FDA Quality Management System Regulation (QMSR) in force: alignment with ISO 13485

The FDA's Quality Management System Regulation (QMSR) took effect on 2 February 2026. It replaces the device good-manufacturing-practice requirements in 21 CFR Part 820 and incorporates ISO 13485:2016 by reference.

The old Quality System Regulation (QSR) wrote its requirements directly in subparts A to O of Part 820. QMSR instead uses the reference method: the core requirements are ISO 13485:2016, alongside only a few US-specific FDA provisions.

The aim of the change is to align the FDA framework with the framework used by other regulatory authorities. In other words, a single quality system becomes possible for manufacturers who previously had to run two separate systems.

FDA kept in Part 820 the topics it concluded ISO 13485 does not sufficiently cover: scope, definitions, incorporation by reference, quality management system requirements, control of records, and device labelling and packaging controls.

Although this list looks short, it matters in practice: control of records and labelling are the areas that most often generate findings in FDA inspections. Even a system that has moved to ISO 13485 encounters additional US-specific expectations on these topics.

From 2 February 2026, FDA began using the inspection process defined in its updated compliance programme. The framework of the inspector's questions now follows the ISO 13485 structure.

This does not mean the job is done for a manufacturer holding an ISO 13485 certificate: the certificate is not a declaration of conformity, and an FDA inspection looks at how the system operates, not at the certificate. A gap analysis is needed even for certified organisations — especially on the topics retained in Part 820.

A note on scope: the regulation applies to finished-device manufacturers producing a medical device for commercial distribution.

Medical device manufacturers worked for years in two separate quality-system languages: the language of the international standard and the language of the United States' own regulation. The requirements largely overlapped, but the terminology, structure and record formats differed.

The convergence of the two regimes reduces the burden of dual documentation: the same procedure no longer needs to be written in two separate forms. This is a concrete simplification, especially for manufacturers selling into both markets together.

But convergence is not merger: the regulation continues to place its own additional requirements on top of the standard. The assumption "we comply with the standard, so the regulation is met too" is therefore incorrect.

The change in quality-system approach does not change the device's route to market: risk class, the notification or approval pathway, and clinical evidence expectations continue to run according to their own rules.

Facility registration and device listing obligations also remain in place; the quality system does not replace them. The authority retains its power to inspect facilities, including foreign ones.

Complaint handling, event reporting and corrective action processes are the most heavily inspected parts of the quality system; this is usually where findings arise during inspection.

The task is not to build the system from scratch but to MAP the existing system onto the new structure: which procedure meets each requirement is shown in a mapping table, and records are produced for unmet items.

The mapping table is also the most useful document during inspection: when an inspector asks about a requirement, the table shows which procedure holds the answer.

Terminology differences are closed through training: where the same concept is named differently in the two regimes, the team must recognise both terms, otherwise answers are misunderstood during inspection.