1What changed on 2 February 2026.
FDA’s final rule, published on 2 February 2024, amended 21 CFR Part 820 to align it with ISO 13485, effective 2 February 2026.¹ The amended regulation is titled the Quality Management System Regulation (QMSR). It incorporates by reference ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes, third edition of 1 March 2016, and the terms and definitions in Clause 3 of ISO 9000:2015.² A manufacturer must document a quality management system that complies with the applicable requirements of ISO 13485 and with the other applicable requirements of Part 820.³
FDA’s view is that the requirements of ISO 13485 are, “when taken in totality, substantially similar” to those of the former Quality System regulation.⁴ On the same date FDA stopped using the Quality System Inspection Technique (QSIT) and began inspecting under Compliance Program 7382.850.⁴ ISO last reviewed and confirmed ISO 13485:2016 in 2025, so that edition remains current.⁵ If ISO revises it, FDA will evaluate the changes and, if appropriate, amend the QMSR through rulemaking.⁴
2How the two compare.
| ISO 13485:2016 | 21 CFR Part 820 (QMSR) | |
|---|---|---|
| What it is | An international standard for medical device quality management systems, from ISO technical committee ISO/TC 210.⁵ ISO first issued it in 1996 as a voluntary consensus standard.¹ | A US regulation setting device CGMP. Failing an applicable requirement renders a device adulterated under section 501(h) of the FD&C Act.⁶³ |
| Who it is for | Manufacturers and suppliers of medical devices.⁵ | Manufacturers of finished devices for human use made in the US or offered for import, including contract sterilisers, relabellers, specification developers and initial distributors of foreign entities. Component manufacturers are not subject to it.⁶ |
| How conformity is checked | Third-party audits, which FDA describes as annual on a three-year plan.⁴ | FDA inspection, scheduled by risk. FDA does not require or issue ISO 13485 certificates, and a certificate does not exempt a manufacturer from inspection.⁴ |
| Definitions | ISO 13485, and Clause 3 of ISO 9000.⁷ | The same, except that the FD&C Act’s definitions supersede them. “Organization” means manufacturer, and “safety and performance” means safety and effectiveness.⁷ |
| Design and development | Clause 7.3 and its subclauses.³ | Required for class II and class III devices, class I devices automated with computer software and five listed class I devices.³ |
Where a clause of ISO 13485 conflicts with the FD&C Act or its implementing regulations, the Act and the regulations control.⁶
3What Part 820 adds to ISO 13485.
The QMSR keeps ISO 13485’s structure and adds US requirements at named clauses.³
- Clause 7.5.8, Identification: a documented system to assign unique device identification under 21 CFR Part 830.
- Clause 7.5.9.1, Traceability: procedures under Part 821, where it applies.
- Clause 8.2.3, Reporting to regulatory authorities: notify FDA of complaints that meet the medical device reporting criteria of Part 803.
- Clauses 7.2.3, 8.2.3 and 8.3.3: advisory notices handled under Part 806.
- Clause 7.5.9.2, Traceability for implantable devices: also required for devices that support or sustain life.
Section 820.35 adds content to records. Complaints reported under Part 803, or investigated, must record the device name, the date received, any UDI or UPC, the complainant’s name, address and phone number, the nature and details of the complaint, any correction or corrective action, and any reply. Servicing records must show the device, its identification, the date, who serviced it, the service performed and any test and inspection data, and the UDI must be recorded for each device or batch.⁸ Section 820.45 requires documented labelling and packaging controls: examination for accuracy before release or storage, covering the UDI, expiration date, storage and handling instructions, documented release of labelling and inspection before use to prevent mix-ups.⁹
4What went away, and what FDA can now see.
The QMSR does not keep the former record types: the quality system record, device master record (DMR), design history file (DHF) and device history record (DHR). FDA’s view is that their contents are largely required by ISO 13485 Clause 4.2 and Clause 7. The medical device file under Clause 4.2.3 contains or references the current procedures and specifications, the design and development file under Clause 7.3.10 contains or references the design records, and much of the former DHR belongs in the record for each device or batch under Clause 7.5.1.¹
The exceptions in the former 820.180(c) are gone too. FDA can now inspect management review, quality audit and supplier audit reports.⁴ Investigators may review records created before 2 February 2026, and FDA says a manufacturer may find a comparative analysis useful to show that older documents and records meet the QMSR.⁴ FDA also notes that, by incorporating ISO 13485, the regulation “now specifically requires risk management”.¹⁰
5Certification, MDSAP and inspections.
FDA will not rely on ISO 13485 certificates for its oversight. It cannot be sure that independent ISO 13485 audits cover its other device requirements, such as Parts 803, 806, 821 and 830, and it does not oversee auditing organisations outside the Medical Device Single Audit Program (MDSAP).¹ MDSAP remains voluntary. FDA uses MDSAP audit reports, not certificates, and may accept them in place of routine surveillance inspections.¹⁴
For approvals, FDA reads ISO 13485’s “approved” as requiring a signature and date, and accepts electronic signature methods that meet its electronic signature requirements; its focus is “whether the substance of the requirements is met”.¹ ISO 13485:2016 and Clause 3 of ISO 9000:2015 can be read in read-only form through ANSI’s incorporated-
6How it runs in Seal.
Seal’s medical device blueprint records traceability as the work is done: protocols are created against requirements, results attach to executions, and risk controls, technical documentation and complaints link to the same records. It keeps the contents of the former DHF, DMR and DHR as connected records, whichever names your procedures use, and complaints are entered as structured data. Electronic device history records build the as-built record for each lot or serial while manufacturing happens, with labels rendered from the approved template and controlled product and UDI data.
The blueprint’s advice is to map the configured quality system to the QMSR, ISO 13485 and the other requirements that apply to your device and operation, because the presence of a workflow does not itself demonstrate conformity. Deviations, CAPA, change control, documents, training, audits, suppliers, complaints and risk run in the QMS.
References
- 1Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496, FDA, 2 February 2024. https:/
/ www. federalregister. gov/ documents/ 2024/ 02/ 02/ 2024- 01709/ medical- devices- quality- system- regulation- amendments (read 6 November 2026) - 221 CFR 820.7, Incorporation by reference, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- A/ section- 820. 7 (read 6 November 2026) - 321 CFR 820.10, Requirements for a quality management system, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- A/ section- 820. 10 (read 6 November 2026) - 4Quality Management System Regulation, Frequently Asked Questions, FDA, November 2026. https:/
/ www. fda. gov/ medical- devices/ quality- management- system- regulation- qmsr/ quality- management- system- regulation- frequently- asked- questions (read 6 November 2026) - 5ISO 13485:2016, Medical devices, Quality management systems, Requirements for regulatory purposes, ISO. https:/
/ www. iso. org/ standard/ 59752. html (read 6 November 2026) - 621 CFR 820.1, Scope, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- A/ section- 820. 1 (read 6 November 2026) - 721 CFR 820.3, Definitions, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- A/ section- 820. 3 (read 6 November 2026) - 821 CFR 820.35, Control of records, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- B/ section- 820. 35 (read 6 November 2026) - 921 CFR 820.45, Device labeling and packaging controls, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- H/ part- 820/ subpart- B/ section- 820. 45 (read 6 November 2026) - 10Quality Management System Regulation (QMSR), FDA, 2 February 2026. https:/
/ www. fda. gov/ medical- devices/ postmarket- requirements- devices/ quality- management- system- regulation- qmsr (read 6 November 2026)
AQuestions and answers
Do I need ISO 13485 certification to sell medical devices in the US?
No. FDA does not require ISO 13485 certification, does not issue certificates and does not accept one in place of an inspection. It inspects against the QMSR, which includes ISO 13485’s requirements. Other regulators may require certification for their own markets.
Are the design history file, device master record and device history record still required?
Not under those names. The QMSR dropped the record types, but FDA expects their contents in the records ISO 13485 requires: the design and development file, the medical device file, and the record kept for each device or batch.
Can FDA inspectors now read our management review and internal audit reports?
Yes. The QMSR did not keep the exceptions in the former 820.180(c), so FDA can inspect management review, quality audit and supplier audit reports. FDA reasons that manufacturers already provide these records to other regulators.
Does Part 820 apply to component suppliers?
No. Manufacturers of components or parts of finished devices are not subject to it, though FDA encourages them to consider its provisions. The finished device manufacturer remains responsible for assessing whether its suppliers can provide acceptable product.
What replaced the Quality System Inspection Technique?
From 2 February 2026 FDA inspects device manufacturers under the updated Compliance Program 7382.850, Inspection of Medical Device Manufacturers. It stopped using QSIT and the older compliance programmes 7382.845 and 7383.001 on that date.
Can approvals under the QMSR be electronic?
Yes. FDA reads an approval under ISO 13485 as a signature and date, and accepts electronic signatures that meet its electronic signature requirements. FDA says its focus is whether the substance of the requirement is met, not whether the record is on paper.