FDA QMSR Explained: 21 CFR 820 Meets ISO 13485 in 2026

FDA QMSR RULE · IN FORCE SINCE FEBRUARY 2, 2026

Federal. Aligned. Inspectable.

For thirty years, a medical device quality manager could hand an FDA investigator a great deal and still, lawfully and politely, decline to hand over three things: the management review minutes, the internal audit reports, and the supplier audit reports. That refusal was written into the regulation. It is not written there anymore. The FDA QMSR rule removed it, and the records your team produced last quarter under the old assumption of privacy are now producible on request.

That single change is the reason the FDA QMSR rule deserves more than a skim. Most coverage of the rule — written before it took effect — framed it as a harmonization story: the United States finally adopting the international standard everyone else already used. True, and pleasant, and incomplete. Harmonization is what the FDA QMSR rule is. Inspectability is what it does.

This guide covers what the QMSR changed, what it deliberately preserved, how FDA now inspects against it under a brand-new compliance program, and the six areas a device manufacturer should verify to confirm the transition is real in practice and not just on paper. It is written for the people who own the answer when an investigator asks — and it draws on what Management Systems International (MSI) has observed across 200+ certification and regulatory audits attended alongside clients.

Key Takeaways on the FDA QMSR Rule

• The FDA QMSR rule took effect February 2, 2026, replacing the legacy Quality System Regulation under 21 CFR Part 820.
• ISO 13485:2016 is incorporated by reference — the international standard now carries the force of U.S. federal law for finished-device manufacturers.
• The § 820.180(c) confidentiality exemption was eliminated. Management review, internal audit, and supplier audit records are now FDA-inspectable.
• QSIT is retired. Compliance Program 7382.850 replaced it, restructuring inspections around a Total Product Life Cycle model rather than four subsystems.
• FDA-specific requirements survive on top of ISO 13485: UDI, MDR reporting, traceability, recall reporting, labeling, and complaint files.
• FDA projects $532–$554 million in annual industry savings from the harmonization.
• The most common gap MSI sees is not systemic — it is procedural language. The system is compliant; the documentation still speaks QSR.

SECTION 1 · CONTEXT

Why the FDA QMSR Rule Replaced the QSR

Harmonize. Modernize. Simplify.

For nearly three decades the United States ran a domestic quality regulation that diverged from the consensus standard every other major regulator used. The Medical Device Single Audit Program — which lets a single audit satisfy regulators in the United States, Canada, Brazil, Australia, and Japan — already ran on ISO 13485. The QSR was the holdout. The FDA QMSR rule closed that gap.

FDA's official QMSR overview states that harmonization aligns the U.S. framework with the one used by other authorities and is intended to bring safe, effective devices to patients sooner. The agency's economic analysis, published with the February 2024 final rule, projects $532 million to $554 million in annual savings from removing the duplicate compliance burden.

Manufacturers operating across jurisdictions consistently reported that maintaining two parallel frameworks added cost, slowed launches, and produced semantic gaps between U.S. and international audit findings. A finding written in QSR vocabulary did not map cleanly onto a notified body's ISO 13485 language, and the reconciliation work fell on the quality team. The ISO 13485 standard has been the global reference for medical device quality systems since 1996. Aligning Part 820 with it ended an artificial split that had outlived its purpose.

But the QMSR is not cosmetic, and reading it as a translation exercise is the single most expensive misread available. The structure changed. The vocabulary changed. The inspection model changed. And the evidentiary posture of your internal records changed permanently.

SECTION 2 · MECHANISM

What the FDA QMSR Rule Actually Says

Reference. Overlay. Layer.

The FDA QMSR rule rewrote 21 CFR Part 820 by incorporating ISO 13485:2016 — and Clause 3 of ISO 9000:2015 for terminology — by reference. In administrative law, incorporation by reference means a second document is treated as though it were fully written into the first. ISO 13485 now carries the same legal force as the regulation that cites it.

There is a practical consequence worth pausing on: the standard is copyrighted, and the regulation does not reprint it. A manufacturer subject to the QMSR must hold a legitimate copy of ISO 13485:2016 to read its own governing law. That is unusual, and it catches small manufacturers off guard.

Most of Part 820 is now either a pointer to a specific ISO 13485 clause or marked “Reserved.” The sections that retain unique FDA wording are the ones where ISO 13485 was not sufficient on its own under U.S. statute.

Core Changes Under the FDA QMSR Rule

• ISO 13485:2016 incorporated by reference. The international standard is now the primary body of QMS requirements inside Part 820.
• ISO 9000:2015 Clause 3 incorporated for terminology. The definitions ISO 13485 relies on come with it.
• Risk-based thinking runs throughout. ISO 13485 threads risk through the whole QMS, not only design — a meaningful departure from the QSR's more prescriptive shape.
• Legacy terminology retired. Design History File, Device Master Record, and Device History Record are no longer defined terms. The underlying records survive under ISO 13485 vocabulary.
• “Design controls” becomes “design and development.” The discipline is preserved; the name aligns with the standard.
• The FDA-specific overlay is retained. UDI, traceability, MDR vigilance reporting, recall reporting, and labeling controls remain layered on top of ISO 13485.

SECTION 3 · CROSSWALK

The QSR-to-ISO 13485 Crosswalk Every Procedure Needs

Map. Rewrite. Retrain.

The documentation work created by the QMSR is unglamorous and unavoidable. Every quality manual, SOP, work instruction, form, and audit checklist that cites a QSR section number is now citing a regulation that no longer reads the way it is quoted. The table below is the reconciliation map MSI walks clients through during a planning session.

MSI client experience suggests this crosswalk is where transitions quietly fail. The system is fine. The engineers are doing the right work. But an audit checklist still asks “is the DHF complete?” and an investigator working from the QMSR hears a company describing its own quality system in a language the regulation retired. The finding that follows is not about capability. It is about control of documents — a discipline MSI covers in its guide to document control that actually holds up.

SECTION 4 · THE BIG ONE

Why the FDA QMSR Rule Made Your Audit Records Inspectable

Exposed. Evidentiary. Permanent.

Under the prior QSR, 21 CFR § 820.180(c) carved out a confidentiality exemption. Management review records, internal quality audit reports, and supplier audit reports did not have to be produced during an FDA inspection. A manufacturer could decline. Many did, as a matter of routine policy. The FDA QMSR rule eliminated that exemption outright.

FDA's reasoning is disarmingly reasonable: manufacturers already hand these reports to notified bodies, MDSAP auditors, and other regulators. Producing them for FDA formalizes a reality that already exists. But the effect on the room changes. Every management review meeting held under the QMSR now produces a record that a federal investigator may read.

The instinct this provokes is exactly the wrong one. The temptation is to write softer minutes — to record fewer findings, to blur an unresolved action, to describe a serious escalation as “under discussion.” That instinct will produce a worse outcome than the honest record ever could. An investigator who reads a management review that surfaces three real problems and documents three assigned owners with due dates sees a functioning system. An investigator who reads a management review in which nothing was ever wrong sees a system that does not detect anything. Under the QMSR, sanitized minutes are not protection. They are a finding waiting to be written.

What Inspectable Actually Means for the Three Record Types

• Management review records (Clause 5.6.3). Twelve required inputs under 5.6.2. A review chaired by the management representative with the CEO logged as “absent, reviewed minutes” is a documented gap — and one now visible to FDA. MSI's ISO 13485 management review playbook works through all twelve inputs and the decisions each must produce.
• Internal audit reports (Clause 8.2.4). An investigator can now compare what your own auditors found against what your CAPA system did about it. The gap between those two documents is the most revealing artifact in a device QMS.
• Supplier audit reports (Clause 7.4). If a supplier audit flagged a nonconformity in 2025 and the supplier is still on the approved list with no evidence of follow-up, the FDA QMSR rule has now made that visible.

SECTION 5 · INSPECTION MODEL

How FDA Inspects Under the FDA QMSR Rule Now

Lifecycle. Risk. Integration.

The Quality System Inspection Technique — the four-subsystem method FDA investigators used from 1999 onward — was withdrawn when the QMSR took effect. In its place FDA issued Compliance Program 7382.850, Inspection of Medical Device Manufacturers, with an implementation date of February 2, 2026. It supersedes both CP 7382.845 and CP 7383.001, the PMA pre- and postmarket inspection program.

This is the part of the QMSR transition most organizations have not rehearsed. If your internal audit program, your mock-inspection drills, and your front-room binder were all organized around the QSIT subsystems — Management, Design, Production & Process Controls, and Corrective & Preventive Actions — you are rehearsing for an inspection that no longer happens that way.

What Changed in the Inspection Itself

• Total Product Life Cycle assessment. CP 7382.850 structures the inspection around the device's full lifecycle rather than four discrete subsystems, with benefit-risk-informed compliance decisions.
• Other Applicable FDA Requirements (OAFR). The program explicitly directs investigators to assess UDI, medical device tracking, corrections and removals, and MDR practices alongside the QMS itself. These are not side topics under the FDA QMSR rule — they carry their own reporting codes.
• Defined inspection types. Baseline surveillance, non-baseline surveillance, compliance follow-up, for-cause, and specific-product-risk assignments each carry distinct scope and triggers.
• System function over system existence. The practical shift most quality leaders report: investigators are less interested in whether a procedure exists and more interested in whether the system behaves as an integrated, risk-driven whole.

Organizations that want their internal audit program to actually predict an FDA outcome under the QMSR need to restructure it around this model. MSI's guidance on internal audit planning lays out how to build a schedule that follows the product rather than the org chart — and the ISO 19011:2026 revision pushes in the same direction by requiring defined objectives for every audit, not just scope and criteria.

SECTION 6 · THE OVERLAY

What the FDA QMSR Rule Did Not Change

Retained. Layered. Mandatory.

A dangerous simplification circulating since February is that the QMSR means “ISO 13485 certification equals FDA compliance.” It does not. ISO 13485 is now the QMS backbone, but a set of uniquely American obligations sits on top of it, and they are exactly the requirements a certified-but-complacent manufacturer forgets to demonstrate.

The FDA Overlay Requirements That Survived

• Unique Device Identification — 21 CFR Part 830, plus FDA's UDI system requirements. ISO 13485 does not require a UDI. U.S. law does.
• Medical Device Reporting — 21 CFR Part 803. Vigilance timelines and reportability decisions remain FDA-specific.
• Device tracking — 21 CFR Part 821.
• Corrections and removals — 21 CFR Part 806.
• Labeling and packaging controls — Part 820 §§ 820.35 and 820.45, retained with unique FDA wording.
• Combination products — 21 CFR Part 4, whose cross-references were amended to point at the FDA QMSR rule. A device-led combination product must satisfy the QMSR and the applicable drug cGMP provisions.

Device classification also survives unchanged. Whether a given provision of the QMSR applies to your product still depends on where the device sits in FDA's classification scheme — certain Class I devices retain partial exemptions, and the classification regulation for your specific product remains the authority.

SECTION 7 · RISK

Risk Management Under the FDA QMSR Rule

Embedded. Continuous. Provable.

The QSR treated risk analysis largely as a design-phase activity. ISO 13485 — and therefore the QMSR — treats it as a property of the whole management system. Risk-based thinking is expected to appear in supplier qualification, in process validation decisions, in change control, in the sampling plans behind acceptance activities, and in how CAPA is prioritized.

ISO 13485 points to ISO 14971 as the risk management method, and FDA maintains it among the recognized consensus standards a manufacturer can declare conformity to. The practical implication under the QMSR is that a risk file which exists only as a design-era artifact — written once, filed, never revisited against post-market data — is now visibly out of step with the regulation.

This is where CAPA under ISO 13485 becomes the connective tissue. Complaint data feeds risk. Risk reprioritizes CAPA. CAPA feeds design change. Design change feeds validation. Organizations whose change control still runs on email and shared drives struggle to demonstrate that loop — a failure mode MSI examines in its analysis of ISO 9001 change management automation, where design changes under Clause 7.3.9 are now squarely inside federal regulation.

SECTION 8 · SUPPLIERS

Supplier Controls: The Quiet Exposure in the FDA QMSR Rule

Evaluate. Monitor. Evidence.

Clause 7.4 asks a manufacturer to evaluate and select suppliers based on their ability to meet requirements, to apply controls proportionate to the risk the purchased product carries, and to keep records of the evaluation. Straightforward on paper. The exposure created by the QMSR is that the supplier audit reports behind those records are now inspectable.

Organizations typically report that supplier files are the least-maintained corner of a device QMS. The approved supplier list is current. The supplier evidence often is not: an audit from three years ago, a certificate that expired, a corrective action request the supplier never closed. Under the old QSR the manufacturer could keep that quietly to itself. Under the QMSR it is on the table.

The remedy is unglamorous: reconcile the approved supplier list against the actual evidence file, close what is open, and set a monitoring cadence proportionate to risk. Manufacturers whose supply chain spans additive manufacturing, sterilization, or contract testing carry more of this exposure than most — MSI covers those cases in its work on ISO for additive manufacturing and ISO for scientific service providers.

SECTION 9 · VERIFICATION

Six Areas to Verify Under the FDA QMSR Rule

Review. Reconcile. Refine.

Most U.S. manufacturers planned their transition during 2024 and 2025. Now that the QMSR is in force and inspections are running under the new compliance program, the useful question is no longer “did we plan?” but “did the plan land?” A structured planning session against the QMSR covers six areas.

1. Procedure mapping. Every procedure citing a QSR clause should now cite the corresponding ISO 13485 clause, with the FDA Part 820 overlay named where it applies. Confirm the cross-references are current and that staff have been retrained on the vocabulary. A procedure that says the right thing while the operator says “DHF” out loud in an interview is only half-transitioned.
2. Management review records. Review the most recent minutes against Clauses 5.6.2 and 5.6.3. All twelve inputs addressed, decisions documented, owners and dates assigned. Under the FDA QMSR rule these are inspection-ready or they are a finding — MSI's Medical Device ISO 13485 Management Review Tool Kit is the fastest way to close the distance between the two.
3. Internal audit program. Confirm the schedule covers all applicable ISO 13485 clauses on a planned basis, that reports are retrievable, and that the program is structured for the lifecycle model rather than the retired QSIT subsystems.
4. Supplier audit documentation. Reconcile the approved supplier list against the evidence behind it. Everything the FDA QMSR rule made inspectable for internal audits applies equally here.
5. Risk management integration. Demonstrate risk-based thinking in design, supplier qualification, CAPA, validation, and monitoring — not only in a design-era risk file.
6. FDA overlay coverage. UDI, MDR, tracking, corrections and removals, labeling, and complaint specifics addressed explicitly in the QMS — not assumed to be covered by the ISO 13485 reference.

MSI client experience suggests the most common shortfall under the QMSR is not a broken process. It is procedural language: quality manuals and SOPs still referencing QSR section numbers, “Design History File,” “Device Master Record,” or QSIT subsystems in audit checklists. The substance of the system is often current. The documentation lags — and the documentation is what an investigator reads first.

Smaller manufacturers carry the most of this exposure, because the original QMS was frequently assembled from QSR-era templates. MSI's caution to medical device startups that misread ISO 13485 and its guide to what ISO 13485 does to a device launch both walk through where those templates break.

SECTION 10 · CROSS-REFERENCES

The 179-Section Cleanup the FDA QMSR Rule Triggered

Editorial. Sweeping. Consequential.

In December 2025 FDA issued technical amendments updating 179 sections across 18 parts of Title 21 to conform existing references to the QMSR. The amendments are editorial in character — but the reach (parts 801, 803, 812, 860, 862, 864, 866, 868, 872, 874, 876, 878, 880, 882, 886, 888, 890, 892) shows how deeply Part 820 is woven into the wider device framework.

For documentation owners the implication is concrete: any internal procedure, work instruction, quality manual, or regulatory submission template citing 21 CFR sections needs a cross-reference sweep. References to § 820.30 (Design Controls), § 820.180 (Records) and § 820.198 (Complaint Files) under the old QSR now resolve differently under the QMSR. This is exactly the kind of change that a well-run first management review should catch and assign.

SECTION 11 · UPSIDE

The Real Benefits of the FDA QMSR Rule

Cost. Speed. Confidence.

For all the exposure it creates, the QMSR is a net reduction in regulatory friction — particularly for manufacturers who sell outside the United States.

One System Instead of Two

FDA's economic analysis projects $532 million to $554 million in annual industry savings, driven by the elimination of duplicate quality documentation, reduced audit overhead under MDSAP, and training consolidated around a single standard. Organizations typically report that the savings surface as reduced audit-preparation and consulting hours rather than as a visible line item.

Faster Market Access

A QMS that satisfies the FDA QMSR rule simultaneously satisfies the ISO 13485 certification requirements used by EU notified bodies, Health Canada, ANVISA, the TGA, and the PMDA. For an organization expanding internationally, the distance between U.S. clearance and a second-jurisdiction filing has genuinely compressed. The wider 2026 ISO revisions reinforce the point: ISO 13485 was reaffirmed at its 2016 edition rather than rewritten, precisely because so much regulatory machinery — now including FDA's — depends on its stability.

A More Honest System

This is the benefit nobody puts in a press release. When management review minutes and internal audit reports become visible to a regulator, the incentive to run those meetings seriously goes up. Organizations that had drifted into ceremonial management reviews — a slide deck, a nod, an adjournment — tend to rebuild them into real ones. The FDA QMSR rule made a governance practice consequential, and consequential practices improve.

For manufacturers who want to prove maturity rather than merely assert it, the FDA Voluntary Improvement Program now measures the same system the FDA QMSR rule enforces — improving one improves both. Sustained performance is also what continuous improvement under ISO 13485 is built to deliver, and what MSI's SureResults maintenance program keeps running between audits.

SECTION 12 · WHERE EXPERTISE FITS

What ISO Consulting Adds to an FDA QMSR Rule Transition

Pattern. Precision. Proof.

The value of experienced ISO consulting on an FDA QMSR rule transition is not that a consultant knows the regulation. The text is public; anyone can read it. The value is pattern recognition — knowing, before you open a single binder, which three places a QSR-era system almost always fails to translate.

That is measurable, not rhetorical. Across 28 years, Management Systems International (MSI) has supported 80+ certifications, attended 200+ audits alongside clients, and counts 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries. Sitting on the client's side of the table through 200+ audits is a specific education: you learn what an auditor reaches for second, after the procedure checks out. Under the FDA QMSR rule, what they reach for second is now the management review file.

ISO 13485 is also the deliberate exception in the standards family. Unlike ISO 9001, ISO 14001, ISO 45001, and ISO 7101, it does not use the harmonized ten-clause structure — it keeps its own architecture, with the medical device file at Clause 4.2.3 and competence tied to defined roles at Clause 6.2. Knowing precisely where ISO 13485 converges with and diverges from the rest is the kind of precision good ISO consulting exists to supply, and MSI lays that map out in its ISO consulting decoder ring.

MSI builds ISO 13485 quality systems around how a team actually designs, manufactures, validates, and ships product — engineered to satisfy the FDA QMSR rule, MDSAP, and EU MDR at once, without bloating documentation or grinding operations to a halt. For organizations starting from a blank page, SurePath carries the build through to first-pass certification, and MSI's clients span the regulated industries where getting this wrong is expensive.

SECTION 13 · FREQUENTLY ASKED

FDA QMSR Rule — Common Questions

Direct. Practical. Current.

When did the FDA QMSR rule take effect?

Which records became inspectable under the FDA QMSR rule?

Does ISO 13485 certification mean I comply with the FDA QMSR rule?

What replaced QSIT under the FDA QMSR rule?

Do I still need a Design History File under the FDA QMSR rule?

Does the FDA QMSR rule apply to combination products?

Are any manufacturers exempt from the FDA QMSR rule?

What should a manufacturer verify now under the FDA QMSR rule?

Related Reading on the FDA QMSR Rule and ISO 13485