21 CFR 820 Records Under QMSR: Which QSR-Era Records Still Need to Exist

The QMSR Transition Did Not Erase Your Record-Keeping Obligations

When FDA finalized the Quality Management System Regulation (QMSR) on February 2, 2024, and set an effective date of February 2, 2026, many medical device companies exhaled. The thinking was: ISO 13485 is already in our DNA, so the hard work is done. That assumption is dangerous. While the QMSR (21 CFR Part 820, revised) deliberately harmonizes with ISO 13485:2016, it does not simply hand FDA oversight to a third-party standard. FDA retained specific requirements, and the records that supported QSR-era compliance do not automatically disappear -- many of them are still legally required, just expressed in new language.

If you are a startup founder preparing for your first FDA inspection, a VP of Quality managing a QMS migration, or a regulatory affairs professional advising leadership on compliance posture, this post will tell you exactly which records survived the transition and why they still matter.

What the QMSR Actually Changed -- and What It Did Not

The QMSR restructured 21 CFR Part 820 to align with ISO 13485:2016 clause structure. Gone are legacy terms like 'Device History Record' (DHR), 'Device Master Record' (DMR), and 'Quality System Record' (QSR file). In their place, you will find ISO-harmonized language referencing 'documented information,' 'records,' and 'documents.' However, FDA made clear in its February 2024 preamble that the substantive requirements behind those legacy terms remain intact.

FDA explicitly stated that the QMSR does not reduce any existing documentation obligations -- it reframes them within an ISO 13485:2016 architecture. That means the underlying content of your DHR, DMR, and complaint files must still exist and be audit-ready, even if your QMS now labels them differently.

QSR-Era Records That Must Still Exist Under QMSR

1. Device Master Record Content (Now 'Documented Information for Product Realization')

Under the old 21 CFR 820.181, the DMR was a defined, indexed compilation of records defining a finished device. The QMSR replaces this label, but ISO 13485:2016 Sections 4.2.3 and 7.1 require documented information that covers design outputs, production specifications, quality requirements, and packaging/labeling specs. FDA expects to find all of that content in an organized, retrievable format. If an investigator asks for what used to be your DMR and your team cannot produce the equivalent, that is a 483 observation waiting to happen.

2. Device History Record Content (Now 'Production and Service Records')

The DHR under 21 CFR 820.184 required lot-specific documentation proving each device was manufactured per the DMR. QMSR, aligned with ISO 13485:2016 Section 8.3 and 8.5, still requires records demonstrating conformity of each unit or lot to defined requirements. Batch records, traveler documents, in-process inspection records, and final acceptance records must still exist, be traceable to the specific device or lot, and be retained for the period specified under 21 CFR 820.180 (generally two years from distribution, or the device useful life, whichever is longer).

3. Complaint Files and MDR-Related Records

21 CFR Part 803 (Medical Device Reporting) was not modified by the QMSR, and 21 CFR 820.198 complaint file requirements now live within the QMSR framework under ISO 13485:2016 Section 8.2.2. Every complaint must still be evaluated for MDR reportability, investigated, and documented. The record must capture the device identification, the nature of the complaint, the investigation outcome, and any corrective action taken. FDA investigators review complaint files closely during every Quality System inspection.

4. CAPA Records

Corrective and Preventive Action records were codified under the old 21 CFR 820.100. Under QMSR, they align with ISO 13485:2016 Sections 8.5.2 and 8.5.3. The record requirements are substantively identical: documented nonconformity, root cause analysis, actions taken, verification of effectiveness, and escalation to management review when appropriate. FDA has not softened its expectations here -- CAPA system failures remain among the top 483 observations issued every year.

5. Management Review Records

ISO 13485:2016 Section 9.3 and the corresponding QMSR provisions require documented management review records. FDA expects to see inputs including audit results, complaint trends, process performance data, and CAPA status, along with documented outputs such as resource decisions and improvement actions. These records demonstrate that your quality system is actively managed, not just maintained on paper.

6. Design Control Records

Under the old 21 CFR 820.30, design controls were among the most scrutinized areas during inspections. QMSR aligns these with ISO 13485:2016 Section 7.3. Design plans, inputs, outputs, review records, verification and validation protocols and reports, and design transfer records must all still exist and be traceable through the design history. For startups in particular, gaps in design control documentation are a leading cause of FDA inspection deficiencies and 510(k) deficiencies alike.

Do Not Confuse Harmonization With Exemption

A common mistake in the post-QMSR environment is treating ISO 13485 certification as a proxy for FDA compliance. It is not. ISO 13485 is a management system standard audited by notified bodies or certification bodies. FDA conducts its own inspections under its own authority, and the QMSR is a federal regulation, not a voluntary standard. Even if your ISO 13485 certificate is current, FDA can and will inspect your facility and cite deficiencies if the underlying records do not meet the substantive requirements now expressed in the QMSR.

Practical Steps for Your QMS Transition

• Conduct a gap assessment mapping your current record structure to both ISO 13485:2016 clause requirements and FDA-specific QMSR provisions.
• Rename and reorganize, but do not delete. Legacy DHR and DMR content must be preserved and retrievable, even if rebranded.
• Update SOPs to reflect QMSR language while maintaining traceability to the regulatory requirements each procedure addresses.
• Train your team on what changed and -- critically -- what did not. Front-line quality staff need to understand that QMSR is not a reduced standard.
• Review your retention schedule against 21 CFR 820.180 and your device useful life to ensure records are not being purged prematurely.

The Bottom Line

The QMSR modernized the regulatory framework and reduced friction for companies already operating under ISO 13485:2016. But it did not reduce FDA's authority, and it did not eliminate the substantive records that FDA inspectors expect to find. The labels changed; the obligations did not. Companies that treat the QMSR transition as a documentation cleanup exercise -- rather than a careful, requirement-by-requirement alignment -- are taking on real compliance risk.

If your team is working through a QMSR gap assessment or preparing for an FDA inspection under the new framework, ADB Consulting and CRO Inc. can help you get there efficiently and correctly.

Book a free discovery call with Andre Butler and the ADB team at adbccro.com. We will assess where your QMS stands today and give you a clear, actionable path to QMSR compliance -- before FDA shows up at your door.

If this applies to your program, our QMS Gap Assessment walks through the process in detail.