FDA QMSR + ISO 13485 Alignment: What Manufacturers Must Prepare For

The FDA's Quality Management System Regulation (QMSR) is the biggest change to U.S. medical device quality requirements in decades. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, and it took effect on 2 February 2026. The aim is harmonisation, but QMSR still adds FDA-specific requirements, changes how FDA inspects, and makes some records inspectable that were previously protected. This guide covers where alignment is seamless and where you still need deliberate system updates.

1. What the FDA's QMSR alignment actually means

QMSR incorporates ISO 13485:2016 by reference, so ISO 13485 becomes the core quality system requirement for U.S. device manufacturers. It is not a simple adoption. FDA kept additional requirements in Part 820, including:

• FDA definitions that apply alongside ISO 13485 terms, and a rule that the FD&C Act and FDA regulations control where they conflict with ISO 13485
• Record requirements in 21 CFR 820.35, including complaint records, servicing records and unique device identifier (UDI) records
• Labeling and packaging controls in 21 CFR 820.45
• Links to other FDA regulations, such as Medical Device Reporting (Part 803) and corrections and removals (Part 806)

Successful implementation means understanding both the harmonised core and the retained U.S.-specific obligations.

2. Core areas of alignment between QMSR and ISO 13485

2.1 Risk management integration

ISO 13485 requires a risk-based approach across the QMS. Under QMSR, FDA expects that integration to be visible in:

• Design controls
• Purchasing controls and supplier management
• Process validation
• Corrective and preventive action
• Complaint analysis and post-market response

2.2 Process-based QMS structure

ISO 13485's process approach fits FDA's intention to evaluate the quality system as a whole, including the interactions between design, production, purchasing and feedback processes.

2.3 Documentation and record control

Manufacturers already certified to ISO 13485 will recognise the structures for document control, record retention and objective evidence.

3. Key differences manufacturers must prepare for

3.1 Complaint handling expectations

FDA's complaint requirements remain more prescriptive than ISO 13485 alone. Make sure you have:

• Documented evaluation of each complaint for Medical Device Reporting (MDR) reportability
• Complaint records containing the information 21 CFR 820.35 requires
• Consistent, documented decision pathways
• Links between complaints, CAPA and risk file updates

3.2 Device records: from DHF, DMR and DHR to the medical device file

QMSR removed the old Part 820 terms design history file (DHF), device master record (DMR) and device history record (DHR). The equivalent content now sits in the ISO 13485 structure:

• Design and development file (ISO 13485 clause 7.3.10) replaces the DHF concept
• Medical device file (clause 4.2.3) covers what the DMR used to hold: specifications, production and service procedures, labeling and installation requirements
• Batch or lot records (clause 7.5.1) and identification and traceability records (clauses 7.5.8 and 7.5.9) cover what the DHR used to show

You do not have to rename your files overnight, but your procedures should map old FDA terms to the ISO 13485 records so an investigator can follow the trail. Keep the 820.35 complaint, servicing and UDI record content in addition.

3.3 How FDA now inspects: QSIT has been replaced

On 2 February 2026 FDA stopped using the Quality System Inspection Technique (QSIT) for device inspections. Inspections now follow the updated compliance program 7382.850, Inspection of Medical Device Manufacturers. In practice, prepare for:

• Inspections organised around ISO 13485 processes and their interactions, rather than the four QSIT subsystems
• Risk-based sampling of records across the product lifecycle
• Management review, internal audit and supplier audit reports being available to investigators. The old Part 820 exception that kept these reports out of inspections was not carried into QMSR.
• Complete, contemporaneous records that show how risk informed your decisions

ISO 13485 certification does not replace FDA inspection readiness. Notified body or registrar audits are a different exercise from an FDA inspection.

3.4 Post-market obligations

ISO 13485 covers feedback and monitoring, but FDA keeps separate statutory obligations, including:

• Medical Device Reporting (21 CFR Part 803)
• Reports of corrections and removals (21 CFR Part 806)
• Complaint and servicing record content under 21 CFR 820.35
• UDI requirements (21 CFR Part 830) and labeling controls (820.45)

4. Preparing the QMS for QMSR

4.1 Run a gap assessment against both frameworks

• Terminology mapping (old Part 820 terms to ISO 13485 records)
• Complaint handling and MDR evaluation
• 820.35 record content and retrieval
• Design and development file structure
• Supplier evaluation and control
• Depth of risk-management integration
• Whether management review, internal audit and supplier audit reports are written to be read by an investigator

4.2 Update design control processes

QMSR design requirements follow ISO 13485 clause 7.3. Check user needs documentation, verification and validation traceability, design review records and documented design transfer.

4.3 Strengthen complaint and feedback systems

• Consistent, documented MDR reportability decisions
• Links to CAPA and risk updates
• Timely closure with objective evidence

4.4 Train people on QMSR terminology and the new inspection approach

• How old DHF/DMR/DHR terms map to ISO 13485 records
• MDR versus vigilance terminology
• What compliance program 7382.850 changes compared with QSIT

4.5 Keep the risk-based system integrated

• Risk controls mapped into design, production and post-market systems
• Evidence supporting risk-based decisions
• Risk files updated with feedback, complaints and CAPA outputs

5. What to expect during QMSR inspections

Under compliance program 7382.850, expect investigators to look for:

• Evidence that risk informed decisions across processes
• Retrievable medical device files, design and development files and 820.35 records
• Complaint handling and MDR decisions
• Links between reporting, CAPA and risk management
• Management review, internal audit and supplier audit records that show the system is working
• Competence of the people running these processes

Conclusion

QMSR reduces global complexity but does not lower expectations. Map your records to ISO 13485, keep the FDA-specific record and reporting requirements, assume your audit and management review reports will be read, and prepare for the 7382.850 inspection approach rather than QSIT.

Sources

• FDA: Quality Management System Regulation (QMSR), including the 2 February 2026 effective date and the replacement of QSIT with compliance program 7382.850
• 21 CFR Part 820 (eCFR)
• ISO 13485:2016, Medical devices — Quality management systems — Requirements for regulatory purposes

This article is general guidance, not legal or regulatory advice. Confirm current requirements against FDA's published text before relying on them.