The structure changed significantly while the underlying compliance obligations largely stayed intact. Here is what your quality team needs to understand.

What is 21 CFR Part 820?

21 CFR Part 820 is the section of the Code of Federal Regulations that establishes the minimum current good manufacturing practice (cGMP) requirements for the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished medical devices sold in the United States. The original Quality System Regulation (QSR) under Part 820 went into effect on December 18, 1978, and was last substantively updated in 1996.

For roughly 28 years before the QMSR transition, the QSR operated as a standalone FDA framework, separate from international standards like ISO 13485. That gap between US and global requirements created a dual-compliance burden for manufacturers selling into both US and international markets.

What is the QMSR?

The QMSR (Quality Management System Regulation) is the revised version of 21 CFR Part 820, published by FDA on February 2, 2024, in the Federal Register, with a two-year compliance window that ended February 2, 2026.

The QMSR's central change is that it incorporates ISO 13485:2016 by reference as the core compliance framework. Rather than maintaining a separate FDA-specific quality system standard, the QMSR treats ISO 13485 as the baseline, with FDA supplemental requirements layered on top. According to FDA's QMSR FAQ page, the agency made conforming edits to 21 CFR Part 4 as well to address combination product oversight.

What changed: the major differences

Structure and framework

The legacy QSR was a standalone document with its own clause structure, definitions, and requirements. The QMSR replaced that structure with ISO 13485:2016 as the incorporated standard, meaning manufacturers now work within an internationally recognized framework rather than a purely FDA-specific one.

For manufacturers already certified to ISO 13485, this simplifies dual compliance significantly. The two frameworks address the same quality system domains but used different terminology and clause numbering. QMSR eliminates much of that redundancy.

Terminology and definitions

The old QSR used terms like "finished device," "quality audit," and "quality system record" in ways that did not always map cleanly to ISO 13485 vocabulary. The QMSR aligns terminology with ISO 13485, which means quality system documentation may need updates to reflect current regulatory language.

According to the Federal Register final rule, FDA received comments recommending full alignment of definitions with ISO 13485, and the agency made significant adjustments in response.

FDA supplemental requirements

Even though ISO 13485 is now the core, FDA retained supplemental requirements that go beyond the international standard. These include requirements specific to complaint files and Medical Device Reports (MDRs), Unique Device Identifier (UDI) integration requirements, provisions addressing combination products under 21 CFR Part 4, and specific requirements for software validation tied to FDA's Computer Software Assurance (CSA) framework.

The NSF analysis of QMSR notes that QMSR makes ISO 13485:2016 "the core set of requirements," with FDA additions that enhance or clarify the international standard rather than replace it.

Design controls

Design controls remain mandatory under QMSR, but the requirements now flow through ISO 13485 Section 7.3. The substantive obligations are similar to the old 21 CFR 820.30 design control requirements, but the structure and documentation expectations reflect ISO 13485 conventions.

Risk management

The QMSR places greater emphasis on risk management by aligning with ISO 13485's risk-based approach. Manufacturers should ensure their risk register and associated risk management documentation meet ISO 14971 integration requirements, which are referenced in ISO 13485 and by extension in QMSR.

What stayed the same

The core compliance obligations that FDA has enforced for decades remain in place.

Document control remains required: all quality system documentation must be reviewed, approved, and controlled. The process does not change materially, though the clause references update to ISO 13485 numbering.

CAPA requirements carry forward. FDA inspectors continue to scrutinize CAPA programs closely, and the expectation for thorough root cause investigation remains unchanged.

Complaint handling persists: manufacturers must still maintain complaint files and evaluate each complaint for potential reportability as an MDR. The threshold for determining reportability has not changed.

Audits of the quality system remain required. The audit trail requirements for electronic records under 21 CFR Part 11 also remain in effect.

Supplier qualification and management requirements persist. The QMSR continues to require that manufacturers evaluate and select suppliers capable of meeting quality requirements.

Records retention timeframes and requirements carry over with limited modification.

What QMSR means for companies already certified to ISO 13485

For manufacturers who hold ISO 13485:2016 certification, the transition to QMSR compliance is primarily about understanding where FDA's supplemental requirements go beyond the international standard and ensuring those gaps are addressed in your quality system.

The Morgan Lewis QMSR readiness guide from October 2024 identified the key areas requiring attention as: MDR-specific complaint file requirements, UDI integration in records, software validation under CSA guidance, and combination product-specific provisions.

If your ISO 13485 certification scope covers those areas and your procedures reflect current FDA expectations, the transition documentation burden is manageable.

What QMSR means for companies that relied only on the old QSR

Manufacturers who built their quality system around the legacy QSR without maintaining ISO 13485 alignment face a more significant gap analysis. The clause structure is different, the risk management expectations are deeper, and the terminology in procedures and records may need updating.

FDA's own FAQ confirms that manufacturers were expected to have full systems in place by February 2, 2026, and that inspectors will evaluate compliance against the new QMSR framework. An FDA Form 483 observation citing QMSR non-compliance carries the same weight as any other observation, and repeated findings can escalate to warning letters.

The practical gap analysis: where to start

A QMSR transition gap analysis typically covers five areas.

First, map existing procedures to QMSR/ISO 13485 clause numbers. Identify procedures that reference old QSR sections by number and update those references.

Second, confirm that risk management documentation meets ISO 14971 requirements as integrated into ISO 13485 Section 7.1.

Third, verify supplier qualification files reflect QMSR requirements for supplier evaluation and re-evaluation.

Fourth, confirm that your computer system validation approach aligns with FDA's CSA guidance, which applies under QMSR.

Fifth, ensure the complaint process clearly identifies the MDR reporting decision point and documents that determination in the complaint record.

How a modern QMS platform supports QMSR compliance

Maintaining QMSR compliance requires a quality system that connects CAPA, complaints, document control, supplier qualification, risk management, and audit management in a single traceable environment. Disconnected spreadsheets and paper-based systems make it difficult to demonstrate the integrated quality system FDA now expects.

Cloudtheapp's cloud-based QMS gives medical device manufacturers a pre-validated, FDA-compliant platform with 60+ applications covering every QMSR domain. The platform supports ISO 13485 alignment out of the box, with built-in audit trail functionality, automated CAPA workflows, and electronic records that meet 21 CFR Part 11 requirements.

If your quality system needs a structural update to support QMSR compliance, schedule a demo to see how Cloudtheapp can accelerate your transition.

Frequently asked questions

When did QMSR go into effect?

The QMSR became effective February 2, 2026. FDA published the final rule in the Federal Register on February 2, 2024.

Does QMSR replace 21 CFR Part 820?

The QMSR revises 21 CFR Part 820, rather than replacing the regulatory citation. Part 820 still exists as the regulatory address, but the content now incorporates ISO 13485:2016 by reference.

Do I need ISO 13485 certification to comply with QMSR?

Certification is not required. ISO 13485 certification demonstrates conformance but is not mandated by FDA. The QMSR requires compliance with the substance of ISO 13485, not the certification credential.

What happens during an FDA inspection under QMSR?

FDA inspectors will evaluate your quality system against QMSR requirements, which include ISO 13485 obligations plus FDA supplemental requirements. Inspectors may ask to see gap analysis documentation from the transition, particularly for companies that previously operated under the old QSR without ISO 13485 alignment.

How long does a QMSR gap analysis take?

The timeline depends on the size and complexity of your existing quality system. A manufacturer with an ISO 13485-aligned system may complete the gap analysis in weeks. A manufacturer rebuilding from a QSR-only baseline may need three to six months.

This post created by and appeared first on Cloudtheapp