What the QMSR is
The Quality Management System Regulation (QMSR) is FDA’s current good manufacturing practice rule for medical devices, codified at 21 CFR Part 820. FDA states that “The rule became effective, February 2, 2026, two years after publication in the Federal Register” (FDA QMSR FAQ). It replaced the Quality System (QS) regulation that had governed device manufacturing since 1996.
The core change is that FDA now uses the international standard. “The QMSR incorporates by reference the international standard, ISO 13485:2016,” which FDA says “harmonizes the FDA’s CGMP regulatory framework with that used by other regulatory authorities” (FDA). The regulation requires manufacturers to “Document a quality management system that complies with the applicable requirements of ISO 13485” (eCFR, 21 CFR 820.10).
For a checklist of the gaps FDA looks for under the QMSR, see FDA QMSR Checklist: An ISO 13485 Gap Analysis for U.S. Device Makers.
QS regulation vs QMSR: the changes that matter
| Topic | QS regulation (until Feb 1, 2026) | QMSR (from Feb 2, 2026) |
|---|---|---|
| Requirements | FDA-written requirements in 820.20 to 820.250 | ISO 13485:2016 incorporated by reference, plus FDA-specific provisions |
| Terminology | Design history file, device master record, device history record | ISO 13485 terms such as medical device file; FDA aligns definitions with ISO 9000:2015 clause 3 |
| Risk management | Explicit mainly in design validation | Expected throughout the QMS, as ISO 13485 requires |
| Records access | Management review, internal audit and supplier audit reports shielded under 820.180(c) | “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained in the QMSR” (FDA QMSR FAQ) |
| Inspection method | Quality System Inspection Technique (QSIT) | Compliance Program 7382.850, risk-based element selection |
| Additional FDA requirements | Built in | Retained for areas such as labeling and packaging, UDI and complaint records |
How device inspections changed
FDA confirms that it “stopped using the Quality System Inspection Technique (QSIT) for device inspections” and replaced it with “Compliance Program: 7382.850” (FDA QMSR FAQ). According to King & Spalding, “Investigators now select elements based on firm specific risks, rather than standardized sampling,” and they may “request and review internal audit reports, supplier audits reports, and management review documentation” (King & Spalding).
Hogan Lovells describes the program as organized around six QMS areas: change control; design and development; management oversight; measurement, analysis and improvement; outsourcing and purchasing; and production and service provision (Hogan Lovells).
What early QMSR inspections are finding
In May 2026, Keisha Thomas of CDRH’s Office of Product Evaluation and Quality said FDA had conducted “just north of 100” QMSR inspections and that risk management was “the top observation,” followed by outsourcing and purchasing, complaint handling, UDI and corrective actions (RAPS).
The first QMSR warning letters followed. Hyman, Phelps & McNamara reported letters in May and July 2026 citing ISO 13485 clause 7.1 on risk management and clause 7.3.9 on design changes. In one, the firm’s risk procedure “does not define how risk management activities are performed and documented” (FDA Law Blog).
The message is clear. Under the QS regulation, many firms treated risk management as a design activity. Under the QMSR, FDA expects a risk-based approach across the QMS, documented in procedures that say how the work is actually done.
What to do now
- Re-run your gap assessment against ISO 13485 clauses, not old 820 sections. Pay particular attention to clauses 4.1.2 (risk-based approach), 7.1 (risk management in product realization) and 7.4 (purchasing).
- Rewrite thin procedures. A procedure that only references ISO 14971 is not enough; describe the activities, responsibilities, criteria and records.
- Prepare internal audit and management review records for FDA eyes. They are now inspectable. Make them factual and specific, and close out what they find.
- Strengthen supplier controls with risk-based selection, evaluation and monitoring.
- Check complaint handling and UDI, which feature in early observations.
- Update terminology and cross-references in procedures, forms and training.
- Validate QMS software proportionately under FDA’s Computer Software Assurance guidance, finalized in September 2025 and updated in February 2026.
- Brief your teams on the new inspection approach, since investigators now choose areas based on your risk profile.
QMSR readiness checklist
- Gap assessment completed against ISO 13485:2016 and QMSR-specific provisions
- Risk management procedure defines activities, criteria, responsibilities and records
- Risk-based approach documented for QMS processes, including suppliers and software
- Design change records include risk review, verification and validation
- Complaint handling and UDI processes verified
- Internal audit, supplier audit and management review records inspection-ready
- Procedures and forms updated to QMSR terminology
- QMS software validated under a risk-based approach
- Staff briefed on Compliance Program 7382.850
Find QMSR gaps with cited evidence
The QMSR turned ISO 13485’s text into FDA’s yardstick, so every procedure needs to stand up clause by clause. AI document assessment can check procedures and records against ISO 13485 and QMSR provisions, flag gaps such as risk procedures that do not define activities, and cite the passage behind every finding.
Run a sample QMSR gap assessment on your risk management or purchasing procedure. AskDona shows the evidence; your quality team decides.
FAQ
What is the FDA QMSR? FDA’s Quality Management System Regulation for medical devices, 21 CFR Part 820, effective February 2, 2026, which incorporates ISO 13485:2016 by reference.
Does QMSR require ISO 13485 certification? No. It requires a QMS that complies with ISO 13485’s applicable requirements; FDA checks through inspection.
Can FDA see internal audit reports now? Yes. The 820.180(c) exception is not maintained in the QMSR (FDA QMSR FAQ).
What is the top QMSR inspection finding? Risk management, according to a CDRH official in May 2026 (RAPS).
Does FDA still use QSIT? No. It now uses Compliance Program 7382.850.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QMSR FAQ | Regulator | Oct 2, 2026 | Effective date, records, QSIT |
| FDA: QMSR | Regulator | Feb 2, 2026 | Incorporation by reference |
| eCFR: 21 CFR 820 | Regulation | Current | 820.10 |
| King & Spalding: QMSR goes live | Law firm | Feb 3, 2026 | Inspection approach |
| Hogan Lovells: CP 7382.850 | Law firm | Feb 3, 2026 | Six QMS areas |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | Early findings |
| FDA Law Blog: First QMSR warning letters | Law firm | Aug 12, 2026 | Warning letters |