own separate anchor on the last device a given declaration of conformity covers. A retention-schedule worksheet built around that split is previewed in the launch catalog. If your program derives the device-lifetime figure differently, the shelf takes that correction directly.