For years, medical device manufacturers supplying the US market worked under FDA’s Quality System Regulation (QSR). That changed on February 2, 2026, when the FDA’s Quality Management System Regulation (QMSR) became effective under 21 CFR Part 820.
QMSR now incorporates ISO 13485:2016 into Part 820. This brings the US quality system requirements closer to the standard already followed in many other markets. It does not, however, make the FDA requirements identical to ISO 13485. Certain FDA-specific requirements continue to apply.
FDA finalized the rule in January 2024, with implementation scheduled two years later. That transition period has now ended. The focus for manufacturers is on making sure their quality systems meet the current Part 820 requirements.
This article looks at what changed from QSR to QMSR, how ISO 13485:2016 fits into the FDA framework, and what manufacturers need to know under the current requirements.
What Was FDA’s Quality System Regulation (QSR)?
Before QMSR, the FDA regulated medical device quality systems through the Quality System Regulation (QSR) in 21 CFR Part 820. This version of Part 820 was published on October 7, 1996, and took effect on June 1, 1997, replacing the earlier device GMP regulation.
Manufacturers covered by QSR had to put appropriate quality procedures and controls in place for the devices they produced. Depending on the activities involved, Part 820 covered areas such as:
- Design controls
- Purchasing controls
- Production and process controls
- Corrective and preventive action (CAPA)
- Complaint handling
- Document and record controls
- Labeling and packaging controls
- Handling, storage, distribution, installation, and servicing
QSR remained the FDA’s medical device quality system framework until QMSR took effect on February 2, 2026. The former QSR already had some alignment with international quality system standards, although QMSR now aligns Part 820 much more directly with ISO 13485:2016.
What Is the Quality Management System Regulation (QMSR)?
Under 21 CFR Part 820, QMSR sets out the quality system requirements FDA applies to medical devices. It came into effect on February 2, 2026, and took over from the older QSR.
The revised Part 820 incorporates ISO 13485:2016 by reference, but QMSR is not limited to the ISO standard. A number of FDA’s own provisions remain in the rule, and manufacturers must meet those too.
Part 820 applies to finished devices intended for human use, made in the US or imported or offered for import. It covers:
- design and manufacture
- packaging and labeling
- storage
- installation and servicing
If a manufacturer performs only some of these activities, only the requirements applicable to those operations need to be followed.
Why FDA Moved from QSR to QMSR
The move from QSR to QMSR was not simply a change in name. FDA wanted to modernize its medical device CGMP requirements and bring them into closer alignment with the quality management system approach used by other regulatory authorities.
ISO 13485:2016 is a key part of that change. FDA found that the standard covers many of the same quality system areas addressed under the former QSR. Bringing ISO 13485:2016 into Part 820 also helps reduce duplication for manufacturers that already work with the international standard.
FDA has also linked greater harmonization with less unnecessary regulatory burden and fewer differences between quality system requirements across markets. The aim is to make regulation more consistent while continuing to protect device quality and patient safety.
Even with this closer alignment, US requirements are not identical to ISO 13485. QMSR still includes FDA-specific requirements that manufacturers must follow.
QMSR and ISO 13485:2016: How the Alignment Works
ISO 13485:2016 now forms a central part of FDA’s quality system framework for medical devices. QMSR incorporates the standard by reference into 21 CFR Part 820. Manufacturers covered by Part 820 must document a quality management system that meets the applicable ISO 13485 requirements along with the other FDA requirements that apply to them.
QMSR also incorporates Clause 3 of ISO 9000:2015 for terms and definitions. However, FDA terminology still takes priority where required. In some cases, terms defined under US law or FDA regulations take precedence over the corresponding ISO definitions.
Part 820 is now built around ISO 13485, but that doesn’t make the standard enough on its own. FDA’s additional requirements still apply, and manufacturers need to plan for them.
Timeline From QSR to QMSR
The shift from QSR to QMSR took place over several years. The main regulatory milestones are shown below.
The formal QMSR rulemaking began with FDA’s 2022 proposed rule, followed by the final QMSR rule in 2024. After the two-year transition period, QMSR became effective on February 2, 2026.
QSR vs QMSR: Key Differences
QMSR was not built from scratch. When FDA compared the two frameworks, it found the former QSR and ISO 13485:2016 to be substantially similar. The differences that do exist come down to structure and to how risk is handled, along with some changes in record terminology and in FDA’s approach to inspections.
| Area | Former QSR | QMSR |
| Regulatory structure | Quality system requirements were written directly into 21 CFR Part 820. |
Part 820 now incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015, together with FDA-specific provisions.
|
| International alignment | The FDA regulation already had some alignment with international quality system standards. | Part 820 now incorporates ISO 13485:2016 by reference, creating closer alignment with the current international QMS framework. |
| Risk management | Risk-related requirements appeared in specific parts of the QSR, including design controls. |
Risk management is addressed across the ISO 13485 quality management system and is used more explicitly in risk-based decision-making.
|
| Record terminology | QSR used terms such as Design History File (DHF), Device Master Record (DMR), Device History Record (DHR), and Quality System Record. |
These specific record-type terms are not used in QMSR. The information behind them is largely covered through ISO 13485 documentation requirements.
|
| FDA inspections | FDA used the Quality System Inspection Technique (QSIT). | QSIT is no longer used. Since February 2, 2026, FDA inspections follow Compliance Program 7382.850. |
| Audit and management review records | Management review, quality audit, and supplier audit reports had an exemption from routine FDA inspection under former Section 820.180(c). |
That exemption was not carried into QMSR. FDA investigators may now review these records during an inspection.
|
| Effective period | The revised QSR took effect in 1997 and remained in place until February 1, 2026. |
QMSR became effective on February 2, 2026.
|
ISO 13485 certification is not required to comply with QMSR. FDA inspections also remain separate from certification audits.
FDA-Specific Requirements Under QMSR
QMSR incorporates ISO 13485:2016, but FDA did not rely on the ISO standard alone. 21 CFR Part 820 includes additional requirements that manufacturers need to consider along with the incorporated ISO provisions.
Section 820.10 – Requirements for a Quality Management System
Under Section 820.10, manufacturers subject to Part 820 must document a quality management system that meets the applicable requirements of ISO 13485:2016 as well as other FDA requirements that apply to their devices.
The section also connects certain ISO clauses with existing FDA regulations. These include Unique Device Identification under Part 830, device tracking under Part 821 where applicable, Medical Device Reporting under Part 803, and corrections and removals under Part 806.
Design and development requirements also depend on the device. ISO 13485 Clause 7.3 applies to Class II and Class III devices, along with specified Class I devices identified in Section 820.10.
Manufacturers of devices that support or sustain life also need to consider an additional traceability requirement. Where failure of the device, when properly used according to its labeling, could reasonably be expected to result in significant injury, ISO 13485 Clause 7.5.9.2 applies alongside the other applicable Part 820 requirements.
Section 820.35 – Control of Records
Section 820.35 adds some record details that FDA expects in addition to the ISO 13485 requirements. Complaint records are one example. If a complaint involves the possible failure of a device, its labeling, or its packaging to meet specifications, the related review, evaluation, and investigation records need to be maintained.
A second investigation is not always needed when the same type of complaint has already been investigated. In that case, the reason for not investigating again needs to be recorded.
Servicing records should make it clear which device was worked on, when the service took place, who carried it out, and what was done. Any related test or inspection data also needs to be kept. UDI information must be recorded for each device or batch, as applicable.
Section 820.45 – Device Labeling and Packaging Controls
Section 820.45 focuses on how labeling and packaging are controlled. Manufacturers need written procedures that cover the checks and handling needed to protect labeling and packaging through normal processing, storage, handling, and distribution.
Before labeling or packaging is released or placed into storage, it must be checked where applicable. The review may include details such as the device identifier, expiration date, storage instructions, handling instructions, and any extra processing instructions.
Controls are also needed to avoid labeling or packaging mix-ups. The release of labeling and the results of required inspections must be documented.
What Changed for FDA Inspections Under QMSR?
FDA also changed how medical device quality system inspections are handled after QMSR took effect on February 2, 2026. The earlier Quality System Inspection Technique (QSIT) was retired. FDA now uses the Inspection of Medical Device Manufacturers Compliance Program 7382.850 for these inspections.
FDA may look at records created before February 2, 2026 when they are relevant to current compliance. Manufacturers may find it useful to compare older QSR records with the current requirements and show how those records continue to meet QMSR expectations.
FDA can now also review management review reports, quality audit reports, and supplier audit reports. These records had specific inspection exemptions under the former QSR that were not carried into QMSR.
ISO 13485 certification and an FDA inspection are two different things. Having the certificate does not remove a manufacturer from FDA inspection or, by itself, show that all FDA requirements have been met.
During an inspection, manufacturers should be able to explain how their quality system meets QMSR and make the supporting records available.
What QMSR Means for Medical Device Manufacturers
For manufacturers, QMSR is more about reviewing the quality system already in use than replacing it. Much of an existing QMS may still be usable if it meets Part 820. The review is mainly about finding what no longer fits.
Risk has a more visible role under the ISO 13485 framework now incorporated into QMSR. This matters when companies make decisions about areas such as processes and suppliers. When suppliers are evaluated, both the effect of the purchased product on the finished device and the related risk need to be considered.
Some procedures may also need updating. Where a procedure is revised, the people using it need to know what changed in practice.
Older QSR records can remain in their original form. FDA says records made before February 2, 2026 can still use terms such as Design History File or Device Master Record. The main concern is whether the underlying processes continue to meet QMSR. Any process issue found during the review still needs to be dealt with.
Companies that already use ISO 13485:2016 will probably recognize much of the structure. They still need to check the FDA provisions that apply in addition to the incorporated ISO standard.
Conclusion
QMSR is now the FDA’s current quality system framework for medical devices. Part 820 is more closely aligned with ISO 13485:2016, but FDA-specific requirements still remain part of the picture.
Manufacturers now need to look at how their existing quality system works under QMSR. Some procedures may already fit the current requirements, while others may need changes. The same review applies to records, supplier controls, risk-related activities, and inspection preparation.
Artixio’s medical device regulatory and compliance team works with manufacturers on exactly this kind of review, from identifying gaps to planning the changes needed for FDA compliance.
FAQs
1. Is an ISO 13485 certificate necessary under QMSR?
No. QMSR does not require a manufacturer to hold an ISO 13485 certificate. Having one also does not remove FDA’s authority to inspect the facility. FDA still looks at whether the requirements that apply to the manufacturer are being met.
2. Are FDA inspections replaced by ISO audits under QMSR?
No. FDA inspections continue under QMSR and are separate from third-party ISO audits. FDA retired QSIT on February 2, 2026 and now follows the inspection process in Compliance Program 7382.850.
3. What happens to records created before QMSR took effect?
Those records do not have to be recreated simply because the terminology has changed. FDA can still look at them during an inspection. If they show that a process needs updating under QMSR, the manufacturer should address that issue.
4. What changes for supplier management under QMSR?
QMSR expects manufacturers to look at suppliers in relation to the risk they may bring to the finished device. Not every supplier needs the same level of oversight. The controls used should match how much the supplied product or service can affect device quality.
