QMSR 2026: What Changed from 21 CFR Part 820 and What Your Device Company Must Update Now

The Clock Is Running: QMSR Takes Effect and 21 CFR Part 820 Is No Longer Enough

If you are a medical device company operating in the United States, February 2, 2026 was not a date to miss. That is when the FDA's Quality Management System Regulation (QMSR), published as the final rule on February 2, 2024, officially replaced the legacy Quality System Regulation (QSR) under 21 CFR Part 820. Device companies that have not yet completed their transition are now operating in a compliance gap that FDA investigators will not overlook.

This post breaks down exactly what changed, what your quality management system must address, and where companies most commonly fall short during the transition.

Why FDA Replaced 21 CFR Part 820 with the QMSR

The original QSR, codified in 21 CFR Part 820, was established in 1996 and last substantially revised in 1997. Over the decades, the global medical device industry aligned around ISO 13485:2016 as the international standard for quality management systems. FDA recognized the redundancy and compliance burden this created for manufacturers operating in multiple markets.

The QMSR, now found in the revised 21 CFR Part 820, explicitly incorporates ISO 13485:2016 by reference. The FDA's stated goal, outlined in the final rule preamble, was to harmonize U.S. requirements with international standards, reduce duplicative documentation burdens, and modernize the regulatory framework to reflect current industry practices.

This is not a cosmetic update. The structural and substantive differences are significant enough that a line-by-line comparison of your legacy QMS documentation is mandatory, not optional.

What Specifically Changed: Key Differences Between the Old QSR and QMSR

Terminology and Definitions

The QMSR adopts ISO 13485:2016 terminology wholesale. Terms like design history file (DHF) and device master record (DMR) are no longer explicitly defined in the regulation the way they were under the old 820. Instead, the regulation now references ISO 13485 constructs such as the technical file and broader design and development documentation requirements. Your SOPs, work instructions, and training materials that reference legacy QSR terminology must be reviewed and updated for alignment.

Management Responsibility Requirements

Under ISO 13485:2016, Section 5, management responsibility requirements are more prescriptive than the old 21 CFR 820.20. Top management must now demonstrate a documented quality policy, establish measurable quality objectives, and ensure the QMS is actively resourced and reviewed. FDA investigators can and will probe whether executive leadership has meaningful involvement in QMS oversight, not just nominal sign-off authority.

Risk Management Integration

This is one of the most operationally significant changes. The QMSR, reflecting ISO 13485:2016 throughout, requires risk management to be integrated across the entire QMS, not treated as a standalone design control activity. Risk-based thinking must now permeate supplier controls, production and process controls, corrective and preventive action (CAPA), and management review. Companies that maintain risk management only within their 14971 design file are not in compliance with the QMSR's intent.

Supplier and Purchasing Controls

Section 7.4 of ISO 13485:2016, now incorporated into the QMSR, imposes more rigorous supplier evaluation and monitoring requirements than the old 21 CFR 820.50. Specifically, companies must define criteria for supplier selection and re-evaluation, maintain records of those evaluations, and apply risk-based controls proportionate to the impact of supplied products on finished device conformity. A supplier qualification program that was acceptable under the old QSR may now be deficient.

Design and Development Controls

The QMSR aligns design and development requirements more closely with ISO 13485:2016 Section 7.3, which includes explicit requirements for design and development planning updates, transfer controls, and change controls that go beyond what 21 CFR 820.30 required. Design transfer, in particular, is now a defined and documented activity that must demonstrate design outputs can be consistently manufactured.

What Your Company Must Update Before Your Next FDA Inspection

• Quality Manual: Rewrite or restructure to map against ISO 13485:2016 section numbering, which is now the operative framework under the QMSR.
• SOPs and Work Instructions: Audit every procedure that references 21 CFR 820 sections by number and update citations and substantive requirements accordingly.
• Risk Management Procedures: Expand risk-based thinking beyond design controls into CAPA, supplier management, and production processes.
• Supplier Qualification Program: Ensure your approved supplier list (ASL) process reflects defined selection criteria, risk tiering, and re-evaluation intervals.
• Management Review Records: Confirm that inputs and outputs meet ISO 13485:2016 Section 5.6 requirements, which are now enforceable under QMSR.
• Training Records: Document that all relevant personnel have been trained on QMSR requirements, not just the old QSR.

How FDA Will Enforce the QMSR

FDA has stated that Quality System Inspections (QSITs) will now be conducted against QMSR requirements. Investigators have updated their inspection protocols accordingly. Observations issued on Form FDA 483 and Warning Letters citing 21 CFR Part 820 deficiencies will now reference the QMSR framework. Companies that cannot demonstrate QMSR-aligned procedures during an inspection face real regulatory risk, including import alerts and consent decrees for repeat or systemic findings.

Do not assume that because your company passed a QSR inspection in 2023 or 2024 that you are currently compliant. The standard has changed.

Where Startups and Small Device Companies Most Often Fall Short

In our consulting work with device startups and growth-stage companies, the most common gaps we identify are incomplete risk management integration beyond the design file, supplier programs that lack documented re-evaluation cycles, and management review records that satisfy form but not substance. These are exactly the areas FDA investigators probe most aggressively in small company inspections.

Ready to Assess Your QMSR Compliance Gap?

At ADB Consulting and CRO Inc., we specialize in helping medical device companies navigate FDA regulatory requirements with precision and speed. Whether you are preparing for your first FDA inspection, submitting a 510(k), or building your QMS from the ground up, our team can identify your compliance gaps and implement the right solutions.

Book a free discovery call with Andre Butler today at adbccro.com. Let's make sure your QMS is built to pass inspection, not just check a box.

The Quality System Landscape Just Changed -- Is Your Startup Ready?

On February 2, 2026, FDA's Quality Management System Regulation (QMSR) officially took effect, replacing the legacy Quality System Regulation (QSR) codified under 21 CFR Part 820. For medical device startups navigating their first 510(k), De Novo, or PMA submission, this is not a minor administrative update. It is a foundational shift in how FDA expects you to design, document, and demonstrate your quality system -- and the clock is already running.

This post breaks down the critical differences between QMSR and ISO 13485:2016, what the harmonization actually means in practice, and the specific quality infrastructure your startup must have in place before submitting to FDA.

What Is QMSR and Why Did FDA Make the Change?

The final QMSR rule, published in the Federal Register on February 2, 2024 and effective February 2, 2026, explicitly harmonizes 21 CFR Part 820 with ISO 13485:2016. FDA's stated goal was to reduce redundant compliance burdens for manufacturers already certified to ISO 13485 and to align U.S. requirements with internationally accepted quality standards.

The old Part 820 QSR had not been substantively updated since 1996. QMSR modernizes the framework by incorporating ISO 13485:2016 by reference, meaning that satisfying ISO 13485 requirements is now the baseline for satisfying FDA's QMS expectations -- with a few critical U.S.-specific additions.

Key Differences Between QMSR and ISO 13485: What Actually Changed

While QMSR adopts ISO 13485:2016 as its structural backbone, there are meaningful distinctions startup founders and regulatory professionals must understand:

• Complaint Handling and MDR Integration: QMSR retains specific U.S. requirements for complaint files and Medical Device Reporting (MDR) under 21 CFR Part 803. ISO 13485 addresses feedback and complaint handling generically; QMSR requires explicit linkage to FDA's MDR obligations. Your QMS procedures must reflect this distinction.
• Records and Documentation Language: QMSR adopts ISO 13485's terminology -- 'documented information' replaces the QSR's 'records' and 'documents' distinction. This is more than semantic. Your document control SOPs and design history files need to reflect this updated framework.
• Design Controls Remain Non-Negotiable: QMSR Section 820.30 (now restructured under the ISO 13485 design and development clause 7.3) still requires robust design controls. For startups, this means your Design History File (DHF), Device Master Record (DMR), and Design Validation records must be complete and submission-ready before FDA review begins.
• Supplier Controls: ISO 13485 Section 7.4 and QMSR align on supplier evaluation and monitoring, but FDA inspectors will still scrutinize whether your Critical Component suppliers have been formally qualified. A spreadsheet of vendor names does not satisfy this requirement.
• U.S.-Specific Provisions Remain: Certain QSR provisions -- including corrective and preventive action (CAPA) procedural requirements, management responsibility structures, and statistical techniques -- are preserved under QMSR with explicit regulatory force, not merely as ISO guidance suggestions.

What Your Startup Must Have in Place Before Submitting

A common and costly mistake among device startups is treating FDA submission as a documentation exercise disconnected from the underlying quality system. Under QMSR, the expectation is that your QMS is operational -- not theoretical -- at the time of submission. Here is what FDA will expect to see upon submission and during any subsequent inspection:

• A Compliant QMS Framework: Your quality manual, SOPs, and work instructions must reflect QMSR/ISO 13485:2016 requirements. If you are using an off-the-shelf QMS template purchased three years ago, it likely reflects the old QSR structure and needs to be updated.
• A Complete Design History File: Every design input, output, review, verification, validation, and change record must be traceable and complete. For 510(k) submissions, FDA reviewers will reference your design controls during Substantial Equivalence review. For PMAs, the DHF is subject to direct inspection.
• Risk Management Records Per ISO 14971:2019: QMSR and FDA guidance documents -- including the 2023 FDA Guidance on Benefit-Risk Factors -- expect risk management to be integrated throughout your design process, not appended at the end. Your risk management file should reference ISO 14971:2019 and document residual risk acceptability decisions.
• Operational CAPA and Complaint Procedures: Documented procedures alone are insufficient. FDA expects evidence that your CAPA system has been exercised. Even startups with limited commercial history should document internal NCRs and corrective actions from design verification and validation activities.
• Supplier Qualification Records: Approved Supplier Lists (ASLs), supplier audits or questionnaires, and incoming inspection criteria must be documented and current before submission.

The Bottom Line for Startups

QMSR harmonization is genuinely good news for companies already working toward ISO 13485 certification -- it reduces duplicative compliance work. But harmonization does not mean identical. The U.S.-specific provisions, MDR integration requirements, and FDA's inspection-ready expectations mean that an ISO 13485 certificate alone does not supports QMSR compliance, and it certainly does not supports a smooth 510(k) or PMA review.

Startups that treat their QMS as a checkbox rather than a living system consistently run into preventable delays -- FDA Additional Information requests, refuse-to-accept decisions, and post-clearance 483 observations that could have been avoided with proper preparation.

Ready to Get Your Quality System Submission-Ready?

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with device startups and growth-stage companies to build QMSR-compliant quality systems, prepare submission-ready DHFs, and navigate FDA review with confidence. Whether you are six months from your first 510(k) or just beginning your regulatory roadmap, we can help you move faster and avoid the mistakes that derail timelines.

Book your free discovery call today at adbccro.com and let us assess exactly where your quality system stands before you submit.

The Ground Has Shifted: Understanding FDA's Quality Management System Regulation

On February 2, 2024, the FDA's Quality Management System Regulation (QMSR) officially took effect, replacing the legacy Quality System Regulation (QSR) found in 21 CFR Part 820. For medical device startups and small-to-mid-size manufacturers, this is not a cosmetic update. It is a structural realignment of U.S. device quality requirements with the internationally recognized standard ISO 13485:2016. If your submission strategy, quality manual, or QMS infrastructure was built around the old Part 820 framework, it is time for a gap assessment.

This post breaks down what actually changed, what stayed the same, and -- critically -- what your organization needs to have locked in before you hand a 510(k), De Novo, or PMA package to the FDA.

What the QMSR Actually Did

The QMSR, codified at 21 CFR Part 820, now explicitly incorporates ISO 13485:2016 by reference. The FDA's intent is straightforward: align domestic quality system requirements with global harmonization efforts under the International Medical Device Regulators Forum (IMDRF), reducing redundancy for manufacturers operating in multiple markets.

In practical terms, the QMSR preserves the regulatory backbone of Part 820 while adopting the structure, terminology, and process orientation of ISO 13485. The FDA has made clear in its preamble to the final rule that compliance with ISO 13485:2016 -- when implemented correctly -- will generally satisfy QMSR requirements. However, there are U.S.-specific provisions that ISO 13485 alone does not cover, and this is where many startups get into trouble.

Key Differences You Cannot Ignore

1. FDA-Specific Requirements Remain

ISO 13485 certification does not equal QMSR compliance. The QMSR retains several requirements that are explicitly U.S.-centric and not fully addressed by ISO 13485:

• Unique Device Identification (UDI): 21 CFR Part 830 requires UDI labeling and GUDID submission. ISO 13485 has no equivalent obligation.
• Medical Device Reporting (MDR): 21 CFR Part 803 mandates adverse event reporting timelines (30-day, 5-day) that fall outside ISO 13485 scope.
• Corrections and Removals: 21 CFR Part 806 reporting obligations are not mirrored in ISO 13485.
• Establishment Registration and Device Listing: 21 CFR Part 807 requirements remain entirely FDA-specific.

2. Risk Management Is Now Central, Not Peripheral

ISO 13485:2016 integrates risk management throughout the product lifecycle and expects documented linkage to ISO 14971:2019. Under the QMSR, FDA inspectors will now look for this same risk-based approach woven into your design controls, supplier controls, and CAPA processes -- not siloed in a single risk file. If your quality system treats risk management as a checkbox rather than a living process, expect observations during an FDA inspection.

3. Terminology and Process Orientation

The old QSR used terms like 'device master record' and 'device history record.' The QMSR shifts toward ISO 13485 terminology: 'technical file,' 'quality plan,' and process-based documentation. Your SOPs, forms, and quality manual should reflect this updated language to avoid confusion during audit or inspection.

What a Startup Must Have Before Submission

Whether you are preparing a 510(k) under 21 CFR Part 807.87 or a PMA under 21 CFR Part 814, FDA reviewers are increasingly scrutinizing quality system readiness as part of the submission record. Here is what must be demonstrably in place:

• A documented QMS aligned to QMSR and ISO 13485:2016: This means a quality manual, defined quality objectives, and a process map that reflects your actual operations -- not a generic template purchased online.
• Design Controls under 21 CFR 820.30 (now 820.25 in QMSR structure): Your design history file must include traceable requirements, verification and validation protocols, risk management integration per ISO 14971, and documented design reviews.
• Supplier Controls: Approved supplier lists, supplier qualification records, and incoming acceptance criteria. For software-dependent devices, this includes your Software Bill of Materials (SBOM) and any third-party component evaluations.
• CAPA System: A functioning corrective and preventive action process with documented evidence of closure. FDA expects to see real CAPA records, not a blank template.
• Management Review Records: Scheduled, documented reviews covering quality objectives, audit results, complaint trends, and resource adequacy.
• Internal Audit Program: At least one completed audit cycle before submission, with findings and corrective actions documented.
• MDR and Complaint Handling Procedures: Written, trained-to, and aligned with 21 CFR Part 803 and Part 820 complaint requirements.

The Inspection Risk Is Real

For PMA applicants, FDA may conduct a pre-approval inspection (PAI) of your manufacturing facility before granting approval. For 510(k) submissions, while routine pre-clearance inspections are less common, FDA retains the authority to inspect and can place holds on approvals when quality system deficiencies are identified. Post-COVID, FDA has resumed inspections aggressively. An FDA Form 483 observation related to your QMS at the wrong moment can delay clearance by months.

Ready to Get Submission-Ready?

At ADB Consulting and CRO Inc., we help medical device startups and growing manufacturers build QMSR-compliant quality systems, conduct pre-submission gap assessments, and develop regulatory strategies that hold up under FDA scrutiny. Andre Butler and the ADB team bring hands-on FDA regulatory experience to every engagement -- no generic templates, no unnecessary complexity.

Book your free discovery call today at adbccro.com and find out exactly where your quality system stands before your submission deadline.

QMSR and ISO 13485:2016: Closer Than Ever, But Not Identical

When FDA finalized the Quality Management System Regulation (QMSR) in February 2024, it marked the most significant overhaul of device quality regulations in nearly three decades. The new rule, codified at 21 CFR Part 820, explicitly incorporates ISO 13485:2016 by reference — a deliberate move to reduce duplicative compliance burdens for manufacturers operating in global markets.

For medical device startup founders and quality leaders who have already built their QMS around ISO 13485, this is largely good news. But 'largely' is doing a lot of work in that sentence. The QMSR and ISO 13485:2016 are not interchangeable, and assuming they are is a compliance risk you cannot afford. This post breaks down where the two genuinely align and, more importantly, where they still diverge in ways that matter operationally.

Where QMSR and ISO 13485:2016 Genuinely Align

The structural alignment between QMSR and ISO 13485:2016 is real and meaningful. FDA's intent was harmonization, and on the major architectural elements, they delivered.

• Risk-based thinking: Both frameworks now require risk management to be woven throughout the QMS — not siloed in a single procedure. ISO 13485 Clause 0.4 and the QMSR preamble both reinforce this philosophy, and it aligns with ISO 14971:2019 as the expected risk management standard.
• Design and development controls: The QMSR design controls at 21 CFR 820.30 now closely mirror ISO 13485 Clause 7.3, including planning, inputs, outputs, review, verification, validation, and transfer. The sequencing and terminology are substantially harmonized.
• Supplier and purchasing controls: Both frameworks require documented supplier evaluation, selection, and monitoring processes (ISO 13485 Clause 7.4; QMSR 21 CFR 820.50). The underlying expectations for supplier qualification records are functionally equivalent.
• Complaint handling and CAPA: Complaint handling (ISO 13485 Clause 8.2.2; QMSR 21 CFR 820.198) and corrective and preventive action (ISO 13485 Clause 8.5.2 and 8.5.3; QMSR 21 CFR 820.100) are structured similarly, with both requiring documented root cause analysis and effectiveness verification.

If your ISO 13485-certified QMS is well-implemented and current, you have a strong foundation. The gap-closure effort is real but not overwhelming — provided you understand where the gaps actually live.

Where QMSR and ISO 13485:2016 Still Diverge

This is where experienced regulatory professionals need to pay close attention. The divergences are not cosmetic. Several reflect FDA's distinct statutory authority under the Federal Food, Drug, and Cosmetic Act (FD&C Act) and its domestic enforcement posture.

1. FDA-Specific Regulatory Requirements Remain

ISO 13485 has no concept of FDA's Unique Device Identification (UDI) system, established under 21 CFR Part 830, or the requirements tied to the Global Unique Device Identification Database (GUDID). QMSR incorporates UDI labeling and record-keeping expectations that have no parallel in ISO 13485. Similarly, Medical Device Reporting (MDR) obligations under 21 CFR Part 803 are a QMSR-adjacent requirement that ISO 13485 Clause 8.2.3 addresses only in general terms — it does not replicate the specificity of FDA's reportability thresholds, 30-day and 5-day reporting windows, or eMDR submission requirements.

2. Establishment Registration and Device Listing

QMSR assumes compliance with 21 CFR Part 807, which governs establishment registration and device listing with FDA. ISO 13485 certification provides no coverage here. This is a purely domestic regulatory obligation that remains entirely outside the scope of the international standard.

3. Records and Documentation Language

While QMSR adopts ISO 13485 terminology around 'documented information,' FDA inspectors still operate under established inspection procedures that reference legacy QSR language. Manufacturers should helps prepare their document management systems can demonstrate compliance in terms FDA investigators will recognize during a 21 CFR 820 inspection, even as the regulatory text has modernized.

4. Software and SaMD Considerations

ISO 13485 Clause 7.5.6 addresses software validation for production and service, but neither ISO 13485 nor QMSR fully addresses the Software as a Medical Device (SaMD) regulatory pathway expectations that FDA has articulated in its 2019 Software Functions guidance and the AI/ML action plan. QMSR compliance is necessary but not sufficient for SaMD manufacturers navigating FDA's digital health framework.

5. Enforcement Context and FDA Inspection Authority

Perhaps the most consequential divergence is not textual — it is jurisdictional. ISO 13485 certification is granted by a Notified Body or certification body. QMSR compliance is enforced by FDA investigators with authority to issue Form 483 observations, Warning Letters, import alerts, and injunctions. A certificate does not shield you from an inspection finding. Regulatory posture, inspection readiness, and documented objective evidence are non-negotiable in the FDA context in ways that certification audits simply do not replicate.

What This Means for Your QMS Strategy

If you are a startup building your first QMS, or a VP of Quality reassessing your compliance architecture ahead of a submission or FDA inspection, the practical guidance is this: use ISO 13485:2016 as your structural backbone, but layer in QMSR-specific requirements deliberately and traceably. Do not assume that your Notified Body certificate closes your FDA compliance gap — it does not.

Map your procedures explicitly to both the QMSR regulatory citations and the corresponding ISO 13485 clauses. Maintain that mapping as a living document. Treat FDA inspection readiness as a distinct workstream from certification audit preparation.

The QMSR harmonization is a genuine step forward for the industry. But harmonization is not unification, and the distinctions that remain carry real regulatory and business risk.

The Biggest Overhaul to 21 CFR Part 820 in 25 Years Is Now in Effect

On February 2, 2026, FDA's Quality Management System Regulation (QMSR) became the enforceable law of the land for U.S. medical device manufacturers. The legacy Quality System Regulation (QSR) that had governed device quality since 1996 is gone. In its place is a regulation explicitly harmonized with ISO 13485:2016 -- and if your quality system has not been updated to reflect that shift, you are already out of compliance.

This post breaks down exactly what changed, what did not, and what your team needs to do right now. No filler. Just the regulatory specifics you need.

Why FDA Made This Change

FDA's rationale was straightforward: the global medical device industry increasingly operates under ISO 13485, the internationally recognized quality management system standard. The legacy 21 CFR Part 820 was largely aligned in spirit, but diverged enough in structure and terminology to create duplicative documentation burdens for manufacturers selling into both the U.S. and international markets.

The QMSR Final Rule, published in the Federal Register on February 23, 2024 (89 FR 7496), gave manufacturers a two-year implementation window. That window closed on February 2, 2026. FDA's stated intent, as outlined in the preamble to the final rule, was to 'incorporate by reference' ISO 13485:2016 into U.S. federal regulation while retaining specific FDA-only requirements where necessary.

What Actually Changed

1. The Regulatory Architecture

Under the old QSR, 21 CFR Part 820 had its own standalone structure -- design controls, corrective action, production controls, and so on. The QMSR replaces that architecture with ISO 13485:2016 as the backbone. Manufacturers must now demonstrate compliance with ISO 13485 clauses, not just legacy QSR sections. FDA has incorporated ISO 13485:2016 by reference under 21 CFR 820.1.

2. Terminology Alignment

The old QSR used terms like 'device master record' (DMR), 'device history record' (DHR), and 'quality system record' (QSR). QMSR maps these to ISO 13485 terminology: 'technical file,' 'manufacturing records,' and 'quality management system documentation.' This is not merely cosmetic -- auditors and FDA investigators will now audit against ISO language, and your SOPs should reflect that shift.

3. Risk Management Integration

This is one of the most substantive changes. The legacy QSR referenced risk in limited contexts. ISO 13485:2016, and therefore QMSR, requires risk management to be threaded throughout the QMS -- from design and development (Clause 7.3) to production controls (Clause 7.5) and corrective action (Clause 8.5). FDA expects to see documented risk-based decision making at each stage, consistent with ISO 14971:2019.

4. Complaint Handling and Feedback

ISO 13485 Clause 8.2 requires a formal feedback system as part of post-market surveillance -- broader than the old QSR's complaint handling language. Manufacturers must now demonstrate a systematic process for collecting and analyzing post-market data, not just responding to individual complaints.

5. Supplier Controls

QMSR raises the bar on supplier qualification. ISO 13485 Clause 7.4 requires risk-based supplier evaluation and re-evaluation with documented criteria. FDA investigators will be looking for evidence that supplier monitoring is ongoing, not just a one-time onboarding checklist.

What Did NOT Change

This is where many companies trip up -- assuming harmonization means FDA requirements disappeared. It did not.

• MDR Requirements Remain Separate: Medical Device Reporting under 21 CFR Part 803 is unchanged. QMSR does not touch adverse event reporting timelines or obligations.
• FDA-Specific QMSR Additions: FDA retained several requirements that go beyond ISO 13485. These include complaint files (21 CFR 820.198 equivalent language preserved in the QMSR), servicing records, and specific device identification requirements under 21 CFR 830.
• Inspection Authority: FDA retains full authority to conduct Quality System Inspections (QSITs) and issue Form 483 observations. An ISO 13485 certificate does not shield you from FDA inspection findings.
• Design Controls Are Still Mandatory: For Class II and Class III devices, design controls remain a non-negotiable requirement. ISO 13485 Clause 7.3 aligns closely with old 21 CFR 820.30, but the expectation of documented design inputs, outputs, verification, and validation has not softened.
• UDI and Labeling Requirements: Nothing in the QMSR changes your obligations under 21 CFR Part 801 or the UDI rule (21 CFR Part 830).

Practical Steps If You Have Not Made the Transition

If your QMS still references the legacy QSR structure, here is what needs to happen immediately:

• Conduct a gap analysis mapping your current SOPs against ISO 13485:2016 clause by clause
• Update your quality manual and master SOP structure to reflect ISO 13485 terminology and architecture
• Integrate risk management references (ISO 14971) into design, production, and CAPA procedures
• Revise supplier qualification and monitoring processes to meet Clause 7.4 expectations
• Train quality and regulatory staff on the new QMSR language -- FDA investigators will audit using it
• Review your post-market surveillance system against ISO 13485 Clause 8.2 requirements

FDA has signaled that it will not grandfather companies still operating under legacy QSR structures. The QMSR is enforceable now, and 483 observations citing non-conformance with the updated regulation are already appearing in FDA inspection records.

The Bottom Line

The QMSR is not a minor administrative update. It is a structural realignment of how FDA thinks about and audits quality systems. For startups building their QMS from scratch, this is actually good news -- you can build directly to ISO 13485 and QMSR simultaneously without maintaining two parallel systems. For established companies, the risk lies in assuming your existing QSR-compliant system is 'close enough.' It may not be.

At ADB Consulting and CRO Inc., we have helped medical device companies across the compliance spectrum -- from pre-submission startups to post-market remediation -- navigate FDA quality system requirements with precision. Whether you need a full QMSR gap analysis, SOP rewriting, or pre-inspection readiness support, we have the regulatory depth to get it done right.

Book a free discovery call with Andre Butler today at adbccro.com. Let's assess where your QMS stands and build a clear path to QMSR compliance before your next FDA interaction.

If this applies to your program, our QMS Gap Assessment walks through the process in detail.