The medical device quality system has a new legal basis
For nearly 30 years, “quality system” in the US meant FDA’s Quality System Regulation (QS regulation, or QSR), 21 CFR Part 820. On February 2, 2026, Part 820 became the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference (FDA). FDA published the final rule on February 2, 2024, giving manufacturers two years to transition (Federal Register).
More than eight months after the effective date, many companies have rewritten their quality manual but not their procedures, forms, training or audit checklists. This guide explains what changed, what did not, and how to confirm your transition is actually complete.
QS regulation vs QMSR at a glance
| Topic | QS regulation (until Feb 1, 2026) | QMSR (from Feb 2, 2026) |
|---|---|---|
| Core requirements | Detailed FDA text, §§820.20–820.250 | ISO 13485:2016 incorporated by reference (§820.10(a)) |
| FDA-specific additions | Embedded throughout | Concentrated in §820.10(b)–(c), §820.35 (records) and §820.45 (labeling and packaging) |
| Risk management | Mainly in design validation | Risk-based approach across the QMS per ISO 13485 |
| Design records | Design history file (DHF) | Design and development file (ISO 13485 clause 7.3.10) |
| Device-level documentation | Device master record (DMR) | Medical device file (ISO 13485 clause 4.2.3) |
| Production records | Device history record (DHR) | Records required by ISO 13485, including clause 7.5.1 and 7.5.8 traceability |
| Audit and review records | Shielded from routine FDA review by §820.180(c) | Open to inspection: exception “not maintained” |
| Inspection approach | QSIT (four subsystems) | CP 7382.850 (six QMS areas) |
Sources: eCFR Part 820; FDA QMSR FAQ; FDA CP 7382.850.
What changed in practice
ISO 13485 became the requirement text. §820.10(a) requires manufacturers to “Document a quality management system that complies with the applicable requirements of ISO 13485” (eCFR). Procedures should now cite ISO 13485 clauses.
FDA-specific requirements were consolidated, not dropped. §820.10(b) ties the QMS to UDI (Part 830), tracking (Part 821), medical device reporting (Part 803) and corrections and removals (Part 806). §820.35 adds specific content to complaint and servicing records, and §820.45 keeps detailed labeling and packaging controls (eCFR).
More records are visible. FDA states that “The exceptions that existed in the QS regulation at § 820.180(c) are not maintained” (FDA QMSR FAQ). Management review, internal audit and supplier audit reports can be reviewed during inspections.
Inspections changed. QSIT was retired. CP 7382.850 inspects six areas: change control; design and development; management oversight; measurement, analysis and improvement; outsourcing and purchasing; and production and service provision (FDA).
Risk moved to the center. Early QMSR inspections show “Risk management is the top observation” (RAPS).
What did not change
- FDA still does not certify quality systems. An ISO 13485 certificate does not replace FDA inspection, and FDA inspections do not follow certification audit methods.
- Other FDA regulations still apply in full: registration and listing, premarket requirements, labeling, MDR, corrections and removals, UDI and Part 11 for electronic records.
- Design controls remain mandatory for Class II and III devices and specified Class I devices, now via ISO 13485 clause 7.3 (§820.10(c)).
- Process validation, CAPA, complaint handling and supplier controls are still core; the requirement text moved, the expectations did not soften.
Legacy QSR to ISO 13485 cross-reference
Use this map to find procedures that still cite retired sections. It is a practical starting point, not a one-to-one legal equivalence; some QSR requirements are spread across several ISO 13485 clauses.
| Legacy QSR section | Topic | Primary ISO 13485:2016 clause(s) |
|---|---|---|
| 820.20 | Management responsibility | 5.1–5.6 |
| 820.22 | Quality audit | 8.2.4 |
| 820.25 | Personnel and training | 6.2 |
| 820.30 | Design controls | 7.3 (required by §820.10(c)) |
| 820.40 | Document controls | 4.2.4 |
| 820.50 | Purchasing controls | 7.4 |
| 820.70 / 820.75 | Production and process controls; process validation | 7.5.1, 7.5.6 |
| 820.72 | Inspection, measuring and test equipment | 7.6 |
| 820.80 / 820.86 | Acceptance activities and status | 7.4.3, 7.5.8, 8.2.6 |
| 820.90 | Nonconforming product | 8.3 |
| 820.100 | CAPA | 8.5.2, 8.5.3 |
| 820.120 / 820.130 | Labeling and packaging | 7.5.1 plus §820.45 |
| 820.180–820.186 | Records, DMR, DHR, QS record | 4.2.3, 4.2.5 plus §820.35 |
| 820.198 | Complaint files | 8.2.2 plus §820.35 and Part 803 |
| 820.200 | Servicing | 7.5.4 plus §820.35 |
| 820.250 | Statistical techniques | 8.1, 8.4 |
Terminology to update
| Old term (QSR) | QMSR / ISO 13485 term |
|---|---|
| Management with executive responsibility | Top management |
| Design history file (DHF) | Design and development file |
| Device master record (DMR) | Medical device file (MDF) |
| Device history record (DHR) | Records of each medical device or batch (ISO 13485 clause 7.5.1) |
| Quality system record | QMS documentation per clause 4.2 |
FDA’s December 2025 webinar on QMSR key takeaways walks through these changes and is a useful training resource (FDA).
QMSR transition completion checklist
- Quality manual references ISO 13485:2016 and Part 820 (QMSR), with scope and exclusions justified
- Every procedure, work instruction and form updated to ISO 13485 clauses; no live references to retired QSR sections
- DHF, DMR and DHR terminology replaced, or mapped in a controlled glossary
- §820.10(b) links in place: UDI, tracking, MDR and corrections and removals procedures
- Complaint and servicing records include §820.35 content
- Labeling and packaging procedures meet §820.45
- Risk-based approach documented across QMS processes, not only design
- Management review, internal audit and supplier audit reports written for FDA visibility
- Internal audit checklists rebuilt around FDA’s six QMS areas
- QMS software validated using a risk-based CSA approach (FDA)
- Training completed on the new structure and terminology
- Mock inspection run against CP 7382.850
Find the leftovers fast
The hardest part of a QMSR transition is finding what was missed: a form that still cites §820.198, a procedure that never mentions risk, a complaint record missing §820.35 content. AI document assessment can read your full document set against the QMSR and ISO 13485, flag outdated references and missing requirements, and cite the passage behind every finding.
Run a sample regulatory document assessment on a set of procedures. AskDona shows the evidence; your quality team decides.
FAQ
What is the medical device quality system regulation now? The Quality Management System Regulation (QMSR), 21 CFR Part 820, effective February 2, 2026, which incorporates ISO 13485:2016 (FDA).
Do DHF, DMR and DHR still exist? Not as regulatory terms. Their content maps to the design and development file, the medical device file and production records under ISO 13485.
Can FDA now review internal audit reports? Yes. The §820.180(c) exception is “not maintained” under QMSR (FDA QMSR FAQ).
Does ISO 13485 certification mean we comply with QMSR? No. QMSR includes FDA-specific requirements beyond ISO 13485, and FDA inspects independently of certification bodies.
References
All pages opened and checked by October 13, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| FDA: QS Regulation / QMSR | Regulator | 2026 | Effective date |
| Federal Register: QMSR final rule | Regulation | Feb 2, 2024 | Final rule |
| eCFR: 21 CFR Part 820 | Regulation | Current | §§820.10, 820.35, 820.45 |
| FDA: QMSR FAQ | Regulator | 2026 | §820.180(c) |
| FDA: CP 7382.850 | Regulator | Feb 2, 2026 | Inspection areas |
| FDA: QMSR key takeaways webinar | Regulator | Dec 16, 2025 | Training |
| RAPS: Top QMSR observations | Professional body | May 14, 2026 | Risk findings |
| FDA: CSA guidance | Regulator guidance | Feb 3, 2026 | Software validation |