21 CFR 820 Records Under QMSR: Which QSR-Era Records Still Need to Exist

The QMSR Transition Did Not Eliminate Your Record-Keeping Obligations

When FDA finalized the Quality Management System Regulation (QMSR) in February 2024, many medical device companies exhaled. The new rule -- codified at 21 CFR Part 820 and effective February 2, 2026 -- harmonizes FDA's quality system requirements with ISO 13485:2016, reducing the friction of maintaining parallel compliance programs. But here is what some regulatory teams got wrong: harmonization is not elimination. Several record types that originated in the legacy Quality System Regulation (QSR) are still required, either explicitly through QMSR language, through ISO 13485 incorporation, or through FDA's broader statutory authority under 21 CFR Parts 803, 806, and 830.

If your QMS transition strategy assumed that aligning with ISO 13485 certificates your records program automatically, you may have compliance gaps that will surface on your next FDA inspection. This post breaks down which QSR-era records still need to exist, why, and how to make sure your document control infrastructure reflects the current regulatory reality.

What QMSR Actually Changed -- and What It Did Not

The QMSR replaced the 1996 QSR by incorporating ISO 13485:2016 by reference, meaning the substantive quality system requirements now live inside that standard. FDA eliminated some prescriptive QSR language in favor of ISO 13485's more principles-based approach. However, 21 CFR 820 still contains several direct record requirements that are independent of ISO 13485, and FDA's preamble to the final rule made clear that existing statutory requirements under the FD&C Act remain in full force.

The practical effect: your Device History Record (DHR), Device Master Record (DMR), and Quality System Record (QSR record) structures may look different under ISO 13485 terminology -- think 'technical file' or 'device file' -- but the underlying data those records must capture has not materially changed.

QSR-Era Records That Remain Mandatory Under QMSR

Device Master Record (DMR)

Under the legacy QSR, 21 CFR 820.181 required a DMR for each device type containing specifications, production process procedures, quality assurance procedures, packaging and labeling specifications, and installation and servicing procedures. QMSR does not use the term 'DMR,' but ISO 13485 Section 4.2.3 requires documented information sufficient to demonstrate conformity of products and processes. FDA's QMSR preamble explicitly states that DMR-equivalent documentation remains expected. Your device file under ISO 13485 must contain the same categories of information -- do not let a terminology change create a content gap.

Device History Record (DHR)

The DHR requirement from 21 CFR 820.184 is effectively preserved under QMSR through ISO 13485 Section 8.2.6, which requires records demonstrating that the product has been manufactured in accordance with established procedures. FDA expects to see lot/batch records, acceptance activity records, labeling records, and distribution records. For combination products or devices with significant software components, these records must also account for software version history and any configuration changes made during production.

Complaint Files

21 CFR 820.198 in the legacy QSR required complaint files with specific content elements. ISO 13485 Section 8.2.2 addresses customer complaints, and QMSR reinforces this. Critically, your complaint handling records must integrate with your MDR obligations under 21 CFR Part 803. FDA investigators routinely cross-reference complaint files against MDR submissions -- gaps between the two are a top-cited 483 observation. Complaint records must document the investigation rationale, corrective action determination, and MDR reportability decision with supporting justification.

CAPA Records

ISO 13485 Sections 8.5.2 and 8.5.3 cover corrective and preventive action, preserving the substantive content of 21 CFR 820.100. Your CAPA records must demonstrate problem identification, root cause analysis methodology, action taken, effectiveness verification, and management review of trends. FDA has not softened its expectations here -- CAPA deficiencies remain a leading cause of Warning Letters post-QMSR.

Management Review Records

Legacy 21 CFR 820.20(c) required documented management reviews. ISO 13485 Section 5.6 maintains this requirement, with specific input and output elements that must be recorded. Under QMSR, FDA expects these records to demonstrate that top management is actively evaluating QMS performance -- not simply signing off on a template.

Records That FDA Can Still Demand Through Other Authorities

Even where QMSR removed specific prescriptive language, FDA retains inspection authority under Section 704 of the FD&C Act and can request records supporting:

• Unique Device Identification (UDI) compliance under 21 CFR Part 830
• Medical Device Reporting under 21 CFR Part 803
• Corrections and Removals under 21 CFR Part 806
• Post-market surveillance studies under 21 CFR Part 522

These are not QMSR records per se, but they depend on the same underlying production, complaint, and distribution data your QMSR program must generate and retain.

Practical Recommendations for Your Records Infrastructure

Do not simply relabel your existing QSR records with ISO 13485 terminology and call it a transition. Conduct a documented gap assessment that maps each legacy 21 CFR 820 record requirement to its QMSR and ISO 13485 equivalent, identifies any content gaps, and assigns ownership for remediation. Key actions include:

• Updating your document control SOP to reflect QMSR terminology while preserving all required content elements
• Training quality staff on the distinction between terminology changes and substantive requirement changes
• Ensuring your eQMS or paper-based system can produce records on demand in a format consistent with FDA inspection expectations
• Reviewing record retention schedules -- ISO 13485 Section 4.2.5 requires records be retained for a defined period, but FDA expects a minimum of two years from device release date or the lifetime of the device, whichever is longer

The Bottom Line

QMSR modernized the regulatory framework, but it did not give device companies a clean slate on records. The companies that will struggle on their next FDA inspection are those that treated QMSR as a simplification rather than a realignment. Your records program needs to satisfy both ISO 13485 and FDA's enduring statutory expectations -- simultaneously, not alternatively.

At ADB Consulting and CRO Inc., we help medical device startups and established manufacturers build records programs that are inspection-ready from day one. Whether you are building your QMS from scratch or remediating gaps identified in a 483 response, we provide the regulatory depth your team needs to move forward with confidence.

Book a free discovery call with Andre Butler today at adbccro.com and find out exactly where your records program stands under QMSR.

Related reading: a QMS Gap Assessment engagement covers this in more depth.