1. Policy Background and Significance

On February 2, 2026, the U.S. Food and Drug Administration (FDA) Quality Management System Regulation (QMSR) officially took effect. This amendment does not merely make minor technical adjustments to the existing 21 CFR Part 820. It formally incorporates ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes, into U.S. federal regulations. U.S. medical device quality system regulation is shifting from a long-standing domestic QS Regulation (QSR) model to a globally harmonized model built on international standards and supplemented by FDA-specific legal requirements.

The underlying background is that the U.S. medical device industry is highly globalized. Manufacturers often face quality system requirements from multiple markets, including the United States, the European Union, Canada, Australia, and Japan. Although the old 21 CFR Part 820 had some conceptual overlap with ISO 13485, significant differences remained in structure, terminology, documentation requirements, and inspection methods. Manufacturers long bore duplicative compliance costs: one system, two languages, and dual inspections. FDA announced its quality system modernization and global harmonization direction in 2018, published a proposed rule in 2022, and issued the final rule in 2024, confirming February 2, 2026, as the effective date.

The significance of QMSR is that U.S. medical device quality system requirements now comprehensively align with ISO 13485:2016 by regulation for the first time. The regulatory language has shifted from a FDA-specific QSR framework to an “international standard plus FDA supplemental requirements” framework. This reduces duplicative compliance burden for multinational companies while strengthening the regulatory logic of risk management and full product lifecycle quality assurance.

2. Core Changes Analysis

1. 21 CFR Part 820 incorporates ISO 13485:2016, fundamentally changing the statutory basis for quality system requirements

The revised 21 CFR 820.1 explicitly requires manufacturers to establish and maintain a quality management system that complies with ISO 13485:2016. Definitions in 21 CFR 820.3 are aligned with ISO 13485:2016. Audits and inspections are no longer organized around the old Part 820 subsystems, but are evaluated according to the structure of ISO 13485, including:

• Clause 4: General quality management system requirements (4.1) and documentation requirements (4.2)
• Clause 5: Management responsibility
• Clause 6: Resource management
• Clause 7: Product realization, including design and development (7.3), purchasing (7.4), and production and service provision (7.5)
• Clause 8: Measurement, analysis, and improvement

This means manufacturers’ quality manuals, procedures, process records, and internal audits must clearly map to ISO 13485:2016 clause requirements. A system that only met the old 21 CFR Part 820 will no longer be accepted by FDA as sufficiently compliant.

2. A dual model of “ISO 13485 + FDA supplemental provisions” is established

QMSR does not completely replace all previous FDA requirements. Instead, it creates a model based on ISO 13485:2016, supplemented by FDA-specific requirements. FDA retains several supplementary provisions in 21 CFR Part 820, for example:

• 21 CFR 820.10: General requirements for a quality management system
• 21 CFR 820.15: Clarification of concepts
• 21 CFR 820.20: Record controls
• 21 CFR 820.25: Complaint files
• 21 CFR 820.30: Device labeling and packaging controls
• 21 CFR 820.35: Device master record
• 21 CFR 820.40: Quality plan
• 21 CFR 820.45: Device acceptance
• 21 CFR 820.50: Nonconforming product
• 21 CFR 820.55: Corrective and preventive action
• 21 CFR 820.60: Statistical techniques
• 21 CFR 820.65: Traceability of implantable devices

These provisions reflect FDA statutory requirements that are not fully covered by ISO 13485 or require further clarification. Manufacturers must satisfy both ISO 13485 and these supplemental provisions; otherwise, quality system deficiencies may still be cited.

3. QSIT is retired, and Compliance Program 7382.850 becomes the new inspection basis

The old Quality System Inspection Technique (QSIT) was retired on February 2, 2026. Previously, FDA investigators used QSIT to assess seven subsystems: management controls, design controls, corrective and preventive actions, production and process controls, records/documents/change controls, material controls, and facilities and equipment controls.

After QMSR takes effect, FDA will use Compliance Program 7382.850, which aligns with the structure and process approach of ISO 13485:2016. Investigators will focus less on the old subsystem compliance framework and more on process effectiveness, risk management, and lifecycle controls based on ISO 13485. Manufacturers must reorganize internal audits and inspection readiness according to the new process approach and ISO 13485 clauses, rather than continuing to rely on the old QSIT seven-subsystem approach.

4. The 1997 Design Control Guidance and 2008 PMA manufacturing inspection guidance are withdrawn

In connection with QMSR implementation, FDA also withdrew the 1997 Design Control Guidance for Medical Device Manufacturers and the 2008 PMA manufacturing inspection guidance. It is important to stress that withdrawing the guidance does not eliminate design control or PMA production inspection requirements. Design control requirements remain mandatory through ISO 13485:2016 Clause 7.3 and QMSR supplemental provisions. The real meaning of the withdrawal is that interpretations and inspection approaches based on the old Part 820 no longer align with the new ISO 13485 inspection framework. Manufacturers should instead rely on ISO 13485:2016, FDA-recognized consensus standards, and new FDA guidance documents to establish and maintain their design control system.

5. ISO 13485 certification and QMSR compliance are not simply equivalent

QMSR does not require manufacturers to hold an ISO 13485 certificate, but it does require manufacturers to substantively meet ISO 13485:2016 requirements and the supplemental provisions in 21 CFR Part 820. An ISO 13485 certificate can serve as a foundation for compliance, but it cannot replace FDA inspection. FDA investigators will verify the effectiveness of the manufacturer’s actual quality system implementation, not merely the existence of a certificate. If a manufacturer only maintains an ISO 13485 certificate but fails to implement FDA supplemental requirements, it may still be cited for deficiencies during an FDA inspection.

3. Impact Analysis

1. Impact on manufacturers

For multinational manufacturers that already maintain both the old 21 CFR Part 820 system and ISO 13485 system, QMSR generally reduces burden. However, for manufacturers in China, India, Southeast Asia, and other regions that primarily target the U.S. market, QMSR may impose a systematic quality system upgrade burden. Key impacts include:

• Quality system documents must be restructured: Quality manuals, procedures, and records must be re-mapped to ISO 13485:2016 and 21 CFR Part 820 supplemental provisions.
• Design control requirements are not reduced; they are strengthened: Although the old design control guidance has been withdrawn, ISO 13485 Clause 7.3 imposes more systematic requirements for design and development planning, inputs, outputs, review, verification, validation, changes, and design transfer, with clearer expectations for risk evaluation in design transfer and design changes.
• Risk management must be embedded throughout the entire process: ISO 13485:2016 repeatedly emphasizes a risk-based approach. Manufacturers must demonstrate that risk management is embedded in design, purchasing, production, inspection, complaint handling, and corrective and preventive action.
• Complaints and postmarket surveillance receive greater attention: 21 CFR 820.25 and ISO 13485 Clause 8.2.2 require manufacturers to evaluate and investigate complaints and determine whether they require Medical Device Reporting or field corrections.

2. Impact on the medical device industry

The implementation of QMSR will further promote global convergence of medical device quality system regulation. The United States, European Union, Canada, Australia, Japan, and other major markets increasingly use ISO 13485 as a common basis. The alignment between the MDSAP single audit program and FDA QMSR will also become smoother. For contract manufacturers, critical suppliers, and sterilization service providers in the supply chain, QMSR will also have a significant impact. Brand owners will flow down ISO 13485 and FDA supplemental requirements through purchasing agreements and quality agreements, and supplier audits may become deeper and more frequent.

3. Impact on patients and users

QMSR is centered on a process approach and risk management, helping to identify and control risks earlier in design, production, and postmarket stages. Stronger complaint handling, corrective and preventive action, and adverse event reporting will improve the speed and closed-loop management of postmarket safety signals. In the long run, patients and users will benefit from more consistent, lifecycle-wide quality assurance.

4. Compliance Recommendations

1. Conduct a structured gap analysis

Manufacturers should immediately conduct a gap analysis of their current quality system against ISO 13485:2016 clause by clause, combined with the new supplemental provisions in 21 CFR Part 820. Focus on inputs, outputs, responsibilities, and records for each process in Clauses 4 through 8. Gap analysis results should be documented and incorporated into the corrective and preventive action plan.

2. Restructure quality system documentation

The quality manual should clearly state that the system conforms to ISO 13485:2016 and 21 CFR Part 820 QMSR requirements. Procedures should be updated to use ISO 13485 clause numbering and terminology while retaining FDA-specific supplemental documentation requirements, such as complaint files, device master records, and quality plans. Avoid a situation where old and new numbering systems coexist and cannot be traced.

3. Strengthen design controls and risk management

Design control procedures should cover all requirements of ISO 13485 Clause 7.3 and explicitly address design transfer, design changes, and design history file maintenance. Risk management should be based on ISO 14971 and embedded in design inputs, design outputs, design verification and validation, purchasing, production, complaints, and CAPA. After the design control guidance is withdrawn, manufacturers should not lower design control requirements but should upgrade them according to current standards and FDA expectations.

4. Upgrade complaint handling and postmarket surveillance

Establish complaint handling procedures that satisfy 21 CFR 820.25 and ISO 13485 Clause 8.2.2. Ensure every complaint is evaluated, documented, and assessed for whether it triggers MDR reporting, field corrections, or recalls. Complaint data should be incorporated into data analysis and management review to form a closed-loop continuous improvement system.

5. Strengthen supplier and purchasing controls based on risk

In accordance with ISO 13485 Clause 7.4, implement risk-based supplier classification, evaluation, selection, and re-evaluation. Purchasing information should clearly define quality requirements. Records must be sufficient for critical suppliers and purchasing processes that affect product safety. Where necessary, flow down FDA QMSR requirements to suppliers through quality agreements.

6. Prepare for FDA inspections under CP 7382.850

Internal audit programs should shift from the old QSIT seven-subsystem framework to the ISO 13485 process approach. Manufacturers should use CP 7382.850 to conduct mock inspections, focusing on interfaces between quality management system processes, risk management activities, complaint and CAPA closed-loop systems. Objective evidence should be prepared in advance for 21 CFR and ISO 13485 clauses that may be cited during inspection.

7. Monitor FDA guidance and standard version updates

Manufacturers should continuously track FDA QMSR-related guidance, inspection programs, and consensus standards updates. Although the 1997 design control guidance and 2008 PMA manufacturing inspection guidance have been withdrawn, FDA may issue new design control or PMA inspection guidance. At the same time, manufacturers should ensure they use the current valid version of ISO 13485:2016 and evaluate related standards such as ISO 14971.

5. Timeline and Key Dates

• February 2, 2024: FDA issued the QMSR final rule, amending 21 CFR Part 820.
• February 2, 2026: QMSR took effect; 21 CFR Part 820 formally incorporated ISO 13485:2016; the old QSIT was retired; Compliance Program 7382.850 became applicable; the 1997 design control guidance and 2008 PMA manufacturing inspection guidance were withdrawn.
• After February 2, 2026: All finished medical device manufacturers subject to 21 CFR Part 820 must comply with QMSR during FDA inspections. There is no additional grace period or transition period.

QMSR is not simply a change of standards; it is a comprehensive upgrade of quality system regulatory logic. Only by completing the transformation of system documentation, process controls, risk management, complaint handling, and inspection readiness can manufacturers maintain sustained compliance and stable market access in the new regulatory cycle.