What is the difference between a deviation and a nonconformance?

1Two definitions.

ICH Q7 defines a deviation as a “departure from an approved instruction or established standard”.¹ ISO 9000:2015 defines a nonconformity as the “non-fulfilment of a requirement”; nonconformance is the everyday word for the same thing.²

2Where each term comes from.

US drug CGMP is written around deviations and discrepancies. Under 21 CFR 211.100(b), “any deviation from the written procedures shall be recorded and justified”.³ Under 211.192, any “unexplained discrepancy”, or a batch or component that fails “to meet any of its specifications”, must be thoroughly investigated.⁴ ICH Q7 asks for any deviation in API manufacture to be documented and explained, and for critical deviations to be investigated.¹

EU GMP Chapter 1 uses both words. Significant deviations are investigated to find their root cause, and the product quality review covers “all significant deviations or non-conformances”.⁵ ICH Q10 lists non-conformances and deviations as separate inputs to the CAPA system.⁶

Device rules use the ISO vocabulary. Since 2 February 2026, 21 CFR Part 820 has incorporated ISO 13485:2016 and applied the definitions in Clause 3 of ISO 9000:2015.⁷ In its final rule, FDA says nonconforming product found before or after distribution should be investigated “to the degree commensurate with the significance and risk of the nonconformity”, consistent with ISO 13485 Clause 8.3. It adds that monitoring applies to “process and quality system nonconformities, as well as product nonconformities”.⁸

So in ISO terms a deviation is one kind of nonconformity. ISO 9000 notes that a specified requirement is one that is stated, “for example in documented information”, such as a procedure.² FDA’s 2006 quality systems guidance shows how loosely the words travel. It defines a discrepancy as a result outside the expected range or an unfulfilled requirement that “may be called non-conformity, defect, deviation, out-of-specification, out-of-limit, out-of-trend”. Its definition of non-conformity covers “a deficiency in a characteristic, product specification, process parameter, record, or procedure”.⁹

3When one event is both.

Events often start as one and become the other. An operator skips a mixing step: that is a deviation from the procedure, to be recorded and justified.³ The blend then fails content uniformity: the batch no longer meets its specification, which 211.192 also requires to be investigated and which the quality control unit must approve or reject.⁴¹⁰ The reverse happens too. A raw-material lot fails incoming testing, and the investigation finds the sampling procedure was not followed.

Link the two records and investigate the shared cause once. Keep the product decision with the nonconformance and the process finding with the deviation, so neither is lost when the other closes.

Planned departures have their own terms. ISO 9000 defines a deviation permit as “permission to depart from the originally specified requirements of a product or service prior to its realization”, and a concession as permission to use or release a product or service “that does not conform to specified requirements”.² For devices, FDA notes that ISO 13485 Clause 8.3.2 allows a concession only if “justification is provided, approval is obtained and applicable regulatory requirements are met”, and that concessions “should be closely monitored and not become accepted practice”.⁸

4How each is handled.

The steps draw on the sources above: recording and justifying deviations (211.100(b)), segregating nonconforming product (FDA’s 2006 guidance), investigation scope (211.192 and the QMSR final rule), the ISO 9000 dispositions, and CAPA inputs (ICH Q10).³⁹⁴⁸²⁶ In the US, the annual review includes the investigations made under 211.192; in the EU, the product quality review covers significant deviations and non-conformances and the effectiveness of the CAPAs they led to.¹¹⁵

5Define both in your procedures.

Because regulators and standards use the words differently, write your own definitions into the quality manual or SOPs, with a rule for which record opens first and how the two link. ICH Q10 asks for the quality system’s design and documentation to be “well structured and clear to facilitate common understanding and consistent application”.⁶ Trend both together, since the same cause can show up as either.

6How it runs in Seal.

Seal keeps the two as separate records that can link. In the nonconformance blueprint, a nonconformance begins with an item, material, product or output that does not meet a requirement and needs control and disposition, and a deviation begins with a departure from an approved instruction or process and needs investigation. One event can create or relate to the other, and their containment, evaluation and decision responsibilities stay separate. An inventory hold can be configured to block issue of nonconforming material until it is dispositioned.

The deviation blueprint links each deviation to the batch, sample and procedure version behind it, and traces the affected population through recorded relationships, keeping potentially affected, assessed unaffected, confirmed affected and unknown items distinct.