FDA QMSR: what changed with ISO 13485 in February 2026

For almost thirty years, manufacturers selling in Europe and the United States kept two neighbouring but distinct quality frameworks: ISO 13485 on one side, the FDA's Quality System Regulation (QSR) on the other. Since 2 February 2026, that duality has narrowed: the QMSR incorporates ISO 13485:2016 by reference. This guide covers what changed and what remains FDA-specific.

Timeline

• 1996: publication of the QSR (21 CFR Part 820), applicable in 1997.
• 2 February 2024: publication of the final rule amending Part 820 and renaming it the Quality Management System Regulation.
• 2 February 2026: the QMSR takes effect, after a two-year transition.

The principle: ISO 13485 by reference

The QMSR did not rewrite the requirements: it incorporates by reference the clauses of ISO 13485:2016, with the ISO 9000:2015 definitions it uses. A quality system that complies with ISO 13485 therefore covers most of the QMSR.

Vocabulary follows: concepts specific to the old QSR, such as the design history file or the device master record, give way to ISO 13485 concepts, such as the medical device file.

What remains FDA-specific

The QMSR adds or clarifies several requirements:

• Records: expected content of complaint and servicing records, device identification including UDI.
• Labelling and packaging controls: inspection of labelling before release, retention of the related records.
• The link with other parts of 21 CFR, which continue to apply: Medical Device Reporting (Part 803), corrections and removals (Part 806), unique device identification (Part 830).

Where a QMSR requirement and an ISO 13485 clause overlap, the QMSR wording prevails.

Inspections change

Two changes matter most to quality teams:

• Internal audit, supplier audit and management review reports were shielded from inspection under the old QSR. That is no longer the case: the FDA may now review them.
• The inspection approach has been revised to align with the QMSR, replacing the former inspection technique based on QSR subsystems.

These reports should therefore be written knowing that an investigator may read them.

What the QMSR does not change

• The FDA does not certify and does not accept an ISO 13485 certificate as proof of compliance: it inspects.
• The MDSAP programme remains the route for replacing routine inspection with a single audit; see our guide on MDSAP.
• Market access pathways (510(k), De Novo, PMA) are unchanged.
• Risk management remains expected throughout product realisation; ISO 14971 is an FDA-recognised standard.

What manufacturers should do

1. Update the requirements map: start from ISO 13485 and add QMSR-specific requirements.
2. Review vocabulary and procedures inherited from the QSR.
3. Adapt how internal audit and management review reports are written, now accessible during inspection.
4. Check complaint, servicing and labelling records against the QMSR.
5. Train teams on the new inspection approach.

For a European manufacturer already certified to ISO 13485, the QMSR is a real simplification. It is not automatic equivalence. FDA publications, from the Federal Register to guidance documents, are part of medical device regulatory monitoring as soon as a device is sold in the United States.