QMSR: A Comprehensive Guide to FDA’s Quality Management System Regulation

The U.S. Food and Drug Administration’s Quality Management System Regulation, or QMSR, is the current regulatory framework for medical device quality management systems under 21 CFR Part 820. Effective February 2, 2026, it incorporates ISO 13485:2016 by reference while retaining FDA-specific requirements and the agency’s inspection and enforcement authority. For manufacturers, the central obligation is to operate a quality management system that meets both the applicable international standard and U.S. regulatory requirements. (FDA QMSR page)

QMSR represents a significant step toward international regulatory alignment. Manufacturers must also understand how the incorporated standard, FDA’s supplemental provisions, other device regulations, and the revised inspection framework work together.

1. What Is QMSR?

QMSR establishes current good manufacturing practice requirements for the methods, facilities, and controls used in the design, manufacture, packaging, labeling, storage, installation, and servicing of finished medical devices intended for human use. Its purpose is to help ensure that devices are safe, effective, and compliant with the Federal Food, Drug, and Cosmetic Act (FD&C Act).

The regulation requires manufacturers to document a quality management system that complies with applicable requirements of ISO 13485:2016 and the additional requirements in Part 820. It also expressly connects quality system processes to other FDA obligations, including medical device reporting, unique device identification, tracking, and corrections and removals.

FDA amended Part 820 and changed its title from the Quality System Regulation, commonly called QSR, to the Quality Management System Regulation. Part 820 remains the legal home of FDA’s device quality system requirements.

2. Why FDA Changed the Previous Framework

FDA’s medical device CGMP framework dates to 1978. A major revision published in 1996, effective in 1997, introduced the quality system framework familiar to many manufacturers, including design controls. That revision also sought greater consistency with international quality standards available at the time.

QMSR continues that alignment effort by using ISO 13485:2016 as its foundational quality management system standard. FDA identifies consistency across regulatory systems and reduced burden on regulated industry as key reasons for incorporation by reference.

U.S. regulatory authority stays with FDA. Where the incorporated standard conflicts with the FD&C Act or its implementing regulations, the U.S. statutory and regulatory requirements control.

3. The Regulatory Structure: What Manufacturers Must Read Together

QMSR is best understood as a combination of three layers:

1. ISO 13485:2016, which supplies the foundational medical device quality management system requirements.
2. FDA-specific provisions in Part 820, including definitions, applicability rules, recordkeeping supplements, and labeling and packaging controls.
3. Other applicable FDA regulations, which continue to govern activities such as adverse event reporting and corrections and removals.

QMSR also incorporates Clause 3 of ISO 9000:2015 for terms and definitions. It incorporates no other part of ISO 9000 as a separate set of operating requirements.

The principal sections of revised Part 820

These are the six substantive sections of the revised regulation; several other section numbers and subparts are reserved. Many requirements now reside in the incorporated standard, so the text of Part 820 alone understates the obligations.

4. Who Must Comply?

QMSR applies to finished device manufacturers whose devices are commercially distributed in the United States, including foreign manufacturers exporting devices to the U.S. A finished device includes an accessory that is suitable for use or capable of functioning, even if it has not yet been packaged, labeled, or sterilized.

The term “manufacturer” extends beyond a company operating a production line. Covered functions can include:

• Design and specification development.
• Contract sterilization.
• Relabeling and repacking.
• Initial distribution for foreign entities that perform these functions.
• Other covered activities involving finished devices.

A manufacturer performing only some covered operations generally must comply with the requirements applicable to those operations. The quality system must be appropriate for the manufacturer’s devices and activities.

Components and accessories

Manufacturers of components or parts of finished devices are generally not directly subject to Part 820 solely because they manufacture those components. Accessories, however, can themselves qualify as finished devices and therefore fall within QMSR.

CGMP exemptions

Certain device types are exempt from CGMP requirements under their classification regulations. FDA explains that finished device manufacturers of exempt devices must still maintain complaint files and meet the general record requirements in § 820.35.

Manufacturers must therefore check the applicable classification regulation and the specific requirement involved.

5. What Changed, and What Stayed the Same

These changes should be read together. International alignment changes the structure of compliance, while FDA oversight and the need for regulatory compliance remain.

6. Risk Management and Lifecycle Controls

FDA describes the incorporation of ISO 13485:2016 as promoting consistency in design, production, and lifecycle controls while specifically requiring risk management. Risk considerations belong within the operating quality system and inform decisions across the lifecycle.

As a practical implementation approach, manufacturers should examine how risk information connects decisions across:

• Design and development.
• Supplier and outsourced-process controls.
• Manufacturing and process changes.
• Nonconforming product.
• Complaint evaluation.
• Corrective and preventive action.
• Postmarket feedback.

These are suggested areas for a gap assessment. FDA does not prescribe this list. The objective is to make the relationship between identified risks, chosen controls, and evidence of effectiveness visible within the QMS.

7. Design and Development Requirements

Section 820.10(c) requires compliance with ISO 13485’s Clause 7.3 and its subclauses for manufacturers of Class II and Class III devices, as well as specified Class I devices. The Class I scope covers devices automated with computer software and the five devices listed in the regulation.

For affected manufacturers, a compliance review should trace how design planning, requirements, reviews, verification, validation, transfer, and changes are documented against the incorporated requirements. The review should test substantive evidence against each requirement. Learn more about eLeaP’s Design and Development system.

FDA also states that investigational devices manufactured under an investigational device exemption (IDE) remain subject to the applicable design and development requirements.

8. FDA-Specific Requirements That Remain Essential

Complaint records

Section 820.35 supplements ISO 13485’s complaint-handling and record-control requirements. Manufacturers must maintain records of the review, evaluation, and investigation of complaints involving possible failure of a device, labeling, or packaging to meet specifications. If a similar complaint has already been investigated, another investigation may be unnecessary, but the justification must be documented.

For MDR-reportable complaints, complaints the manufacturer determines must be investigated, and complaints it investigated regardless of those requirements, required information includes:

• Device name.
• Date the complaint was received.
• Any UDI or UPC, and any other device identification(s).
• Complainant’s name, address, and telephone number.
• Nature and details of the complaint.
• Correction or corrective action taken.
• Any reply to the complainant.

Complaint handling also connects to medical device reporting: § 820.10 expressly requires notification to FDA when complaints meet the reporting criteria in 21 CFR Part 803. Maintaining a complaint record and determining reportability are related but distinct responsibilities.

Servicing records

For servicing activities, § 820.35(b) requires, at minimum, the device name; any UDI or UPC and any other device identification(s); the date of service; the individual(s) who serviced the device; the service performed; and any test and inspection data.

A practical review should therefore check whether service documentation captures the work performed and the test and inspection data supporting the result.

Identification and traceability

QMSR links identification requirements to Part 830 and applicable tracking procedures to Part 821. It also requires the UDI to be recorded for each medical device or batch of medical devices.

In addition, § 820.10(d) requires manufacturers of devices that support or sustain life, whose failure when properly used according to the labeling’s instructions for use can reasonably be expected to result in significant injury, to comply with ISO 13485 Clause 7.5.9.2, Traceability for Implantable Devices, as appropriate. This FDA-specific requirement sits alongside the ISO text.

Labeling and packaging

Section 820.45 requires documented procedures addressing labeling and packaging integrity, inspection, storage, and operations under customary processing, handling, distribution, storage, and, where appropriate, use conditions.

Manufacturers must examine labeling and packaging for accuracy before release or storage, as applicable. The specified checks include device identification, expiration dates, storage instructions, handling instructions, and additional processing instructions. Labeling release and the results of specified labeling inspections must be documented, and operations must prevent mix-ups.

9. Other FDA Regulations Still Apply

QMSR does not consolidate every device obligation into Part 820. Section 820.10 expressly identifies connections to:

These references show how a quality system can align with ISO 13485 and still have gaps in FDA compliance. Manufacturers must account for the U.S. regulatory activities attached to their products and operations.

10. How FDA Inspections Changed

On February 2, 2026, FDA stopped using the Quality System Inspection Technique, or QSIT, and began using the inspection process described in Compliance Program 7382.850, Inspection of Medical Device Manufacturers.

Management review and audit records are inspectable

FDA confirms that QMSR permits inspection of management review, quality audit, and supplier audit reports. The exceptions previously contained in § 820.180(c) were not retained. These records should be readily available during inspection. As a suggested management practice, give findings clear owners, document decisions, and close promised actions.

Historical records may be reviewed

FDA investigators may review QMS records created before February 2, 2026, when determining compliance. At an April 1, 2026 CDRH town hall, FDA panelists stated that manufacturers do not need to revise or recreate those earlier records to meet QMSR requirements, and do not need to remove QSR-era terms such as design history file or device master record. They also stated that FDA expects manufacturers to identify where processes need to change to comply with QMSR and to plan and carry out those changes. FAQ Q7 adds that a comparative analysis can help show that earlier records meet QMSR requirements. An older record can stay as it is and still be reviewed during an inspection.

FDA inspections are not ISO or MDSAP audits

FDA states that QMSR inspections follow the risk-based process in Compliance Program 7382.850 and do not follow the MDSAP audit plan or procedures. An external audit agenda should not be treated as the FDA inspection plan. MDSAP remains available as a voluntary third-party audit program.

11. Is ISO 13485 Certification Required?

No. FDA does not require a certificate of conformity to ISO 13485, does not issue such certificates, and does not exempt certified manufacturers from FDA inspection.

Three concepts must remain distinct:

• Conformity with applicable ISO 13485 requirements.
• Third-party certification to ISO 13485.
• Compliance with QMSR and other applicable FDA requirements.

QMSR requires conformity with the applicable substantive requirements. A certification audit can contribute evidence, but the certificate itself does not establish that FDA-specific obligations have been met.

At the April 1, 2026 CDRH town hall, FDA’s Division of Industry and Consumer Education stated that a notified body audit focused on ISO 13485 conformity may not replace an internal audit of QMSR requirements, although its findings can complement that internal audit.

12. A Practical Compliance and Sustainment Roadmap

QMSR has been effective since February 2, 2026, so implementation is an operating compliance responsibility. The following steps are a suggested management approach.

Step 1: Establish the applicable scope

Identify devices, classifications, sites, activities, outsourced operations, and relevant exemptions. Record which requirements apply and the basis for any exclusions or non-applicability decisions.

Step 2: Build a requirements crosswalk

Map existing procedures and records against:

• Applicable ISO 13485:2016 requirements.
• FDA-specific Part 820 provisions.
• Other applicable FDA regulations.

Crosswalk fields can include the requirement, responsible process, procedure, objective evidence, gap, owner, and completion date.

Step 3: Test implementation, not just documentation

Sample actual complaint, design, production, servicing, supplier, and corrective-action records. A revised procedure is not sufficient evidence that the process operates as intended.

Step 4: Prioritize consequential gaps

A sensible remediation sequence gives early attention to gaps affecting patient safety, product release, reportability decisions, traceability, and the integrity of essential records.

Step 5: Review inspection-accessible records

Assess management reviews, internal audits, and supplier audit reports for clear findings, decisions, assigned actions, and follow-up. Keep records retrievable and preserve their history.

Step 6: Train by responsibility

Training should explain how requirements affect actual work. Complaint personnel, engineers, production teams, service staff, executives, and supplier-quality personnel may benefit from role-specific operational examples.

Step 7: Verify and sustain

Use internal audits and management review to test whether corrective work is effective. Track unresolved issues through closure, and continue the compliance effort after a successful external audit.

This approach reflects the regulation’s combined structure: an applicable documented QMS, FDA-specific supplements, and continuing inspection oversight.

13. Common Questions

Did QMSR replace Part 820?

No. FDA amended and retitled Part 820, incorporating ISO 13485:2016 into its requirements.

Does ISO 13485 certification demonstrate QMSR compliance?

Certification is not required and, by itself, does not establish compliance with all applicable FDA requirements. It also leaves FDA inspection authority in place.

Can FDA review records created under the QSR?

Yes. FDA investigators may review earlier QMS records. Manufacturers do not need to rewrite them, and FDA expects any process gaps found to be addressed.

Does a CGMP exemption remove complaint and record obligations?

Finished device manufacturers of CGMP-exempt devices still keep complaint files and meet the general record requirements in § 820.35.

Does a shorter Part 820 mean fewer quality system responsibilities?

Many requirements now operate through the incorporation by reference of ISO 13485:2016, so the remaining text of Part 820 gives an incomplete picture on its own.

14. Consequences of Noncompliance

Section 820.10(e) states that failure to comply with an applicable requirement renders a device adulterated under section 501(h) of the FD&C Act. The device and persons responsible for the failure are subject to regulatory action.

For imported devices, § 820.1(c) also identifies refusal of admission as a potential consequence where the device appears adulterated under applicable law and regulations.

Conclusion

QMSR brings FDA’s medical device quality system framework closer to the international approach built around ISO 13485:2016, while preserving U.S.-specific requirements and regulatory authority. QMSR has been effective since February 2, 2026, and FDA now uses the revised inspection framework.

For manufacturers, the lasting task is to maintain a coherent system in which procedures, operational records, risk decisions, complaint evaluations, and management actions support one another. A requirements crosswalk can organize that work; reliable evidence that processes function as intended is what makes the system credible.