FDA QMSR

What the FDA QMSR is

The Quality Management System Regulation (QMSR) is the FDA final rule that amends 21 CFR Part 820, replacing the requirements of the 1996 Quality System Regulation (QSR) by incorporating ISO 13485:2016 by reference — with FDA-specific additions layered on top. It was published in the Federal Register on February 2, 2024 and took effect on February 2, 2026, after a two-year transition with no grace period beyond it.

The FDA-specific additions are the parts ISO 13485 does not cover to FDA's satisfaction: control of records (21 CFR 820.35) — including signature-and-date expectations on records and obligations tied to complaint handling and servicing — and control of labeling and packaging (21 CFR 820.45), retained because FDA judged ISO 13485 alone insufficient for label-error risk. Definitions in 820.3 reconcile FDA's statutory vocabulary (per the FD&C Act) with ISO 13485's terms, and where they conflict, the FD&C Act definitions control.

The QMSR applies to manufacturers of finished medical devices marketed in the United States, regardless of where the manufacturer is located. Combination products continue to follow 21 CFR Part 4, which was amended to reference the QMSR structure.

Why the QMSR is more than a renumbering

The QMSR is the first structural overhaul of FDA's device quality system requirements since 1996, and it landed together with a second change that affects daily life more than the rule text: FDA retired QSIT — the Quality System Inspection Technique used since 1999 — and began inspecting under compliance program CP 7382.850, Inspection of Medical Device Manufacturers, on the same effective date.

The new inspection approach is risk-based: it organizes QMSR requirements into six quality management system areas plus other applicable FDA requirements, drops QSIT's fixed sampling tables, and lets investigators choose records based on product risk and professional judgment. That last point changes preparation strategy fundamentally — under QSIT you could anticipate the sample; under the new program, any record in scope needs to be defensible, because you no longer know which ones will be pulled.

For global manufacturers the QMSR also closes a long-standing dual-bookkeeping problem: a single ISO 13485-based quality system can now serve the EU (via MDR conformity assessment), MDSAP jurisdictions, and the US — with the FDA-specific additions managed as a delta rather than a parallel system. Teams that maintained separate QSR and ISO 13485 procedure sets can finally converge them, but the convergence itself is regulated work: every merged procedure is a controlled change.

The change quality teams feel first: FDA eliminated its longstanding policy of not requesting internal audit, supplier audit, and management review records. Under the QMSR-era program these records are reviewable — meeting minutes and audit files that were effectively private for two decades are now inspection evidence.

What changed, what stayed, and what surrounds it

Scoping the transition accurately matters more than moving fast. The QMSR changed the quality system backbone — it did not touch the rest of the device regulatory stack:

• Changed: QSR requirements replaced by ISO 13485:2016 incorporated by reference — including its clause structure for management responsibility (5), resources (6), product realization (7), and measurement/improvement (8)
• Changed: terminology shifts to ISO vocabulary — management review, design and development, nonconformity — with 820.3 reconciling FDA statutory terms
• Changed: risk-based thinking expected throughout the QMS, consistent with ISO 13485's integration of risk management principles (and, through it, ISO 14971)
• Added: 21 CFR 820.35 control of records — signature and date on records, plus records obligations tied to complaint handling and servicing (and alignment to Part 803 reporting)
• Added: 21 CFR 820.45 control of labeling and packaging — label inspection and handling controls beyond ISO 13485's text
• Changed: QSIT retired; inspections run under the risk-based CP 7382.850 program (six QMS areas, no sampling tables, internal audit / supplier audit / management review records now reviewable)
• Unchanged: 21 CFR Part 11 (electronic records and signatures), Part 803 (medical device reporting), Part 806 (corrections and removals), Part 807 (registration and listing), Part 830 (UDI), Part 4 (combination products)
• Still true: FDA inspects directly — ISO 13485 certification is neither required nor accepted as a substitute; MDSAP audit reports remain a separate program FDA participates in

What a QMSR transition actually involves

For manufacturers with a mature QSR-era quality system, the transition is a structured gap assessment rather than a rewrite. The work concentrates in five places, and each leaves records the new inspection program can reach:

Map, then merge. Map each legacy procedure to its ISO 13485:2016 clause plus the FDA additions (820.35, 820.45). Most procedures survive with terminology and reference updates; a minority — typically records control, labeling operations, and management review — need substantive revision. Companies already holding ISO 13485 certification work the delta in the other direction: confirm the FDA additions and the FD&C Act definitions are covered.

Run the document wave under change control. The update wave touches the quality manual, dozens of SOPs, forms, and training material. Running it as controlled changes — with impact assessment, approval, and linked training — turns the transition itself into an inspectable record instead of an undocumented scramble.

Treat management review as a producible record. Cadence, inputs per ISO 13485 §5.6 (audit results, feedback, process performance, CAPA status, follow-ups, changes, recommendations), minutes, and resulting actions — all now within an investigator's reach. The same applies to the internal audit program: re-point checklists at the new requirement set and assume the findings file will be read.

Close the training loop. Every revised procedure needs assigned training, completion evidence, and competency sign-off tied to the new revision before the old one retires — the first thread an investigator pulls after any documentation change.

Rehearse retrieval. Time how long it takes to produce a management review record, an internal audit file, and a CAPA chain end-to-end. Under a program where investigators select records by risk and wait while you produce them, retrieval speed is part of readiness.

What strong QMSR readiness looks like

Teams that pass QMSR-era inspections without drama share a set of concrete controls — most of them quality-system mechanics rather than regulatory interpretation:

• A clause-mapped procedure index — every SOP mapped to its ISO 13485 clause and FDA addition, kept current as documents rev
• One vocabulary — ISO terms used consistently across procedures, forms, and training; no half-migrated documents mixing QSR and ISO language
• Signature-and-date discipline on records — 820.35 expectations embedded in records procedures and e-signature configuration, not left to habit
• Labeling and packaging controls per 820.45 — label inspection, storage, and issuance controls with records
• Management review as a record system — standing agenda, §5.6 inputs assembled from live data, signed minutes, tracked outputs
• Internal audits against the QMSR — checklists re-pointed at ISO clauses + additions; findings, evidence, and follow-up assumed readable by FDA
• Supplier audit files in producible shape — now reviewable; evaluation criteria, re-evaluation cadence, and risk-proportionate controls documented
• Change-controlled transition trail — the migration itself documented as impact-assessed changes with training linkage
• Retrieval drills — timed production of the record sets the six QMS areas will probe

How Complere supports QMSR work

The QMSR transition is mostly document, change, audit, and training work — the workflows an eQMS exists to govern. Complere supports each leg of it with records that are attributable, time-stamped, and retrievable at inspection speed.

The document wave runs in Document Control: the quality manual, SOPs, and forms move through review and approval with electronic signatures and full version history, the new revision becomes the single effective version at publication, and superseded revisions retire automatically. The transition itself runs as impact-assessed controlled changes — each terminology update or procedure merge carries its own approval chain, document linkage, and training trigger, so the migration leaves the inspectable trail the new program expects.

Gap assessments and the re-pointed internal audit program run in Audit Management: plan the transition-verification audit, capture findings with evidence, classify them, and drive them to closure through linked CAPAs. Because internal and supplier audit records are now reviewable, the audit file's completeness and retrievability matter as much as its findings — both are native properties of records kept in the system rather than in folders.

Management review runs as governed work: Dashboards & KPIs assemble the §5.6 inputs from live module data — open and overdue actions, quality-event trends, audit findings and closure status, training compliance — the minutes live in Document Control as signed, versioned records, and review outputs route into CAPA and Change Control with owners and due dates. Producing the management review record set for an investigator becomes a retrieval task, not a reconstruction project.

Training closes the loop: revised procedures trigger role-based training assignments, completion is evidenced against the specific revision, and competency sign-off is recorded where required — so the question “was the operator trained on the procedure in force?” has a one-query answer.

What stays with your team is the regulatory judgement: deciding how your procedures map to the ISO clauses, what the FDA additions mean for your records and labeling operations, and what your management review concludes. Complere makes the work governed and the evidence producible; the quality decisions remain yours. The full transition picture lives on the QMSR transition hub, with a downloadable transition checklist.

Terms related to the FDA QMSR

The QMSR connects to most of the device quality vocabulary. Explore related terms to build a complete picture.

• Design Controls — 820.30's content now flows through ISO 13485 §7.3 under the QMSR
• Management Review — the §5.6 record set FDA can now request
• Internal Audit — audit records lost their QSIT-era exemption
• Nonconformance — 820.90's control of nonconforming product, now via ISO 13485 §8.3
• CAPA — corrective and preventive action under the new clause structure
• 21 CFR Part 11 — unchanged by the QMSR; still governs electronic records and signatures