QMSR vs ISO 13485FDA Quality Management System Regulation vs ISO 13485:2016

FDA published 89 FR 7496 on 2 February 2024 amending 21 CFR Part 820. The amended Part 820 — renamed the Quality Management System Regulation (QMSR) — incorporates ISO 13485:2016 by reference into US federal law. The rule takes effect on 2 February 2026, exactly two years after publication. From that date, US-marketed medical devices must be manufactured under a quality system that meets ISO 13485:2016 as supplemented by FDA-specific requirements that remain in Part 820.

Almost the entire pre-2024 QSR text is gone. Subparts B through O of the old regulation are replaced by §820.10, which incorporates ISO 13485:2016 by reference and is supplemented by a small set of additional or modified requirements. The supplementing requirements address the items where FDA-specific rules diverge from ISO 13485 or where US statute imposes obligations that ISO 13485 does not address.

QMSR retains a thin layer of FDA-specific requirements in Part 820, mostly in the new §820.35 (records and signatures), §820.45 (device labelling and packaging controls), and definitions in §820.3 updated to align with ISO terminology.

Legacy QSR used three documents at the heart of every device file — DMR (device master record), DHF (design history file), DHR (device history record) — and these were memorised by every US medical-device QA professional. ISO 13485 does not use those terms. It uses 'medical device file' (§4.2.3), 'design and development files' (§7.3.10), and production-and-process control records (§7.5.1, §7.5.9.2).

Under QMSR, the substance of DMR/DHF/DHR is unchanged — the document set still has to exist, still has to capture the same information, and still has to be inspectable. The naming and structuring move to ISO 13485 conventions. FDA's preamble to the final rule confirms that legacy DMR/DHF/DHR records do not need to be re-formatted or renamed; what changes is the regulation that authorises them.

If your QMS is already certified to ISO 13485:2016 (which most ex-US manufacturers are, and many US manufacturers selling into Europe or under MDSAP also are), the bulk of QMSR is already met. The remaining work is the FDA overlay.

• Add §820.3 definitions to your QMS glossary — particularly the FDA-specific definitions of 'complaint', 'corrective action', 'design history file' (now mapped to ISO §7.3.10).
• Verify your complaint-handling SOPs include the MDR-reporting linkage (21 CFR 803) and corrections-and-removals linkage (21 CFR 806).
• Verify UDI processes meet §820.35(d) and the underlying 21 CFR 830.
• Verify labelling and packaging controls meet §820.45 and underlying 21 CFR 801.
• Update the QMS scope statement to declare QMSR compliance (not 'compliant with 21 CFR Part 820' as historically phrased).

ISO 13485 certification by itself is NOT recognised by FDA as QMSR compliance — FDA inspects against QMSR using its own programme. But the underlying QMS that earns ISO 13485 certification will, with the overlay above, comply with QMSR.

For manufacturers running only the legacy QSR (typically smaller US-only Class II manufacturers), the transition is more substantive. ISO 13485 introduces several requirements that QSR addressed loosely or not at all.

• Explicit risk-based approach across the QMS (ISO 13485 §4.1.2.b) — not just in design controls.
• Explicit linkage to ISO 14971 risk management throughout the lifecycle.
• Specific clauses on infrastructure (§6.3) and work environment (§6.4) — QSR was implicit.
• Specific requirements on validation of processes for production and service provision (§7.5.6) — broader than QSR's process validation language.
• Specific clauses on customer feedback (§8.2.1) and complaint handling that are more detailed than QSR §820.198.

FDA confirmed in the final-rule preamble and in subsequent communications that inspections under QMSR will continue to use a QSIT-style methodology (adapted) — not the third-party certification model that supports ISO 13485 in much of the world. Inspectors will check against the QMSR text (which is the ISO clauses plus the FDA overlay), not directly against ISO 13485 certificates.

MDSAP audits, which already cover Australia, Brazil, Canada, Japan and the US, will continue to function as an integrated audit programme. The MDSAP audit model is built around ISO 13485 already and will adapt cleanly to QMSR.