Your ISO 13485 certificate is not a QMSR pass
FDA’s Quality Management System Regulation (QMSR), effective February 2, 2026, incorporates ISO 13485:2016 by reference. It is tempting to assume a certified QMS is automatically compliant. FDA says otherwise: “A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection” (FDA QMSR FAQ).
The gaps sit in three places: FDA definitions that override ISO’s, U.S. requirements layered on top of specific clauses, and records that are now open to inspection. Early inspection data shows where firms are slipping. At FDLI in May 2026, an FDA official said “Risk management is the top observation,” followed by outsourcing problems and complaint handling (RAPS).
Use the checklist below to run a QMSR gap analysis against your ISO 13485 system.
For what changed under the QMSR and what inspectors are finding, see FDA QMSR Explained: What Changed, What Inspectors Are Finding and What to Do Now.
QMSR vs ISO 13485: what FDA adds or overrides
FDA did not publish a list of “excluded” ISO clauses. Instead, Part 820 overrides ISO where U.S. law conflicts and adds requirements in specific sections. The current regulation text is on eCFR.
| Section | What it does | Gap to check |
|---|---|---|
| § 820.1(b) | Where ISO conflicts with U.S. law, “the Federal Food, Drug, and Cosmetic Act and/or its other implementing regulations will control” | Procedures that rely on ISO-only interpretations |
| § 820.3 | FD&C Act definitions (device, labeling) supersede ISO’s; adds terms such as component, finished device and remanufacturer; “safety and performance” means safety and effectiveness | Quality manual and SOP definitions |
| § 820.10(a) | “Document a quality management system that complies with the applicable requirements of ISO 13485” | Clause-by-clause mapping |
| § 820.10(b) | Ties ISO clauses to U.S. rules: UDI (Part 830), tracking (Part 821), MDR (Part 803), corrections and removals (Part 806) | Procedures reference both ISO clause and FDA part |
| § 820.10(c) | Design and development (clause 7.3) for class II, III and listed class I devices, including those “automated with computer software” | Design file completeness |
| § 820.10(d) | Life-supporting or life-sustaining devices must also meet clause 7.5.9.2 traceability | Traceability procedures |
| § 820.35 | Adds complaint, servicing and UDI record content to clause 4.2.5; “the UDI must be recorded for each medical device or batch of medical devices” | Required fields in complaint and service records |
| § 820.45 | Labeling and packaging controls, including accuracy checks before release | Label inspection records |
ISO 13485:2016 itself remains current; ISO confirmed it in 2025 (ISO).
Records now in scope. “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR,” so FDA can review management review, internal audit and supplier audit records (FDA QMSR FAQ). FDA notes “A manufacturer may find it useful to complete some type of comparative analysis” to show existing records meet QMSR.
The QMSR gap analysis checklist
The areas below follow FDA’s inspection program, CP 7382.850, which organizes QMSR into six QMS areas plus other FDA requirements (FDA). Tick each item only when you can point to the record that proves it.
Quality system foundations
- Quality manual and SOPs use FD&C Act definitions from § 820.3 where they differ from ISO 13485
- Each procedure is mapped to the ISO 13485 clause and, where relevant, the FDA part it satisfies
- A documented comparative analysis covers records created before February 2, 2026
Management oversight
- Management review records show QMS effectiveness, not just metrics, and are ready for FDA review
- Internal audit reports are complete and cover risk-based processes, not legacy Part 820 checklists
Risk management (the top early finding)
- Risk management is applied across product realization, not only in design
- Complaints, nonconformances and CAPAs feed back into the risk file through a defined pathway
- Risk scales are consistent across departments
Design and development
- Clause 7.3 applies to your device class under § 820.10(c); the design and development file is complete
- Design changes include documented evaluation and re-verification decisions
Outsourcing and purchasing
- Suppliers are classified by risk to product quality and patients
- Quality agreements require suppliers to report nonconformances
- Supplier audit reports are complete and inspection-ready
Production and service provision
- Labeling and packaging controls meet § 820.45, including pre-release accuracy checks of UDI and expiry
- Servicing records include the content required by § 820.35
- Life-supporting or life-sustaining devices meet clause 7.5.9.2 traceability
Measurement, analysis and improvement
- Complaint records include the § 820.35 content and documented MDR reportability decisions (Part 803)
- Corrective and preventive actions are verified or validated for effectiveness
- Data analysis draws on complaints, service, audits and supplier data
Other FDA requirements
- UDI system documented per Part 830 and recorded per device or batch
- Corrections and removals handled per Part 806
- Device tracking procedures per Part 821, where applicable
How to run the gap analysis
- Inventory. List every procedure, form and record type, with the ISO 13485 clause and FDA part each one supports.
- Assess. For each checklist item, mark met, partially met or not met, and record the document that proves it.
- Prioritize by risk. Start with risk management, purchasing and complaints, the top topics in early QMSR inspections.
- Remediate and re-check. Fix procedures first, then confirm records follow them.
- Keep the analysis. FDA suggests a comparative analysis for pre-2026 records; your gap analysis is that evidence.
Where AI speeds this up
Step 2 is the slow part: reading hundreds of SOPs and records against dozens of requirements. AI document assessment can map each document to the checklist, cite the passage that meets each requirement and flag where no evidence exists. Your QA team then reviews the findings instead of starting from blank spreadsheets.
Run a sample regulatory document assessment on one SOP against the QMSR checklist. AskDona shows the evidence behind every finding.
FAQ
Is QMSR the same as ISO 13485? No. QMSR incorporates ISO 13485:2016 by reference but adds U.S. definitions and requirements in §§ 820.1, 820.3, 820.10, 820.35 and 820.45 (eCFR).
Do we have to redo records created before February 2, 2026? No. FDA may review them and suggests a comparative analysis to show they meet QMSR (FDA QMSR FAQ).
Can FDA see our internal audits now? Yes. The § 820.180(c) exception is gone, so management review, internal audit and supplier audit records are inspectable.
What are FDA citing most under QMSR? Risk management, followed by outsourcing, complaint handling, UDI and corrective action, based on FDA remarks in May 2026 (RAPS).
Is ISO 13485:2016 being revised? ISO confirmed the 2016 edition in 2025, and it remains current (ISO).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| eCFR: 21 CFR Part 820 | Regulation text | Current | §§ 820.1–820.45 |
| Federal Register: QMSR final rule (2024-01709) | Regulator | Feb 2, 2024 | Effective date, harmonization intent |
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Certificate, § 820.180(c), comparative analysis |
| FDA: Compliance Program 7382.850 | Regulator | Feb 2, 2026 | Inspection areas |
| ISO: ISO 13485:2016 | Standards body | Confirmed 2025 | Standard status |
| RAPS: Top observations from QMSR inspections | Trade press | May 14, 2026 | Early 483 topics |