QMSR and ISO 13485: What Device Manufacturers Need to Know in 2026

What Changed: QSR to QMSR

For nearly three decades, medical device manufacturers selling in the U.S. market were subject to FDA's Quality System Regulation (QSR) under 21 CFR Part 820, originally published in 1996. While the QSR shared conceptual similarities with ISO 13485, the two frameworks were not identical, forcing device manufacturers to maintain dual quality systems — one for FDA compliance and another for international markets.

On February 2, 2026, the Quality Management System Regulation (QMSR) took effect, completing a transition that FDA finalized in January 2025. The QMSR fundamentally changes 21 CFR Part 820 by:

• Incorporating ISO 13485:2016 by reference — the international standard for medical device quality management systems is now the foundation of the U.S. regulation. Manufacturers must comply with ISO 13485:2016 as their baseline quality system.
• Removing duplicative QSR requirements — provisions in the old Part 820 that overlapped with ISO 13485 have been removed to eliminate redundancy.
• Retaining FDA-specific requirements — certain requirements unique to U.S. law (such as complaint handling timelines, MDR linkages, and specific record-keeping obligations) remain in Part 820 as supplements to ISO 13485.
• Enabling a single quality system — manufacturers can now use a single ISO 13485-based quality system to comply with both FDA requirements and international requirements, reducing the compliance burden significantly.

ISO 13485:2016 — What It Covers

ISO 13485:2016, "Medical devices — Quality management systems — Requirements for regulatory purposes," is an international standard published by the International Organization for Standardization (ISO). It specifies requirements for a quality management system (QMS) applicable to organizations involved in the design, development, production, installation, and servicing of medical devices and related services.

The standard is organized into eight clauses:

1. Scope — defines the applicability of the standard
2. Normative references — references to other standards that are essential for application
3. Terms and definitions — key terms used throughout
4. Quality management system — documentation requirements, quality manual, control of documents and records
5. Management responsibility — management commitment, quality policy, planning, responsibility, authority, communication, and management review
6. Resource management — human resources, infrastructure, work environment, and contamination control
7. Product realization — planning, customer-related processes, design and development, purchasing, production and service provision, and control of monitoring and measuring equipment
8. Measurement, analysis and improvement — monitoring and measurement, control of nonconforming product, analysis of data, and corrective/preventive action (CAPA)

For manufacturers already certified to ISO 13485:2016 by an accredited certification body, the transition to QMSR is relatively straightforward. Your existing ISO 13485 QMS provides the foundation — you need to layer on the FDA-specific supplemental requirements.

FDA-Specific Supplemental Requirements Under QMSR

While QMSR incorporates ISO 13485:2016 as the baseline, FDA retained several supplemental requirements in the revised 21 CFR Part 820 that go beyond or differ from the international standard:

• Design controls for certain Class I devices — ISO 13485 allows design control exclusions. Under QMSR, FDA maintains requirements for design controls for specific Class I devices that are subject to design controls under 21 CFR §820.30 (e.g., software-driven Class I devices).
• Complaint handling linkages — FDA requires that complaint handling processes specifically address Medical Device Reporting (MDR) requirements under 21 CFR Part 803. Any complaint that meets MDR criteria must trigger the MDR process.
• CAPA requirements — while ISO 13485 includes corrective and preventive action requirements, FDA's supplemental provisions emphasize certain aspects, including linkages to MDR reporting and product recalls.
• Unique Device Identification (UDI) — QMSR does not alter UDI requirements under 21 CFR Part 830, which remain in effect as a separate regulation.
• Records and documentation — FDA's supplemental requirements specify retention periods and formats for certain records that may differ from or supplement ISO 13485 requirements.
• Establishment registration and device listing — QMSR does not change the requirement for device establishments to register with FDA under 21 CFR Part 807 and list their devices. Foreign establishments must still designate a U.S. Agent.

Compliance Timeline and Transition

The QMSR transition follows this timeline:

• January 31, 2025 — QMSR final rule published in the Federal Register
• February 2, 2026 — QMSR effective date. From this date forward, FDA inspections of device manufacturers assess compliance against the QMSR framework (ISO 13485:2016 + FDA supplemental requirements)
• February 2, 2026 onward — the legacy QSR (old Part 820 framework) is no longer the applicable regulation. Manufacturers must demonstrate compliance with the new framework.

There is no "grace period" after February 2, 2026. FDA expects manufacturers to have completed their transition by the effective date. However, FDA has acknowledged that the transition requires substantial effort and has published guidance documents to assist manufacturers.

For manufacturers who were not previously ISO 13485 certified, the transition requires more significant effort:

• Gap analysis — compare your current QSR-based quality system against ISO 13485:2016 requirements and identify areas that need updating
• Documentation updates — revise quality manual, procedures, and work instructions to align with ISO 13485 structure and terminology
• Training — ensure personnel understand the new framework, including any process or documentation changes
• Internal audits — conduct audits against the QMSR requirements to verify readiness before the effective date
• Consider ISO 13485 certification — while FDA does not require third-party ISO 13485 certification, obtaining it provides additional assurance and may facilitate business with international customers

FDA Inspections Under QMSR

FDA inspections of device manufacturers after February 2, 2026 use the QMSR framework as the compliance standard. Key changes in the inspection approach include:

• ISO 13485 terminology — investigators will use ISO 13485 concepts and terminology during inspections. Manufacturers should ensure their quality system documentation uses consistent terminology.
• Supplemental requirements emphasis — while ISO 13485 is the baseline, investigators will specifically verify compliance with FDA's supplemental requirements (complaint/MDR linkage, CAPA, etc.).
• Existing inspection approaches continue — FDA's Quality System Inspection Technique (QSIT) and Compliance Program Guidance are being updated to reflect QMSR, but the fundamental inspection methodology (focusing on management, design, CAPA, production) continues.
• Foreign inspections — FDA continues to inspect foreign device manufacturing facilities. Foreign manufacturers should ensure their QMSR transition is complete and that their U.S. Agent is current before an inspection visit.

Inspection observations (Form 483s) issued after February 2, 2026 will cite the revised 21 CFR Part 820 provisions and/or specific ISO 13485 clauses. Manufacturers should familiarize their quality and regulatory teams with the new citation framework.

What Device Manufacturers Should Do Now

With QMSR now in effect, device manufacturers should take these immediate steps:

1. Verify ISO 13485 alignment — if you're already ISO 13485 certified, review your certificate status and ensure your QMS documentation reflects the current standard (2016 version).
2. Address FDA supplemental requirements — review the revised 21 CFR Part 820 to identify the FDA-specific additions and ensure your quality system addresses them.
3. Update procedures and training — revise SOPs, work instructions, and training materials to reflect the QMSR framework. Train quality and production staff on any changes.
4. Conduct an internal audit — audit your quality system against the combined QMSR requirements (ISO 13485 + FDA supplements) to identify any remaining gaps.
5. Maintain FDA registration — ensure your device establishment registration is current under 21 CFR Part 807. Foreign establishments must have a valid U.S. Agent and must renew registration annually (October 1 – December 31) with payment of the MDUFA device establishment fee.
6. Monitor FDA guidance — FDA is publishing additional guidance documents to support the QMSR transition. Check FDA's guidance database regularly for updates.

The QMSR transition is a significant regulatory change, but it ultimately benefits device manufacturers by reducing the compliance burden of maintaining dual quality systems. For foreign manufacturers, the alignment with ISO 13485 is particularly welcome — most already maintain ISO 13485 certification for international market access.