The US Food and Drug Administration’s Quality Management System Regulation (QMSR) came into effect on 2 February 2026, changing the quality management requirements for medical device manufacturers operating in the US market.
The revised 21 CFR Part 820 incorporates ISO 13485:2016 by reference, bringing the FDA’s regulatory framework into closer alignment with the quality management system used by medical device organisations worldwide.
For manufacturers already working to ISO 13485, this represents significant alignment. Their existing quality management system may provide much of the foundation needed to meet the QMSR. However, ISO 13485 certification alone does not automatically demonstrate full FDA compliance.
Manufacturers must understand how the standard, the revised Part 820 requirements and other applicable FDA regulations work together.
What is the FDA Quality Management System Regulation?
The Quality Management System Regulation is the FDA’s framework for current good manufacturing practice requirements relating to medical devices.
The QMSR applies to manufacturers involved in these activities for finished medical devices intended for human use in the United States, including devices imported or offered for import.
The regulation replaced the FDA’s former Quality System Regulation framework by incorporating ISO 13485:2016 as its core quality management system model. It also includes additional FDA-specific provisions intended to maintain the protections and legal requirements established under US law.
How does ISO 13485 support FDA QMSR compliance?
ISO 13485 supports QMSR compliance by providing the foundational quality management system requirements now incorporated into 21 CFR Part 820.
The standard helps medical device organisations establish controlled, documented and risk-based processes across the product lifecycle. Its requirements cover areas including:
Because the FDA now uses ISO 13485:2016 as the foundation of the QMSR, organisations with a mature ISO 13485 system are likely to have many of the required processes in place.
However, they will still need to confirm that those processes satisfy the applicable FDA definitions, supplementary provisions and wider regulatory obligations.
Why did the FDA align its requirements with ISO 13485?
The FDA introduced the QMSR to modernise its medical device quality requirements and create greater consistency with other regulatory jurisdictions.
Many manufacturers supplying multiple international markets previously maintained systems against both the former FDA Quality System Regulation and ISO 13485. Although the two frameworks shared many objectives, differences in terminology and structure could result in duplicated procedures, audits and documentation.
The FDA concluded that the requirements of ISO 13485:2016 were substantially similar to those of its previous Quality System Regulation when considered as a whole. Incorporating the standard therefore creates a more internationally aligned approach while retaining necessary US-specific requirements.
The FDA estimated that the rule could generate annualised net cost savings of approximately $532 million at a 7% discount rate, reflecting the potential efficiency benefits of regulatory harmonisation.
Key areas of alignment between ISO 13485 and the QMSR
Risk management
ISO 13485 requires manufacturers to apply a risk-based approach to the processes needed for their quality management system. Risk management is also embedded across activities such as design, supplier control, production and post-market feedback.
The FDA has highlighted risk management as an important benefit of incorporating ISO 13485 into its regulatory framework.
Manufacturers should be able to demonstrate how risks are identified, assessed, controlled and monitored throughout the device lifecycle. Risk-related decisions should also be supported by clear and accessible records.
Design and development controls
ISO 13485 establishes requirements for planning, inputs, outputs, reviews, verification, validation, transfer and control of design changes.
Under the QMSR, the ISO 13485 design and development requirements apply to:
Class II devices
Class III devices
Class I devices automated with computer software
Certain other Class I devices specifically listed in 21 CFR 820.10
An ISO 13485 quality management system can therefore provide a structured framework for maintaining design controls and demonstrating how safety, effectiveness and regulatory requirements have been considered.
Supplier and purchasing controls
Medical device safety and performance can be affected by materials, components and services supplied by external providers.
ISO 13485 requires organisations to evaluate and select suppliers according to their ability to meet specified requirements. The type and extent of supplier control should reflect the risks associated with the purchased product or service.
FDA commentary on the QMSR also emphasises the need for finished-device manufacturers to perform ongoing, risk-informed supplier assessments. Supplier certification may form part of this evaluation, but the FDA has stated that certification alone may not provide sufficient assurance without further assessment.
Production and process controls
ISO 13485 supports the controlled manufacture of medical devices through documented processes, suitable infrastructure, competent personnel, validated processes and appropriate monitoring.
This can help manufacturers demonstrate that products are consistently produced under defined conditions and meet applicable specifications before release.
Particular attention may be required where process outputs cannot be fully verified through later inspection or testing. In these circumstances, process validation and continued monitoring become especially important.
Traceability and identification
ISO 13485 establishes controls for product identification and traceability. The QMSR connects these requirements to FDA-specific obligations.
Manufacturers must document a system for assigning Unique Device Identification in accordance with 21 CFR Part 830. Where applicable, traceability procedures must also meet the requirements of 21 CFR Part 821.
An effective ISO 13485 system can provide the structure for managing these controls, but the organisation must incorporate the specific requirements that apply to its devices and US operations.
Complaint handling and corrective action
ISO 13485 requires organisations to document procedures for receiving, reviewing and evaluating complaints. It also includes requirements for corrective action, nonconforming products and reporting to regulatory authorities.
These processes can help manufacturers identify recurring issues, investigate possible failures and use post-market information to improve product quality.
The QMSR supplements the standard by specifying information that must be retained in certain complaint records. This includes device identification, the date the complaint was received, details of the complaint, corrective action taken and any response provided to the complainant.
Complaints that meet FDA reporting criteria must also be handled in accordance with the Medical Device Reporting requirements in 21 CFR Part 803.
Internal audits and management review
Internal audits provide evidence that the quality management system has been implemented effectively and continues to meet relevant requirements.
ISO 13485 also requires management reviews to evaluate the suitability, adequacy and effectiveness of the system. Inputs can include audit results, customer feedback, process performance, product conformity, corrective actions and changes that may affect the QMS.
Together, these processes help organisations identify gaps before they become larger compliance or product-quality issues.
Does ISO 13485 certification guarantee FDA QMSR compliance?
No. ISO 13485 certification can provide a strong foundation for QMSR compliance, but it does not replace an organisation’s legal responsibility to meet FDA requirements.
The QMSR incorporates ISO 13485 while adding or connecting it to requirements covering areas such as:
Where an ISO 13485 requirement conflicts with the FD&C Act or another applicable FDA regulation, US legislation and its implementing regulations take precedence.
Manufacturers must therefore build a system that addresses both ISO 13485 and every applicable FDA requirement.
What FDA-specific requirements remain under the QMSR?
Complaint records
In addition to ISO 13485 complaint-handling requirements, manufacturers must retain specified details for relevant complaints. These can include the device name, date received, UDI or other identification, complainant’s details, the nature of the complaint, corrective action and the response provided.
Servicing records
Where servicing requirements apply, records must include information such as:
- The device serviced
- Device identification
- Date of service
- The individuals completing the service
- Work performed
- Test and inspection results
Labelling and packaging controls
Manufacturers must document procedures to protect the integrity and accuracy of labelling and packaging throughout processing, storage, handling and distribution.
Controls must address matters such as:
- Correct device identification
- Expiration dates
- Storage instructions
- Handling instructions
- Additional processing instructions
- Prevention of labelling or packaging mix-ups
- Documented approval and release of labels
FDA reporting obligations
A manufacturer must identify which complaints require reporting under 21 CFR Part 803. Corrections, removals and advisory notices must also be handled in accordance with the applicable US requirements, including 21 CFR Part 806.
These obligations should be integrated into the QMS rather than managed as disconnected regulatory activities.
How should ISO 13485-certified manufacturers assess their QMSR readiness?
A structured gap analysis is the most effective starting point.
Manufacturers should compare their existing quality management system against:
- The applicable clauses of ISO 13485:2016.
- The supplementary provisions in 21 CFR Part 820.
- Related FDA regulations relevant to their devices and activities.
- FDA-specific terminology and definitions.
- The organisation’s actual processes, records and evidence.
The assessment should look beyond whether a procedure exists. It should verify that responsibilities are understood, processes are followed consistently and records provide objective evidence of compliance.
Key questions include:
- Are all applicable FDA requirements identified within the QMS?
- Do complaint procedures include FDA reporting assessments?
- Are UDI and device-tracking obligations correctly documented?
- Are labelling and packaging controls sufficiently detailed?
- Do records contain all FDA-required information?
- Has the organisation reviewed its terminology against QMSR definitions?
- Can staff explain how their work supports regulatory compliance?
- Are internal audits evaluating both ISO 13485 and FDA-specific requirements?
- Are supplier controls proportionate to product and patient risk?
- Can evidence be retrieved efficiently during an FDA inspection?
Preparing for FDA inspections under the QMSR
When the QMSR became effective on 2 February 2026, the FDA also began using an updated inspection process for medical device manufacturers. The former Quality System Inspection Technique, commonly known as QSIT, is no longer used.
Manufacturers should ensure that their internal audit and inspection-readiness programmes reflect the current QMSR framework.
Effective preparation may include:
- Updating audit checklists and compliance matrices
- Reviewing procedures against current Part 820 requirements
- Checking links between risk management and operational controls
- Sampling complaint, CAPA, supplier and production records
- Confirming that FDA-reportability decisions are documented
- Testing how quickly important records can be located
- Training employees on the revised terminology and inspection approach
- Reviewing whether legacy procedures still refer to obsolete QSR sections
A well-maintained QMS should show how quality controls operate in practice, not simply how they are described in documentation.
How IMSM can support ISO 13485 implementation
For medical device organisations, changes to the FDA framework provide an opportunity to simplify quality management while strengthening regulatory readiness.
IMSM’s experienced ISO consultants can support organisations with implementing ISO 13485 and developing a quality management system suited to their products, processes and regulatory environment.
ISO 13485 certification does not replace specialist legal or regulatory advice, but it can give medical device manufacturers a robust and internationally recognised framework on which to build their FDA compliance activities.
Ready to strengthen your medical device quality management system? Contact IMSM to discuss ISO 13485 certification and the next steps for your organisation.
FAQs
References
- US Food and Drug Administration – Quality Management System Regulation
- Electronic Code of Federal Regulations – 21 CFR Part 820: Quality Management System Regulation
- Federal Register – Medical Devices; Quality System Regulation Amendments, Final Rule
- International Organization for Standardization – ISO 13485:2016
This article provides general information and does not constitute legal or regulatory advice. Manufacturers should assess the requirements applicable to their devices, activities and target markets.
