FDA's QMSR

21 CFR Part 820 (FDA QMSR): A Complete Guide to the Quality Management System Regulation

The Quality Management System Regulation (QMSR) is the FDA's current quality system rule for medical devices. It replaced the long-standing Quality System Regulation (QSR), which had governed device manufacturers since the 1990s. The QMSR still lives in 21 CFR Part 820, but it now builds on the international standard ISO 13485:2016 instead of restating every requirement itself. This guide explains what changed, who must comply, how the QMSR relates to ISO 13485, and what to expect from FDA inspections.

What Is FDA QMSR (21 CFR Part 820)?

The QMSR became effective on February 2, 2026. It amends the device current good manufacturing practice (CGMP) requirements of 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. Part 820 is still the correct regulation number, and only the name and internal structure changed. Any document, procedure, or supplier agreement that still refers to the "QSR" is now out of date. 

The FDA did not adopt ISO 13485 as a whole and stop there. A handful of sections remain in Part 820 because the FDA concluded ISO 13485 did not adequately cover them: scope, definitions, incorporation by reference, quality management system requirements, control of records, and device labeling and packaging controls. Compliance therefore means meeting ISO 13485:2016 plus these FDA-specific requirements. 

Why Is This Change Happening?

The main goal is harmonization. Many countries already base their device quality requirements on ISO 13485, so aligning Part 820 with the standard makes it easier for U.S. companies to sell globally. It also reduces duplicated work for manufacturers that maintain both an ISO 13485 system and a separate FDA overlay, and it supports better patient safety through a more consistent, risk-based approach.

The rulemaking took several years:

• In February 2022 the FDA published the proposed rule, and on February 2, 2024 it published the final rule. 
• The final rule gave a two-year transition period, which ended on February 2, 2026. 
• The FDA also participates in the Medical Device Single Audit Program (MDSAP), which is centered on ISO 13485. Harmonizing Part 820 fits that broader effort. 

What Does This Mean for Manufacturers?

If you manufacture or sell medical devices in the U.S., this rule applies to you. Instead of the old QSR text, your quality management system (QMS) must meet ISO 13485:2016, plus FDA-specific additions in Part 820. In practice this means:

• Updating your quality manual, procedures, forms, and templates so they reference the QMSR and ISO 13485 clauses correctly
• Checking that your records meet the new control-of-records requirements
• Training staff on ISO 13485 concepts and risk-based thinking
• Strengthening supplier controls and internal audits, which are now more visible to the FDA
• Preparing for inspections under the FDA's new inspection process

If you already hold an ISO 13485 certificate, you have a head start, but it is not the same as compliance. A certificate is the foundation, and the FDA additions and the new inspection program still have to be addressed. 

Key Changes Introduced in FDA QMSR

The four changes manufacturers should prepare for are updated terminology, formal records control requirements, retained labeling and packaging controls, and a wider emphasis on risk management. Each is covered in its own section below.

Who Must Comply with FDA QMSR?

Part 820 applies to manufacturers of finished medical devices intended for the U.S. market. That includes foreign manufacturers who export to the U.S. In the regulation, "manufacturer" is broad. It covers the parties that design, manufacture, fabricate, assemble, or process a finished device, and it can include contract manufacturers, specification developers, relabelers, repackagers, and remanufacturers.

Points to check for your situation:

• Components and parts: Manufacturers of components are generally not directly subject to the QMSR, but finished device manufacturers must control them through purchasing and supplier controls.
• Exemptions: Some low-risk devices are exempt from parts of Part 820, as stated in their classification regulations.
• Combination products: Device CGMP requirements apply to the device constituent part, so combination product manufacturers should review the FDA's rules on how these requirements fit together.
• Extended traceability: Section 820.10 extends the ISO 13485 traceability requirements for implantable devices to devices that support or sustain life. It also states that failure to comply makes a device adulterated and subject to regulatory action. 

How FDA QMSR Aligns with ISO 13485

The alignment works through incorporation by reference. The QMSR incorporates ISO 13485:2016, plus Clause 3 of ISO 9000:2015, which supplies the terms and definitions needed to apply ISO 13485. Incorporation by reference makes using the standard a legal requirement rather than a voluntary option. 

Part 820 now has two parts:

• Subpart A (General Provisions): scope, definitions, incorporation by reference, and quality management system requirements.
• Subpart B (Quality System Requirements): FDA-specific supplements on control of records (820.35) and device labeling and packaging controls (820.45).

The table below shows where familiar QSR topics now sit in ISO 13485:2016. These are approximate mappings, not exact one-to-one equivalents.

Where ISO 13485 and Part 820 conflict, the FDA's regulation takes precedence.

Core Requirements Under FDA 21 CFR Part 820

The core QMS requirements now come from ISO 13485:2016, supported by the FDA-specific sections:

• General QMS requirements and documentation (Clause 4): a documented quality management system, a risk-based approach to control QMS processes, document and record control, and validation of software used in the QMS.
• Management responsibility (Clause 5): management commitment, quality policy and objectives, responsibilities and authorities, and management review.
• Resource management (Clause 6): competent personnel, infrastructure, and the work environment.
• Product realization (Clause 7): planning, customer-related processes, design and development, purchasing, production and service provision, traceability, and control of monitoring and measuring equipment.
• Measurement, analysis, and improvement (Clause 8): feedback, complaint handling, regulatory reporting, internal audit, control of nonconforming product, data analysis, and corrective and preventive action.
• FDA supplements: control of records (820.35), device labeling and packaging controls (820.45), and the definitions and scope requirements in Subpart A.

Design Controls Under FDA QMSR

Design controls used to be a stand-alone section of the QSR. They now follow ISO 13485 Clause 7.3, design and development. The basic elements are the same:

• Planning (7.3.2): define stages, responsibilities, and reviews.
• Inputs (7.3.3): capture functional, performance, usability, safety, and regulatory requirements, including outputs of risk management.
• Outputs (7.3.4): specifications that can be checked against the inputs.
• Review (7.3.5): systematic reviews at suitable stages.
• Verification (7.3.6): confirm that outputs meet inputs.
• Validation (7.3.7): confirm that the device meets user needs and intended use, including clinical or performance evaluation as required.
• Transfer (7.3.8): make sure design outputs are suitable for manufacturing.
• Changes (7.3.9): control and assess design changes.
• Design and development file (7.3.10): keep the records that show the design followed the plan.

The FDA's earlier design control guidance is still useful for interpretation. Check the scope of Part 820 and your device's classification regulation to confirm which design requirements apply to your device.

Updated Terminology Aligned with ISO Standards

The QMSR adopts ISO 13485 vocabulary. The terms device master record, design history file, and device history record no longer appear in the regulation. The documentation requirements behind them remain. Manufacturers are now expected to maintain the three types of records below. 

Medical Device File

For each device type or family, keep a file (or a file that points to the right documents) covering the product description, intended use, labeling, product and process specifications, and procedures for purchasing, production, installation, servicing, and measurement. It replaces most of what the device master record held.

Design and Development File

Records showing the design and development history for each device type or family, including planning, inputs, outputs, reviews, verification, validation, transfer, and changes. It replaces the design history file.

Product Realization and Quality Records

The records showing that each device or batch was made and controlled as required, such as production, inspection, traceability, and acceptance records. These take over from the device history record.

The change is one of terminology. The FDA does not require you to rename your existing documents, and internal references to DMR, DHR, and DHF can continue as long as the documentation meets the applicable requirements.

Common FDA QMSR Compliance Challenges

• Assuming ISO 13485 certification is enough: The FDA's additions in Sections 820.10, 820.35, and 820.45 must be covered separately.
• Incomplete gap analysis: Comparing only against ISO 13485 and missing FDA supplements or intended use in the U.S. market.
• Terminology confusion: Mixing old and new terms across procedures, or breaking traceability when documents are renamed.
• Superficial risk management: Keeping a risk file, but not linking it to supplier controls, production, and CAPA.
• Missing UDI in complaint and service records: Complaint forms that capture a model number but not the UDI.
• Labeling inspection gaps: Relying on general production controls without a specific labeling accuracy check before release.
• Immature internal audits and management reviews: These records are now within reach of inspectors, so weak or inconsistent records are a real exposure.
• Supplier controls: Supplier evaluation and monitoring that isn't proportionate to risk.
• Resources: Smaller companies may struggle to update documents, train staff, and prepare for inspections at once.
• Outdated references: Procedures, contracts, and quality agreements that still cite the QSR.

Formal Records Control Requirements

Section 820.35 is the QMSR's records section. It works on top of ISO 13485 Clause 4.2.5 and adds FDA-specific content requirements, including for complaint records and servicing records. Records must be accurate, accessible, and traceable through the device lifecycle.

Unique Device Identifier (UDI)

Under this section, complaint records must include any UDI or universal product code (UPC) and any other device identification. The requirement applies to both complaint and service records. The UDI must also be recorded for each medical device or batch of devices, in addition to the requirements of ISO 13485 Clauses 7.5.1, 7.5.8, and 7.5.9. Check that complaint and service systems can capture and store UDIs. 

Confidentiality Protection Guidance

Records the manufacturer considers confidential may be marked as such, to help the FDA decide whether information can be disclosed under the public information regulation in 21 CFR Part 20. Marking is permitted rather than mandatory, but it's good practice for trade secrets and proprietary information you provide to the FDA. Marking does not guarantee non-disclosure. 

Labeling and Packaging Controls Retained

Most of the QMSR follows ISO 13485, but the FDA kept its own requirements for labeling and packaging. The FDA retained Section 820.45 because it felt ISO 13485 does not add enough on labeling inspection activities. In particular, manufacturers must inspect device labels for accuracy on certain elements before release, along the lines of the old 820.120(b) requirement. 

Manufacturers therefore need to meet two things together:

• ISO 13485 Clause 7.5.1, which covers control of production and service provision, including labeling and packaging operations
• QMSR Section 820.45, the FDA-specific controls for labeling and packaging

Where there is a conflict, the FDA regulation takes precedence.

Expanded Emphasis on Risk Management

Risk management is one of the biggest shifts. Under the QSR, risk was tied mainly to design. Under the QMSR, ISO 13485 requires a risk-based approach across the whole quality system. Manufacturers should be able to show risk-based decision making in:

• Design and development: risk analysis feeding design inputs and confirming risk controls.
• Purchasing and supplier controls: evaluating and monitoring suppliers in proportion to the risk of the product they supply.
• Manufacturing processes: process controls, validation, and software validation scaled to risk.
• Corrective and preventive action (CAPA): prioritizing and scoping actions by risk.

ISO 14971 is the standard most manufacturers use for the risk management process itself. Whatever process you choose, the point is that risk information should visibly drive decisions in each of these areas.

What Should Manufacturers Do Next?

The transition period is over, so the focus now is on closing gaps and staying inspection-ready:

1. Run or refresh a gap analysis against ISO 13485:2016 and the FDA-specific parts of Part 820 (820.10, 820.35, 820.45).
2. Update procedures, forms, and templates, including references to the QSR, DMR, DHR, and DHF.
3. Add UDI to complaint and service records, and review your labeling inspection process.
4. Integrate risk management into design, purchasing, production, and CAPA, and make the links visible.
5. Review supplier controls for selection, evaluation, and monitoring based on risk.
6. Train teams on ISO 13485, the FDA supplements, and risk-based thinking.
7. Strengthen internal audits and management reviews, since inspectors can now request them.
8. Run mock inspections modeled on the FDA's new inspection process.
9. Watch for FDA updates, including guidance, Q&As, and inspection observations.

The shift from the QSR to the QMSR is a major change, but it aligns U.S. requirements with international practice, and it can simplify compliance for manufacturers who sell in several markets.

FDA QMSR Inspections: What Manufacturers Should Expect

The QMSR changed how the FDA inspects, too. On February 2, 2026, the FDA began using the inspection process in the updated Compliance Program 7382.850, and it stopped using the older device inspection and PMA inspection compliance programs. The Quality System Inspection Technique (QSIT) was retired at the same time. 

What industry analyses of the new program highlight:

• Structure: Inspections are organized around six QMS Areas and four Other Applicable FDA Requirements, driven by product risk. The areas include Design and Development, Management Oversight, and Measurement, Analysis, and Improvement. 
• Risk documentation: Inspectors reportedly use your risk management documentation as a roadmap for the inspection. Risk management failures are explicitly listed as triggers for Official Action Indicated (OAI) classifications. 
• Records once off-limits: Management reviews, internal audits, and supplier audit reports were previously exempt from FDA inspection, and are no longer categorically exempt. 
• ISO certification: ISO 13485 certification alone does not substitute for an FDA QMSR inspection. 

To prepare, make sure your risk management file is current and linked to other processes. Keep management review and internal audit records complete, with clear follow-up. Confirm that supplier records are organized, and check that your team can explain how risk drives decisions in your QMS.

FAQs about 21 CFR 820

1. What is the difference between QSR and FDA QMSR?

The Quality System Regulation (QSR) was the FDA's device quality rule from the 1990s until early 2026. The Quality Management System Regulation (QMSR) replaced it on February 2, 2026. The main difference is structure: the QSR spelled out each requirement in the regulation, while the QMSR incorporates ISO 13485:2016 by reference and keeps only a few FDA-specific sections.

Underlying good manufacturing practice principles carry over, so much of what you already do still applies.

2. How does QMSR FDA align with ISO 13485?

Through incorporation by reference. The QMSR makes ISO 13485:2016, plus Clause 3 of ISO 9000:2015 for definitions, a legal requirement rather than a voluntary standard. Most of Part 820 now points to the relevant ISO clause instead of restating it.

The FDA kept its own text for a few areas it felt ISO 13485 doesn't cover well: scope, definitions, incorporation by reference, quality management system requirements (820.10), control of records (820.35), and labeling and packaging controls (820.45). Where ISO 13485 and Part 820 conflict, the FDA regulation prevails.

Alignment with ISO 13485 means:

• Risk management: ISO 13485 Clause 7.1 requires risk management across product realization. ISO 14971 is the standard most manufacturers use for the process itself.
• Design and software: Design and development follow Clause 7.3, and software development often follows IEC 62304. Both feed the design and development file.
• Usability: Formative and summative evaluation under usability engineering (IEC 62366-1) is design validation evidence.
• Global use: The same quality system can support the FDA, the EU (where the clinical evaluation report (CER) is a separate technical documentation item), and MDSAP.

An ISO 13485 certificate is a foundation, not proof of QMSR compliance. The FDA-specific sections and the new inspection process still need to be covered.

3. Who is required to comply with FDA QMSR?

Manufacturers of finished medical devices intended for the U.S. market, including foreign manufacturers who export to the U.S. "Manufacturer" is broad. It covers those who design, manufacture, fabricate, assemble, or process a finished device, and can include contract manufacturers, specification developers, relabelers, repackagers, and remanufacturers.

Some points to check for your product:

• Medical device classification: Some low-risk devices are exempt from parts of Part 820, as stated in their classification regulations. The scope of design and development requirements can also depend on the device's class.
• Components: Component makers are generally not directly covered, but finished device manufacturers must control them through purchasing and supplier controls.
• Combination products: Device CGMP requirements apply to the device constituent part.
• Submissions: The FDA doesn't generally inspect before an FDA 510(k) is cleared, but the QMSR still applies to the manufacturer. For premarket approval (PMA), preapproval inspections now follow the FDA's new inspection compliance program.
• Life-supporting devices: Section 820.10 extends ISO 13485's traceability requirements for implantable devices to devices that support or sustain life.

4. What are the major changes introduced in FDA QMSR?

• ISO 13485:2016 incorporated by reference, with FDA supplements.
• New terminology: the DMR, DHR, and DHF become the medical device file, product realization and quality records, and the design and development file. You do not have to rename existing documents.
• A dedicated records section (820.35): it adds FDA content requirements for complaint and service records, including the UDI or UPC. The UDI must be recorded for each device or batch, so your quality records should agree with your GUDID data. It also allows you to mark confidential records to help the FDA decide on disclosure under 21 CFR Part 20.
• Labeling and packaging controls kept (820.45), including a labeling accuracy check before release.
• Risk management across the quality system, not mainly in design.
• A new inspection process: Compliance Program 7382.850 replaced QSIT. Management reviews, internal audits, and supplier audit reports are no longer categorically exempt from FDA review.

Electronic records under 820.35 that are kept electronically also need 21 CFR Part 11 controls, such as audit trails and access limits.

5. Does FDA QMSR replace 21 CFR Part 820?

No. The QMSR is the current version of 21 CFR Part 820. The regulation number did not change, and only the title, structure, and much of the content did. What the QMSR replaced was the QSR text inside Part 820.

In practice, "QMSR" and "21 CFR Part 820" now mean the same regulation. Any procedure, contract, or supplier agreement that still refers to the "QSR" is out of date and should be updated to the QMSR.