ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
QMSR vs ISO 13485 is a slightly misleading way to put the question, because since 2 February 2026 the two are not alternatives. 21 CFR Part 820 now incorporates ISO 13485:2016 by reference. The standard is not a competitor to the regulation — it is most of the regulation.
The real question is narrower and more useful: if you already run a certified ISO 13485 quality system, what is left to build? This guide answers that requirement by requirement.
| ISO 13485:2016 | QMSR (21 CFR Part 820) | |
|---|---|---|
| Status | Voluntary international standard | Binding US federal regulation |
| Relationship | Incorporated by reference under 820.7 | Incorporates the standard, then adds to it |
| Scope unit | The organisation | The operations performed on finished devices |
| Assessed by | A certification body, if you choose | FDA, whether you choose or not |
| Failure consequence | Loss of certificate | Device adulterated under FD&C 501(h) |
| Edition | Whatever is current | 2016 third edition, pinned by law |
That last row catches people. Incorporation by reference fixes the edition until FDA amends the regulation, so a newer ISO edition does not automatically apply. In a QMSR vs ISO 13485 comparison this is the one place where “keeping up to date” is the wrong instinct.
Most of it, honestly. Every requirement the old Quality System Regulation set out in its own words now comes from the standard: management responsibility, resource management, design and development, purchasing, production and service provision, monitoring and measurement, corrective and preventive action, records.
If your certified quality system genuinely covers the operations you perform on devices for the United States market, the bulk of Part 820 is satisfied. That is the good news in any QMSR vs ISO 13485 assessment, and it is worth real money in avoided rework.
Fourteen requirements are not evidenced by a certificate, and they are the whole of the QMSR vs ISO 13485 gap. This is the list to work against.
| 21 CFR | What it adds | ISO clause it supplements |
|---|---|---|
| 820.10(b)(1) | UDI system meeting Part 830 | 7.5.8 |
| 820.10(b)(2) | Device tracking per Part 821, where applicable | 7.5.9.1 |
| 820.10(b)(3) | Notifying FDA of complaints meeting Part 803 criteria | 8.2.3 |
| 820.10(b)(4) | Advisory notices handled to Part 806 | 7.2.3, 8.2.3, 8.3.3 |
| 820.10(c) | Design-control applicability by device class | 7.3 |
| 820.10(d) | Implantable traceability for life-supporting devices | 7.5.9.2 |
| 820.35(a) | Seven complaint data elements, plus the justification record | 8.2.2, 4.2.5 |
| 820.35(b) | Six servicing data elements | 7.5.4, 4.2.5 |
| 820.35(c) | UDI recorded per device or batch | 7.5.1, 7.5.8, 7.5.9 |
| 820.35(d) | Confidentiality marking for Part 20 | 4.2.5 |
| 820.45(a) | Five labeling accuracy checks | 7.5.1 |
| 820.45(b) | Documented release of labeling | 4.2.5, 7.5.1 |
| 820.45(c) | Mixup prevention and pre-use inspection | 7.5.1 |
| 820.3(b) | FDA definitions superseding ISO terms | ISO 9000 Clause 3 |
Six of those rows are the 820.10(b) bridges, and they are the heart of the QMSR vs ISO 13485 delta. Each names an ISO clause and says that to comply with it you must also comply with another part of title 21. A quality system can satisfy Clause 7.5.8 identification perfectly and still fail 820.10(b)(1) because it has no Part 830 UDI system.
Notably, FDA’s inspection program organises its four Other Applicable FDA Requirements around exactly those four parts — 803, 806, 821 and 830. The regulation’s cross-references and the inspection structure agree, which tells you where to concentrate.
820.35 is where certified manufacturers most often have a real gap, because the requirements are specific and countable. Seven named data elements for complaints. Six for servicing. A UDI recorded against the device or batch — not merely assigned and printed, which is a separate obligation people routinely conflate.
There is also the justification record: where you decline to investigate a complaint because a similar one was already investigated, the reasoning must be documented. That record exists in very few quality systems built to the standard alone.
Section 820.3(b) makes FD&C Act section 201 definitions supersede the correlating ISO terms, and defines Organization to mean manufacturer as FDA defines it. That definition reaches contract sterilisation, relabeling, remanufacturing, repacking, specification development and initial distributors of foreign entities.
The practical effect: businesses that read ISO clauses addressed to “the organization” as being about their customer are, under the QMSR, inside them.
One difference in the QMSR vs ISO 13485 picture is not a requirement at all. It is the removal of a protection.
Former section 820.180(c) exempted management review reports, internal quality audit reports and supplier audit reports from FDA review, allowing only a written executive certification that they had been performed. The QMSR has no section 820.180, and FDA Compliance Program 7382.850 lists Internal Audits and Management Review as inspection elements.
ISO 13485 never provided that protection and never withdrew it — this is purely a US regulatory change. But it affects how those records should be written, and a certified quality system carries no advantage here.
Yes, in three practical ways, none of which is compliance.
It gives you the specification. Because the standard is incorporated, your certified processes are the substrate the FDA layer attaches to, and the mapping work is far smaller than starting cold.
It gives you evidence an investigator recognises. Certification records demonstrate the process operates, which is what element-based inspection tests.
It serves other markets. EU MDR, MDSAP and several national schemes all lean on ISO 13485, so the certificate earns its keep regardless of the QMSR position.
What it does not do is discharge any of the fourteen requirements above.
The mechanism that works is a delta register: take each of the fourteen requirements above and disposition it against your existing quality system. Three dispositions cover it.
The middle disposition is where most of the real work sits and where a QMSR vs ISO 13485 gap analysis most often goes wrong, because a reviewer sees a procedure with the right title and marks it covered. Test against the requirement’s actual words: does the complaint record carry all seven data elements? Is the UDI recorded against a batch, or only printed? Is the labeling release documented, or merely happening?
Once the register is complete, sample records created in the last quarter and check them against the requirement. A revised procedure that nobody has followed yet is not evidence that a gap is closed, and this is exactly what an investigator does when testing an element.
No. Certification is voluntary and assessed by a certification body against the standard. QMSR compliance is mandatory for devices marketed in the United States, assessed by FDA, and includes supplements the standard does not contain. You can hold a certificate and be non-compliant, and you can be compliant with no certificate at all.
No. The regulation requires the quality system to comply with the applicable requirements of ISO 13485 — not to be certified against it. Most manufacturers keep certification because it serves other markets and produces convenient evidence, but it is a commercial decision rather than a regulatory requirement.
The 2016 third edition, and only that one. Section 820.7 incorporates ISO 13485:2016(E) dated 1 March 2016, along with ISO 9000:2015(E) Clause 3 for definitions. Those editions stay fixed until FDA amends the regulation, so moving to a later edition is not a compliance improvement under the QMSR.
For an organisation with a mature certified quality system, the work is measured in weeks rather than months, because it is documentation and process attachment rather than system building. The variable is usually the bridges: a manufacturer with no Part 830 UDI process or no Part 806 procedure has real work, while one that already reports to FDA has mostly a documentation exercise.
For the regulation in full, see 21 CFR Part 820 section by section, and for the change in context, the FDA QMSR guide. If you are moving an older quality system across, the QSR to QMSR transition maps all 31 former sections to where their requirements now live.
The current regulation text is on eCFR at 21 CFR Part 820.
Our FDA QMSR Toolkit is built as exactly this delta. It assumes an ISO 13485 quality system and documents only what sits on top — the four bridge procedures, the 820.35 record supplements, the 820.45 labeling controls and the applicability determinations — with a mapping matrix that shows, requirement by requirement, where the QMSR adds to rather than restates the standard. If you hold a certificate, that matrix is the shortest route through the QMSR vs ISO 13485 question.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026