The FDA QMSR (Quality Management System Regulation) is the regulation that replaced the Quality System Regulation (QSR) on February 2, 2026. The QMSR is still found in 21 CFR Part 820 but incorporates ISO 13485:2016 by reference, so most of Part 820 now points to a clause of ISO 13485 instead of stating the requirement itself. A handful of sections remain in Part 820 because FDA concluded ISO 13485 did not adequately cover them: scope, definitions, incorporation by reference, quality management system requirements, control of records, and device labeling and packaging controls.
If you already conform to ISO 13485:2016, most of your quality system carries over. What does not carry over automatically is the FDA-specific overlay, and that is what this article covers.
On January 31, 2024, FDA released its Final Rule for the new Quality Management System Regulation (QMSR).
The new QMSR is the result of aligning the current good manufacturing practice (cGMP) requirements of the FDA’s Quality System Regulation (QSR) with the international consensus standard for medical device quality management systems, ISO 13485:2016.
The medical device industry had been anticipating harmonization between FDA’s QSR and ISO 13485 since 2018. As of February 2, 2026, it’s finally done.
It’s a major step toward global harmonization, and one medical device professionals waited years for.
Below: why FDA harmonized the two, what changed in Part 820, and what the FDA QMSR means for your quality system and your next inspection.
QMSR vs. QSR: How are they different?
FDA incorporated ISO 13485:2016 into Part 820 by reference, along with Clause 3 of ISO 9000:2015 (terms and definitions). The QMSR now addresses most requirements by pointing to their location in the standard instead of restating them, which substantially changed 21 CFR Part 820.
The good news is, many of these changes are semantic in nature and don’t change the basic QMS requirements for medical device companies. For instance, you’ll notice that the terms device master record (DMR), design history file (DHF), and device history record (DHR) don’t appear in the final rule.
That doesn’t mean, however, that the documentation requirements of the DMR, DHR, and DHF have been eliminated. FDA concluded those requirements are adequately described in the standard and are now covered by records such as the medical device file (Clause 4.2.3) and the design and development file (Clause 7.3.10).
On the other hand, there are terms and definitions in ISO 13485 that “could create inconsistencies with FDA’s statutory and regulatory framework.”
In these cases, the FDA’s definitions will supersede those of ISO 13485. For example, ‘device’ and ‘labeling’ supersede the definitions for ‘medical device’ and ‘labelling’ in ISO 13485.
The Final Rule also includes several new sections in Part 820:
-
Section 820.7 - Incorporation by reference
-
Section 820.10 - Requirements for a quality management system
-
Section 820.35 - Control of records
-
Section 820.45 - Device labeling and packaging controls
For context, here’s a screenshot of the table of contents from the QMSR Final Rule.
.png)
That last section, 820.45, could use a little more attention. FDA has previously pointed out that there are device recalls every year related to product labeling and packaging.
Clause 7.5.1(e) of ISO 13485 states that “defined operations for labeling and packaging shall be implemented”, but FDA doesn’t seem to think this goes far enough. That is why the agency added a new labeling and packaging clause to Part 820.
Section 820.45 requires “procedures that provide a detailed description of labeling and packaging activities to ensure the integrity, inspection, storage, and operations for labeling and repackaging.”
The main items Section 820.45 requires are:
-
UDI or UPC
-
Expiration date
-
Storage instructions
-
Handling instructions
-
Processing instructions
Keep in mind, this is all in addition to 21 CFR Part 801 - Labeling, which lays out the specific requirements for the labeling of medical devices.
February 2026 has passed. If you have not reviewed your labeling and packaging procedures against 820.45, that review is overdue rather than optional.
.png)
Where each QSR subsystem lives under QMSR
Nothing in the list below was deleted. Each requirement moved from an explicit paragraph in the old QSR to a referenced clause of ISO 13485:2016, or in two cases to a new section FDA wrote into Part 820. If you are updating procedure cross-references, this is the map.
| Subsystem | Old QSR section | Where the requirement sits under QMSR |
|---|---|---|
| Design controls | 820.30 | ISO 13485:2016 Clause 7.3 |
| Corrective and preventive action | 820.100 | ISO 13485:2016 Clauses 8.5.2 and 8.5.3 |
| Management review | 820.20(c) | ISO 13485:2016 Clause 5.6 |
| Internal audits | 820.22 | ISO 13485:2016 Clause 8.2.4 |
| Risk management | 820.30(g), applied to design | ISO 13485:2016 Clause 7.1, referencing ISO 14971 |
| Complaint handling | 820.198 | ISO 13485:2016 Clause 8.2.2, plus new Part 820.35 |
| Records and retention | 820.180 | ISO 13485:2016 Clause 4.2.5, plus new Part 820.35 |
| Labeling and packaging | 820.120, 820.130 | New Part 820.45, which FDA added because it found ISO 13485 Clause 7.5.1(e) insufficient |
The practical implication for most manufacturers is documentation, not process. Your design control procedure almost certainly still describes the right activity; the citation at the top of it is now wrong.
Why did FDA harmonize the QSR with ISO 13485?
While ISO 13485 was revised repeatedly over two decades, the QSR stayed nearly unchanged from its publication in 1996 until the QMSR replaced it.
When it first proposed the QMSR, FDA admitted that “regulatory expectations for a QMS have evolved since the current Part 820 was implemented over 20 years ago,” and that, “By proposing to incorporate ISO 13485 by reference, we are seeking to explicitly require current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.”
FDA also notes that it has paid attention to the revisions to ISO 13485 over the years, and the agency feels the 2016 version of the standard is closely aligned with requirements of 21 CFR Part 820. All ISO standards are reviewed every five years to decide whether they need updating, and the current version of ISO 13485 was reviewed and confirmed in 2025, and won’t be up for review again until 2030.
FDA repeatedly mentions in its Final Rule that the QMS requirements in Part 820 and ISO 13485 are substantially similar and the burden of complying with the new QMSR should not be any greater than that of current compliance with the QSR.
In fact, the agency believes that harmonization will further the cause of “regulatory simplicity and global harmonization and should reduce burdens on a regulated industry, thereby providing patients more efficient access to necessary devices.”
What the FDA QMSR means for medical device manufacturers
While this may seem like a lot of change for medical device manufacturers, it’s important to keep in mind that the requirements of ISO 13485:2016 and the QSR are really not all that different. The QMSR does not require a total overhaul of your QMS.
With that said, there are a few things to keep in mind regarding the new QMSR:
-
The Final Rule also amends 21 CFR Part 4 — Regulation of Combination Products. FDA has made “conforming edits” to clarify QMS requirements for combination products. Note that these edits do not affect the CGMP requirements for combination products.
- The old Quality System Inspection Technique (QSIT) was retired on February 2, 2026. FDA created a new document in its place: the updated Inspection of Medical Device Manufacturers Compliance Program (CP) 7382.850. See what FDA investigators will look for under QMSR. You can also find more information on inspections in Comment 81 and its response.
- Getting or having ISO 13485:2016 certification does not mean you will automatically be in compliance with the new QMSR. You will not be exempt from FDA inspections if you are already ISO 13485-certified. You will not be issued an ISO 13485 certification of conformance after an FDA inspection.
What FDA can now review during an inspection
Under the old QSR, 21 CFR 820.180(c) kept management review, internal quality audit, and supplier audit reports out of FDA inspections. The QMSR removed that exception. Since February 2, 2026, FDA investigators can review these records, including records created before that date. FDA’s own FAQ suggests a comparative analysis can help show that older records meet QMSR requirements. For how investigators decide what to review under Compliance Program 7382.850, see what FDA investigators look for under QMSR.
If you have not yet run a gap assessment against these sections, start there, even if your QMS already conforms to ISO 13485:2016. Our free QMSR gap assessment tool is a good place to begin.
Modernize your QMS with Greenlight Guru
While you’re thinking about the changes you need to make to comply with the QMSR, it also makes sense to take a step back and look at the QMS solution you’re using.
Is it built specifically for MedTech? Does it help you achieve truly paperless audits? Does it come with a top-notch team of medical device experts who are always ready to help?
If you answered ‘no’ to any of those questions, it’s probably time to modernize your QMS.
At Greenlight Guru, we built our QMSR-ready eQMS for medtech companies because we know that changing standards and regulations, QMSR included, are a lot to handle for even the most seasoned medical device companies. That’s why our QMS comes pre-validated per FDA and ISO best practices, so you don’t have to worry about customization for compliance.
So if you’re ready to experience the power of a purpose-built QMS, then get your free demo of Greenlight Guru today!
FDA QSR, QMSR & ISO 13485:2016 Internal Audit Checklist
