FDA QMSR: Turning 21 CFR 820 into ISO 13485, Without Breaking What Works
QMSR has applied since 2 February 2026. What changed in Part 820, what stayed separate, and how to close the gaps that remain.
In Short
- Part 820 now incorporates ISO 13485:2016; reporting, corrections, tracking, UDI and Part 11 stay separate rules.
- Management review, internal audit and supplier audit reports are no longer excluded from FDA review.
- Pick one vocabulary, add risk-based rationale, and fix procedures by risk.
The Medical Device Production Guide
Built to revision. Inspected. On record.
- What the QMSR changed in February 2026
- Supplier to finished build
- Inspect, review, correct
- Labels, UDI and traceability
Plus Evidence map and four worksheets.
Get the medical device guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Medical Device Production Guide
Built to revision. Inspected. On record.
Since 2 February 2026, FDA's Quality Management System Regulation (QMSR) has applied to medical device manufacturers. The final rule, published on 2 February 2024, amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, with added FDA definitions and requirements. FDA has said this is an alignment, not a relaxation. This guide covers what changed, what stayed, and a transition sequence for teams still running procedures written for the old Quality System Regulation.
What QMSR actually does to Part 820
QMSR keeps the Part 820 citation but replaces most of the old text with ISO 13485:2016 by reference, plus FDA-specific definitions and requirements (for example on records, labelling and packaging controls). Other device rules stay where they were: Part 803 (medical device reporting), Part 806 (corrections and removals), Part 821 (tracking) and Part 830 (UDI).
What applies to a US device maker now
- Law21 CFR Part 820 (QMSR)Effective 2 Feb 2026
Incorporates ISO 13485:2016 by reference, plus FDA definitions and requirements.
- StandardISO 13485:2016Incorporated by reference
The quality management system requirements themselves.
- LawParts 803, 806, 821, 830 and Part 11Unchanged, separate rules
Reporting, corrections and removals, tracking, UDI, electronic records.
- StandardISO 14971FDA-recognised consensus standard
Widely used for product risk management; not named as mandatory by QMSR.
- GuidanceFDA Computer Software AssuranceRevised Feb 2026, nonbinding
Risk-based assurance for device production and quality management system software; supersedes the Sept 2025 version.
More on what QMSR actually does to Part 820
Electronic records still fall under Part 11. FDA also announced it would retire the QSIT inspection approach in favour of one aligned to QMSR. One concrete change: management review, internal audit and supplier audit reports, previously shielded from routine FDA review, are no longer excluded.
Terminology shifts that trip teams up
Small word changes cause real confusion. ISO 13485 talks about top management, the medical device file and records of production; the old regulation spoke of management with executive responsibility, the design history file and the device history record.
Old Wording, New Wording
| Old QSR term | ISO 13485 / QMSR term | What to do |
|---|---|---|
| Management with executive responsibility | Top management | Update the quality manual and review procedures. |
| Device history record (820.184) | Records of production (clause 7.5.1, 7.5.8) | Keep the record; retitle procedures and map the old checklist. |
| Device master record | Medical device file (clause 4.2.3) | Build one file per device type or family. |
| Quality system record | Documentation requirements (clause 4.2) | Fold into document and record control. |
| Management review exempt from inspection | No longer excluded | Write reviews and audit reports for an outside reader. |
- Management with executive responsibility
- ISO 13485 / QMSR term
- Top management
- What to do
- Update the quality manual and review procedures.
- Device history record (820.184)
- ISO 13485 / QMSR term
- Records of production (clause 7.5.1, 7.5.8)
- What to do
- Keep the record; retitle procedures and map the old checklist.
- Device master record
- ISO 13485 / QMSR term
- Medical device file (clause 4.2.3)
- What to do
- Build one file per device type or family.
- Quality system record
- ISO 13485 / QMSR term
- Documentation requirements (clause 4.2)
- What to do
- Fold into document and record control.
- Management review exempt from inspection
- ISO 13485 / QMSR term
- No longer excluded
- What to do
- Write reviews and audit reports for an outside reader.
More on terminology shifts that trip teams up
FDA's definitions in 820.3 bridge some terms. Choose one vocabulary for your procedures, apply it consistently, and keep a cross-reference while auditors and staff adjust.
Risk-based thinking becomes structural
The old regulation mentioned risk in a few places. ISO 13485 expects a risk-based approach across the quality system, including supplier control, software validation and resources.
More on risk-based thinking becomes structural
Be ready to show why each control fits the risk. ISO 14971 is the widely used method for product risk management and is an FDA-recognised consensus standard; QMSR does not make it mandatory by name, but you will need a documented, credible risk process.
Design Controls: Similar, but Tightened
Old 820.30 design controls and ISO 13485 clause 7.3 cover similar ground, but 7.3 is more explicit about planning each stage, design transfer, and records of reviews and changes. Teams whose design files followed the lighter old text may need fuller design plans, clearer review records (who attended, what was decided) and evidence that transfer was reviewed before production.
Supplier control gets a real upgrade
ISO 13485 clause 7.4 asks for documented criteria for selecting, evaluating and re-evaluating suppliers, monitoring in proportion to risk, and control of changes to outsourced processes. In practice that means an approved supplier list with risk levels, re-evaluation intervals that match those levels, and evidence kept for high-risk suppliers.
More on supplier control gets a real upgrade
Because supplier audit reports are no longer excluded from FDA inspection, write them knowing an investigator may read them.
A Transition Sequence
A sensible order: compare every procedure with the matching ISO 13485 clause; rewrite the top-level procedures (quality manual, management review, document control, design, suppliers, CAPA) and retrain; build medical device files for each product family; run an internal audit against the new scope and close findings; then hold a mock inspection. The effective date has passed, so any gaps that remain are current gaps; plan the work by risk rather than to a fixed calendar.
Transition Checks
What FDA inspections will look like after QMSR
Expect investigators to follow a device through design, risk, production records, complaints, CAPA and reporting, using the QMSR structure. Supplier evidence and post-market data feeding the risk file get more attention than they did before.
More on what FDA inspections will look like after QMSR
Treating QMSR as a relabelling exercise leaves gaps an investigator can find.
Questions
Does QMSR replace Part 11?
No. 21 CFR Part 11 remains in force for electronic records and electronic signatures. QMSR governs the QMS; Part 11 governs how the records of that QMS are kept electronically. Both apply, and a clean QMSR implementation has to also be a clean Part 11 implementation.
Do we need ISO 13485 certification once QMSR is in force?
Not for US-only manufacturers. QMSR incorporates 13485 by reference into the regulation, but it does not require third-party certification — FDA inspects you directly. If you already sell outside the US, certification remains the practical entry ticket to the EU, Canada, Japan, Australia and most other markets, and a QMSR-aligned QMS is also a certifiable 13485 QMS.
What happens to existing 820 SOPs on day one?
QMSR took effect on 2 February 2026, so procedures that still follow the old text are being judged against the new one now. Procedures do not fail automatically, but any that conflict with ISO 13485 (wording, missing risk-based controls, thin design or supplier sections) are likely findings. Prioritise rewrites by risk and retrain staff as each one changes.
Will FDA still cite §820 sections in 483s?
Yes. The regulation is still 21 CFR Part 820, so observations cite 820 sections, with the substance often pointing to the incorporated ISO 13485 clauses. Expect a mix of references while inspections settle.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
ASEAN Supplement Rules: BPOM, Thai FDA, Vietnam and PH FDA
DHR vs eDHR: Paper, Scans, Hybrid or Structured Records
21 CFR 106 Infant Formula CGMP Guide: Release, Testing and Traceability
21 CFR 1271 HCT/P Readiness: Records, Release and Retrieval
FDA Food-Contact Polymers (21 CFR 177): Clearance Routes, FCNs and Conditions of Use
21 CFR 507 Animal Food Guide: CGMP, Food Safety Plan, PCQI and Supply-Chain