QMSR vs. ISO 13485: What Changed and What Your Startup Needs Before FDA Submission

The Ground Has Shifted: Understanding FDA's Quality Management System Regulation

On February 2, 2024, the FDA's Quality Management System Regulation (QMSR) officially took effect, replacing the legacy Quality System Regulation (QSR) found in 21 CFR Part 820. For medical device startups and small-to-mid-size manufacturers, this is not a cosmetic update. It is a structural realignment of U.S. device quality requirements with the internationally recognized standard ISO 13485:2016. If your submission strategy, quality manual, or QMS infrastructure was built around the old Part 820 framework, it is time for a gap assessment.

This post breaks down what actually changed, what stayed the same, and -- critically -- what your organization needs to have locked in before you hand a 510(k), De Novo, or PMA package to the FDA.

What the QMSR Actually Did

The QMSR, codified at 21 CFR Part 820, now explicitly incorporates ISO 13485:2016 by reference. The FDA's intent is straightforward: align domestic quality system requirements with global harmonization efforts under the International Medical Device Regulators Forum (IMDRF), reducing redundancy for manufacturers operating in multiple markets.

In practical terms, the QMSR preserves the regulatory backbone of Part 820 while adopting the structure, terminology, and process orientation of ISO 13485. The FDA has made clear in its preamble to the final rule that compliance with ISO 13485:2016 -- when implemented correctly -- will generally satisfy QMSR requirements. However, there are U.S.-specific provisions that ISO 13485 alone does not cover, and this is where many startups get into trouble.

Key Differences You Cannot Ignore

1. FDA-Specific Requirements Remain

ISO 13485 certification does not equal QMSR compliance. The QMSR retains several requirements that are explicitly U.S.-centric and not fully addressed by ISO 13485:

• Unique Device Identification (UDI): 21 CFR Part 830 requires UDI labeling and GUDID submission. ISO 13485 has no equivalent obligation.
• Medical Device Reporting (MDR): 21 CFR Part 803 mandates adverse event reporting timelines (30-day, 5-day) that fall outside ISO 13485 scope.
• Corrections and Removals: 21 CFR Part 806 reporting obligations are not mirrored in ISO 13485.
• Establishment Registration and Device Listing: 21 CFR Part 807 requirements remain entirely FDA-specific.

2. Risk Management Is Now Central, Not Peripheral

ISO 13485:2016 integrates risk management throughout the product lifecycle and expects documented linkage to ISO 14971:2019. Under the QMSR, FDA inspectors will now look for this same risk-based approach woven into your design controls, supplier controls, and CAPA processes -- not siloed in a single risk file. If your quality system treats risk management as a checkbox rather than a living process, expect observations during an FDA inspection.

3. Terminology and Process Orientation

The old QSR used terms like 'device master record' and 'device history record.' The QMSR shifts toward ISO 13485 terminology: 'technical file,' 'quality plan,' and process-based documentation. Your SOPs, forms, and quality manual should reflect this updated language to avoid confusion during audit or inspection.

What a Startup Must Have Before Submission

Whether you are preparing a 510(k) under 21 CFR Part 807.87 or a PMA under 21 CFR Part 814, FDA reviewers are increasingly scrutinizing quality system readiness as part of the submission record. Here is what must be demonstrably in place:

• A documented QMS aligned to QMSR and ISO 13485:2016: This means a quality manual, defined quality objectives, and a process map that reflects your actual operations -- not a generic template purchased online.
• Design Controls under 21 CFR 820.30 (now 820.25 in QMSR structure): Your design history file must include traceable requirements, verification and validation protocols, risk management integration per ISO 14971, and documented design reviews.
• Supplier Controls: Approved supplier lists, supplier qualification records, and incoming acceptance criteria. For software-dependent devices, this includes your Software Bill of Materials (SBOM) and any third-party component evaluations.
• CAPA System: A functioning corrective and preventive action process with documented evidence of closure. FDA expects to see real CAPA records, not a blank template.
• Management Review Records: Scheduled, documented reviews covering quality objectives, audit results, complaint trends, and resource adequacy.
• Internal Audit Program: At least one completed audit cycle before submission, with findings and corrective actions documented.
• MDR and Complaint Handling Procedures: Written, trained-to, and aligned with 21 CFR Part 803 and Part 820 complaint requirements.

The Inspection Risk Is Real

For PMA applicants, FDA may conduct a pre-approval inspection (PAI) of your manufacturing facility before granting approval. For 510(k) submissions, while routine pre-clearance inspections are less common, FDA retains the authority to inspect and can place holds on approvals when quality system deficiencies are identified. Post-COVID, FDA has resumed inspections aggressively. An FDA Form 483 observation related to your QMS at the wrong moment can delay clearance by months.

The Bottom Line for Startups

The QMSR is not simply a rebranding of Part 820. It is a strategic harmonization that raises the bar on documentation rigor, risk integration, and process maturity. Startups that build their QMS on ISO 13485:2016 as a foundation -- while layering in the U.S.-specific requirements that ISO does not cover -- will be better positioned for FDA submission, inspection readiness, and eventual international market access.

If you are unsure whether your current quality system meets QMSR requirements, or if you are building a QMS from the ground up ahead of your first submission, a structured gap assessment is the most efficient first step you can take.

Ready to Get Submission-Ready?

At ADB Consulting and CRO Inc., we help medical device startups and growing manufacturers build QMSR-compliant quality systems, conduct pre-submission gap assessments, and develop regulatory strategies that hold up under FDA scrutiny. Andre Butler and the ADB team bring hands-on FDA regulatory experience to every engagement -- no generic templates, no unnecessary complexity.

Book your free discovery call today at adbccro.com and find out exactly where your quality system stands before your submission deadline.