QMSR 2026: What Changed from 21 CFR Part 820 and What Your Device Company Must Update Now

The Clock Is Running: QMSR Takes Effect and 21 CFR Part 820 Is No Longer Enough

If you are a medical device company operating in the United States, February 2, 2026 was not a date to miss. That is when the FDA's Quality Management System Regulation (QMSR), published as the final rule on February 2, 2024, officially replaced the legacy Quality System Regulation (QSR) under 21 CFR Part 820. Device companies that have not yet completed their transition are now operating in a compliance gap that FDA investigators will not overlook.

This post breaks down exactly what changed, what your quality management system must address, and where companies most commonly fall short during the transition.

Why FDA Replaced 21 CFR Part 820 with the QMSR

The original QSR, codified in 21 CFR Part 820, was established in 1996 and last substantially revised in 1997. Over the decades, the global medical device industry aligned around ISO 13485:2016 as the international standard for quality management systems. FDA recognized the redundancy and compliance burden this created for manufacturers operating in multiple markets.

The QMSR, now found in the revised 21 CFR Part 820, explicitly incorporates ISO 13485:2016 by reference. The FDA's stated goal, outlined in the final rule preamble, was to harmonize U.S. requirements with international standards, reduce duplicative documentation burdens, and modernize the regulatory framework to reflect current industry practices.

This is not a cosmetic update. The structural and substantive differences are significant enough that a line-by-line comparison of your legacy QMS documentation is mandatory, not optional.

What Specifically Changed: Key Differences Between the Old QSR and QMSR

Terminology and Definitions

The QMSR adopts ISO 13485:2016 terminology wholesale. Terms like design history file (DHF) and device master record (DMR) are no longer explicitly defined in the regulation the way they were under the old 820. Instead, the regulation now references ISO 13485 constructs such as the technical file and broader design and development documentation requirements. Your SOPs, work instructions, and training materials that reference legacy QSR terminology must be reviewed and updated for alignment.

Management Responsibility Requirements

Under ISO 13485:2016, Section 5, management responsibility requirements are more prescriptive than the old 21 CFR 820.20. Top management must now demonstrate a documented quality policy, establish measurable quality objectives, and ensure the QMS is actively resourced and reviewed. FDA investigators can and will probe whether executive leadership has meaningful involvement in QMS oversight, not just nominal sign-off authority.

Risk Management Integration

This is one of the most operationally significant changes. The QMSR, reflecting ISO 13485:2016 throughout, requires risk management to be integrated across the entire QMS, not treated as a standalone design control activity. Risk-based thinking must now permeate supplier controls, production and process controls, corrective and preventive action (CAPA), and management review. Companies that maintain risk management only within their 14971 design file are not in compliance with the QMSR's intent.

Supplier and Purchasing Controls

Section 7.4 of ISO 13485:2016, now incorporated into the QMSR, imposes more rigorous supplier evaluation and monitoring requirements than the old 21 CFR 820.50. Specifically, companies must define criteria for supplier selection and re-evaluation, maintain records of those evaluations, and apply risk-based controls proportionate to the impact of supplied products on finished device conformity. A supplier qualification program that was acceptable under the old QSR may now be deficient.

Design and Development Controls

The QMSR aligns design and development requirements more closely with ISO 13485:2016 Section 7.3, which includes explicit requirements for design and development planning updates, transfer controls, and change controls that go beyond what 21 CFR 820.30 required. Design transfer, in particular, is now a defined and documented activity that must demonstrate design outputs can be consistently manufactured.

What Your Company Must Update Before Your Next FDA Inspection

• Quality Manual: Rewrite or restructure to map against ISO 13485:2016 section numbering, which is now the operative framework under the QMSR.
• SOPs and Work Instructions: Audit every procedure that references 21 CFR 820 sections by number and update citations and substantive requirements accordingly.
• Risk Management Procedures: Expand risk-based thinking beyond design controls into CAPA, supplier management, and production processes.
• Supplier Qualification Program: Ensure your approved supplier list (ASL) process reflects defined selection criteria, risk tiering, and re-evaluation intervals.
• Management Review Records: Confirm that inputs and outputs meet ISO 13485:2016 Section 5.6 requirements, which are now enforceable under QMSR.
• Training Records: Document that all relevant personnel have been trained on QMSR requirements, not just the old QSR.

How FDA Will Enforce the QMSR

FDA has stated that Quality System Inspections (QSITs) will now be conducted against QMSR requirements. Investigators have updated their inspection protocols accordingly. Observations issued on Form FDA 483 and Warning Letters citing 21 CFR Part 820 deficiencies will now reference the QMSR framework. Companies that cannot demonstrate QMSR-aligned procedures during an inspection face real regulatory risk, including import alerts and consent decrees for repeat or systemic findings.

Do not assume that because your company passed a QSR inspection in 2023 or 2024 that you are currently compliant. The standard has changed.

Where Startups and Small Device Companies Most Often Fall Short

In our consulting work with device startups and growth-stage companies, the most common gaps we identify are incomplete risk management integration beyond the design file, supplier programs that lack documented re-evaluation cycles, and management review records that satisfy form but not substance. These are exactly the areas FDA investigators probe most aggressively in small company inspections.

Ready to Assess Your QMSR Compliance Gap?

At ADB Consulting and CRO Inc., we specialize in helping medical device companies navigate FDA regulatory requirements with precision and speed. Whether you are preparing for your first FDA inspection, submitting a 510(k), or building your QMS from the ground up, our team can identify your compliance gaps and implement the right solutions.

Book a free discovery call with Andre Butler today at adbccro.com. Let's make sure your QMS is built to pass inspection, not just check a box.