FDA QMSRQuality Management System Regulation

The Quality Management System Regulation (QMSR) is the final rule FDA issued on 2 February 2024 that amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, along with a small set of US-specific provisions. The rule has a two-year transition period and takes full effect on 2 February 2026. After that date, the legacy Quality System Regulation (QSR) text of Part 820 — the 1996-vintage rule device manufacturers have lived with for nearly 30 years — is largely gone, replaced by a Part 820 that points directly at ISO 13485 plus a short list of additions.

The motivation is harmonisation. ISO 13485:2016 is already the global de facto standard — used by EU MDR, EU IVDR, MDSAP (Canada, Brazil, Australia, Japan, US), the UK, Switzerland, Singapore, Korea and most other major markets. Manufacturers selling globally have been running an ISO 13485 QMS while simultaneously demonstrating compliance with the bespoke US Part 820 text. QMSR eliminates most of that duplication.

The biggest change is the wholesale replacement of the QSR text with incorporation of ISO 13485:2016 by reference. Every QSR subpart is gone in its old form — design controls, document controls, purchasing controls, identification and traceability, process controls, acceptance activities, nonconforming product, CAPA, labelling and packaging controls, handling and storage, records, servicing, and statistical techniques are now governed by the corresponding ISO 13485 clauses.

Layered on top, QMSR retains a small set of US-specific requirements in a new §820.10 and amended §820.35 and §820.45:

• §820.10 incorporates ISO 13485:2016 by reference (with the ISO 9000:2015 vocabulary).
• §820.35(a) — additional record-control requirements: the QMS must include procedures for record retention; signatures on records and the date of signature must be readily identifiable.
• §820.35(b) — confidentiality marking for records the manufacturer wants protected from disclosure under FOIA.
• §820.35(d) — Unique Device Identification (UDI) records under 21 CFR 830 are part of the QMS document set.
• §820.45 — labelling and packaging control requirements specific to US Part 801 and Part 809 labelling rules.
• Definitions of key terms from the FD&C Act and FDA regulations are preserved (device, component, finished device, manufacturer, remanufacturer, etc.) so the rule continues to integrate with the rest of US device law.

Not new: the legal authority. QMSR still derives from sections 501, 502, 510, 513, 514, 515, 518, 519, 520, 522, 701, 704, 801 and 803 of the FD&C Act. The adulteration consequence of cGMP failure under §501(h) continues unchanged.

The legacy QSR-specific terms 'design history file' (DHF), 'device master record' (DMR) and 'device history record' (DHR) do not appear in the QMSR rule text — ISO 13485 uses different vocabulary (medical-device file, product realisation, records of manufacturing). Practically, however, the content requirements those legacy artefacts captured are unchanged; an organisation can keep using DHF/DMR/DHR labels in its QMS as long as the underlying content meets ISO 13485. FDA has explicitly said the legacy terminology is acceptable.

The Quality System Inspection Technique (QSIT) — the inspector workflow FDA has used since 1999, organised around four subsystems (Management Controls, Design Controls, CAPA, Production and Process Controls) — is being retired. FDA's new approach aligns with the MDSAP Audit Approach and the ISO 13485 process-audit logic. Sites that have been through MDSAP already know what an inspection under the new regime looks like.

For most US-only device manufacturers without an existing ISO 13485 certification, the day-to-day operational requirements change much less than the regulatory text suggests. Design controls remain mandatory (ISO 13485 §7.3 maps almost one-to-one to §820.30). CAPA remains a critical subsystem (§8.5.2 / §8.5.3). Production controls remain (§7.5). Records remain required. Management review remains. Internal audits remain. The depth of expectation in some areas — risk-based thinking applied across the entire QMS, post-market feedback integration into design changes — is higher under ISO 13485 than the legacy QSR text demanded, but that gap was already being closed by FDA inspectors interpreting the legacy rule under modern expectations.

MDR (21 CFR Part 803), recall reporting (Part 806), UDI (Part 830), establishment registration and device listing (Part 807), labelling (Part 801) and IVD labelling (Part 809) all continue unchanged. QMSR amends Part 820; everything outside Part 820 is unaffected.

Between the publication date (2 February 2024) and the effective date (2 February 2026), manufacturers can continue to operate under the legacy QSR. FDA inspectors will not cite QMSR requirements during this period. After 2 February 2026, the QMSR text is fully effective and inspections will be conducted against it. There is no extended grace period.

A realistic transition workplan covers four streams: (1) gap analysis of the existing QMS against ISO 13485:2016 clauses, identifying anything currently driven only by the legacy QSR vocabulary; (2) rewrite of the quality manual, procedures and templates to align with ISO 13485 structure, terminology and risk-based posture; (3) re-training of staff on the updated procedures, especially internal auditors and management-review participants; (4) update of the internal-audit programme and the supplier-audit checklist to the new framework.

• Document control follows ISO 13485 §4.2.4 vocabulary and structure while still capturing the §820.35 US-specific record-control additions (signature identification, retention, UDI links).
• Design controls workspace organises evidence by ISO 13485 §7.3 stages (planning, inputs, outputs, review, V&V, transfer, changes) while preserving DHF/DMR/DHR labels for organisations that want to keep the legacy vocabulary internally.
• CAPA workflow aligns with §8.5.2 / §8.5.3 with the §820.100 audit-trail expectations preserved (signature, date, reason).
• Supplier control follows §7.4 risk-based evaluation with audit-due-date enforcement and onsite-audit scheduling for higher-risk suppliers.
• Internal audit and management review modules emit reports formatted for both legacy QSR and QMSR/ISO 13485 expectations so the transition period is covered with one configuration.
• Reports render in either legacy DHF/DMR/DHR vocabulary or ISO 13485 medical-device-file vocabulary so the same evidence answers both an FDA QMSR inspection and an MDSAP audit.