The provision that changed who reads your records
The most consequential change in the transition to the QMSR is a provision that was removed rather than one that was added. The former §820.180(c) exempted management review records, quality audit reports and supplier audit reports from inspection: on request, a member of executive management certified in writing that the reviews and audits had been performed, with their dates, and that was the extent of what FDA saw. The current Part 820 carries no such exception, and FDA's QMSR FAQ states the position plainly: those records are inspectable.
For a manufacturer that has held ISO 13485 certification for years, that is the practical meaning of the QMSR. The quality system has not become harder. Its reader has changed. Records that were written for internal readers, management review slides, an audit-findings spreadsheet, a supplier audit summary, are now read by an investigator who did not attend the meeting, and the certificate on the wall does not answer any question the investigator asks. The sections below set out what the QMSR is, why a certificate is not compliance, what stayed the same, what FDA added and removed, what changes for a quality team in practice, and a transition sequence for three different starting positions.
What the QMSR is, in one paragraph
On 2 February 2024 FDA published the Quality Management System Regulation final rule (89 FR 7496); it took effect on 2 February 2026. It replaces the operational requirements of the 1996 Quality System Regulation with ISO 13485:2016, incorporated by reference, plus a thin layer of FDA-specific provisions. The same day, FDA withdrew the Quality System Inspection Technique (QSIT) and started inspecting under Compliance Program 7382.850. Part 820 is now short: scope, definitions, the incorporation itself, one requirements section, a records section and a labelling section. Everything else you're held to is the standard's own text. (For the clause-by-clause view of what that means for your eQMS, the 12-clause map is the companion piece; this post is about what changed and why a certificate doesn't settle it.)
A certificate is not compliance
The most expensive misunderstanding of the transition is the assumption that "incorporates ISO 13485" means "accepts ISO 13485 certification". It doesn't, and FDA has said so in its own QMSR FAQ:
- FDA will not require certificates of conformance to ISO 13485.
- FDA will not issue them.
- A certificate will not exempt a manufacturer from an FDA inspection.
- FDA inspections will not follow the MDSAP audit plan or procedures.
The reason is structural. Certification is a registrar sampling your system against the standard on a schedule you both know. An FDA inspection is an investigator with the authority of the FD&C Act pulling records to determine whether your devices are adulterated under section 501(h), which §820.10(e) says any failure to comply with Part 820 makes them. Different reader, different consequence, different depth.
Three differences show up in the room:
| Registrar audit (ISO 13485) | FDA inspection (QMSR) | |
|---|---|---|
| Method | Sampling against clauses; scheduled; scope agreed | Record traceback; can be unannounced for cause; follows the compliance program |
| Coverage | The standard | The standard plus §820.3, §820.10, §820.35, §820.45 and the cross-referenced parts (803, 806, 821, 830) |
| Outcome | Nonconformities; certificate maintained or suspended | Form 483, warning letter, and the adulteration finding behind them |
A well-run certified system is a genuine advantage. It is not the end of the work.
What stayed the same
For a company that already runs a real ISO 13485 system, most of the requirements didn't change; they changed address. Document control, design and development, purchasing and supplier control, production controls, CAPA, complaint handling, internal audit and management review are now ISO 13485 clauses 4.2, 7.3, 7.4, 7.5, 8.5, 8.2.2, 8.2.4 and 5.6, applied directly. The words on the page are the standard's, not FDA's rewrite of them.
Two things follow from that. First, the harmonisation is real: a single set of procedures can now serve FDA, EU MDR notified bodies and MDSAP without a crosswalk between "QSR language" and "ISO language". Second, the standard's own emphasis comes with it, and ISO 13485 leans harder than the QSR did on risk management across the product lifecycle (clause 7.1), on software validation for QMS processes (4.1.6) and on the medical device file as the single technical record (4.2.3).
What FDA added on top of ISO 13485
The FDA layer is short enough to read in one sitting, and every inspector has. Here it is in plain language, section by section.
| Section | What it does | Why it matters day to day |
|---|---|---|
| §820.1 Scope | Applies to manufacturers of finished devices; keeps the class I design-control exemption, with exceptions | Decides whether clause 7.3 applies to you |
| §820.3 Definitions | FD&C Act definitions win over ISO's (device, labeling). Adds FDA terms (batch, component, finished device, remanufacturer). Reads ISO's "safety and performance" as "safety and effectiveness", and "organization" as "manufacturer" | When the standard says "safety and performance", FDA hears the statutory standard, and so should your risk file |
| §820.7 Incorporation | Incorporates ISO 13485:2016 and ISO 9000:2015 clause 3 by reference | The standard's text is the regulation; you need a copy |
| §820.10 Requirements | (a) document a QMS that complies with ISO 13485; (b) tie four clauses to existing FDA rules: UDI (clause 7.5.8 → Part 830), traceability (7.5.9.1 → Part 821), reporting (8.2.3 → Part 803 MDR), advisory notices (7.2.3, 8.2.3, 8.3.3 → Part 806); (c) design controls (7.3) for class II, class III and listed class I devices, including any class I device automated with software; (d) implant-level traceability (7.5.9.2) for life-supporting devices; (e) non-compliance = adulteration | Your MDR, recall and UDI procedures are now explicitly part of the QMS inspection; the software-automated class I trap catches teams that thought they were exempt from design controls |
| §820.35 Control of records | On top of clause 4.2.5: complaint records must capture device name, date received, UDI/UPC, complainant details, nature of complaint, correction or corrective action, and any reply; investigations of possible failures to meet specification must be recorded (or the justification for not investigating a repeat); servicing records get a required content list; UDI must be recorded per device or batch; confidential records may be marked | Complaint and servicing records have a mandatory field list again. If your complaint form dropped fields when you "went ISO", they're back |
| §820.45 Labelling and packaging | Documented procedures for labelling/packaging integrity, inspection, storage and operations; examine labelling for accuracy before release (UDI/UPC, expiry, storage, handling, processing instructions); document label release and inspection results under 4.2.5; controls to prevent mix-ups | Labelling inspection is a record, per lot, that an investigator will ask for |
Nothing in that table appears in an ISO 13485 audit checklist. It is exactly the territory a certified company is most likely to have thin evidence in.
What FDA removed
Three removals matter more than any addition.
The §820.180(c) exception. Under the QSR, management review results, quality audit results and supplier audit reports were exempt from FDA review; investigators could ask whether they existed and were signed, not what they said. The QMSR does not carry that exception forward. FDA's FAQ is explicit: it has the authority to inspect management review, quality audits and supplier audit reports, on the reasoning that manufacturers already produce them for other regulators. Every one of those records now needs to be a record: dated, attributable, with inputs, conclusions and actions, and retrievable on request.
DMR, DHF and DHR as separate constructs. ISO 13485 clause 4.2.3 collapses them into the medical device file. Your records don't need renaming, but your index does, and an investigator will ask for the file, not the acronyms.
QSIT. The four-subsystem inspection model (management controls, design controls, CAPA, production and process controls) that companies arranged their inspection readiness around is withdrawn. Compliance Program 7382.850 follows the ISO clause structure, and an investigator can open with clause 5.6 or 7.4 as naturally as with CAPA. If your readiness binder is organised by QSIT subsystem, it's organised for an inspection that no longer happens.
What changes for a quality team, in practice
Pulling the three sections above together, this is the working list. None of it is philosophy.
- Management review becomes a producible record. Agenda that covers the clause 5.6.2 inputs, attendees, data reviewed, decisions, actions with owners, and evidence the actions closed. Slide decks aren't records; minutes are. See management review.
- Internal audit reports will be read by FDA. Findings, objective evidence, the auditee's response and the CAPA link. Audits that were written to be gentle need rewriting to be accurate; an investigator who finds a gap your own audit missed asks why.
- Supplier audit reports are inspectable. Including the ones for contract sterilisers, software vendors and critical component suppliers under clause 7.4.
- Complaint records need the §820.35(a) fields. Every one of them, and the investigation or the documented reason not to investigate a repeat.
- Servicing records need the §820.35(b) fields. Device, UDI, date, who, what, test data.
- Labelling inspection is a documented step under §820.45, per lot, with the results kept.
- Software used in the QMS must be validated under clause 4.1.6, and that includes the eQMS itself; a pre-2024 validation binder that never mentions the QMSR will draw the question.
- Risk runs through the lifecycle, not just design validation; clause 7.1 expects documented risk management in product realisation, and the risk file has to speak the "safety and effectiveness" language of §820.3.
- The vocabulary shifts. "Management with executive responsibility" is "top management"; "DHF/DMR/DHR" is the medical device file; "quality system" is "quality management system". Procedures that still use QSR terms aren't wrong, but they read as unmaintained.
Three starting positions, three different jobs
| Where you are | What the transition mostly is |
|---|---|
| ISO 13485 certified and FDA registered | Add the FDA layer: map §820.10's cross-references to your MDR/recall/UDI procedures, check complaint and servicing forms against §820.35, add the §820.45 labelling inspection record, and treat management review, internal audit and supplier audit outputs as inspectable records. Re-map inspection readiness from QSIT to the clause structure |
| FDA registered, never ISO | The bigger job: adopt the standard's structure (medical device file, clause 7.1 risk, 4.1.6 software validation, 5.6 management review inputs) and then the FDA layer on top. A gap assessment against every clause is the first deliverable |
| Certified through MDSAP | Closest to done on the standard, but FDA's inspection will not follow the MDSAP audit plan. The FDA-specific sections and the record-retrieval readiness still need their own evidence |
A transition sequence that holds up
Whatever the starting point, the sequence is the same, and it's the spine of the transition checklist.
- Gap assessment against ISO 13485 clause by clause, plus §820.10, §820.35 and §820.45. Record the evidence you found, not just the verdict.
- Document updates under change control: terminology, the medical device file index, complaint and servicing forms, labelling inspection, the MDR/recall/UDI cross-references.
- Management review as a record: run one under the new structure and keep minutes an investigator could read cold.
- Internal audit programme re-pointed at the clause structure, with reports written for an external reader.
- Training on every revised procedure, with records.
- Readiness drills, including a timed retrieval: management review minutes, an internal audit report, a supplier audit report and one complaint file, produced in minutes, not days.
Download the FDA QMSR transition checklist for that spine: nineteen tasks, with a place for evidence against each. The sequence above is what the workbook walks.
How Complere supports a QMSR-era quality system
The records FDA can now read are kept as records. Management review, internal audit findings and supplier evaluations live as controlled records with dates, owners, decisions and follow-up actions, so the request for "the last two years of minutes" is a retrieval, not a reconstruction.
Nothing changes without leaving a mark. Every edit and approval on those records carries who, when and what it was before, so an audit report written for an internal reader still holds up in front of an external one.
The chain stays connected. A complaint stays tied to its investigation, the CAPA it produced and the change that followed, so the §820.35 story from receipt to reply reads as one thread.
Retrieval takes minutes. Records and their histories can be produced as complete, readable copies on request, for the whole retention period, which is what a readiness drill is really testing.
The gap assessment, the risk file, what management review concludes and what an audit finding means remain the site's determinations. The system's part is that each determination is recorded in a form an FDA investigator can read without a briefing.
