FDA QMSR (21 CFR Part 820): What Changed in 2026

Timeline

Date	What happened
2 Feb 2024	FDA publishes the final rule amending 21 CFR Part 820, with a two-year transition.
4 Dec 2025	FDA publishes conforming technical amendments, updating references to the old QSR sections across other parts of Title 21.
2 Feb 2026	The QMSR takes effect. FDA inspects against it from this date.

What Part 820 contains now

Most of the old Part 820 is gone. What remains is short: six sections with their own text, while the bulk of the requirements come from ISO 13485:2016, incorporated by reference.

Section	What it does
§820.1 Scope	Who must comply: manufacturers of finished devices for human use. Component manufacturers are not covered. "Manufacturer" (defined in §820.3) includes specification developers, contract sterilizers, installers, relabelers, remanufacturers and repackers.
§820.3 Definitions	FD&C Act definitions and Part 820's own definitions take precedence over the matching ISO 13485 terms.
§820.7 Incorporation by reference	Brings in ISO 13485:2016 and clause 3 of ISO 9000:2015.
§820.10 Requirements	Document a QMS that meets ISO 13485, tie it to other FDA rules (reporting, corrections and removals, tracking, UDI), and set the scope of design controls.
§820.35 Control of records	What complaint and servicing records must contain, and that the UDI is recorded for each device or batch.
§820.45 Labeling and packaging	Procedures and pre-release inspection of labels and packaging to prevent mix-ups.

What FDA adds on top of ISO 13485

This is where ISO 13485-certified teams get caught. Certification covers the standard; it does not cover these FDA-specific requirements.

Links to other FDA regulations. §820.10(b) connects ISO 13485 processes to medical device reporting (Part 803), corrections and removals (Part 806), device tracking (Part 821) and UDI (Part 830).
Design control scope. §820.10(c) applies ISO 13485 §7.3 to all Class II and III devices, Class I devices automated with software, and a short list of other Class I devices. For those devices, ISO 13485 §7.3 must be met in full.
Complaint record content. §820.35 lists what each complaint record must hold, including device name, UDI or UPC, complainant contact details, the complaint itself and any corrective action.
Servicing record content. Device, UDI or UPC, date, who serviced it, what was done, and test and inspection data.
UDI in production records. The UDI must be recorded for each device or batch.
Label inspection before release. §820.45 requires checking the UDI or UPC, expiry date, storage and handling instructions, and any processing instructions before release, and documenting the result.
FDA definitions win. Where an FD&C Act or Part 820 definition differs from an ISO term, such as "manufacturer" or "rework", the FDA definition applies.

QSR to QMSR: where things moved

The QMSR drops several familiar QSR terms. Their content did not disappear; it now sits in ISO 13485 clauses or the remaining Part 820 sections.

Old QSR	Under the QMSR
Device master record (DMR)	Medical device file, ISO 13485 §4.2.3
Design history file (DHF)	Design and development file, §7.3.10
Device history record (DHR)	Record for each device or batch, §7.5.1, with the UDI per §820.35
§820.20 Management responsibility	ISO 13485 clause 5
§820.22 Quality audit	Internal audit, §8.2.4
§820.25 Personnel	Human resources, §6.2
§820.30 Design controls	§7.3, with scope set by §820.10(c)
§820.30(i) Design changes	§7.3.9 (our guide)
§820.50 Purchasing controls	§7.4
§820.75 Process validation	§7.5.6
§820.90 Nonconforming product	§8.3
§820.100 CAPA	Corrective action §8.5.2, preventive action §8.5.3
§820.120 / §820.130 Labeling and packaging	§820.45 plus §7.5.1
§820.198 Complaint files	§8.2.2 plus §820.35
§820.200 Servicing	§7.5.4 plus §820.35

FDA has not published an official crosswalk. Apart from the DMR, DHF and DHR, which FDA maps in the final rule, this table follows ISO 13485 clause content and common industry practice (see AAMI TIR102). If your SOPs, forms or software still cite QSR section numbers, update the references.

How inspections changed

FDA retired the QSIT inspection technique and now inspects under a risk-based compliance program, CP 7382.850, which focuses on the areas that pose the greatest risk to patients and users. Two practical consequences:

More records are in scope. The old exemption in §820.180(c) is gone, so management review, internal audit and supplier audit reports can now be reviewed by investigators, as they already are under MDSAP.
Certificates do not replace inspections. FDA does not require ISO 13485 certificates, will not issue them, and still inspects certified manufacturers.

Risk thinking runs through the new program. One example of a serious finding it describes is not evaluating design changes for risk and impact on product before implementation.

QMSR readiness checklist

If you were QSR-compliant and ISO 13485-certified before February 2026, most of the work is mapping and records. Check that:

Your quality manual and SOPs reference ISO 13485 and the QMSR, not old QSR sections
DMR, DHF and DHR content is organized as the medical device file, design and development file, and device or batch records
Complaint and servicing records capture every field §820.35 lists
The UDI is recorded for each device or batch
Label and packaging inspection before release is documented under §820.45
Procedures for reporting, corrections and removals, tracking and UDI are linked from the QMS
Management review, internal audit and supplier audit reports are complete enough for an investigator to read
Risk management, usually under ISO 14971, is visible across product realization and design changes
Supplier controls follow ISO 13485 §7.4, with records of evaluation and monitoring

How Omni Octa helps under the QMSR

Omni Octa maps events from your engineering and business tools to the ISO 13485 clauses and QMSR sections they trigger. A released CAD revision becomes a §7.3.9 design change with risk, verification and approval tasks; a supplier switch in your ERP becomes a §7.4 purchasing obligation. Gaps are chased with their owners and every decision is recorded, so the evidence an investigator asks for already exists.

Book a demo Try the interactive demo

Frequently asked questions

When did the QMSR take effect?

On 2 February 2026. FDA published the final rule on 2 February 2024 and gave manufacturers two years to transition.

Is ISO 13485 certification enough to comply with the QMSR?

No. The QMSR incorporates ISO 13485:2016, but it also has FDA-specific requirements in §820.10, §820.35 and §820.45, and FDA and Part 820 definitions take precedence. FDA does not accept certificates in place of inspections.

Can FDA now see our management review and internal audit reports?

Yes. The QMSR removed the exception that kept management review, internal audit and supplier audit reports out of FDA inspections.

Does the QMSR require ISO 14971?

ISO 14971 is not incorporated by reference. ISO 13485 does require documented risk management throughout product realization, and FDA recognizes ISO 14971 as a consensus standard, so most manufacturers meet the requirement with it.

Do design controls apply to Class I devices?

Only to Class I devices automated with computer software and the few Class I devices listed in §820.10(c). Design controls apply to all Class II and Class III devices.

What happened to the DMR, DHF and DHR?

The terms are gone. Their content now lives in the medical device file (ISO 13485 §4.2.3), the design and development file (§7.3.10) and the record kept for each device or batch (§7.5.1).

Sources

This page is general information, not legal or regulatory advice for a specific device.

FDA QMSR: what changed for medical device manufacturers