1. Policy Background and Significance

On June 26, 2026, the U.S. Office of the Federal Register updated the medical device regulations in Subchapter H of Chapter I, Title 21 of the Code of Federal Regulations (CFR), covering Parts 800 through 898 in the electronic CFR (eCFR). This update affects core compliance areas for medical devices, including general controls, labeling, adverse event reporting, reports of corrections and removals, establishment registration and device listing, investigational device exemptions, premarket approval, quality systems, unique device identification (UDI), and classification panels.

From a legal perspective, 21 CFR is a codification of effective federal administrative law. The “current as of” date of June 26, 2026 in eCFR means that the text has incorporated final rules and technical amendments effective as of that date; it is not necessarily a new rule published by FDA on that day. Nevertheless, the substantive impact of this update is significant: it reflects that the Quality Management System Regulation (QMSR) final rule published by FDA in January 2024 became effective on February 2, 2026, and has now been codified into Part 820. This marks a fundamental shift in FDA’s regulatory paradigm for medical device quality systems, from the traditional Quality System Regulation (QSR) to a Quality Management System Regulation (QMSR) closely aligned with ISO 13485:2016.

In addition, Part 801 labeling, Part 803 Medical Device Reporting (MDR), Part 806 Reports of Corrections and Removals, Part 807 Establishment Registration and Device Listing, Part 830 UDI, and Part 860 classification procedures may also reflect final rules or editorial revisions published by FDA in the Federal Register in recent years. Regulatory affairs professionals should therefore treat this CFR update as a systematic compliance milestone rather than a mere textual change.

2. Core Changes Analysis

(1) 21 CFR Part 820: Formal Codification of QMSR

1. Alignment of quality management system requirements with international standards
   The revised Part 820 no longer relies solely on the traditional QSR structure of separate subparts for management responsibility, design controls, corrective and preventive actions, and other topics. Instead, through amended sections such as 21 CFR 820.1 and 820.3, it requires manufacturers to establish, implement, and maintain a quality management system that complies with ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes. While adopting the ISO standard, FDA has retained certain U.S.-specific definitions and requirements, including the Device Master Record (DMR), Device History Record (DHR), and FDA-specific requirements for complaint files, labeling, and packaging controls.

2. Terminology shift and update of system documentation
   The term “quality system” has been replaced by “quality management system,” reflecting FDA’s shift in focus from mere structural compliance to system effectiveness and risk control. Manufacturers must update quality manuals, procedures, and work instructions to align terminology and structure. FDA has made clear in the QMSR final rule that ISO 13485 certification alone does not automatically satisfy Part 820; manufacturers must also meet the additional FDA-specific provisions. Therefore, companies cannot simply substitute an ISO certificate for FDA compliance, but should establish a mapping between the two frameworks.

3. Risk-based approach across the entire product lifecycle
   The QMSR requires the application of risk management beyond design and development, extending into purchasing, production, service, training, validation, and change control. Manufacturers must provide evidence that they have established a risk management process based on ISO 14971 or an equivalent method, and that risk data are actually used in design inputs, supplier evaluation, process validation, and feedback analysis.

4. Strengthened management responsibility and management review
   The updated provisions emphasize top management responsibility and require management review inputs to include regulatory compliance, quality objectives, adverse event trends, status of corrective and preventive actions, audit results, and customer feedback. FDA investigators will increasingly focus on whether management is genuinely involved in QMS decision-making rather than merely signing documents.

5. Purchasing and supplier controls
   Under QMSR, purchasing controls must be based on supplier risk assessment and product risk level. For companies, merely holding a supplier’s ISO 13485 certificate is not sufficient; they must also establish supplier performance monitoring, re-evaluation, and on-site audit programs. FDA scrutiny of such records will be a priority in inspections after February 2, 2026.

(2) 21 CFR Part 801 and Part 830: Cross-Compliance of Labeling and UDI

Part 801 sets forth general requirements for medical device labeling and instructions for use. The revised text may incorporate recent requirements on label readability and the distinction between prescription and over-the-counter devices, and further integrate with the UDI requirements in Part 830. Under 21 CFR 830.20, device labels and packages must bear a UDI in the format and location specified by FDA, unless an exception or alternative applies. Manufacturers must ensure that the UDI on the label is consistent with the information in the GUDID database, and any label change must undergo change control and assessment of whether registration listings and UDI records need to be updated.

(3) Part 803 and Part 806: Postmarket Surveillance and Reporting

Part 803 requires manufacturers, importers, and user facilities to report reportable events to FDA within specified timeframes after becoming aware of them: death or serious injury events within 30 calendar days; serious public health threats within 5 calendar days; and other reportable events within 30 calendar days. Part 803 currently requires submission through electronic Medical Device Reporting (eMDR); companies should verify that their electronic submission accounts and XML output formats are functioning correctly.

Part 806 requires reports of corrections or removals of marketed devices to be submitted to FDA within 10 working days. The revised text may clarify the boundaries between “correction” and “removal,” particularly regarding field software updates, labeling corrections, or customer notifications.

(4) Part 807: Establishment Registration and Device Listing

Part 807 requires all establishments engaged in the manufacture, preparation, propagation, compounding, assembly, or processing of devices to register with FDA, and to list their devices. The annual registration window is from October 1 to December 31 each year. Companies must ensure that registration information is consistent with FDA’s Unified Registration and Listing System (FURLS) and GUDID data. This CFR update may incorporate strengthened requirements linking UDI data to registration information.

(5) Part 860: Classification Procedures and Reclassification

Part 860 sets out procedures for the classification and reclassification of medical devices. Although this update does not necessarily change the classification of any individual device, updates to the classification database may indirectly affect the control requirements for specific products. Companies should periodically verify product classification codes and corresponding control requirements, especially when introducing new products or changing intended use.

3. Impact Analysis

(1) For Manufacturers

The most immediate pressure for manufacturers is the full transition of Part 820. After February 2, 2026, FDA inspections will be conducted under QMSR. Companies that continue to operate under the old QSR documentation may be found noncompliant during inspections. Documents requiring updates include quality manuals, document control procedures, risk management procedures, purchasing control procedures, design and development procedures, CAPA procedures, internal audit procedures, and management review procedures. In addition, manufacturers must ensure that DMR and DHR content meets FDA-specific requirements, because ISO 13485 certification audits may not cover these U.S.-specific regulatory requirements.

(2) For the Industry

At the industry level, the convergence of QMSR with ISO 13485 helps global manufacturers reduce duplication costs associated with maintaining multiple quality systems and improves the efficiency of a single-system audit. In the short term, however, companies must invest resources in gap assessments and employee training. Small and medium-sized enterprises that rely on third-party audits or headquarters-level system documents need to pay particular attention to the completeness of U.S.-specific local documentation.

(3) For Patients and Users

Patient safety is the ultimate goal of this update. A more stringent quality management system, more comprehensive risk management, more timely MDR reporting, and more accurate UDI traceability all contribute to greater transparency across the device lifecycle and reduce injuries caused by design defects, supplier failures, or delayed corrective actions. Clearer labeling requirements also reduce the risk of user error.

4. Compliance Recommendations

1. Obtain the official text and create a redline comparison
   Immediately download the June 26, 2026 version of Parts 800 through 898 from eCFR and compare it clause by clause with the previous annual version. Record all changes. Do not rely on summaries from commercial databases; cite the specific 21 CFR section numbers directly.

2. Conduct a QMSR gap assessment
   Perform a clause-by-clause gap assessment of Part 820, focusing on DMR/DHR, risk management, purchasing controls, management review, and complaint handling. Develop a corrective action plan and complete closure before FDA inspection.

3. Review labeling and UDI data
   Verify the requirements of Part 801 and Part 830, and confirm that all labeling carriers, instructions for use, and GUDID records are consistent. Pay particular attention to UDI requirements for prescription devices, sterile devices, and software products.

4. Validate postmarket reporting channels
   Test the eMDR submission process to ensure XML templates and FDA accounts are functional. Review Part 806 correction/removal procedures and clearly define the responsible person and process for the 10-working-day reporting requirement.

5. Update registration and listing data
   Before the annual registration window from October 1 to December 31, 2026, complete FURLS/GUDID data updates and ensure that device listings are consistent with labeling.

6. Strengthen supplier management and employee training
   Incorporate QMSR and ISO 13485 requirements into supplier audit checklists. Provide targeted training to quality, regulatory, production, and supply chain teams, and retain training records.

7. Establish continuous compliance monitoring
   Subscribe to Federal Register and eCFR updates, designate a person responsible for monitoring changes to 21 CFR Parts 800 through 898 and FDA guidance documents, and incorporate regulatory updates into the change control process.

5. Timeline and Key Dates

• February 2, 2026: QMSR final rule becomes effective; the new requirements of 21 CFR Part 820 begin to apply.
• June 26, 2026: 21 CFR Parts 800 through 898 are updated in eCFR, reflecting QMSR and other effective amendments.
• October 1–December 31, 2026: Annual establishment registration and device listing update window for fiscal year 2027.
• Continuously applicable: Part 803 MDR reporting timeframes of 30 days/5 days, Part 806 correction/removal reporting timeframe of 10 working days; FDA may conduct inspections at any time.

It should be emphasized that this article is based solely on publicly available information for compliance interpretation and does not constitute legal advice. Companies should work with legal counsel or FDA-certified experts to develop specific compliance strategies based on their own product portfolios and regulatory history.