FDA Quality Management System Regulation (QMSR)
21 CFR Part 820 quality-system requirements for finished medical devices
Standard Introduction
The FDA Quality Management System Regulation is the binding U.S. medical-device current good manufacturing practice rule in 21 CFR Part 820. The revised regulation became effective on February 2, 2026 and incorporates ISO 13485:2016 plus ISO 9000:2015 Clause 3 by reference.
QMSR applies according to the device, activity and role, and retains FDA-specific provisions for records, labeling and packaging. It is not an ISO certification program: manufacturers must meet the incorporated requirements, applicable U.S. law and FDA inspection expectations.
Binding U.S. Rule
QMSR is the current medical-device CGMP regulation in 21 CFR Part 820. It is not a voluntary certification scheme.
ISO 13485 Incorporated
The rule incorporates ISO 13485:2016 and ISO 9000:2015 Clause 3 by reference, with FDA-specific provisions and U.S. law controlling any conflict.
New Inspection Process
FDA stopped using QSIT on February 2, 2026 and now inspects device manufacturers under Compliance Program 7382.850.
list_alt QMSR Readiness Evidence
- Documented QMS scope and applicable activities
- Risk management across product and process lifecycle
- Design and development evidence where applicable
- Supplier and outsourced-process controls
- Production, validation, labeling and packaging controls
- Complaint, servicing and record controls
- CAPA, internal audit and management review
- FDA inspection-ready records and responsible personnel
Who Needs to Comply?
Manufacturers engaged in the design, manufacture, packaging, labeling, storage, installation or servicing of finished medical devices for the U.S. market, including specified contract sterilizers, installers, relabelers, remanufacturers, repackers, specification developers and initial distributors of foreign manufacturers. Component makers are generally outside Part 820 unless their product is itself a finished device or accessory, but device-specific rules and contracts may still apply.
Key Requirements
Establish an Applicable QMS
Under 21 CFR 820.10, establish and document a quality management system that complies with the applicable requirements of ISO 13485:2016 as incorporated by reference and the supplemental provisions of Part 820.
Apply Risk Management
Use risk management and risk-based decisions throughout relevant QMS and product-realization processes. Keep the rationale, inputs, controls, verification and change impacts traceable to the device and its intended use.
Control Design and Development
Apply ISO 13485 design-and-development controls when required, including for investigational devices. Maintain planning, inputs, outputs, reviews, verification, validation, transfer and change evidence appropriate to the device.
Meet FDA Record Controls
Apply 21 CFR 820.35 alongside ISO 13485 record requirements, including FDA access rules and the U.S.-specific treatment of complaint and servicing records. CGMP-exempt finished devices remain subject to specified complaint and record duties.
Control Device Labeling and Packaging
Meet 21 CFR 820.45 controls for labeling and packaging operations, including documented procedures, inspection, release and controls intended to prevent mix-ups and errors.
Prepare for FDA Inspection
Maintain an evidence trail from responsibilities and procedures to current records, risk decisions, nonconformities and corrective action. FDA inspections now use Compliance Program 7382.850 rather than QSIT.
Implementation Roadmap
Confirm scope and responsible operations
Map every U.S.-market finished device, legal manufacturer, site and activity covered by 21 CFR Part 820. Record exemptions, contract operations, imported-device roles and any investigational-device design obligations.
Map Part 820 to the existing QMS
Obtain authorized access to ISO 13485:2016 and ISO 9000:2015 Clause 3. Map applicable ISO clauses, 21 CFR 820.10, 820.35 and 820.45, and other device regulations to process owners and evidence.
Close process and evidence gaps
Update risk management, design controls, supplier oversight, production validation, complaint handling, servicing, records, labeling and packaging controls. Preserve the reason for each applicability and risk decision.
Test the system
Run internal audits, management review and an inspection-readiness exercise using representative device and complaint records. Correct systemic causes, verify CAPA effectiveness and confirm personnel can retrieve evidence.
Maintain FDA inspection readiness
Monitor device and process changes, suppliers, complaints, servicing, nonconformities and FDA updates. Keep the scope map and evidence current under Compliance Program 7382.850.
Compliance Checklist
checklist Scope and governance
checklist QMS and risk controls
checklist FDA-specific evidence
checklist Assurance and inspection readiness
QMSR, ISO 13485 and 510(k) answer different questions
Use QMSR for binding U.S. manufacturing controls, ISO 13485 for the incorporated international QMS framework, and 510(k) for premarket clearance when that pathway applies.
| Reference | Primary question | Legal or assurance role |
|---|---|---|
| FDA QMSR / 21 CFR Part 820 | What quality-system controls apply to U.S.-market finished devices? | Binding U.S. CGMP regulation |
| ISO 13485:2016 | What international QMS requirements support medical-device regulatory purposes? | Voluntary standard, incorporated into QMSR and used by multiple regulators |
| FDA 510(k) | Must this device obtain premarket clearance by showing substantial equivalence? | Device-specific U.S. premarket pathway |
| ISO 14971:2019 | How should medical-device risk management be structured across the lifecycle? | Voluntary risk-management standard used with regulatory QMS controls |
Common Misconceptions
QMSR made ISO 13485 certification mandatory in the United States.
QMSR incorporates the standard's requirements by reference, but it does not create an FDA ISO certification program or make a private certificate a substitute for compliance.
An existing ISO 13485 system needs no U.S.-specific review.
Manufacturers must add the FDA-specific Part 820 provisions, resolve terminology and record-access differences, and comply with other applicable U.S. device regulations.
A 510(k) clearance proves the factory complies with QMSR.
Premarket clearance and manufacturing quality-system compliance are distinct. A cleared device can still be subject to inspection and enforcement for QMSR failures.
Penalties & Enforcement
QMSR is binding U.S. law. A device made under nonconforming methods or controls may be considered adulterated under the Federal Food, Drug, and Cosmetic Act. FDA responses can include inspection observations, warning letters, import refusal, product seizure, injunction, recall-related action and civil or criminal enforcement. Consequences depend on the facts and applicable statutory authority.
Frequently Asked Questions
When did FDA QMSR become effective?
expand_more
The final rule was published on February 2, 2024 and the revised 21 CFR Part 820 became effective on February 2, 2026. On that date the former Quality System Regulation was replaced by the Quality Management System Regulation.
Is an ISO 13485 certificate enough to prove QMSR compliance?
expand_more
No. QMSR incorporates ISO 13485:2016 as its foundation, but FDA-specific provisions and other U.S. device regulations still apply. FDA does not issue or require a private ISO 13485 certificate as a substitute for compliance, and it may inspect the manufacturer.
Who is covered by QMSR?
expand_more
Part 820 covers manufacturers involved in applicable design, manufacture, packaging, labeling, storage, installation or servicing of finished devices intended for human use in, or imported into, the United States. The regulation expressly includes several contract and specification-development roles; applicability still depends on the activity and device.
Are component manufacturers covered?
expand_more
Manufacturers of components or parts are generally outside Part 820 unless the item is itself a finished device or accessory. FDA encourages appropriate use of the regulation, and purchasing controls or customer contracts may still impose quality requirements.
Are CGMP-exempt devices exempt from every QMSR record requirement?
expand_more
No. FDA states that exemption from CGMP requirements does not remove the complaint-file and general record requirements specified in 21 CFR 820.35. The product's classification regulation and current Part 820 text should be checked.
Does FDA still use QSIT for inspections?
expand_more
No. FDA states that it stopped using the Quality System Inspection Technique on February 2, 2026 and began using the inspection process in Compliance Program 7382.850.
Official Documentation
Official PDF for FDA Quality Management System Regulation (QMSR)
Official publication or summary for FDA Quality Management System Regulation (QMSR)
Official online resource
U.S. Food and Drug Administration (FDA) guidance and reference material
Implementation toolkit
Templates, guidance, or companion resources for FDA Quality Management System Regulation (QMSR)