QMSR Explained: What the FDA Quality System Regulation Change Means for Device Makers

For nearly 30 years, medical device manufacturers in the United States complied with the Quality System Regulation (QSR), codified at 21 CFR Part 820. The QSR established requirements for design controls, production and process controls, records, and complaint handling, among other quality system elements. It was a U.S.-specific standard that did not align with the global ISO 13485 standard used in Europe, Canada, Japan, and most other major markets.

This created a compliance burden for global device companies, which had to maintain two parallel quality systems: one for ISO 13485 (satisfying international regulators) and one for the QSR (satisfying FDA). FDA finalized the QMSR rule on February 2, 2024 (89 FR 7523). The compliance date was set at February 2, 2026, giving manufacturers two years to transition.

The QMSR addresses the dual-system problem by incorporating ISO 13485:2016 by reference into Part 820. Under the QMSR, complying with ISO 13485:2016 (plus the FDA-specific supplemental requirements) is how a manufacturer complies with 21 CFR Part 820. The goal is harmonization: a manufacturer that is ISO 13485 certified and compliant with the supplemental provisions should be able to satisfy both FDA and international regulators from a single quality system.

FDA does not require manufacturers to obtain ISO 13485 certification. Certification is not a condition of QMSR compliance. But manufacturers whose QMS was built around ISO 13485 will find the transition less disruptive than those who built exclusively around the legacy QSR.

The Architecture of the New Part 820

The structure of 21 CFR Part 820 under the QMSR looks fundamentally different from the legacy QSR (verified against the current eCFR text). The general provisions and the QMS, design-and-development, records, and labeling requirements live in the general and supplemental provisions (sections 820.1 through 820.45). The sections that formerly carried the substantive QSR requirements, such as 820.20, 820.30, 820.70, 820.75, and 820.181, are shown as "[Reserved]" in the current text, with those requirements now met through ISO 13485:2016 as incorporated by reference.

General provisions. The general provisions retain scope, definitions, and applicability. Critically, 820.10(c) directs manufacturers to ISO 13485:2016 Clause 7.3 for design and development controls. This is the QMSR's mechanism for handling design controls for the device types that were previously subject to 820.30 (Class II, Class III, and certain Class I devices).

Supplemental FDA-specific provisions. A small number of retained sections add FDA-specific requirements that ISO 13485 does not fully address. These include:

• Control of records (820.35), which captures the FDA-specific records requirements, including complaint and servicing records, that go beyond ISO 13485's complaint-management provisions
• Device labeling and packaging controls (820.45), which supplement ISO 13485 with FDA-specific expectations for label inspection and control

These supplemental provisions represent FDA's judgment that certain requirements are important enough to the U.S. regulatory framework that they should be stated explicitly rather than incorporated by reference.

Reserved sections. The individual legacy sections that previously contained the substantive quality system requirements (design controls, production and process controls, acceptance activities, nonconforming product, corrective and preventive action, labeling controls, records, handling, storage, distribution, installation, complaint handling, and servicing) are now marked "[Reserved]" in the current regulation. The requirements for those quality system elements are now found in ISO 13485:2016, which Part 820 incorporates by reference. Readers of Part 820 who look for the old section numbers will find only "[Reserved]" and a pointer to ISO 13485.

What Happened to the Sections Companies Relied On

The QSR sections most commonly referenced in FDA inspections and quality system audits were:

820.20 (Management Responsibility): Reserved. The management responsibility requirements are now found in ISO 13485:2016 Clause 5 (Management Responsibility), which covers management commitment, customer focus, quality policy, planning, responsibility and authority, and management review.

820.30 (Design Controls): Reserved. This section, for decades one of the most scrutinized in FDA device inspections, is now superseded. Design and development requirements are fulfilled by ISO 13485:2016 Clause 7.3, as directed by 820.10(c). Clause 7.3 covers design and development planning, inputs, outputs, review, verification, validation, changes, and the design history file (DHF) equivalent. The underlying requirements are substantially similar to what 820.30 required, but the language, structure, and documentation terminology come from ISO 13485.

820.70 (Production and Process Controls): Reserved. Production and process control requirements now flow from ISO 13485:2016 Clause 7.5.1 (Control of Production and Service Provision). Manufacturers should ensure their production control procedures reference the ISO clause structure rather than the old CFR section number.

820.75 (Process Validation): Reserved. Process validation requirements are now in ISO 13485:2016 Clause 7.5.6 (Validation of Processes for Production and Service Provision). The requirement to validate processes whose results cannot be verified by subsequent inspection or testing remains in force; it is now governed by the ISO clause.

820.181 (Device Master Record): Reserved. The Device Master Record (DMR) concept now corresponds to the ISO 13485:2016 Clause 4.2.3 "Medical device file," which requires a file containing or referencing the specifications, production and control procedures, and labeling for each device type. General document and record controls sit in ISO 13485 Clause 4.2.4 and 4.2.5, but the direct DMR analog is the Clause 4.2.3 medical device file. The term "Device Master Record" may no longer appear in FDA inspectional findings under the QMSR, as the ISO 13485 terminology differs, but the substantive requirement to maintain controlled documentation of device specifications, production processes, quality assurance procedures, and labeling remains.

What Has Not Changed

Several important realities did not change on February 2, 2026.

FDA jurisdiction and inspectional authority remain. FDA's authority to inspect device manufacturers under Section 704 of the FD&C Act is unaffected. What FDA inspects is now measured against ISO 13485 (as incorporated by reference) plus the FDA-specific supplemental requirements, rather than the old QSR section structure.

Other Part 820 obligations remain separate from other regulations. The QMSR does not change requirements under 21 CFR Part 803 (Medical Device Reporting), 21 CFR Part 806 (Corrections and Removals), 21 CFR Part 821 (Device Tracking), or 21 CFR Part 830 (Unique Device Identification). Those regulations remain in force independently. Section 820.10 notes that manufacturers are still subject to these other applicable FDA requirements.

ISO 13485 certification is not required. Manufacturers can achieve QMSR compliance without obtaining third-party certification to ISO 13485. FDA will not use ISO 13485 certification status as a basis for its oversight activities. Certification may provide business benefits (supplier qualifications, EU market access) but is not a QMSR compliance condition.

The substantive quality requirements are substantially similar. The QMSR is not a relaxation of quality system requirements. The requirements in ISO 13485:2016 that now govern design controls, production controls, process validation, and records are substantially similar to what the QSR required. The difference is structural and terminological, not a reduction in rigor.

What Device Companies Must Do

If your quality system was built entirely around the legacy QSR section structure, February 2, 2026 was the date by which your procedures, SOPs, work instructions, and training materials should have been updated to reflect ISO 13485:2016 terminology and clause structure. There was no grace period.

For manufacturers who had not completed the transition by February 2, 2026, the practical implication is that any FDA inspection conducted on or after that date will assess the facility against the QMSR, not the QSR. Procedures that reference 820.30, 820.70, or 820.181 as their regulatory basis, rather than the corresponding ISO 13485 clauses, may be cited as deficiencies.

The transition work typically involves:

1. Conducting a gap analysis between your current QMS documentation and ISO 13485:2016 requirements
2. Updating procedure documents to reference ISO clause numbers rather than (or in addition to) legacy CFR section numbers
3. Confirming that your DHF and DMR structure meets ISO 13485 documentation requirements
4. Training quality personnel on the new regulatory framework
5. Reviewing supplier quality agreements to ensure they reference the current standard
6. Updating internal audit checklists from QSR-based to ISO 13485-based formats

Manufacturers already certified to ISO 13485:2016 with a Notified Body will have substantially completed steps 1 through 4 for the ISO requirements. Their remaining work is primarily adding the FDA-specific supplemental requirements (complaint records, labeling controls) to their ISO 13485-based system and updating any U.S.-specific documentation that still references QSR section numbers.

Why This Matters for Market-Stage Companies

The QMSR transition is not only a manufacturing and quality operations concern. It has direct implications for marketing, because the quality system governs every document that goes into the 510(k) or PMA record, and any labeling or promotional material that goes through design controls.

Labeling is subject to design controls under ISO 13485 Clause 7.3. That means the process by which IFUs, product labels, and promotional materials are designed, reviewed, approved, and changed must flow through your QMSR-compliant quality system. Marketing teams that treat regulatory review of promotional materials as a separate process from the quality system create compliance gaps that can surface during inspections.

At Buzzbox Media, our work with medical device companies over 15 years includes understanding how cleared labeling defines the boundary of what marketing content can claim. See our medical device marketing services for how we connect regulatory strategy to commercial messaging.