FDA QMSR: what it is, what changed from Part 820, and how compliance works

What is the FDA QMSR?

The Quality Management System Regulation is the FDA's rule for the quality management system a medical device manufacturer must run to sell in the United States. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference and keeps a small set of FDA-specific requirements on top. Compliance is shown to an FDA investigator at inspection, on records.

The final rule was published in the Federal Register on 2 February 2024 and took effect on 2 February 2026. There is no QMSR certificate and no certification body.

Who needs to comply with the QMSR?

Every manufacturer of a finished medical device for the US market, of any class, that was subject to Part 820 before

Companies already certified to ISO 13485, who hold most of what the rule asks for and still have the FDA-specific requirements to show

Contract manufacturers and specification developers whose devices reach the US market under someone else's name

The rule becomes urgent when an FDA inspection is announced, when a customer's supplier audit asks for the QMSR gap assessment, or when someone opens the quality manual and finds it still written to Part 820.

What changed from Part 820 to the QMSR

The rule moved the core requirements out of the FDA's own text and into ISO 13485:2016, kept what the standard does not cover, and retired the rest.

The quality management system requirements now come from the international standard, read with the FDA's definitions in 820.3 and the additions in 820.10

The design history file, device master record and device history record fold toward the medical device file and the records ISO 13485 already names

Control of records including complaint and servicing records (820.35), device labelling and packaging controls (820.45), and the FDA's definitions where they differ from the standard's

Investigators inspect against the QMSR's structure, and the QSIT-era inspection approach is replaced

"Management with executive responsibility" and "quality system" give way to the standard's terms, and procedures that cite Part 820 by section number cite the wrong text

How QMSR compliance works

1. Assess the current system against the QMSR

Read every procedure and record against ISO 13485:2016 and the FDA-specific requirements, and list what is missing, misnamed or still written to Part 820.

2. Remediate by priority

Terminology, the medical device file structure, the risk-based requirements the standard adds, and the FDA overlays, worked as change controls with the rationale recorded.

3. Update the quality manual and the procedures

And retrain the people who run them, so nothing in the system cites a rule that no longer exists.

4. Be ready to show it

An investigator asks for records by requirement, and the answer has to be the record, its approval and the procedure it followed.

5. Keep it aligned

FDA guidance and the standard both move, and the system has to move with them between inspections.

THE QMSR IN QUALIO

Qualio assesses the records you already hold against the QMSR and lists the FDA-specific gaps on their own

Qualio breaks the QMSR down requirement by requirement, beside ISO 13485 in the same library, and maps your procedures, training records, complaint files and CAPAs to both. Requirements the two share are answered once, and the FDA-specific ones show as their own gaps with a recommendation each. Copilot drafts the procedure update from the recommendation, and your team approves it. When an investigator asks, you export the evidence by requirement.

The same records assessed against ISO 13485 and the QMSR, so an 820-era system shows where it falls short of the new rule

Complaint and servicing records for 820.35, each traceable to the event that raised it and the CAPA that closed it

Labelling and packaging controls for 820.45 held as controlled procedures with the training that follows each revision

Standards that apply alongside the QMSR

Medical devicesISO 13485: The standard the QMSR incorporates, so a certified system covers the core and the FDA-specific requirements are what is left to show
Medical devicesMDSAP: Audits to ISO 13485 for five regulators including the FDA, which accepts an MDSAP audit report in place of a routine inspection
Medical devicesEU MDR: The EU's equivalent expectation of a quality management system, audited by a notified body rather than inspected
Electronic records21 CFR Part 11: The FDA's rule for the electronic records and signatures the QMSR's records will be kept in
Medical devicesISO 14971: The risk management ISO 13485 asks for and the QMSR inherits

Sentec

An enterprise medical device team reduced audit prep from one week to one day and gained 360° visibility across their QMS

Read the Sentec story

“Qualio surfaces gaps automatically. We resolve issues faster and walk into audits with confidence.”

Christophe DohrSite Quality Manager, Sentec

Guides and checklists for the QMSR

Checklist

QMSR transition checklist

Guide

QMSR and ISO 13485 Compliance Primer

Guide

How to respond to an FDA 483

Questions about the QMSR

What is the FDA QMSR?

The Quality Management System Regulation is the FDA's rule for the quality management system a medical device manufacturer runs for the US market. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, keeps a short list of FDA-specific requirements, and took effect on 2 February 2026. Compliance is shown at inspection.

What changed between 21 CFR Part 820 and the QMSR?

The core requirements now come from ISO 13485:2016 rather than the FDA's own text. Part 820's standalone provisions were withdrawn or folded into the standard's records, FDA-specific controls on records, labelling and packaging were kept, and investigators now inspect against the new structure rather than the QSIT approach.

We are ISO 13485 certified. Are we automatically QMSR compliant?

No, though you are most of the way. The QMSR incorporates the standard, so a certified system covers the core. The FDA keeps requirements the standard does not have, inspects the running system rather than the certificate, and expects the quality manual and procedures to say so. The remainder is yours to close and show.

Is there a QMSR certification?

No. The QMSR is a regulation, and no body certifies against it. Compliance is demonstrated to FDA investigators at inspection, on the records the system produces. An ISO 13485 certificate is evidence that the core of the system is in place, and it is not a QMSR certificate.

What are the penalties for QMSR non-compliance?

The same as under Part 820. An inspection ends with Form 483 observations for what the investigator found, a warning letter if the response does not satisfy the FDA, and escalation from there to import holds, seizure, injunction or consent decree.

How quickly can an existing QMS be brought into QMSR compliance?

It depends on how far the system already matches ISO 13485. A certified system needs its FDA-specific gaps closed and its manual and procedures reworded. An 820-era system without the certificate has the standard's requirements to add first, and that is a longer piece of work.

Can we add the QMSR to the standards we already run in Qualio?

Yes. Add it from the library and Qualio assesses the records you already hold against every requirement, beside ISO 13485 if you run that too. Requirements the two share count once, and the first assessment lists the FDA-specific gaps on their own.

Is your quality manual still written to Part 820?

Bring it. We will show you the QMSR assessed against your current procedures requirement by requirement, with the FDA-specific gaps on their own list and the evidence exported the way an investigator asks.

Book a demo Get the QMSR transition checklist

Less time on audit prep. More time on quality.