How to Read a QMSR Gap Assessment Against Your ISO 13485 Certificate

Your ISO 13485 Certificate Is Not a QMSR Free Pass

When FDA finalized the Quality Management System Regulation (QMSR) on February 2, 2024, it effectively aligned 21 CFR Part 820 with ISO 13485:2016. On the surface, that sounds like great news for any manufacturer already holding an ISO 13485 certificate. In practice, the alignment is real but incomplete, and misreading a gap assessment at this stage can cost you a warning letter, a Form 483, or a failed inspection.

This post walks through how to interpret a QMSR gap assessment in the specific context of an existing ISO 13485 QMS, what the gaps actually mean operationally, and where companies consistently underestimate the remaining work.

What the QMSR Actually Did and Did Not Do

The QMSR incorporated ISO 13485:2016 by reference into 21 CFR Part 820. FDA's intent was to reduce duplicative compliance burdens for manufacturers selling globally. However, the agency was explicit in the preamble to the final rule: ISO 13485 certification from a Notified Body does not satisfy QMSR obligations. FDA conducts its own inspections under its own statutory authority. Your certificate is evidence of a functioning QMS, not a substitute for regulatory compliance.

Additionally, the QMSR retained several uniquely American requirements that have no direct ISO 13485 counterpart, including explicit complaint handling timelines tied to MDR obligations under 21 CFR Part 803, correction and removal reporting under 21 CFR Part 806, and UDI integration requirements. A gap assessment that does not address these residual FDA-only provisions is, by definition, incomplete.

How to Structure Your Reading of a Gap Assessment

A well-constructed QMSR gap assessment will map your current QMS procedures to three reference points: the text of ISO 13485:2016, the new QMSR regulatory text at 21 CFR Part 820, and any applicable FDA guidance documents such as the 2023 FDA guidance on cybersecurity for medical devices or the Quality System Information for Certain Premarket Application Reviews guidance. When you receive a gap assessment, read it in layers, not as a flat checklist.

Layer 1: Structural Gaps

These are missing procedures or records entirely. If your ISO 13485-based QMS lacks a documented process for complaint handling that references 21 CFR 820.198 or does not explicitly link complaint investigations to MDR reportability decisions, that is a structural gap. These are highest priority because they represent audit findings waiting to happen.

Layer 2: Procedural Alignment Gaps

These exist when a procedure is present but written against ISO 13485 language that does not fully map to QMSR requirements. For example, your design controls procedure may satisfy ISO 13485 Clause 7.3 but fail to address the specific QMSR requirements for design history file content as described in 21 CFR 820.30. The document exists; the content needs updating.

Layer 3: Evidence and Record Gaps

These are perhaps the most dangerous for companies with mature ISO 13485 systems because they are invisible until an inspector asks for them. A good gap assessment will identify where your records do not yet demonstrate the traceability or completeness that QMSR inspectors will expect. This is particularly acute in areas like supplier controls under 21 CFR 820.50, where FDA expects documented supplier qualification evidence that goes beyond what many Notified Bodies have historically reviewed closely.

Three Areas Where ISO 13485 Holders Consistently Have Gaps

• Management Review Records: ISO 13485 Clause 5.6 and QMSR 21 CFR 820.20 both require management reviews, but FDA inspectors look for explicit quality policy commitments and documented resource adequacy discussions. Review your minutes to confirm they address QMSR-specific agenda items.
• CAPA Effectiveness Verification: Under 21 CFR 820.100, FDA expects objective evidence that corrective actions have been verified as effective. Many ISO 13485 CAPA records close actions without documented effectiveness checks. This is a leading Form 483 observation category.
• Software Validation Records: If you use software in your QMS or your manufacturing process, 21 CFR 820.70(i) requires documented software validation. ISO 13485 Clause 7.5.6 addresses this, but FDA expects a level of IQ/OQ/PQ rigor that many certification bodies do not enforce consistently. Your gap assessment should flag each software system individually.

Prioritizing Remediation Before the Enforcement Deadline

FDA's compliance date for the QMSR was February 2, 2026. Inspections conducted after that date are evaluated against the new standard. If your gap assessment was completed before or around that transition, revisit it now with current eyes. Prioritize structural gaps first, then procedural alignment, then evidence remediation. Build a remediation tracker that ties each gap to a procedure number, an owner, a target close date, and a verification step.

Do not treat your Notified Body surveillance audit schedule as a proxy for FDA readiness. The inspection criteria, inspector training, and documentation expectations differ materially between the two systems.

The Bottom Line

An ISO 13485 certificate is a meaningful asset and a genuine head start. But reading a QMSR gap assessment correctly means understanding that the certificate closes roughly 80 percent of the distance to full compliance, not 100 percent. The remaining 20 percent includes some of the highest-risk observations FDA is actively citing. Close those gaps deliberately, with documented evidence, before an investigator asks for them.

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and quality and regulatory teams at small and mid-size companies to translate gap assessments into actionable remediation plans that hold up under FDA scrutiny. If you have a gap assessment sitting on your desk and are not sure what to prioritize, that is exactly the conversation we are built for.

Book a free discovery call at adbccro.com and let us help you close the right gaps before your next FDA inspection.

For related guidance, see our quality management system gap assessment.