FDA QMSR and ISO 13485:2016: What Medical Device Makers Must Do Now

On February 2, 2026, the way the United States regulates medical device quality changed in a fundamental way. The Quality System Regulation (QSR) that governed device manufacturing for nearly three decades is gone. In its place is the Quality Management System Regulation (QMSR), a rebuilt version of 21 CFR Part 820 that is now built directly on the international standard ISO 13485:2016.

For medical device makers, this is not a cosmetic rename. The QMSR brings new expectations around risk management, opens records that were once off-limits to FDA inspectors, and replaces the long-standing inspection method that most quality teams were trained on. This guide explains what the QMSR is, how it differs from the old QSR, and the concrete steps your company should take to stay compliant and inspection ready.

Executive summary

What is changing? On February 2, 2026, the FDA replaced the Quality System Regulation with the Quality Management System Regulation. The revised 21 CFR Part 820 incorporates ISO 13485:2016 by reference, adds a small set of FDA-specific requirements on top of the standard, and is supported by a new inspection process. The old Quality System Inspection Technique has been retired.

Why does it matter? The QMSR harmonizes US requirements with the system used by Health Canada, the European Union, and other authorities, but it also raises the bar. Risk management now runs through the entire quality system, and internal audit, management review, and supplier audit records that the QSR shielded from FDA review are now open to inspection.

What should companies do? Move from a QSR-structured quality system to one organized around ISO 13485:2016, map the FDA-specific additions into your procedures, and make sure every record an inspector can now request is complete and current. A focused gap assessment is the fastest way to find what still needs to change.

What is the FDA QMSR?

The Quality Management System Regulation (QMSR) is the FDA's current good manufacturing practice (CGMP) requirement for medical devices, set out in 21 CFR Part 820. Effective February 2, 2026, it incorporates by reference ISO 13485:2016, the international standard for medical device quality management systems, along with the terms and definitions in Clause 3 of ISO 9000:2015. The FDA finalized the rule on February 2, 2024 and gave industry a two-year transition period.

The FDA concluded that the requirements in ISO 13485, taken in totality, are substantially similar to the old QSR and provide a similar level of assurance that devices are safe and effective. Where any clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or its regulations, the Act and its regulations control. In other words, ISO 13485 is now the backbone of Part 820, but FDA law still sits on top.

QMSR vs QSR: what actually changed

The QMSR keeps the same goal as the QSR, which is a quality system that consistently produces safe and effective devices. What changes is the structure, the language, and the depth of certain expectations. The table below summarizes the shifts that matter most to quality and regulatory teams.

ISO 13485:2016 is now the backbone of Part 820

Because the QMSR incorporates ISO 13485:2016 by reference, the standard itself is now enforceable US law. A quality system that is genuinely built to ISO 13485, with risk-based processes, clear management responsibility, controlled documents, and lifecycle design and development controls, already meets most of the QMSR. The FDA also incorporated Clause 3 of ISO 9000:2015 so that everyone uses the same definitions for core quality terms.

Manufacturers can read both standards at no cost in a read-only format through the American National Standards Institute (ANSI) Incorporated by Reference portal. That access matters, because the regulation now points to specific clauses of the standard rather than spelling out every requirement in the CFR text.

The FDA requirements that sit on top of ISO 13485

ISO 13485 alone does not cover everything the FDA needs, so the QMSR adds a focused set of US-specific requirements. These additions are where many ISO-certified companies will still find gaps.

Quality system records and cross-references (820.10). The QMSR requires your quality system to link clearly to other FDA rules that ISO 13485 does not address, including medical device reporting, unique device identification (UDI), corrections and removals, and device tracking.

Control of records (820.35). The FDA spells out specific content for complaint records and servicing records, including device identification, dates, any UDI information, investigation results, and whether the device met its specifications. This is more detailed and explicit than the old QSR.

Device labeling and packaging controls (820.45). The FDA decided ISO 13485's labeling and packaging provisions were not adequate, so it added requirements. Manufacturers must inspect labeling for accuracy before release and control labeling and packaging through storage and handling, with UDI applied and maintained where it applies.

Combination products (Part 4). The FDA made conforming edits to 21 CFR Part 4 to clarify quality system expectations for combination products. These edits do not change the underlying CGMP requirements for combination products.

Records that were once off-limits are now open

This is one of the most important changes for inspection readiness. The old QSR, at 820.180(c), shielded certain records from routine FDA review, including internal audit reports, supplier audit reports, and management review reports. The QMSR does not carry that exemption forward.

From February 2, 2026, FDA investigators can request and review your management review, quality audit, and supplier audit records. The FDA's reasoning is that manufacturers already provide these records to other regulators, so making them available to FDA inspectors is not an added burden. The practical message is simple. These records must be complete, honest, and ready to show, because an inspector can now ask for them.

A new inspection process replaces QSIT

On February 2, 2026, the FDA retired the Quality System Inspection Technique (QSIT) that quality teams had used to prepare for inspections for years. Inspections now follow the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850. The FDA also withdrew two older programs, Inspection of Medical Device Manufacturers (7382.845) and Medical Device PMA Preapproval and PMA Postmarket Inspections (7383.001).

The best preparation has not changed in principle. Meet the requirements that apply to your product, and be ready to discuss and produce records that show compliance with the QMSR. What has changed is the frame of reference. Your team should be fluent in ISO 13485 structure and language, not just the old QSR subpart numbers.

No ISO 13485 certificate required, and MDSAP stays voluntary

Incorporating ISO 13485 does not mean the FDA will ask for a certificate. The FDA will not require, and will not issue, certificates of conformance to ISO 13485, and holding a certificate does not exempt a manufacturer from an FDA inspection. FDA inspections assess compliance with FDA regulations and are scheduled based on risk.

The Medical Device Single Audit Program (MDSAP) remains a separate, voluntary third-party program. FDA inspections under the QMSR do not follow the MDSAP audit plan or procedures. That said, a strong MDSAP or ISO 13485 certification is excellent evidence that your system already meets the core of the QMSR.

Who must comply

The QMSR applies to finished device manufacturers who intend to commercially distribute medical devices in the United States. A finished device is any device, or accessory to a device, that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized. Manufacturers of accessories are covered too.

Some Class I devices remain exempt from most CGMP requirements through FDA classification regulations, but exemption is never total. Even exempt manufacturers must keep complaint files and the general records required under 820.35. Devices made under an investigational device exemption (IDE) are not exempt from design and development controls under 820.10(c) and ISO 13485 Clause 7.

The Canadian and cross-border advantage

For companies that already sell in Canada or Europe, the QMSR is good news. Health Canada has required ISO 13485 certification through MDSAP for Class II, III, and IV device licences for years, and the European system is also built on ISO 13485. A manufacturer with a mature ISO 13485 quality system has already done most of the heavy lifting for the US market.

The work that remains is targeted. Map the FDA-specific additions for records, labeling, and cross-references into your existing procedures, confirm that risk management reaches every process, and make sure the audit and management review records FDA can now see are in order. This is exactly the kind of focused, cross-border medical device gap work that turns one quality system into market access for Canada, the United States, and the EU.

Technical amendments tidied up the rest of the rules

Alongside the main rule, the FDA published technical amendments on December 4, 2025 that updated 179 sections across 18 parts of Title 21 to use the new QMSR references and language. The FDA describes these as editorial, with no new requirements. They confirm, among other things, that certain Class I devices stay exempt from most QMSR requirements except for the recordkeeping under 820.35.

QMSR compliance checklist

Use this checklist to structure your transition work and your inspection readiness.

• Restructure your quality manual and procedures around ISO 13485:2016 clauses, not the old QSR subparts.
• Confirm risk management runs through the whole system, including supplier controls, production, training, and post-market, not only design.
• Map the FDA additions into your procedures: cross-references (820.10), record and complaint content (820.35), and labeling and packaging controls (820.45).
• Review your medical device file and document controls against ISO 13485 Clause 4.
• Make internal audit, supplier audit, and management review records complete and inspection ready, because the 820.180(c) exemption is gone.
• Verify UDI, medical device reporting, corrections and removals, and device tracking links are clear within the quality system.
• Train your team on ISO 13485 language and the new Compliance Program 7382.850 inspection approach.
• Run a comparative analysis showing that records created before February 2, 2026 meet QMSR expectations.
• If you hold MDSAP or ISO 13485 certification, use it as evidence, but do not assume it closes every FDA-specific gap.

Common mistakes to avoid

Treating the QMSR as a simple rename. The QMSR is not the QSR with a new title. The structure, terminology, and risk expectations are different, and so is the inspection method.

Leaving risk management in the design file. ISO 13485 expects risk-based thinking across the entire system. A risk file that stops at design controls will not satisfy the QMSR.

Forgetting that audit and management review records are now visible. Companies used to keeping these records away from the FDA need to make sure they are accurate and defensible, because investigators can now request them.

Assuming an ISO 13485 certificate is enough. Certification helps, but the FDA does not accept it in place of an inspection, and it does not cover the FDA-specific additions in 820.10, 820.35, and 820.45.

Overlooking the FDA additions on labeling and records. These are the areas where ISO-certified companies most often have gaps, because ISO 13485 alone does not go as far as the FDA requires.

Frequently asked questions

When did the FDA QMSR take effect?

The QMSR became effective on February 2, 2026, two years after the final rule was published in the Federal Register on February 2, 2024. The Quality System Regulation no longer applies.

What is the difference between the QSR and the QMSR?

The QSR was an FDA-specific rule written in the 1990s. The QMSR is the same Part 820 rebuilt on ISO 13485:2016, with a small set of FDA-specific additions, expanded risk expectations, fewer record exemptions, and a new inspection process.

Does the QMSR require ISO 13485 certification?

No. The FDA incorporates ISO 13485:2016 by reference but will not require or issue certificates of conformance. A certificate does not exempt a manufacturer from an FDA inspection.

Can the FDA now review our internal audit and management review records?

Yes. The QMSR removes the old 820.180(c) exemption. From February 2, 2026, FDA investigators can request management review, quality audit, and supplier audit records during an inspection.

How are QMSR inspections different?

The FDA retired the QSIT method and now inspects under Compliance Program 7382.850. Inspections assess compliance with the QMSR, and teams should be ready to produce records framed in ISO 13485 terms.

Do small or Class I device makers have to comply?

Most do. Some Class I devices are exempt from most CGMP requirements, but even exempt manufacturers must keep complaint files and the records required under 820.35. Accessory manufacturers are also covered.

We already have MDSAP. Are we ready for the QMSR?

You are well positioned. MDSAP and ISO 13485 cover the core of the QMSR, but you still need to confirm the FDA-specific additions for cross-references, records, and labeling, and ensure newly visible records are inspection ready.

How MFLRC can help

MFLRC helps medical device manufacturers, importers, and startups move from a QSR-era quality system to a QMSR and ISO 13485:2016 system that holds up under FDA inspection. Our work in medical devices and quality assurance covers the full quality lifecycle, from gap assessment through remediation and inspection readiness.

• ISO 13485:2016 gap assessment that compares your current system to the QMSR and pinpoints every FDA-specific gap.
• QMS build and remediation to restructure your quality manual, procedures, and records around ISO 13485 with the FDA additions mapped in.
• Internal and supplier audits and inspection-readiness assessments so missing or outdated records are found before an FDA investigator finds them.
• US-market readiness for Canadian and international manufacturers who want to turn an existing ISO 13485 or MDSAP system into US market access.

If your devices involve machine learning, see our guidance on Health Canada's PCCP framework, and if you import or distribute into Canada, review our briefing on the MDEL Phase II amendments that take effect in December 2026.

Conclusion

The QMSR is the biggest change to US device quality regulation in a generation. It aligns the United States with the rest of the world by building Part 820 on ISO 13485:2016, but it also raises expectations on risk management and removes the record exemptions that used to keep audits and management reviews out of FDA view. For companies with a mature ISO 13485 system, the path is short and mostly about mapping FDA-specific additions and tightening records. For companies still running a QSR-shaped system, the work is real and the clock has already started. The QMSR is in force today, and the next FDA inspection will be measured against it.

Sources and references

FDA, Quality Management System Regulation (QMSR).

FDA, Quality Management System Regulation - Frequently Asked Questions.

Federal Register, Medical Devices; Quality System Regulation Amendments (final rule), February 2, 2024.

Federal Register, Medical Devices; Quality Management System Regulation Technical Amendments, December 4, 2025.

ISO, ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes.

ANSI, Incorporated by Reference (IBR) Portal.