21 CFR 820 Records Under QMSR: Which QSR-Era Records Still Need to Exist

The QMSR Transition Did Not Erase Your Record-Keeping Obligations

When FDA finalized the Quality Management System Regulation (QMSR) on February 2, 2024, and set an effective date of February 2, 2026, many medical device companies exhaled. The thinking was: ISO 13485 is already in our DNA, so the hard work is done. That assumption is dangerous. While the QMSR (21 CFR Part 820, revised) deliberately harmonizes with ISO 13485:2016, it does not simply hand FDA oversight to a third-party standard. FDA retained specific requirements, and the records that supported QSR-era compliance do not automatically disappear -- many of them are still legally required, just expressed in new language.

If you are a startup founder preparing for your first FDA inspection, a VP of Quality managing a QMS migration, or a regulatory affairs professional advising leadership on compliance posture, this post will tell you exactly which records survived the transition and why they still matter.

What the QMSR Actually Changed -- and What It Did Not

The QMSR restructured 21 CFR Part 820 to align with ISO 13485:2016 clause structure. Gone are legacy terms like 'Device History Record' (DHR), 'Device Master Record' (DMR), and 'Quality System Record' (QSR file). In their place, you will find ISO-harmonized language referencing 'documented information,' 'records,' and 'documents.' However, FDA made clear in its February 2024 preamble that the substantive requirements behind those legacy terms remain intact.

FDA explicitly stated that the QMSR does not reduce any existing documentation obligations -- it reframes them within an ISO 13485:2016 architecture. That means the underlying content of your DHR, DMR, and complaint files must still exist and be audit-ready, even if your QMS now labels them differently.

QSR-Era Records That Must Still Exist Under QMSR

1. Device Master Record Content (Now 'Documented Information for Product Realization')

Under the old 21 CFR 820.181, the DMR was a defined, indexed compilation of records defining a finished device. The QMSR replaces this label, but ISO 13485:2016 Sections 4.2.3 and 7.1 require documented information that covers design outputs, production specifications, quality requirements, and packaging/labeling specs. FDA expects to find all of that content in an organized, retrievable format. If an investigator asks for what used to be your DMR and your team cannot produce the equivalent, that is a 483 observation waiting to happen.

2. Device History Record Content (Now 'Production and Service Records')

The DHR under 21 CFR 820.184 required lot-specific documentation proving each device was manufactured per the DMR. QMSR, aligned with ISO 13485:2016 Section 8.3 and 8.5, still requires records demonstrating conformity of each unit or lot to defined requirements. Batch records, traveler documents, in-process inspection records, and final acceptance records must still exist, be traceable to the specific device or lot, and be retained for the period specified under 21 CFR 820.180 (generally two years from distribution, or the device useful life, whichever is longer).

3. Complaint Files and MDR-Related Records

21 CFR Part 803 (Medical Device Reporting) was not modified by the QMSR, and 21 CFR 820.198 complaint file requirements now live within the QMSR framework under ISO 13485:2016 Section 8.2.2. Every complaint must still be evaluated for MDR reportability, investigated, and documented. The record must capture the device identification, the nature of the complaint, the investigation outcome, and any corrective action taken. FDA investigators review complaint files closely during every Quality System inspection.

4. CAPA Records

Corrective and Preventive Action records were codified under the old 21 CFR 820.100. Under QMSR, they align with ISO 13485:2016 Sections 8.5.2 and 8.5.3. The record requirements are substantively identical: documented nonconformity, root cause analysis, actions taken, verification of effectiveness, and escalation to management review when appropriate. FDA has not softened its expectations here -- CAPA system failures remain among the top 483 observations issued every year.

5. Management Review Records

ISO 13485:2016 Section 9.3 and the corresponding QMSR provisions require documented management review records. FDA expects to see inputs including audit results, complaint trends, process performance data, and CAPA status, along with documented outputs such as resource decisions and improvement actions. These records demonstrate that your quality system is actively managed, not just maintained on paper.

6. Design Control Records

Under the old 21 CFR 820.30, design controls were among the most scrutinized areas during inspections. QMSR aligns these with ISO 13485:2016 Section 7.3. Design plans, inputs, outputs, review records, verification and validation protocols and reports, and design transfer records must all still exist and be traceable through the design history. For startups in particular, gaps in design control documentation are a leading cause of FDA inspection deficiencies and 510(k) deficiencies alike.

Do Not Confuse Harmonization With Exemption

A common mistake in the post-QMSR environment is treating ISO 13485 certification as a proxy for FDA compliance. It is not. ISO 13485 is a management system standard audited by notified bodies or certification bodies. FDA conducts its own inspections under its own authority, and the QMSR is a federal regulation, not a voluntary standard. Even if your ISO 13485 certificate is current, FDA can and will inspect your facility and cite deficiencies if the underlying records do not meet the substantive requirements now expressed in the QMSR.

Practical Steps for Your QMS Transition

• Conduct a gap assessment mapping your current record structure to both ISO 13485:2016 clause requirements and FDA-specific QMSR provisions.
• Rename and reorganize, but do not delete. Legacy DHR and DMR content must be preserved and retrievable, even if rebranded.
• Update SOPs to reflect QMSR language while maintaining traceability to the regulatory requirements each procedure addresses.
• Train your team on what changed and -- critically -- what did not. Front-line quality staff need to understand that QMSR is not a reduced standard.
• Review your retention schedule against 21 CFR 820.180 and your device useful life to ensure records are not being purged prematurely.

The Bottom Line

The QMSR modernized the regulatory framework and reduced friction for companies already operating under ISO 13485:2016. But it did not reduce FDA's authority, and it did not eliminate the substantive records that FDA inspectors expect to find. The labels changed; the obligations did not. Companies that treat the QMSR transition as a documentation cleanup exercise -- rather than a careful, requirement-by-requirement alignment -- are taking on real compliance risk.

If your team is working through a QMSR gap assessment or preparing for an FDA inspection under the new framework, ADB Consulting and CRO Inc. can help you get there efficiently and correctly.

Book a free discovery call with Andre Butler and the ADB team at adbccro.com. We will assess where your QMS stands today and give you a clear, actionable path to QMSR compliance -- before FDA shows up at your door.

If this applies to your program, our QMS Gap Assessment walks through the process in detail.

The QMSR Transition Did Not Eliminate Your Record-Keeping Obligations

When FDA finalized the Quality Management System Regulation (QMSR) in February 2024, many medical device companies exhaled. The new rule -- codified at 21 CFR Part 820 and effective February 2, 2026 -- harmonizes FDA's quality system requirements with ISO 13485:2016, reducing the friction of maintaining parallel compliance programs. But here is what some regulatory teams got wrong: harmonization is not elimination. Several record types that originated in the legacy Quality System Regulation (QSR) are still required, either explicitly through QMSR language, through ISO 13485 incorporation, or through FDA's broader statutory authority under 21 CFR Parts 803, 806, and 830.

If your QMS transition strategy assumed that aligning with ISO 13485 certificates your records program automatically, you may have compliance gaps that will surface on your next FDA inspection. This post breaks down which QSR-era records still need to exist, why, and how to make sure your document control infrastructure reflects the current regulatory reality.

What QMSR Actually Changed -- and What It Did Not

The QMSR replaced the 1996 QSR by incorporating ISO 13485:2016 by reference, meaning the substantive quality system requirements now live inside that standard. FDA eliminated some prescriptive QSR language in favor of ISO 13485's more principles-based approach. However, 21 CFR 820 still contains several direct record requirements that are independent of ISO 13485, and FDA's preamble to the final rule made clear that existing statutory requirements under the FD&C Act remain in full force.

The practical effect: your Device History Record (DHR), Device Master Record (DMR), and Quality System Record (QSR record) structures may look different under ISO 13485 terminology -- think 'technical file' or 'device file' -- but the underlying data those records must capture has not materially changed.

QSR-Era Records That Remain Mandatory Under QMSR

Device Master Record (DMR)

Under the legacy QSR, 21 CFR 820.181 required a DMR for each device type containing specifications, production process procedures, quality assurance procedures, packaging and labeling specifications, and installation and servicing procedures. QMSR does not use the term 'DMR,' but ISO 13485 Section 4.2.3 requires documented information sufficient to demonstrate conformity of products and processes. FDA's QMSR preamble explicitly states that DMR-equivalent documentation remains expected. Your device file under ISO 13485 must contain the same categories of information -- do not let a terminology change create a content gap.

Device History Record (DHR)

The DHR requirement from 21 CFR 820.184 is effectively preserved under QMSR through ISO 13485 Section 8.2.6, which requires records demonstrating that the product has been manufactured in accordance with established procedures. FDA expects to see lot/batch records, acceptance activity records, labeling records, and distribution records. For combination products or devices with significant software components, these records must also account for software version history and any configuration changes made during production.

Complaint Files

21 CFR 820.198 in the legacy QSR required complaint files with specific content elements. ISO 13485 Section 8.2.2 addresses customer complaints, and QMSR reinforces this. Critically, your complaint handling records must integrate with your MDR obligations under 21 CFR Part 803. FDA investigators routinely cross-reference complaint files against MDR submissions -- gaps between the two are a top-cited 483 observation. Complaint records must document the investigation rationale, corrective action determination, and MDR reportability decision with supporting justification.

CAPA Records

ISO 13485 Sections 8.5.2 and 8.5.3 cover corrective and preventive action, preserving the substantive content of 21 CFR 820.100. Your CAPA records must demonstrate problem identification, root cause analysis methodology, action taken, effectiveness verification, and management review of trends. FDA has not softened its expectations here -- CAPA deficiencies remain a leading cause of Warning Letters post-QMSR.

Management Review Records

Legacy 21 CFR 820.20(c) required documented management reviews. ISO 13485 Section 5.6 maintains this requirement, with specific input and output elements that must be recorded. Under QMSR, FDA expects these records to demonstrate that top management is actively evaluating QMS performance -- not simply signing off on a template.

Records That FDA Can Still Demand Through Other Authorities

Even where QMSR removed specific prescriptive language, FDA retains inspection authority under Section 704 of the FD&C Act and can request records supporting:

• Unique Device Identification (UDI) compliance under 21 CFR Part 830
• Medical Device Reporting under 21 CFR Part 803
• Corrections and Removals under 21 CFR Part 806
• Post-market surveillance studies under 21 CFR Part 522

These are not QMSR records per se, but they depend on the same underlying production, complaint, and distribution data your QMSR program must generate and retain.

Practical Recommendations for Your Records Infrastructure

Do not simply relabel your existing QSR records with ISO 13485 terminology and call it a transition. Conduct a documented gap assessment that maps each legacy 21 CFR 820 record requirement to its QMSR and ISO 13485 equivalent, identifies any content gaps, and assigns ownership for remediation. Key actions include:

• Updating your document control SOP to reflect QMSR terminology while preserving all required content elements
• Training quality staff on the distinction between terminology changes and substantive requirement changes
• Ensuring your eQMS or paper-based system can produce records on demand in a format consistent with FDA inspection expectations
• Reviewing record retention schedules -- ISO 13485 Section 4.2.5 requires records be retained for a defined period, but FDA expects a minimum of two years from device release date or the lifetime of the device, whichever is longer