FDA QMSR (21 CFR Part 820): What Changed and How to Comply

The FDA’s Quality Management System Regulation at 21 CFR Part 820 takes effect on February 2, 2026, and it replaces the old Quality System Regulation by writing the international standard ISO 13485:2016 directly into federal law.¹ If your company designs, builds, packages, labels, stores, installs, or services a finished medical device sold in the United States, you now have to run a quality system that satisfies both ISO 13485 and a set of FDA-specific supplemental requirements that sit on top of it. One system can meet domestic and international expectations at once, but the transition also brings new inspection access to records that used to be off-limits, a rewritten vocabulary, and tighter risk management obligations that run across the full product lifecycle.

Who Has to Comply

The scope is broad. Any entity engaged in the design, manufacture, packaging, labeling, storage, installation, or servicing of a finished device must maintain a compliant quality management system, and that reach extends to contract sterilizers, repackagers, relabelers, remanufacturers, specification developers, and initial distributors of foreign manufacturers that perform any of those functions.² Companies only need to comply with the requirements that apply to what they actually do.

Class I devices get a partial exemption. Manufacturers of most Class I devices are not required to follow the design and development requirements in Clause 7.3 of ISO 13485. The exceptions are Class I devices automated with computer software and a short list of specific devices, including tracheobronchial suction catheters, surgeon’s non-powdered gloves, protective restraints, manual radionuclide applicator systems, and radionuclide teletherapy sources. All Class II and Class III device manufacturers must follow every design control requirement.³

What Changed From the Old QSR

The FDA said the QMSR requirements are, in totality, substantially similar to the old QSR requirements, but the transition reorganizes and renames enough that treating it as a light update is a mistake.⁴ Four shifts matter most.

The Device Master Record is gone as a term. Under ISO 13485 Clause 4.2.3, manufacturers now maintain a Medical Device File that contains or references the current procedures and specifications used on the manufacturing floor. Product specifications, manufacturing procedures, and servicing requirements that used to live in the DMR now belong in the MDF.⁵

The definitions have been overhauled. The old Part 820 vocabulary is largely replaced by ISO 13485 and ISO 9000:2015 terminology, giving U.S. manufacturers a shared dictionary with international regulators.¹

Management review and internal audit records are no longer shielded. Under the old QSR, Section 820.180(c) kept management review reports, internal quality audit reports, and supplier audit reports away from routine FDA inspection. That exception no longer exists. Inspectors can now review these records, and the FDA expects them to be readily available.⁶ If your management reviews have been perfunctory because you assumed they would never face scrutiny, that assumption no longer holds.

Most of the substantive subparts of the old QSR — purchasing controls, production controls, acceptance activities, statistical techniques — are now governed by the corresponding ISO 13485 clause rather than by standalone FDA regulatory text.⁴ You need the actual standard on hand. It can be purchased through the American National Standards Institute or the International Organization for Standardization, and the QMSR refers to its clauses constantly.

How ISO 13485 Fits Into Federal Law

The FDA used a legal mechanism called incorporation by reference to make ISO 13485:2016 enforceable as part of the Code of Federal Regulations. The regulation specifically adopts the third edition of the standard, dated March 1, 2016, along with Clause 3 of ISO 9000:2015 for quality management vocabulary and definitions.⁷ Because the full text of these standards is binding law, failing to follow them is not just a quality lapse. It makes the device legally adulterated under Section 501(h) of the Federal Food, Drug, and Cosmetic Act.⁸

One hierarchy matters. If any clause of ISO 13485 conflicts with the FD&C Act or its implementing regulations, the federal statute wins.¹ The regulation also replaces certain ISO terms with FDA-specific ones. Wherever ISO 13485 says “organization,” the QMSR reads that as “manufacturer.” The five statutory definitions from Section 201 of the FD&C Act, including “device” and “labeling,” override any corresponding ISO 13485 definitions.³

Supplemental FDA Requirements That Remain

The QMSR does not consist entirely of ISO 13485. Several FDA-specific requirements sit alongside the incorporated standard, and compliance with both is mandatory.

Device labeling must comply with 21 CFR Part 801, which covers items from the manufacturer’s name and address to unique device identification and principal display panel rules.⁹ Release of labeling for use and the results of labeling inspections must be documented under ISO 13485 Clause 4.2.5.³

Combination products remain subject to 21 CFR Part 4. The quality management requirements from Part 820 apply to the device constituent, and the drug, biologic, or tissue requirements from their respective parts apply at the same time. Those requirements supplement each other; they do not cancel out.¹⁰

Corrections and removals initiated to reduce a health risk or to remedy a violation that could pose a health risk must be reported to the FDA under 21 CFR Part 806. Corrections and removals that do not trigger reporting still have to be documented and retained.¹¹ Complaints meeting the adverse event criteria in Part 803 must be submitted to the FDA through Medical Device Reporting. Unique device identification follows 21 CFR Part 830, and implantable devices carry additional traceability obligations under ISO 13485 Clause 7.5.9.2.¹²

Risk Management Across the Lifecycle

The QMSR expects risk management to run through every stage of a device’s life, from initial design through post-market surveillance. It is a continuous cycle of identifying hazards, analyzing and evaluating risks, implementing controls, and monitoring whether those controls work.¹³

ISO 13485 embeds risk-based thinking across multiple clauses: a risk-based approach to controlling processes under Clause 4.1, risk management outputs feeding design inputs under Clause 7.3, supplier evaluation based on the risk posed by purchased components under Clause 7.4, software validation effort proportioned to the risk of the software’s use under Clause 7.5, and corrective actions scaled to the severity of the nonconformity under Clause 8.5.¹³ The FDA has identified ISO 14971:2019 as a useful framework for carrying out these activities.

Documentation carries the weight. The FDA recommends maintaining a centralized risk management file that pulls together the risk management plan, risk analysis reports, risk evaluation summaries, and a risk traceability matrix showing that identified hazards have been addressed, updated throughout the device lifecycle. Inspectors will evaluate whether hazards have been categorized properly and whether controls are proportionate to the level of risk.¹³

Design Controls

For Class II, Class III, and the identified Class I devices, ISO 13485 Clause 7.3 requires a full design and development process. The FDA published dedicated guidance on how to work through it, and design controls are consistently one of the most inspection-intensive areas of the quality system.¹⁴

At a high level, the process runs from a documented design plan, through defined inputs that capture functional, performance, usability, safety, regulatory, and risk requirements, to outputs that meet those inputs and specify characteristics essential for safe use. Verification confirms outputs satisfy inputs; validation confirms the device meets its intended use on representative product. Both must be completed before release. Design outputs then must be verified as suitable for manufacturing before becoming final production specifications, and every design change has to be reviewed, verified or validated as appropriate, and approved before implementation, with an evaluation of impact on constituent parts and the product itself.¹⁴ The final design output becomes the starting point for the Medical Device File, tying design controls directly to manufacturing records.⁵

Complaints, CAPA, and Nonconforming Product

Manufacturers must maintain records of the review, evaluation, and investigation of any complaint involving a possible failure of the device, its labeling, or its packaging to meet specifications. If a similar complaint has already been investigated, a new investigation is not required, but the justification for that decision has to be documented. For complaints reportable under Part 803, complaints the manufacturer determines require investigation, and complaints the manufacturer investigates anyway, the record must capture the device name, the date the complaint was received, the UDI or UPC and any other device identification, complainant contact information, the nature and details of the complaint, any correction or corrective action taken, and any reply to the complainant.¹⁵

Corrective and preventive action processes are governed by ISO 13485 Clauses 8.5.2 and 8.5.3. Manufacturers must identify the root cause of nonconformities, implement corrections proportionate to their impact, and verify that those corrections actually work. Preventive actions follow the same logic: identify potential problems, assess the risk, implement measures, and confirm they did not introduce new issues.³ CAPA is consistently one of the most scrutinized areas during FDA inspections, and weak root cause analysis is where most findings originate.

When a device or component does not meet specifications, procedures must exist to identify, document, evaluate, segregate, and dispose of it. The evaluation must include whether a deeper investigation is needed and whether the responsible parties should be notified. If the manufacturer decides to use a nonconforming product anyway, the justification and the signature of the person authorizing that use must be documented. Rework is permitted, but rework activities and reevaluation results, along with a determination of whether the rework had an adverse effect on the product, must be recorded in the Device History Record.¹⁶

Records Retention

The QMSR requires a documented quality management system that complies with every applicable clause of ISO 13485 and every supplemental FDA requirement.¹² Records must be retained for at least the lifetime of the medical device as defined by the manufacturer, or as required by applicable regulations, but never for less than two years from the date the device was released.³ For implantable devices and products with long service lives, retention stretches well beyond that floor. Records need to show a clear audit trail, be readily accessible for FDA review, and be stored so they cannot be changed without authorization.

What Inspections Look Like Now

On February 2, 2026, the FDA retired the Quality System Inspection Technique that had governed device inspections for decades. Investigators follow the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850, which is aligned with QMSR requirements.¹⁷ The older compliance programs, 7382.845 for general device manufacturer inspections and 7383.001 for PMA preapproval and postmarket inspections, are no longer in use.¹

On site, investigators evaluate whether the manufacturer has implemented a quality management system that satisfies both ISO 13485 and the supplemental FDA requirements. The biggest practical change: investigators can now review management review reports, internal quality audit reports, and supplier audit reports. Section 820.180(c) restricted access to those records under the old QSR. That restriction is gone.⁶

If the investigator observes conditions that may violate the regulation, they issue an FDA Form 483 listing those observations at the close of the inspection. The FDA recommends that manufacturers submit a written response within 15 business days of the Form 483 being issued, though the response is voluntary.¹⁸ In practice, not responding, or responding weakly, is a fast path to a warning letter. A useful response describes specific corrective actions taken or planned, with timelines, rather than general promises of improvement.

What Noncompliance Costs

A device manufactured in violation of the QMSR is legally adulterated under 21 U.S.C. § 351(h), which exposes it to the full range of FDA enforcement tools.⁸ Enforcement typically escalates from Form 483 observations to warning letters when problems are not corrected. From there the ladder can include civil money penalties, product seizure, injunctions barring continued manufacturing, consent decrees placing the company under court-supervised compliance, and import alerts that block foreign-manufactured devices at the border. The FDA also has authority to pursue criminal prosecution in cases of willful violations or fraud.

For most manufacturers, the more immediate concern is a warning letter, which becomes public record, and the possibility of a consent decree that can halt manufacturing for months or years while the quality system is rebuilt under judicial oversight. Fixing a broken system after enforcement action costs far more than building a compliant one in the first place.

1
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR)
2
eCFR. 21 CFR 820.1 – Scope
3
eCFR. 21 CFR Part 820 – Quality Management System Regulation
4
U.S. Food and Drug Administration. Navigating the Quality Management System Regulation
5
Federal Register. Medical Devices; Quality System Regulation Amendments
6
U.S. Food and Drug Administration. Quality Management System Regulation – Frequently Asked Questions
7
eCFR. 21 CFR 820.7 – Incorporation by Reference
8
Office of the Law Revision Counsel. 21 USC 351 – Adulterated Drugs and Devices
9
eCFR. 21 CFR Part 801 – Labeling
10
eCFR. 21 CFR Part 4 – Regulation of Combination Products
11
eCFR. 21 CFR Part 806 – Medical Devices; Reports of Corrections and Removals
12
eCFR. 21 CFR 820.10 – Quality Management System
13
U.S. Food and Drug Administration. Quality Management System Regulation (QMSR) – Risk Management, Risk-Based Approach, and Risk-Based Decisions
14
U.S. Food and Drug Administration. QMSR Design and Development
15
eCFR. 21 CFR 820.35 – Control of Records
16
eCFR. 21 CFR 820.90 – Nonconforming Product
17
U.S. Food and Drug Administration. Center for Devices and Radiological Health (CDRH) Compliance Programs
18
U.S. Food and Drug Administration. Responding to FDA Form 483 Observations at the Conclusion of an Inspection