ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The QSR to QMSR transition is mostly a mapping exercise, and that is genuinely good news. The old Quality System Regulation had 31 sections. The Quality Management System Regulation that replaced it on 2 February 2026 has nine, four of them reserved. Almost everything that disappeared did not vanish — it moved into ISO 13485:2016, which Part 820 now incorporates by reference.
This guide maps all 31 old sections to where their requirements now live, identifies the one with no successor at all, and sets out how to run the change as a controlled change rather than an assumption.
Four things, in descending order of how much work they cause.
| Change | Effect on a certified ISO 13485 quality system |
|---|---|
| ISO 13485:2016 incorporated by reference | Most former Subpart requirements are met through the standard you already follow |
| Four bridges named in 820.10(b) | Explicit links from ISO clauses to Parts 803, 806, 821 and 830 — usually new work |
| Section 820.180(c) removed | Management review, internal audit and supplier audit reports are no longer exempt from FDA review |
| Terminology aligned to ISO | Device master record becomes medical device file, and related vocabulary shifts |
Of the four, the third causes the least documentation work in the QSR to QMSR transition and the most behavioural change, which is why it is the row most often skipped.
Where a requirement moved into ISO 13485, the clause is given. Where it stayed in Part 820, the new section is given.
| Old QSR | Old title | Where it lives now |
|---|---|---|
| 820.1 | Scope | 820.1, rewritten |
| 820.3 | Definitions | 820.3 plus ISO 13485 and ISO 9000 Clause 3 |
| 820.5 | Quality system | 820.10(a) and Clause 4.1 |
| 820.20 | Management responsibility | Clauses 5.1–5.6 |
| 820.22 | Quality audit | Clause 8.2.4 — the FDA review exemption did not carry across |
| 820.25 | Personnel | Clause 6.2 |
| 820.30 | Design controls | Clause 7.3, applicability now set by 820.10(c) and (d) |
| 820.40 | Document controls | Clause 4.2.4 — 820.40 is now [Reserved], do not cite it |
| 820.50 | Purchasing controls | Clauses 7.4.1–7.4.3 — supplier audit report exemption gone |
| 820.60 | Identification | Clause 7.5.8, bridged to Part 830 |
| 820.65 | Traceability | Clauses 7.5.9.1 and 7.5.9.2, bridged to Part 821 |
| 820.70 | Production and process controls | Clauses 6.3, 6.4, 7.5.1 |
| 820.72 | Inspection, measuring and test equipment | Clause 7.6 |
| 820.75 | Process validation | Clauses 7.5.6, 7.5.7 |
| 820.80 | Receiving, in-process and finished device acceptance | Clauses 7.4.3, 8.2.6 |
| 820.86 | Acceptance status | Clause 7.5.8 |
| 820.90 | Nonconforming product | Clauses 8.3.1–8.3.4, advisory notices bridged to Part 806 |
| 820.100 | Corrective and preventive action | Clauses 8.5.2, 8.5.3 |
| 820.120 | Device labeling | 820.45 and Clause 7.5.1 |
| 820.130 | Device packaging | 820.45 — merged |
| 820.140–820.160 | Handling, storage, distribution | Clause 7.5.11 |
| 820.170 | Installation | Clause 7.5.3, records supplemented by 820.35(b) |
| 820.180 | General requirements (records) | Clause 4.2.5 and 820.35 — 820.180(c) has NO successor |
| 820.181 | Device master record | Clause 4.2.3 — now the medical device file |
| 820.184 | Device history record | Clauses 4.2.5, 7.5.1 — no longer a named record type |
| 820.186 | Quality system record | Clauses 4.2.1, 4.2.2 |
| 820.198 | Complaint files | Clause 8.2.2 and 820.35(a) — seven data elements retained |
| 820.200 | Servicing | Clause 7.5.4 and 820.35(b) — six data elements retained |
| 820.250 | Statistical techniques | Clauses 8.1, 8.4 |
Every QSR to QMSR transition should stop at 820.180(c) and read it twice.
Under the old rule, the records-availability section did not apply to the reports required by 820.20(c) management review, 820.22 quality audits, or supplier audit reports used to meet 820.50(a). On request, an employee in management with executive responsibility could certify in writing that those had been performed and documented, with dates, and that any required corrective action had been undertaken. The reports themselves stayed internal.
The QMSR contains no section 820.180. There is no exemption and no certification route, and Compliance Program 7382.850 names Internal Audits and Management Review as inspection elements. Those reports can now be requested and read.
The right response is not thinner reports — an audit programme that finds nothing invites more scrutiny, not less. The right response is to write findings plainly, record the evidence examined, name owners and dates, and close what you open.
Terminology is the quiet risk in any QSR to QMSR transition. Spoken habit will lag written practice for a long time, and in conversation that is harmless. It stops being harmless when it lands in a record, or when an investigator asks for the device master record and is told you do not have one.
| QSR term | Now | Source |
|---|---|---|
| Device master record (DMR) | Medical device file | Clause 4.2.3 |
| Device history record (DHR) | Records of production | Clauses 4.2.5, 7.5.1 |
| Design history file (DHF) | Design and development file | Clause 7.3.10 |
| Quality audit | Internal audit | Clause 8.2.4 |
| Establish | Document | ISO usage — “establish” meant define, document and implement |
| Medical device | Device | FD&C Act 201(h) supersedes the ISO term |
| Labelling | Labeling | FD&C Act 201(m), and broader than the ISO term |
| The organization | The manufacturer | 21 CFR 820.3(b) supersedes the ISO term |
The transition is itself a change to the quality management system, and Compliance Program 7382.850 makes Change Control a QMS Area in its own right. A transition carried out informally is a change-control finding on top of whatever else it may be.
Classify every affected document before touching it — this is the step that keeps a QSR to QMSR transition auditable. Five categories cover it:
Treat the last category carefully. A document written for a withdrawn section may still be doing useful work, and withdrawing it can quietly remove a control you rely on.
These are the places a QSR-era document set most often falls short: the seven complaint data elements of 820.35(a) and the justification record where no investigation is performed; the six servicing data elements of 820.35(b); the five labeling accuracy checks and documented release of 820.45; the UDI recorded against a device or batch under 820.35(c) rather than merely printed; the four 820.10(b) bridges; and the design-control applicability determinations under 820.10(c) and (d).
The effective date has passed. An organisation still working through the QSR to QMSR transition is not beyond help, but the position should be recorded honestly: which requirements are met, which are not, what the interim controls are, and the target dates.
An investigator finding an incomplete transition that is documented, resourced and progressing is in a materially different conversation from one finding an incomplete transition nobody has written down.
Eight phases, each producing something you can show an investigator:
Phase 6 is the one most often assumed rather than tested. A bridge procedure that nobody has exercised is an intention, and the Part 821 bridge in particular needs its applicability determination recorded even where the answer is that no tracking order applies.
No, and treating the QSR to QMSR transition that way wastes months. If you already run an ISO 13485 quality system, most of Part 820’s former content is already satisfied. The work is the FDA layer on top: the bridges, the record supplements, the labeling controls and the applicability determinations.
Then the transition is larger, because the incorporated standard now carries requirements your quality system met in Part 820’s own words. Compliance does not require a certificate — but it does require the quality system to comply with the applicable requirements of the standard, so the standard is the specification either way.
Retain the plan, the gap assessment, the document impact assessment with each item’s category, the training records, and the management review that accepted closure. Then verify by sampling records created under the revised documents — a revised procedure nobody has yet followed is not evidence that anything changed.
Yes. Part 4 was amended in step with the QMSR, and 4.4(b)(1) now names ISO 13485 clauses as incorporated under 820.7 rather than referring to the old QSR sections. If you make a combination product, re-read Part 4 rather than assuming your existing streamlined approach still reads correctly.
For the regulation as it now stands, start with the FDA QMSR guide, and for the delta a certified manufacturer still has to build, see QMSR vs ISO 13485. Inspection preparation is covered in QMSR inspection.
For the underlying instrument behind every row of the QSR to QMSR transition map, the current regulation text is on eCFR at 21 CFR Part 820, and the final rule with its preamble is on the Federal Register.
Our FDA QMSR Toolkit ships the section mapping matrix above pre-loaded with all 31 old sections, alongside the gap assessment workbook, the document impact assessment and the terminology register. The mapping matrix is the artefact that turns a QSR to QMSR transition from a worry into a checklist.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026