1What the QMSR is.
The QMSR is the current text of 21 CFR Part 820. It “amends the device current good manufacturing practice (CGMP) requirements of 21 CFR Part 820, incorporating by reference” ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes.¹ FDA published the final rule on 2 February 2024, and it took effect two years later, on 2 February 2026.²³
Part 820 governs “the methods used in, and the facilities and controls used for, the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use”. Every manufacturer engaged in those activities must establish and maintain a quality management system appropriate for its devices. That includes contract sterilisers, relabellers, remanufacturers, repackers and specification developers, and the initial distributors of foreign entities that perform these functions. Makers of components or parts are not covered, though they are encouraged to apply it.⁴
It replaced the Quality System Regulation, which FDA published in October 1996 and which took effect on 1 June 1997, itself a revision of the device CGMP rule of 1978.¹
2What changed from the QSR.
FDA took most of the QSR’s own requirements out of the regulation and put ISO 13485 in their place. FDA judged ISO 13485, “when taken in totality”, to be “substantially similar” to the QSR’s requirements.³
| Quality System Regulation, to 1 February 2026 | QMSR, from 2 February 2026 | |
|---|---|---|
| Structure | FDA’s own requirements in subparts A to O, such as management responsibility (820.20), design controls (820.30) and CAPA (820.100) | ISO 13485:2016 incorporated by reference (820.7 and 820.10), with supplemental sections on records (820.35) and labelling and packaging (820.45) |
| Definitions | FDA’s own definitions in 820.3 | The definitions in ISO 13485 and clause 3 of ISO 9000:2015, with the FD&C Act’s definitions taking precedence |
| Record types | Design history file (820.30(j)), device master record (820.181), device history record (820.184) and quality system record (820.186) | Not retained; their contents are largely required by ISO 13485, in the design and development file (7.3.10), the medical device file (4.2.3) and the record for each device or batch (7.5.1) |
| Risk management | Addressed explicitly in design validation, which included risk analysis where appropriate (820.30(g)) | Built into the requirements throughout, for example clauses 4.1, 7.1 and 7.3 of ISO 13485 |
| Management review, quality audit and supplier audit reports | Exempt from FDA inspection under 820.180(c) | Open to FDA inspection |
| Inspection approach | Quality System Inspection Technique (QSIT) | Compliance Program 7382.850 |
The sources for the table are the QSR as it stood on 1 February 2026, the QMSR, the final rule and FDA’s QMSR FAQ.⁵⁴²³
Two of the changes alter which records exist and who may read them. First, under the old 820.180(c), the QSR’s rule on making records available to FDA did not apply to management review, quality audit and supplier audit reports; on request, a manager with executive responsibility certified in writing that they had been performed and documented.⁵ The QMSR does not keep that exception, so investigators can now read the reports themselves.³ Second, ISO 13485 does not contain the QSR’s record types. FDA said it eliminated those terms “because we believe the elements that comprise those records are largely required to be documented by ISO 13485”.²
3What FDA added to ISO 13485.
Where ISO 13485 points to regulatory requirements, the QMSR names the FDA rules that apply. A manufacturer must document a unique device identification system under Part 830, traceability procedures under Part 821 where applicable, reporting of complaints that meet Part 803’s medical device reporting criteria, and handling of advisory notices under Part 806.⁴
The QMSR also says who must meet ISO 13485’s design and development clause: makers of class II and class III devices and of certain class I devices, including those automated with computer software. Manufacturers of devices that support or sustain life must meet the clause on traceability for implantable devices.⁴
Section 820.35 sets the minimum content of the records for complaints that are investigated or reportable under Part 803, including the device name, date received, any UDI, the complainant’s details, the nature of the complaint, any correction and any reply, and of servicing records. Section 820.45 requires labelling and packaging to be examined for accuracy before release, including the UDI, expiry date and storage and handling instructions, and requires controls against mix-ups.⁴
Where any clause of ISO 13485 conflicts with the FD&C Act or FDA’s regulations, the Act and the regulations control. Failing to comply with Part 820 renders a device adulterated under section 501(h) of the Act.⁴
4Inspections and certificates.
On 2 February 2026 FDA stopped using QSIT and began inspecting under the updated Inspection of Medical Device Manufacturers Compliance Program, 7382.850. It also retired compliance programmes 7382.845 and 7383.001.¹ Investigators may review records created before that date; FDA suggests a comparative analysis can help show that older records meet the QMSR.³
FDA inspections under the QMSR do not follow the Medical Device Single Audit Program’s audit plan. FDA “will not require certificates of conformance to ISO 13485 and will not issue certificates of conformance to ISO 13485”, and a certificate does not exempt a manufacturer from inspection.³ The rule incorporates the 2016 edition specifically: if ISO revises the standard, FDA will evaluate the change and, if appropriate, amend the QMSR through rulemaking.³
5How it runs in Seal.
The medical device blueprint keeps the records the QSR called the DHF, DMR and DHR as connected records, whichever names your procedures use: requirements to verification for the design and development file, the released configuration for the medical device file, and each unit’s actual build for the record per device or batch. Complaints are entered as structured data, so trends can be queried without reading every complaint.
In the design control blueprint, requirements, design outputs and tests are linked as the work is done, the traceability matrix is derived from those links, and a requirement with no linked test is listed as a gap. The QMS blueprint configures workflows for the product and jurisdiction, including design controls and risk management for devices. Map the configured system to the QMSR and ISO 13485 yourself: the presence of a workflow does not by itself demonstrate conformity.
References
- 1Quality Management System Regulation (QMSR), FDA, update of 2 February 2026. https:/
/ www. fda. gov/ medical- devices/ postmarket- requirements- devices/ quality- management- system- regulation- qmsr (read 6 November 2026) - 2Medical Devices; Quality System Regulation Amendments, final rule, FDA, 89 FR 7496, 2 February 2024, including the responses to comments 19 and 31. https:/
/ www. federalregister. gov/ documents/ 2024/ 02/ 02/ 2024- 01709/ medical- devices- quality- system- regulation- amendments (read 6 November 2026) - 3Quality Management System Regulation, Frequently Asked Questions, FDA, questions 5, 6, 7, 8, 9 and 13. https:/
/ www. fda. gov/ medical- devices/ quality- management- system- regulation- qmsr/ quality- management- system- regulation- frequently- asked- questions (read 6 November 2026) - 421 CFR Part 820, Quality Management System Regulation, sections 820.1, 820.3, 820.7, 820.10, 820.35 and 820.45, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820 (read 6 November 2026) - 521 CFR Part 820, Quality System Regulation, as in force on 1 February 2026, sections 820.30 and 820.180 to 820.186, eCFR. https:/
/ www. ecfr. gov/ on/ 2026- 02- 01/ title- 21/ chapter- I/ subchapter- H/ part- 820 (read 6 November 2026)
AQuestions and answers
When did the QMSR take effect?
On 2 February 2026, two years after FDA published the final rule on 2 February 2024. FDA enforces the QMSR from that date, and investigators may review records created before it.
Do you need ISO 13485 certification to comply with the QMSR?
No. FDA does not require or issue ISO 13485 certificates, and holding one does not exempt a manufacturer from FDA inspection. FDA inspects against its own regulation, scheduled by risk, while certification bodies audit conformance to the standard.
Is the design history file still required?
The term is gone from the regulation, but the content is not. FDA points to clause 7.3.10 of ISO 13485, which requires a design and development file that contains or references the records needed to show compliance with the design and development requirements, including the design and development plan and procedures.
Can FDA inspectors now see management review and internal audit reports?
Yes. The QSR exempted management review, quality audit and supplier audit reports from FDA review. The QMSR does not keep that exception, so these reports should be ready for inspection like other quality records.
Does the QMSR apply to component manufacturers?
No. It applies to manufacturers of finished devices and accessories, including contract sterilisers, relabellers, repackers and specification developers. Component makers are encouraged to apply its provisions where appropriate.
What happens when ISO 13485 is revised?
The QMSR incorporates the 2016 edition. FDA has said it will evaluate any revision and, if appropriate, amend the QMSR through rulemaking, so a new edition does not apply automatically.