FDA QMSR and ISO 13485: What 21 CFR Part 820 Now Requires
Summary:
The Quality Management System Regulation (QMSR) is the revised 21 CFR part 820, in force since 2 February 2026. It incorporates ISO 13485:2016 by reference and supplements it with a small set of FDA-specific requirements: definitional overrides in § 820.3, four cross-references to other FDA regulations in § 820.10(b), the design and development scope in § 820.10(c), traceability for life-supporting devices in § 820.10(d), record content in § 820.35, and labeling and packaging controls in § 820.45. Everything else in the part is now marked reserved. FDA's own position is that the former Quality System Regulation and ISO 13485 are substantially similar, so the requirements themselves have largely carried over. What changed is how they are expressed and how FDA cites them.
What the QMSR Actually Is
The QMSR is the rewritten form of part 820. Part 820 remains the source, in the Code of Federal Regulations, of current good manufacturing practice requirements for finished devices, and it still governs design, manufacture, packaging, labeling, storage, installation and servicing.
The most useful way to see what happened is to look at the length of the part. It now runs from § 820.1 to § 820.45, and most of that range is empty. Section 820.5 is reserved. Sections 820.20 through 820.30 are reserved. Section 820.40 is reserved. Subparts C through O, which once carried design controls, document controls, purchasing controls, process validation, corrective and preventive action and related requirements, are all reserved.
Six sections contain the entire regulation: scope, definitions, incorporation by reference, the quality management system requirement, control of records, and device labeling and packaging controls. FDA replaced most of its own provisions with a reference to ISO 13485:2016.
Section 820.7 does this by incorporating ISO 13485:2016 and clause 3 of ISO 9000:2015 with the approval of the Director of the Federal Register. Incorporation by reference gives the standard the force of regulation. Failure to comply with an applicable ISO 13485 clause renders a device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act, as § 820.10(e) states directly.
The final rule was published on 2 February 2024 at 89 FR 7496, with the codified amendments beginning at 89 FR 7523, and corrected on 15 October 2024 at 89 FR 82945. It took effect two years after publication, on 2 February 2026. FDA estimated the change would produce annualised net cost savings of around $532 million at a 7 percent discount rate. FDA based the estimate on the fact that establishments complying with both the former Quality System Regulation and ISO 13485 had been meeting two substantially similar sets of requirements.
Because the standard is incorporated by reference, it can be read at no cost through the ANSI incorporation-by-reference portal. This access matters to a firm that needs the text before purchasing a licence.
Where FDA Requirements Go Beyond ISO 13485
A quality management system that conforms to ISO 13485:2016 supplies most of what part 820 requires, because the standard is incorporated into the regulation. A certificate from a registrar is a separate matter: FDA does not require certification, does not rely on it for regulatory oversight, and does not accept it as a substitute for an inspection. FDA states directly in the final rule that compliance with ISO 13485 alone does not fully satisfy the QMSR. Part 820 adds requirements in six places. The list below covers the structural additions; § 820.10(b) names other title 21 requirements as examples rather than as an exhaustive list.
Definitions that override the standard. Section 820.3 applies the ISO 13485 and ISO 9000 definitions to the part, then overrides several of them. The definitions of device and labeling in sections 201(h) and 201(m) of the Federal Food, Drug, and Cosmetic Act supersede the standard's definitions of medical device and labelling. "Organization" has the meaning of "manufacturer" as defined in part 820. Section 820.3 also adds terms the standard does not use, including batch, lot, component, finished device and remanufacturer, and it defines rework by reference to the medical device file.
This matters more than a definitions section usually does, because the FD&C Act meaning of labeling is considerably wider than the standard's, and that broader meaning applies to every clause that mentions labeling.Four links to other FDA regulations. Section 820.10(b) requires compliance with the other applicable regulatory requirements in title 21, including, but not limited to, four requirements that it links to specific clauses of the standard. FDA has stated that the list is not comprehensive and that a manufacturer remains responsible for identifying every applicable requirement, whether or not § 820.10 names it:
clause 7.5.8, Identification, requires a documented system for assigning unique device identification under part 830
clause 7.5.9.1, Traceability, requires documented traceability procedures under part 821, where applicable
clause 8.2.3, Reporting to regulatory authorities, requires notification to FDA of complaints meeting the reporting criteria of part 803
clauses 7.2.3, 8.2.3 and 8.3.3 require advisory notices to be handled under part 806
The design and development scope. Section 820.10(c) applies clause 7.3 and its subclauses to class II and class III devices, and to two categories of class I devices: those automated with computer software and the five device types named in a table. The five are the tracheobronchial suction catheter (§ 868.6810), the non-powdered surgeon's glove (§ 878.4460), the protective restraint (§ 880.6760), the manual radionuclide applicator system (§ 892.5650) and the radionuclide teletherapy source (§ 892.5740).
Traceability for life-supporting devices. Section 820.10(d) applies clause 7.5.9.2, traceability for implantable devices, to devices that support or sustain life and whose failure in normal use could reasonably be expected to cause significant injury.
Record content. Section 820.35 supplements clause 4.2.5 and specifies what certain records must contain. For complaints that fall under part 803, complaints the manufacturer decides to investigate, and complaints it investigates regardless of those requirements, the record must contain the device name, the date received, any UDI or UPC and other device identification, the complainant's name, address and phone number, the nature and details of the complaint, any correction or corrective action, and any reply. For servicing activities, the record must contain the device name, any UDI or UPC, the date of service, the individuals who performed it, the service performed, and any test and inspection data. The UDI must be recorded for each device or batch of devices, subject to the exemptions in part 830.
Section 820.35(a) also allows a manufacturer to skip an investigation when one has already been performed for a similar complaint, provided the justification is documented.Labeling and packaging controls. Section 820.45 supplements clause 7.5.1 and requires documented procedures for labeling and packaging integrity, inspection, storage and operations. Before release or storage, labeling and packaging must be examined for accuracy. The examination must cover the correct UDI or UPC and other device identification, expiration date, storage instructions, handling instructions and any additional processing instructions. The release of labeling for use must be documented under clause 4.2.5. Labeling and packaging operations must prevent mix-ups; this includes inspection before use against the medical device file and documentation of the results.
The codified section requires documented examination and documented inspection, and leaves the method to the manufacturer. FDA set out a firmer expectation in the preamble to the final rule, where it addressed automated label readers: an automated check should be followed by human oversight, and a designated individual should examine at least a representative sample. A manufacturer relying on automated label verification alone would therefore be acting contrary to FDA's stated expectation, even though the codified text does not spell the method out.
How Part 820 Connects to the Rest of Title 21
Part 820 covers the quality management system and nothing else. Medical device reporting is governed by part 803. Reports of corrections and removals are addressed in part 806. Device tracking is governed by part 821. Unique device identification is addressed in part 830. Device classification is governed by part 860. Section 820.1(b) says plainly that the QMSR supplements the regulations in other parts of the chapter.
These parts are still tied into the quality management system through § 820.10(b), which is what makes the boundary worth understanding rather than ignoring. A manufacturer's obligation under part 803 comes from part 803. What § 820.10(b) adds is that the quality management system must be built so the obligation is met: clause 8.2.3 is the hook, and the reporting decision must be integrated into the complaint-handling process.
Part 820 can be read quickly. Determining what a specific manufacturer must change takes longer, because the answer depends on the device, the markets it is sold into, the state of the existing quality system and which other parts of title 21 apply.
The Requirements Are Substantially Similar
FDA's stated position on the QMSR is that the former Quality System Regulation and ISO 13485 are substantially similar, and that the change does not fundamentally alter what a manufacturer has to do. FDA's reasoning is that almost all requirements in the old regulation corresponded to requirements in ISO 13485, so the change was made for regulatory simplicity and harmonisation rather than to increase the substantive requirements. How much work a given firm faces still depends on how its existing system was documented.
Three things did change in ways that show up in practice.
The record-inspection exemptions have been removed. The former § 820.180(c) prevented FDA investigators from reviewing management review reports, internal quality audit reports and supplier audit reports during a routine inspection. That provision has no counterpart in the current part. Management-review and internal-audit records are now open to inspection like other records.
Risk-based controls are more explicit throughout the standard than they were in the old regulation, where risk was concentrated mainly in design controls. FDA has been clear that this reflects how the requirements are expressed rather than a change in regulatory philosophy, so a manufacturer should expect its existing risk management activity to be applied across the entire system.
The citation format changed. FDA now cites findings by reference to ISO 13485 clause numbers, as the early public warning letters below show.
The Deleted Terminology
FDA removed the design history file, the device master record, the device history record and the quality system record as defined regulatory terms. None of the four appears in the current part 820. The medical device file, which ISO 13485 defines in clause 4.2.3, is now the term used in the regulation, and § 820.45(c) refers to it directly.
Removing a definition is not the same as requiring a rename. FDA declined to set out one-to-one mappings between the old terms and the ISO files, and nothing in the regulation requires a manufacturer to rename internal folders, procedures or record types. A firm that finds "DHF" a useful internal label can keep it, as long as the file contains what clause 7.3.10 requires.
FDA has described a comparative analysis between legacy records and their ISO equivalents as potentially useful, particularly for older records. The analysis is optional and provides no protection against inspectional observations.
How FDA Inspects Under the QMSR
The Quality System Inspection Technique has been retired. Device establishment inspections now run under compliance program 7382.850, which organises the inspection around six QMS areas and four Other Applicable FDA Requirements.
The six QMS areas are management oversight, design and development, measurement, analysis and improvement, change control, outsourcing and purchasing, and production and service provision. The four Other Applicable FDA Requirements are medical device reporting, reports of corrections and removals, medical device tracking, and unique device identification, and these are the same four regulations cross-referenced in § 820.10(b).
The programme sets two inspection models. Under Model 1, used for routine surveillance, an investigator evaluates at least one element from each QMS area and each Other Applicable FDA Requirement. Model 2, used for baseline and preapproval inspections, has a broader set of specified minimum elements.
A remote regulatory assessment is a separate instrument. Section 704(a)(4) of the FD&C Act, which the Food and Drug Omnibus Reform Act amended to cover device establishments, gives FDA authority to request records in advance of or in lieu of an inspection. The final rule states directly that the QMSR left FDA's inspectional authority under section 704 unchanged. An assessment conducted under that authority is expressly not an inspection: FDA issues no Form 482 and no Form 483 for the assessment itself. Information gathered may support a later inspection or enforcement action, so a records request should be treated seriously. The assessment alone does not produce an inspection classification.
What the Early Warning Letters Show
Two warning letters published since the effective date show how FDA cites the QMSR in enforcement. Both resulted from inspections that began during the regulation's first week in force. Further inspections, Form 483 observations and other actions from the same period may not yet be public.
Koven Technologies was inspected from 2 to 6 February 2026 and received a warning letter dated 21 July 2026. Three of the four violations are cited to ISO 13485:2016 clauses: clause 7.3.9 for failing to control design and development changes, where the indications for use of a cleared Doppler had been extended to fetal applications without documented design change review or an assessment of whether a new 510(k) was needed; clause 7.1 for risk management in product realisation, where the risk files for two devices contained no evaluation of risks to the fetus; and clause 7.4.1 for supplier evaluation criteria, where no site assessment had been performed on a contract manufacturer that the firm's own procedure classed as critical.
The fourth violation is cited to § 820.35(a). Of 29 returned goods authorisation forms reviewed, 13 reported device failures, and none of those 13 had been evaluated as a complaint under the firm's own complaint procedure.Linemaster Switch Corporation was inspected from 4 February to 6 March 2026 and received a warning letter dated 27 May 2026. All five violations are cited to ISO 13485:2016 clauses: 8.3.4 for undocumented rework, 7.1 for risk management in product realisation, 8.5.2 for corrective action, 6.4.1 for work environment controls, and 7.6 for validation of software used in monitoring and measurement.
Three things are worth taking from these letters. FDA cites ISO clause numbers in warning letters, so a quality system that maps procedures to clause references is easier to defend. Clause 7.1, risk management in product realisation, is cited as the second violation in each letter, which is consistent with FDA's position that risk-based controls are now explicit across the system. And both letters include failures to implement procedures the firm already had. Linemaster also cites missing or inadequate procedures for risk management and work-environment controls.
Premarket Submissions for PMA and HDE
FDA issued draft guidance in October 2025 on the quality management system information recommended in premarket approval and humanitarian device exemption submissions. The guidance remains in draft form and is marked "Not for Implementation", so it is not binding in its current form.
The underlying obligation is older than the guidance. An application has long had to describe the methods, facilities and controls used in manufacture, and insufficient detail on those points is a statutory ground for withholding approval under sections 515(c)(1)(C), 515(d)(2)(C) and 520(m) of the Federal Food, Drug, and Cosmetic Act together with 21 CFR 814.20, 814.45, 814.104 and 814.118. The draft guidance sets out the information FDA considers useful in meeting that requirement under the QMSR and organises the recommended information by ISO 13485 clause. It does not create a new mandatory artefact.
Manufacturers preparing a premarket approval or humanitarian device exemption submission should treat the guidance as an indication of what a reviewer will look for and should confirm its status before relying on it, since draft guidance can change substantially before it is finalised.
What a Manufacturer Should Do Now
The QMSR has been in force since February 2026 and warning letters citing it are now public, so the useful work at this point is verification rather than preparation.
The short list is as follows: confirm the quality system documentation reflects the current ISO 13485 clause structure well enough that a procedure can be produced in response to a clause reference; check the record content requirements in § 820.35 against the fields the complaint and servicing records actually capture; check labeling and packaging procedures against the five specific items § 820.45(a) requires to be examined; confirm the § 820.10(b) links are integrated into the quality system; and confirm that management review and internal audit records are in a state fit for inspection, now that the exemption is gone.
QMLogic supports this work through gap analysis against 21 CFR part 820, ISO 13485 quality management system consulting and medical device audit preparation.
We build eQMS systems on Microsoft Power Platform for medical device companies. In a transition of this kind, most of the work lies in configuring record structures and procedure references in a system that a quality team can use without a lengthy adoption period; reading the regulation takes less time.
Related Reading
Frequently Asked Questions
Is the QMSR the same thing as 21 CFR part 820?
Yes. The QMSR is the revised part 820, in force since 2 February 2026. It replaced the former Quality System Regulation, which occupied the same part of the Code of Federal Regulations.
Does ISO 13485 certification make a manufacturer compliant with the QMSR?
No. FDA states in the final rule that compliance with ISO 13485 alone does not fully satisfy the QMSR, and separately that certification is not required, is not relied on for regulatory oversight and is not a substitute for an inspection. A quality management system that conforms to ISO 13485:2016 does supply most of what part 820 requires, since the standard is incorporated by reference. Part 820 then adds definitional overrides in § 820.3, cross-references to other FDA regulations in § 820.10(b), the design and development scope in § 820.10(c), traceability for life-supporting devices in § 820.10(d), record content in § 820.35, and labeling and packaging controls in § 820.45. Section 820.10(b) names those other regulations as examples rather than as an exhaustive list.
What does ISO 13485 not cover that FDA requires?
ISO 13485 addresses all four subjects in general terms: identification at clause 7.5.8, traceability at clause 7.5.9.1, reporting to regulatory authorities at clause 8.2.3, and advisory notices at clauses 7.2.3, 8.2.3 and 8.3.3. The specific United States obligations sit in other regulations: medical device reporting in part 803, corrections and removals in part 806, device tracking in part 821 and unique device identification in part 830. Section 820.10(b) ties each of those to the relevant clause, so the quality management system has to be built to meet them.
Which devices are subject to design and development controls under the QMSR?
Class II and class III devices, class I devices automated with computer software, and five named class I device types: the tracheobronchial suction catheter, the non-powdered surgeon's glove, the protective restraint, the manual radionuclide applicator system and the radionuclide teletherapy source.
Can FDA inspect internal audit and management review records under the QMSR?
Yes. The former § 820.180(c), which exempted management review reports, internal quality audit reports and supplier audit reports from routine inspection, has no counterpart in the current part 820.
Do the DHF, DMR and DHR still exist?
Not as defined regulatory terms. FDA removed all four legacy record definitions, including the quality system record, and the regulation now uses the medical device file from clause 4.2.3 of ISO 13485. Manufacturers are free to keep legacy internal names, provided the files hold what the applicable clauses require.
How does FDA inspect under the QMSR?
Under compliance program 7382.850, which replaced the Quality System Inspection Technique. Inspections are organised around six QMS areas and four Other Applicable FDA Requirements, with a Model 1 scope for routine surveillance and a broader Model 2 scope for baseline and preapproval inspections.
Is a remote regulatory assessment an inspection?
No. Section 704(a)(4) of the FD&C Act allows FDA to request records in advance of or in lieu of an inspection, and no Form 482 or Form 483 is issued for the assessment itself. The information can support a later inspection or enforcement action.
