ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The FDA QMSR took effect on 2 February 2026, and it is the biggest change to United States medical device quality requirements in almost thirty years. It is also, for most manufacturers, a smaller job than the headline suggests — provided you understand what actually changed, which is not what most of the commentary says.
This guide covers what the FDA QMSR is, the nine sections Part 820 now contains, the requirements an ISO 13485 certificate does not evidence, and the one change that catches almost every quality system built under the old rule.
The Quality Management System Regulation amends 21 CFR Part 820. Instead of setting out quality system requirements in its own words, it now incorporates ISO 13485:2016 by reference and adds a small number of FDA-specific supplements on top.
The practical effect is dramatic. The old Quality System Regulation had 31 sections across Subparts A to O. The FDA QMSR has nine, and four of those are reserved.
| Section | What it does |
|---|---|
| 820.1 | Scope — which operations and which devices are covered |
| 820.3 | Definitions, including FDA terms that supersede the ISO wording |
| 820.5 | [Reserved] |
| 820.7 | Incorporation by reference — the exact standard editions pinned |
| 820.10 | The quality management system requirement, four bridges to other parts, design-control applicability, and the adulteration consequence |
| 820.20–820.30 | [Reserved] |
| 820.35 | Additional information required in complaint, servicing and identification records |
| 820.40 | [Reserved] |
| 820.45 | Device labeling and packaging controls |
Subparts C to O are reserved entirely. Six sections carry all the substantive content of the FDA QMSR, which is why a transition that looks daunting on paper is usually a matter of weeks rather than months.
Because 820.40 is now reserved, citing it as a current requirement is wrong — it was “Document controls” under the old rule and the number was widely carried across. Document control now lives in ISO 13485 Clause 4.2.4. This turns up in a surprising number of mapping matrices.
Section 820.7 incorporates two standards, not one:
Incorporation by reference fixes those editions until FDA amends the regulation. A newer ISO edition does not apply automatically. Updating your quality system to a later edition on the assumption that newer is safer is, under the FDA QMSR, a compliance error rather than good housekeeping.
This is the question every certified manufacturer asks, and the honest answer is that the gap is narrower than feared but real. A certificate evidences conformity with the standard. It does not evidence:
Conversely, holding no certificate does not make you non-compliant with the FDA QMSR, which requires the quality system to comply with the applicable requirements of the standard; it does not require certification by anybody.
Section 820.3(b) defines Organization to mean manufacturer as defined in this part. Every ISO 13485 clause addressed to “the organization” therefore binds you — and FDA’s definition of manufacturer reaches contract sterilisation, installation, relabeling, remanufacturing, repacking, specification development and initial distributors of foreign entities. Several categories of business that assumed those clauses were about somebody else are squarely inside them.
Similarly, all definitions in section 201 of the Federal Food, Drug, and Cosmetic Act supersede the correlating ISO terms. Device under 201(h) and labeling under 201(m) mean what the Act says, and both are broader than the ISO terms they replace.
Under the old rule, section 820.180(c) exempted management review reports, internal quality audit reports and supplier audit reports from FDA review. An investigator could require only a written certification that they had been performed and dated, and that corrective action had been undertaken. The reports themselves stayed internal.
The FDA QMSR has no section 820.180. The exemption went with it. And FDA Compliance Program 7382.850 — which replaced the Quality System Inspection Technique on the same day — lists Internal Audits and Management Review among the elements an investigator may select.
Under the FDA QMSR those reports can now be read. Anyone who learned their job under the old rule may hold a belief that is no longer true, and that belief produces one of two bad outcomes: a refusal that cannot be sustained, or a record written on the assumption nobody outside would ever see it.
The wrong response is to write thinner reports. An audit programme that never finds anything is itself a finding, because it suggests the audit is not being performed effectively.
FDA stopped using QSIT on 2 February 2026 and now inspects under Compliance Program 7382.850. Preparation material written for the old four-subsystem model no longer describes what will happen.
The new program organises the quality system into six QMS Areas containing 54 elements — Change Control, Design and Development, Management Oversight, Measurement Analysis and Improvement, Outsourcing and Purchasing, and Production and Service Provision — plus four Other Applicable FDA Requirements covering Parts 803, 806, 821 and 830.
Inspections are risk-based: investigators select elements from the product risks that could adversely affect patients and users rather than from fixed sampling, and your risk management documentation is the roadmap they work from. One inspection model requires at least one element from each of the six areas, so every area gets touched.
Section 820.10(e) provides that failure to comply with any applicable requirement in this part renders the device adulterated under section 501(h) of the Act, and that the device and any person responsible for the failure are subject to regulatory action.
Three things follow. It attaches to the product, not to the paperwork. It says any applicable requirement, which includes the supplements a quality system inherited from ISO 13485 alone is most likely to miss. And it names persons, not only the company.
Applicability turns on the operations you perform, not on what you call yourself. Section 820.1 says a manufacturer engaged in only some of the covered operations need comply only with the requirements applicable to those operations — but the determination has to be recorded.
The covered operations are design, manufacture, packaging, labeling, storage, installation and servicing of finished devices, and the definition explicitly reaches contract sterilisation, relabeling, remanufacturing, repacking, specification development and initial distribution for a foreign entity.
Three carve-outs are worth knowing. Manufacturers of components and parts are outside the part, though encouraged to consider it. Blood and blood components for transfusion or further manufacturing fall under subchapter F instead. And HCT/Ps are in scope only where they are regulated as devices.
Record every exclusion you claim with its basis. An unexplained exclusion is the first thing an investigator probes, and a blank cell reads exactly like an unasked question.
No. The regulation requires your quality system to comply with the applicable requirements of ISO 13485; it does not require a certificate. Many manufacturers hold one because it serves other markets and because it is convenient evidence, but it is not a QMSR requirement and it does not by itself demonstrate the FDA supplements.
The device master record is now the medical device file under ISO 13485 Clause 4.2.3. The device history record is no longer a named record type; the underlying records are required through Clauses 4.2.5 and 7.5.1. Expect spoken habit to lag written practice for a while, and train the mapping rather than assuming it.
No. The final rule published on 2 February 2024 with a two-year transition, and the regulation has been in force since 2 February 2026. An organisation still working through it should record the position honestly — which requirements are met, which are not, the interim controls and the target dates — because a documented, resourced, progressing transition is a very different conversation from one nobody has written down.
MDSAP audit evidence remains useful but does not substitute for the FDA layer. The compliance program notes that an investigator discusses MDSAP participation with a supervisor, which is not the same as the audit replacing the inspection. Map what MDSAP genuinely covers and evidence the supplements separately.
Begin with scope: record which operations you perform, because 820.1 makes applicability turn on that. Then work the delta rather than rebuilding a quality system you already have — our guide to QMSR vs ISO 13485 sets out exactly what is left to build, and the QSR to QMSR transition maps all 31 old sections to where their requirements now live.
If you want the regulation itself, the current text is on eCFR at 21 CFR Part 820. For inspection preparation, see QMSR inspection under Compliance Program 7382.850.
Our FDA QMSR Toolkit covers the FDA layer specifically — the four bridges, the 820.35 record supplements, the 820.45 labeling controls and inspection readiness built on the six QMS Areas, with the evidence map pre-loaded with all 54 elements. It assumes you have an ISO 13485 quality system and builds only what sits on top of it.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026