ISO 13485 vs QMSR (21 CFR Part 820): What Changed February 2, 2026 and What Did Not

The Biggest Overhaul to 21 CFR Part 820 in 25 Years Is Now in Effect

On February 2, 2026, FDA's Quality Management System Regulation (QMSR) became the enforceable law of the land for U.S. medical device manufacturers. The legacy Quality System Regulation (QSR) that had governed device quality since 1996 is gone. In its place is a regulation explicitly harmonized with ISO 13485:2016 -- and if your quality system has not been updated to reflect that shift, you are already out of compliance.

This post breaks down exactly what changed, what did not, and what your team needs to do right now. No filler. Just the regulatory specifics you need.

Why FDA Made This Change

FDA's rationale was straightforward: the global medical device industry increasingly operates under ISO 13485, the internationally recognized quality management system standard. The legacy 21 CFR Part 820 was largely aligned in spirit, but diverged enough in structure and terminology to create duplicative documentation burdens for manufacturers selling into both the U.S. and international markets.

The QMSR Final Rule, published in the Federal Register on February 23, 2024 (89 FR 7496), gave manufacturers a two-year implementation window. That window closed on February 2, 2026. FDA's stated intent, as outlined in the preamble to the final rule, was to 'incorporate by reference' ISO 13485:2016 into U.S. federal regulation while retaining specific FDA-only requirements where necessary.

What Actually Changed

1. The Regulatory Architecture

Under the old QSR, 21 CFR Part 820 had its own standalone structure -- design controls, corrective action, production controls, and so on. The QMSR replaces that architecture with ISO 13485:2016 as the backbone. Manufacturers must now demonstrate compliance with ISO 13485 clauses, not just legacy QSR sections. FDA has incorporated ISO 13485:2016 by reference under 21 CFR 820.1.

2. Terminology Alignment

The old QSR used terms like 'device master record' (DMR), 'device history record' (DHR), and 'quality system record' (QSR). QMSR maps these to ISO 13485 terminology: 'technical file,' 'manufacturing records,' and 'quality management system documentation.' This is not merely cosmetic -- auditors and FDA investigators will now audit against ISO language, and your SOPs should reflect that shift.

3. Risk Management Integration

This is one of the most substantive changes. The legacy QSR referenced risk in limited contexts. ISO 13485:2016, and therefore QMSR, requires risk management to be threaded throughout the QMS -- from design and development (Clause 7.3) to production controls (Clause 7.5) and corrective action (Clause 8.5). FDA expects to see documented risk-based decision making at each stage, consistent with ISO 14971:2019.

4. Complaint Handling and Feedback

ISO 13485 Clause 8.2 requires a formal feedback system as part of post-market surveillance -- broader than the old QSR's complaint handling language. Manufacturers must now demonstrate a systematic process for collecting and analyzing post-market data, not just responding to individual complaints.

5. Supplier Controls

QMSR raises the bar on supplier qualification. ISO 13485 Clause 7.4 requires risk-based supplier evaluation and re-evaluation with documented criteria. FDA investigators will be looking for evidence that supplier monitoring is ongoing, not just a one-time onboarding checklist.

What Did NOT Change

This is where many companies trip up -- assuming harmonization means FDA requirements disappeared. It did not.

• MDR Requirements Remain Separate: Medical Device Reporting under 21 CFR Part 803 is unchanged. QMSR does not touch adverse event reporting timelines or obligations.
• FDA-Specific QMSR Additions: FDA retained several requirements that go beyond ISO 13485. These include complaint files (21 CFR 820.198 equivalent language preserved in the QMSR), servicing records, and specific device identification requirements under 21 CFR 830.
• Inspection Authority: FDA retains full authority to conduct Quality System Inspections (QSITs) and issue Form 483 observations. An ISO 13485 certificate does not shield you from FDA inspection findings.
• Design Controls Are Still Mandatory: For Class II and Class III devices, design controls remain a non-negotiable requirement. ISO 13485 Clause 7.3 aligns closely with old 21 CFR 820.30, but the expectation of documented design inputs, outputs, verification, and validation has not softened.
• UDI and Labeling Requirements: Nothing in the QMSR changes your obligations under 21 CFR Part 801 or the UDI rule (21 CFR Part 830).

Practical Steps If You Have Not Made the Transition

If your QMS still references the legacy QSR structure, here is what needs to happen immediately:

• Conduct a gap analysis mapping your current SOPs against ISO 13485:2016 clause by clause
• Update your quality manual and master SOP structure to reflect ISO 13485 terminology and architecture
• Integrate risk management references (ISO 14971) into design, production, and CAPA procedures
• Revise supplier qualification and monitoring processes to meet Clause 7.4 expectations
• Train quality and regulatory staff on the new QMSR language -- FDA investigators will audit using it
• Review your post-market surveillance system against ISO 13485 Clause 8.2 requirements

FDA has signaled that it will not grandfather companies still operating under legacy QSR structures. The QMSR is enforceable now, and 483 observations citing non-conformance with the updated regulation are already appearing in FDA inspection records.

The Bottom Line

The QMSR is not a minor administrative update. It is a structural realignment of how FDA thinks about and audits quality systems. For startups building their QMS from scratch, this is actually good news -- you can build directly to ISO 13485 and QMSR simultaneously without maintaining two parallel systems. For established companies, the risk lies in assuming your existing QSR-compliant system is 'close enough.' It may not be.

At ADB Consulting and CRO Inc., we have helped medical device companies across the compliance spectrum -- from pre-submission startups to post-market remediation -- navigate FDA quality system requirements with precision. Whether you need a full QMSR gap analysis, SOP rewriting, or pre-inspection readiness support, we have the regulatory depth to get it done right.

Book a free discovery call with Andre Butler today at adbccro.com. Let's assess where your QMS stands and build a clear path to QMSR compliance before your next FDA interaction.

If this applies to your program, our QMS Gap Assessment walks through the process in detail.