The FDA’s Quality Management System Regulation (QMSR) took effect on February 2, 2026, replacing the old Quality System Regulation (QSR) that had governed 21 CFR Part 820 since 1996. The regulation number stayed the same, 21 CFR Part 820, but the substance changed significantly. The core shift: the FDA incorporated ISO 13485:2016 by reference, making it the backbone of U.S. medical device quality system requirements for the first time. For manufacturers already certified to ISO 13485, many obligations now overlap with FDA expectations. For those who were not, the QMSR represents a broader set of documented requirements than the old QSR demanded.

What the QMSR actually is

The QMSR is the revised version of 21 CFR Part 820. The FDA published the final rule on February 2, 2024, giving manufacturers exactly two years to prepare before enforcement began. The rule did not create a new regulation from scratch. It amended the existing Part 820 by incorporating ISO 13485:2016 and ISO 9000:2015 Clause 3 (definitions) by reference, while adding FDA-specific requirements where ISO 13485 alone was insufficient to meet the statutory expectations of the Federal Food, Drug, and Cosmetic Act.

The old regulation was informally called the Quality System Regulation or QSR. The revised version carries a new name: the Quality Management System Regulation, or QMSR. The underlying legal authority, Section 520(f) of the FD&C Act, did not change. What changed is how the FDA defines what a compliant quality system looks like in practice.

According to the FDA’s QMSR page, the agency determined that ISO 13485:2016 requirements are, taken in totality, substantially similar to the old QSR requirements, providing an equivalent level of assurance that devices are manufactured safely and consistently.

What changed from the old QSR

Incorporation of ISO 13485:2016

The most consequential change is structural. Under the old QSR, the FDA maintained its own standalone quality system requirements. Under the QMSR, ISO 13485:2016 is incorporated by reference, meaning compliance with the QMSR requires compliance with ISO 13485 unless FDA-specific provisions say otherwise. Manufacturers can access the standard in read-only format through the ANSI Incorporated by Reference Portal at ibr.ansi.org.

This harmonization aligns the U.S. with regulatory authorities in Canada, the European Union, Japan, and other markets that have used ISO 13485 as the baseline standard for years. A manufacturer certified to ISO 13485:2016 by an accredited certification body will find that a large portion of their existing documentation already addresses QMSR obligations, though FDA-specific additions still apply.

Expanded FDA inspection authority

Under the old QSR, Section 820.180(c) exempted internal quality audits from FDA inspection, including supplier audits and management review reports. The QMSR eliminates this exemption entirely.

As of February 2, 2026, FDA investigators can request and review:

• Internal audit reports
• Supplier audit reports and findings
• Management review meeting records and outputs

The FDA’s rationale, stated in the final rule preamble, is that manufacturers already provide these records to other regulatory bodies under ISO 13485, so making them available to FDA investigators does not create additional burden. For manufacturers whose internal audits have historically been informal or underdocumented, this change creates a real compliance gap. An audit trail that shows systematic, structured internal reviews is now essential to inspection readiness.

New inspection process replacing QSIT

The Quality System Inspection Technique (QSIT), which FDA investigators used for decades to structure device inspections, was withdrawn on February 2, 2026. The new inspection process is described in the updated Compliance Program 7382.850 (Inspection of Medical Device Manufacturers), implemented on the same date the QMSR took effect.

Manufacturers preparing for their first post-QMSR inspection should review this compliance program and understand how their quality system documentation maps to QMSR requirements rather than the old QSIT subsystem framework.

Combination product requirements clarified

The FDA also made conforming edits to 21 CFR Part 4 to clarify quality management system requirements for combination products (devices combined with drugs or biologics). These edits did not change the underlying CGMP requirements for combination products but provide additional clarity for manufacturers operating at the device-drug or device-biologic boundary.

What stayed the same

The fundamental obligations of a quality management system for medical devices did not change. Manufacturers must still:

• Establish, document, implement, and maintain a quality management system
• Define and control processes for design, production, and post-market activities
• Conduct internal audits at planned intervals
• Control nonconforming products and initiate corrective and preventive actions
• Maintain document and record control systems
• Qualify and monitor suppliers

The FDA was explicit in the final rule: the requirements of the QSR and the QMSR are substantially similar. A manufacturer that maintained a well-run quality system under the old regulation should find the transition manageable. Records created before February 2, 2026 remain valid, and the FDA has indicated that investigators may find it useful when manufacturers complete a comparative analysis showing that pre-QMSR records meet QMSR requirements.

The statutory basis and enforcement authority also stayed the same. The FDA still conducts risk-based inspections. A FDA Form 483 observation under the QMSR carries the same weight as it did under the old QSR. The path from inspection observation to warning letter to consent decree follows the same escalation pattern.

MDSAP (Medical Device Single Audit Program) continues as a voluntary third-party audit program. Holding an MDSAP certificate does not exempt a manufacturer from FDA inspection, and the FDA will not issue ISO 13485 certificates of conformance. FDA inspections assess compliance with federal regulations; third-party MDSAP audits assess conformance to the ISO standard.

What the QMSR means for ISO 13485-certified manufacturers

If your facility holds a current ISO 13485:2016 certification, a significant portion of your quality system already aligns with QMSR requirements. The areas to examine carefully are the FDA-specific additions: requirements that clarify expectations beyond what ISO 13485 alone specifies, particularly around electronic records under 21 CFR Part 11, combination product documentation, and the now-eliminated inspection exemptions for audits and management reviews.

ISO 13485 certification is not a substitute for QMSR compliance, and the FDA will not accept a certification certificate as evidence of compliance. The FDA’s inspection program operates independently from third-party certification schemes.

What the QMSR means for manufacturers who were not ISO 13485-certified

The transition is more substantial for facilities that built their quality systems to the minimum QSR requirements without pursuing ISO 13485 certification. ISO 13485 is more prescriptive in certain areas, particularly risk management integration, supplier qualification, and formal management review documentation.

Areas that commonly require additional work include:

• Risk management documentation and integration with design and production processes
• Supplier qualification and audit programs (now fully subject to FDA inspection)
• Formal management review records with documented outputs and follow-up actions
• Process validation with documented evidence across all production stages

The two-year transition period from February 2024 to February 2026 was intended to allow manufacturers to close these gaps. Manufacturers still working through their gap analysis should prioritize the areas most likely to surface during an inspection visit: internal audit records, supplier controls, management review minutes, and corrective action systems.

How an eQMS supports QMSR compliance

The shift to QMSR compliance is, at its core, a documentation and traceability challenge. Every process change, corrective action, audit finding, supplier evaluation, and management review decision must be recorded, controlled, and available for review on demand.

Paper-based or fragmented quality systems create serious risk in this environment. When an FDA investigator arrives and requests your supplier audit reports from the past three years, a quality management system that stores documents in shared drives or physical binders cannot produce them quickly or consistently.

Cloudtheapp’s cloud-based eQMS is built for exactly this operating model. With 60+ purpose-built applications covering audits, supplier qualification, CAPA, document control, and management review, Cloudtheapp gives quality teams a single source of truth for every record that matters under the QMSR. The platform is validated to FDA computer system validation guidelines and supports 21 CFR Part 11 electronic records and signatures, so your digital records meet the same evidentiary standards as paper records in an FDA inspection.

Manufacturers transitioning from the old QSR to the QMSR use Cloudtheapp to map their existing quality system documentation against QMSR requirements, identify gaps, and build the processes needed to close them, without rebuilding their system from scratch.

See how Cloudtheapp supports QMSR compliance

Common questions about 21 CFR Part 820 and the QMSR

Does 21 CFR Part 820 still exist?

Yes. The regulation number 21 CFR Part 820 did not change. The QMSR is the updated version of Part 820, published under the same citation. References to “21 CFR Part 820” after February 2, 2026 refer to the QMSR.

When did the QMSR become mandatory?

February 2, 2026. The final rule was published on February 2, 2024, and the two-year transition period ended on the effective date. FDA inspections conducted on or after that date assess compliance with the QMSR, not the old QSR.

Do I need ISO 13485 certification to comply with the QMSR?

No. ISO 13485 certification from a third-party body is voluntary. The QMSR incorporates ISO 13485:2016 requirements by reference as the substantive content of the regulation. You must meet those requirements, but the FDA does not require a third-party certificate.

What happened to the QSIT inspection process?

The Quality System Inspection Technique (QSIT) was withdrawn on February 2, 2026. FDA device inspections now follow the updated Compliance Program 7382.850.

Can FDA now inspect my internal audit records?

Yes. The exemption that previously protected internal quality audits, supplier audits, and management review reports from FDA inspection was eliminated under the QMSR. These records are now subject to review during FDA device inspections.

Conclusion

The QMSR kept the same regulation number but changed the underlying framework in ways that matter for daily quality operations. ISO 13485:2016 is now legally embedded in 21 CFR Part 820. Internal audits and management reviews are fully visible to FDA investigators. A new inspection process governs how those investigations unfold.

Manufacturers with well-documented quality systems built on ISO 13485 are in a strong position. Those whose quality systems were structured around the minimum QSR requirements have more work ahead, particularly in supplier qualification, audit documentation, and risk management.

The practical path forward is a documented gap analysis against QMSR requirements, followed by a systematic plan to close the identified gaps before your next FDA inspection visit. An eQMS like Cloudtheapp makes that process faster and gives you the documentation infrastructure to sustain it.

Request a demo to see how Cloudtheapp supports QMSR compliance

This post created by and appeared first on Cloudtheapp

TLDR

The FDA's Quality Management System Regulation (QMSR) became effective February 2, 2026, replacing the decades-old Quality System Regulation (QSR). Alongside this shift, FDA retired its Quality System Inspection Technique (QSIT) and launched a new risk-based inspection framework under Compliance Program 7382.850. Inspectors now open by reviewing your risk management file, not a checklist of four subsystems. Management reviews, internal audits, and supplier audit reports are all now fair game for FDA review. Risk management failures are explicitly listed as triggers for Official Action Indicated (OAI) classifications. If your QMS was built around the old QSIT playbook, your inspection-readiness strategy needs a serious update in 2026.

February 2, 2026 was not just a regulatory compliance deadline. It was the day FDA rewired how it inspects medical device manufacturers.

The new Quality Management System Regulation replaced the Quality System Regulation that had governed device manufacturing practices for more than 25 years. But the change that matters most for quality teams is not what the regulation says. It is how FDA investigators now walk through your facility, what records they request first, and which findings send your inspection outcome straight to Official Action Indicated.

This article walks through the new QMSR inspection framework in practical terms, from how investigators prepare before they arrive to what you should have ready the moment they do.

What Changed on February 2, 2026

The QMSR amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. Instead of a written requirement for each element of your quality system, the regulation now points to the corresponding ISO 13485 section. The result is a shorter Part 820 text that harmonizes U.S. device quality requirements with the global standard used by regulatory authorities across Canada, Europe, Japan, and Australia.

On the same day the QMSR took effect, FDA released Compliance Program 7382.850, the new Inspection of Medical Device Manufacturers program. This document replaced both the QSIT guide and the separate compliance programs that had previously governed premarket approval (PMA) inspections and routine surveillance inspections.

The QSIT organized FDA inspections around four subsystems: Management Controls, Design Controls, Corrective and Preventive Actions, and Production and Process Controls. Under the new CP 7382.850, that structure is gone. In its place is a six-area framework driven entirely by product risk to patients and users.

How the New QMSR Inspection Framework Is Structured

The new framework organizes QMSR compliance review into six Quality Management System Areas and four Other Applicable FDA Requirements (OAFRs).

The six QMS Areas are:

• Management Oversight (includes management review records and medical device file)
• Measurement, Analysis, and Improvement (includes complaint handling, internal audits, corrective action, preventive action, and control of nonconforming product)
• Design and Development (includes design inputs, outputs, review, verification, validation, software validation, and design transfer)
• Change Control (product and process changes)
• Outsourcing and Purchasing (supplier controls)
• Production and Service Provision (manufacturing controls, identification, traceability)

The four OAFRs that apply to every inspection are: Medical Device Reporting (MDR), Reports of Corrections and Removals, Medical Device Tracking (where applicable), and Unique Device Identification (UDI).

The Two Inspection Models

FDA uses two inspection models depending on the inspection type.

Model 1 applies to non-baseline surveillance inspections, compliance follow-up inspections, for-cause inspections, Specific Product Risk Assignment (SPRA) inspections, and PMA post-market inspections. Under Model 1, the investigator selects at least one element from each of the six QMS Areas, guided by the specific risks identified for the products under review.

Model 2 applies to baseline surveillance inspections and PMA pre-approval inspections. Under Model 2, all applicable elements within each QMS Area are reviewed. This is the more comprehensive inspection model and the one that presents the highest documentation exposure for manufacturers.

How FDA Investigators Prepare Before They Arrive

This is the part most quality teams underestimate.

Under the old QSIT model, investigators generally arrived and began working through the four subsystems based on what they found on the floor. Under CP 7382.850, FDA investigators review external information before they enter your building.

That pre-inspection review includes medical device reports (MDRs), trade complaints, reports of corrections and removals for similar products, and any prior inspection history for your facility. The objective is to build a product-specific risk profile before the investigator sets foot on your manufacturing floor.

On arrival, the investigator then opens your risk management file. This is the new starting point. According to CP 7382.850, the identified product-specific risks from your file are "used to evaluate whether a manufacturer is meeting requirements." The risk management file effectively becomes the roadmap for the entire inspection.

The practical implication: if your risk management documentation is incomplete, inconsistent with your actual manufacturing practices, or has not been updated to reflect recent changes, the investigator identifies those gaps in the first hours of the inspection, and every subsequent step is colored by that finding.

What Records FDA Now Requests That Were Off-Limits Before

One of the most consequential changes under QMSR is the elimination of the record exemptions that existed under the QSR.

Under the old Quality System Regulation, FDA was explicitly prohibited from reviewing three categories of records during inspections: management review records, internal quality audit reports, and supplier audit reports. These were considered confidential quality assurance records.

The QMSR removes all three exemptions. ISO 13485 contains no such carve-outs, and when FDA incorporated ISO 13485 by reference, it carried this change directly into U.S. federal law.

Under the new framework:

• Management review records are a named element within the Management Oversight QMS Area. They are now a standard inspection item.
• Internal audit reports appear under the Measurement, Analysis, and Improvement Area. FDA investigators can request, review, and copy them.
• Supplier audit reports are subject to FDA review and are explicitly called out on FDA's QMSR FAQ page.

FDA's legacy Compliance Policy Guide (CPG Sec. 130.300), which stated that FDA "will not review or copy reports and records that result from audits and inspections of the written quality assurance program" during routine inspections, remains on FDA's website as of early 2026. FDA has not formally rescinded it. However, the page now includes a reference to the QMSR final rule, and the legal reality is that the new regulation supersedes the older policy in practice.

Quality teams should treat all three record categories as reviewable in any inspection conducted after February 2, 2026.

What Triggers a Form 483 Under QMSR

An FDA Form 483 documents inspectional observations, meaning conditions or practices the investigator observed that may constitute violations of FDA regulations. Under the new QMSR inspection framework, several categories of findings are explicitly listed as triggers for an Official Action Indicated (OAI) classification, which is the most serious outcome and the one most likely to result in a warning letter or enforcement action.

CP 7382.850 lists the following risk management failures as Situation 1 findings, meaning they automatically move the inspection toward OAI:

• Failure to establish, implement, or maintain one or more processes for risk management in product realization
• Failure to monitor, measure, analyze, and improve processes that have demonstrated adverse impact to finished product or patient safety
• Failure to adequately analyze data, or failure to use current risk information, resulting in a decision not to proceed with formal investigations or corrective actions, where that failure leads to unmitigated adverse health consequences or nonconformities
• Feedback and postmarket surveillance data not used as inputs into risk management for monitoring and maintaining product realization processes
• Failure to control design and development of product, including inadequate evaluation of changes for risk and impact prior to implementation
• Failure to ensure processes, including changes, are adequately monitored, controlled, or evaluated for risk and impact on products prior to implementation

In addition, cybersecurity has entered the inspection scope for the first time. CP 7382.850 requires investigators to assess "cyber devices" and other software-enabled medical devices for conformity with FDA cybersecurity requirements. Failure to comply is classified as a Situation 1 finding eligible for OAI treatment.

The pattern across all of these triggers is consistent: risk management failures are the new priority. Under the QSIT, design controls were the primary focus. Under CP 7382.850, the question at every step is whether risk has been identified, evaluated, controlled, and kept current.

Six High-Priority Records to Have Ready for Any QMSR Inspection

Quality teams preparing for a QMSR inspection should ensure the following records are organized, current, and retrievable within the first day of an inspection:

Risk management file. This is the document investigators read first. It must be complete, up to date, and consistent with your current manufacturing processes and product configuration.

Management review records. These are now a named inspection element. They must reflect systematic, documented review of QMS performance at planned intervals, with clear inputs, outputs, and follow-up actions.

Internal audit reports. All internal audit records, including the scope, findings, audit findings, and corrective actions taken, are now reviewable. Audits that show findings without documented closure are particularly high-risk.

CAPA records. While CAPA is no longer a standalone mandatory element in Model 1 inspections, corrective and preventive action processes appear as elements within Measurement, Analysis, and Improvement. Root cause investigation records must show genuine analysis, not just conclusion statements.

Complaint handling and feedback records. FDA investigators will look for evidence that complaints and postmarket feedback are feeding back into risk management. Complaint records that sit in a database without documented risk review are a 483 vulnerability.

Change control records. Under both the Change Control QMS Area and the Design and Development Area, any product or process change must show documented evaluation of risk and impact prior to implementation. Undocumented or inadequately evaluated changes are among the most common 483 subjects.

What QMSR Compliance Looks Like in Practice

The shift from QSIT to CP 7382.850 is a shift in philosophy, not just structure. QSIT organized compliance into boxes. CP 7382.850 asks a single question across every box: does your organization actually understand and manage product risk throughout the product lifecycle?

That question demands a quality system with living documentation. Risk management files that are updated when products change. Internal audits that reflect honest findings. Management reviews that show leadership is genuinely engaged. Supplier controls that extend to audit reports, not just approved supplier lists.

For manufacturers that have been operating under ISO 13485 for international markets, this transition is largely familiar territory. For manufacturers whose QMS was built around QSR requirements alone, the gap is material.

The specific areas that require immediate attention for most manufacturers include: aligning the risk management file structure with ISO 14971 and ensuring it is current; updating internal audit procedures to cover all six QMS Areas; and reviewing whether management review records reflect adequate depth for FDA scrutiny.

An inspection plan that maps your existing records to the six QMS Areas and four OAFRs before your next inspection is not optional. It is how you avoid being reorganized by the investigator's roadmap instead of your own.

How Cloudtheapp Supports QMSR Inspection Readiness

Cloudtheapp is an AI-powered, no-code Quality Management System platform validated for FDA 21 CFR Part 820 (QMSR), ISO 13485:2016, and ISO 9001. It is purpose-built for the inspection environment that CP 7382.850 now defines.

Every QMSR inspection priority maps directly to a Cloudtheapp module:

The Risk Management module maintains a centralized, dynamic risk file that links product risks to design controls, process changes, and corrective actions. When FDA investigators ask to see your risk management documentation, the records are traceable, timestamped, and current.

The Audits module manages internal audits with structured scope, findings, and closure workflows. All audit records are maintained with a full audit trail, making them retrievable and defensible in an FDA review.

The CAPA module ties corrective and preventive actions to root cause investigations, complaint records, and risk assessments. Every step is documented and time-stamped.

The Change Management module ensures that every product or process change goes through a documented risk evaluation before implementation, precisely the gap that produces the most common 483 observations under the new framework.

The Complaint Handling module routes customer feedback and MDR-eligible events directly into risk review workflows, closing the loop between postmarket data and risk management inputs that CP 7382.850 explicitly evaluates.

All records are maintained in a validated, 21 CFR Part 11-compliant environment with electronic signatures and a complete audit trail on every record. That is the difference between being inspection-ready and being caught reorganizing folders the morning the investigator arrives.

Ready to build a QMS that is structured for QMSR inspections from the ground up? Request a demo of Cloudtheapp and see how quality teams in medical devices, pharma, and biotech use the platform to stay continuously inspection-ready.

Frequently Asked Questions About QMSR Inspections

What is the difference between QMSR and QSR?
The Quality Management System Regulation (QMSR) replaced the Quality System Regulation (QSR) on February 2, 2026. The QMSR amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, harmonizing U.S. medical device quality requirements with the global standard. The QSR contained prescriptive written requirements for each element of the quality system. Under QMSR, many of those requirements now point to the corresponding ISO 13485 clauses.

Can FDA review internal audit reports under QMSR?
Yes. The QMSR removed the record exemptions that previously protected internal quality audit reports, management review records, and supplier audit reports from FDA inspection. All three categories are now subject to FDA review during inspections conducted under CP 7382.850.

What is CP 7382.850?
Compliance Program 7382.850, released January 30, 2026 and effective February 2, 2026, is the new FDA compliance program manual governing inspections of medical device manufacturers. It replaced the QSIT guide and two prior compliance programs. It establishes the six QMS Areas and four OAFRs that structure all QMSR inspections.

What triggers an OAI classification under QMSR?
CP 7382.850 lists several risk management failures as Situation 1 findings that can lead to an Official Action Indicated classification, including failure to establish or maintain risk management processes, failure to use postmarket data as risk management input, and failure to evaluate changes for risk prior to implementation. Cybersecurity failures on software-enabled devices are also classified as OAI-eligible findings.

Do MDSAP participants need to prepare differently for QMSR inspections?
For manufacturers already participating in the Medical Device Single Audit Program, the transition to CP 7382.850 has limited practical impact, since the MDSAP audit process uses a similar risk-based, process-linked approach. FDA does not conduct routine surveillance inspections for MDSAP-audited manufacturers, though for-cause and compliance follow-up inspections remain in scope.

How should quality teams prepare for their first QMSR inspection?
The most important preparation steps are: review CP 7382.850 in full and map your current QMS documentation to the six QMS Areas; ensure your risk management file is complete, current, and linked to your active products and processes; update internal audit procedures to align with the new framework; and conduct mock audits using the new inspection model as the reference structure.

This post created by and appeared first on Cloudtheapp

The FDA’s Quality Management System Regulation (QMSR) became effective on February 2, 2026, replacing the decades-old Quality System Regulation (QSR) under 21 CFR Part 820. The QMSR incorporates ISO 13485:2016 by reference, making international quality standards the legal foundation for U.S. medical device compliance. There is no grace period. Full compliance is required now. Key changes include the elimination of QSR’s QSIT inspection framework, mandatory separation of corrective and preventive actions, expanded FDA access to internal audits and supplier records, and the requirement for risk-based thinking across every element of your quality system — not just design controls.

Medical device manufacturers operating in the United States have just crossed one of the most significant regulatory thresholds in decades. On February 2, 2026, the FDA’s new Quality Management System Regulation (QMSR) replaced the Quality System Regulation (QSR) that governed device manufacturing practices since 1996.

This is not a name change. It is a structural overhaul of how the FDA defines, inspects, and enforces quality management for medical devices. If your QMS was built around the legacy QSR framework, key elements of your documentation, CAPA processes, design controls, and supplier management are likely non-compliant today.

This guide covers exactly what changed, who is affected, what the new requirements demand, and how to build a QMSR-ready quality system that stands up to FDA inspection.

What Is the FDA QMSR?

The Quality Management System Regulation is the FDA’s updated regulatory framework for medical device quality systems. It amends 21 CFR Part 820 by incorporating ISO 13485:2016 — the international standard for medical device quality management systems — directly by reference. The QMSR also incorporates Clause 3 of ISO 9000:2015 to align terminology across U.S. and international regulatory requirements.

Where the legacy QSR spelled out individual requirements across Subparts A through O of Part 820, the QMSR takes a different approach: Part 820 now functions as a regulatory overlay that points directly to ISO 13485:2016 clauses. A small number of FDA-specific provisions are retained or added where ISO 13485 does not fully address U.S. statutory requirements, such as definitions, recordkeeping expectations, and complaint-handling standards.

The QMSR final rule was published by the FDA on February 2, 2024, with a two-year transition period. That period ended on February 2, 2026. Enforcement is now active. Source: FDA

Why Did the FDA Replace the QSR?

The QSR served as the foundation for U.S. medical device quality regulation for nearly 30 years. By the time the FDA began its rulemaking, it had become structurally misaligned with the global standard — ISO 13485:2016 — that most international regulatory bodies, including the European Union, Canada, Australia, and Japan, already used to evaluate device quality systems.

This misalignment created a real compliance burden. A manufacturer selling into multiple markets had to maintain two separate quality frameworks: one for FDA under the QSR, and one for international regulators under ISO 13485. Audit preparation, documentation structures, and inspection readiness all had to be managed twice.

The QMSR eliminates that duplication. By harmonizing 21 CFR Part 820 with ISO 13485:2016, the FDA allows manufacturers who already hold ISO 13485 certification to operate under a unified quality framework. It also brings U.S. inspections into alignment with the internationally recognized compliance model, making FDA’s expectations more transparent and consistent with what device companies already practice in global markets.

Who Must Comply with QMSR?

QMSR applies to the same scope of entities previously covered by the QSR: manufacturers, specification developers, repackagers, relabelers, and importers of finished medical devices intended for commercial distribution in the United States.

Any organization subject to 21 CFR Part 820 under the legacy QSR is subject to QMSR today. If your organization held FDA Registration under the QSR framework, full QMSR compliance is now mandatory — effective February 2, 2026, with no phase-in period.

Contract manufacturers, component suppliers, and sterilization providers who perform activities under a device manufacturer’s quality system are also affected. The QMSR’s strengthened supplier qualification requirements mean that device manufacturers must ensure their supply chain partners meet the standard’s supplier control expectations.

QMSR vs QSR: Key Differences

Understanding the shift from QSR to QMSR requires looking at both structure and substance. The two frameworks share many underlying principles, but the way those principles are codified, inspected, and enforced has changed significantly.

Structure: From Self-Contained Rules to ISO by Reference

Under the QSR, every requirement was written directly into Part 820 subparts. Quality managers could read the regulation and know exactly what the FDA required. Under QMSR, Part 820 is now a much shorter document. Most requirements are satisfied by pointing to the corresponding ISO 13485:2016 clause.

This means quality professionals must work from two documents simultaneously: the updated 21 CFR Part 820 and the ISO 13485:2016 standard. The ISO standard is not freely available — it requires purchase from ISO or AAMI. This has practical implications for training, SOPs, and documentation.

Terminology: Legacy Terms Retired

The FDA has retired several QSR-era terms that many quality systems still use. The Device History File (DHF), Device Master Record (DMR), and Device History Record (DHR) are no longer the operative framework. Under QMSR, these concepts are consolidated under the Medical Device File (MDF) concept from ISO 13485. Organizations that built their entire documentation structure around DHF/DMR/DHR silos must restructure their approach.

Similarly, the QMSR aligns terminology with ISO 9000:2015 Clause 3, which introduces definitions that differ in some cases from legacy QSR language. Quality teams need to audit their documentation for terminology conflicts.

CAPA: Mandatory Separation

Under the QSR, corrective and preventive actions were often combined in a single CAPA procedure. Under QMSR, Deviation CAPA management must be split: corrective actions and preventive actions must be managed as distinct processes. Organizations that still handle both in a unified CAPA SOP are now out of compliance. An FDA Form 483 observation citing a combined CAPA procedure is now a realistic inspection finding.

Internal Audits and Supplier Records: Now Inspectable

This is one of the most significant operational changes under QMSR. Under the QSR, the FDA’s Quality System Inspection Technique (QSIT) focused on four main subsystems and generally did not review internal audit reports or supplier audits. Under QMSR, the new Compliance Program 7382.850 gives FDA investigators the authority to review internal audit findings and supplier audit records as part of a standard inspection.

If your internal audit reports contain unresolved observations, insufficient root cause analysis, or a pattern of repeat findings, those records are now visible to FDA during an inspection. The same applies to supplier qualification records and supplier audit outcomes.

Risk-Based Thinking: Expanded Scope

The QSR addressed risk primarily within design controls. ISO 13485:2016 — and by extension QMSR — requires risk-based thinking to be embedded throughout the entire QMS: in document control, purchasing, production, measurement, and management review. Risk management is no longer a design-phase activity. It is a system-wide discipline.

Core Requirements Under QMSR

Management Responsibility

QMSR strengthens management review requirements relative to the QSR. Under ISO 13485:2016 Clause 5, top management must establish quality policy, ensure adequate resources, and conduct formal management reviews that include specific inputs — customer feedback, process performance data, audit results, and corrective action status. Management review records are now subject to FDA inspection scrutiny. Vague or incomplete management review minutes create direct inspection risk.

Document and Record Control

The QMSR maintains strong document control and audit trail requirements. All records must be legible, identifiable, and retrievable. Electronic records systems must ensure integrity, and organizations subject to 21 CFR Part 11 must maintain those controls in parallel.

A key practical change: organizations must maintain documented procedures for records that ISO 13485 designates as “quality records.” The list of required quality records under ISO 13485 is longer than what the QSR explicitly required, so many organizations will need to create or formalize documentation they previously handled informally.

Design and Development Controls

The QMSR aligns design controls with ISO 13485:2016 Clause 7.3. The underlying requirements are substantially similar to what the QSR required under 820.30. However, terminology changes and the Medical Device File consolidation mean that legacy design control documentation structures must be reviewed.

Traceability between design inputs and design outputs, design verification and validation evidence, and design transfer documentation remain mandatory — and FDA inspectors can now apply ISO 13485 clause-by-clause expectations rather than the older QSIT design control subsystem checklist.

Supplier and Purchasing Controls

Supplier Quality Management (SQM) requirements under QMSR are more explicit than under the QSR. ISO 13485:2016 Clause 7.4 requires manufacturers to evaluate and select suppliers based on their ability to meet requirements, maintain records of those evaluations, and re-evaluate suppliers at defined intervals.

Critically, supplier audit records are now accessible to FDA during inspections. Manufacturers who relied on questionnaires or certifications alone — without documented process audit activity — need to strengthen their supplier qualification programs immediately.

CAPA and Nonconformance Management

As noted above, corrective and preventive actions must now be managed as separate processes. ISO 13485:2016 Clause 8.5 provides the framework. Each process requires defined procedures, documented root cause investigation for corrective actions, effectiveness verification steps, and escalation mechanisms for systemic issues.

Organizations must also ensure their nonconforming product controls, customer complaint handling, and internal audit finding disposition processes feed into the CAPA system in a traceable, documented way.

How QMSR Changes FDA Inspections

The inspection change under QMSR is as significant as the regulatory text change. On February 2, 2026, the FDA officially retired the QSIT and replaced it with the updated Compliance Program for Inspection of Medical Device Manufacturers (7382.850).

Under the old QSIT, FDA investigators followed a structured four-subsystem approach and specific limitations on what records they could request. The new compliance program gives investigators broader latitude to follow audit trails wherever the evidence leads — including into internal audit files, supplier qualification records, and management review documentation.

What this means operationally: Your internal audit reports must reflect a mature, functioning audit program. Repeat findings without effective corrective actions create significant inspection risk. Your management review records must be thorough, dated, and show that leadership is actively engaging with quality data — not just signing off on templated agendas. Your supplier qualification records must demonstrate documented evaluation and ongoing monitoring, not just a signed supplier agreement. Your risk register must be current, cross-referenced with your QMS processes, and show evidence of ongoing risk assessment activity.

5 Steps to QMSR Compliance

1. Conduct a Gap Analysis Against ISO 13485:2016

Map your current QMS procedures, records, and documentation structures against ISO 13485:2016 clause by clause. Identify where your existing QSR-based system does not satisfy the ISO standard’s explicit requirements. Pay particular attention to Clauses 5 (management responsibility), 7.4 (purchasing), 7.5 (production controls), 8.2 (monitoring), and 8.5 (CAPA).

2. Restructure Your CAPA System

If your organization still uses a combined CAPA procedure, splitting it is your highest-priority compliance action. Create separate SOPs for corrective actions and preventive actions. Ensure each process includes root cause investigation requirements, effectiveness verification steps, and escalation triggers for systemic issues.

3. Prepare Internal Audit and Supplier Records for Inspection

Audit your audit program. Review the last two years of internal audit reports and identify any unresolved findings, repeat observations, or inadequate closure documentation. Build a remediation plan before an FDA investigator does it for you. Apply the same review to supplier qualification files.

4. Update Terminology and Documentation Structures

Replace DHF/DMR/DHR references in your SOPs, work instructions, and templates with the Medical Device File structure. Align terminology throughout your QMS with ISO 9000:2015 Clause 3 definitions. Train your quality team on the terminology changes before the next audit cycle.

5. Embed Risk-Based Thinking System-Wide

Risk management can no longer live only in design controls. Conduct a formal review of how risk-based decision-making is documented across purchasing, production, monitoring, measurement, and CAPA. Update your quality manual, SOPs, and process documentation to reflect risk-based rationale across the full QMS scope.

How Cloudtheapp Supports QMSR Compliance

Achieving QMSR compliance requires a QMS platform that can support the expanded documentation demands, the separated CAPA workflow, the risk-based process requirements, and the deeper audit traceability that FDA investigators now expect to see.

Cloudtheapp is an FDA-validated, AI-powered eQMS platform built for regulated industries including medical devices, life sciences, and pharmaceuticals. The platform supports 21 CFR Part 11 compliant electronic records and signatures, full audit trail controls, and configurable workflows for CAPA, design controls, supplier management, document control, and risk assessments — all within a single, cloud-native system validated to FDA and ISO 13485 standards.

For manufacturers transitioning from legacy QSR-era systems to QMSR, Cloudtheapp provides the structural flexibility to rebuild documentation processes, separate CAPA workflows, and configure supplier qualification programs without requiring IT development resources. The platform’s built-in analytics give quality leadership the real-time visibility into process performance data that QMSR’s management review requirements demand.

With over 45 configurable applications available through the Cloudtheapp Store — including Corrective and Preventive Actions, Supplier Qualification Management, Audits, Risk Assessments, Design Controls, and Document Control — medical device manufacturers can deploy a QMSR-ready quality system and configure it to match their specific processes in days, not months.

Ready to see how Cloudtheapp can support your QMSR transition? Request a demo or start a 30-day trial today.

Conclusion

The FDA QMSR 2026 marks the end of a 30-year regulatory era and the beginning of a globally harmonized compliance framework for U.S. medical device manufacturers. The regulation is active, enforcement has begun, and there is no grace period.

The organizations that will navigate QMSR inspections successfully are those that understand the structural differences from the QSR, have restructured their CAPA systems, and have made their internal audit and supplier records inspection-ready. Risk-based thinking must now run through every layer of the quality system — not just design controls.

For quality professionals, this is both a compliance obligation and an operational opportunity. A QMSR-aligned QMS — one built on ISO 13485:2016 principles and supported by a validated, configurable eQMS platform — puts your organization in a stronger compliance position across every market where ISO 13485 is the accepted standard.

The regulatory clock has already started. The question now is whether your QMS is built to meet the standard it sets.

This post created by and appeared first on Cloudtheapp