On February 2, 2026, the FDA’s Quality Management System Regulation (QMSR) took effect. It replaces the quality system requirements that had been in 21 CFR Part 820 since 1996 and aligns them with the international standard most device manufacturers already use: ISO 13485:2016.
What changed
- ISO 13485:2016 is incorporated by reference. The core QMS requirements for the US now come from the same standard used for the EU MDR, Canada, Japan and many other markets.
- Part 820 keeps US-specific additions. The QMSR adds definitions and requirements that go beyond ISO 13485, for example around records and labeling and packaging controls. These need to be mapped explicitly.
- Other FDA regulations still apply. Medical Device Reporting (21 CFR 803), corrections and removals (Part 806) and UDI (Part 830) continue to interact with your QMS.
The change most teams underestimate: audit reports
Under the old regulation, FDA policy did not routinely inspect management review, internal quality audit and supplier audit reports. The idea was to encourage candid internal auditing.
The QMSR removed that exception. These records are now part of what an FDA investigator can review. In practice:
- Audit reports need objective evidence and clear, risk-graded findings, not vague notes.
- Findings need follow-up: an investigator will look for the CAPA and its effectiveness check.
- Auditor independence must be visible. ISO 13485 requires that auditors do not audit their own work.
- The audit program should cover every QMS process at a frequency justified by risk.
A practical checklist
| Area | Question to ask |
|---|---|
| Audit program | Does it cover all processes, with a documented risk rationale for frequency? |
| Auditor independence | Can you show that no auditor audited their own work? |
| Reports | Would an outside reader understand each finding and its evidence? |
| CAPA linkage | Is every significant finding linked to a correction or CAPA, with an effectiveness check? |
| Supplier audits | Are critical suppliers evaluated, and are the reports complete? |
| Management review | Does it use audit results as an input and record decisions? |
If you are already ISO 13485 certified, a focused QMSR gap analysis is usually enough to find the differences. If your internal audits were written mainly for internal use, an independent audit cycle is the fastest way to make them inspection-ready.
Sources
FAQ
Does an ISO 13485 certificate mean we comply with the QMSR?
Not automatically. The QMSR incorporates ISO 13485:2016 by reference but keeps additional US requirements, and other FDA regulations such as Medical Device Reporting still apply. An ISO 13485 certificate also does not replace or exempt you from FDA inspection.
Which records can FDA now review that it previously did not?
Under the former Quality System Regulation, FDA policy kept management review, internal quality audit and supplier audit reports out of routine inspection. The QMSR removed that exception, so these records can now be reviewed.