The short answer. Since February 2, 2026, FDA’s Quality Management System Regulation (QMSR, 21 CFR Part 820) replaces the old Quality System Regulation. It incorporates ISO 13485:2016 by reference, keeps a few FDA-specific requirements, opens management review and audit records to inspection, and comes with a new inspection program that replaced QSIT. An ISO 13485 certificate does not exempt a manufacturer from FDA inspection.
What changed
| Topic | Old QSR | QMSR since February 2, 2026 |
|---|---|---|
| Basis | FDA’s own text, 21 CFR 820.1 to 820.250 | ISO 13485:2016 incorporated by reference, plus Clause 3 of ISO 9000:2015 for definitions |
| Records | Device master record, design history file, device history record | No separate record types; content moves to the Medical Device File (ISO 13485 clause 4.2.3) and the design and development file (7.3.10) |
| Risk management | Explicit only in design validation, 820.30(g) | Risk management throughout the requirements; ISO 14971 itself is not incorporated |
| Management review, internal and supplier audits | Excluded from routine FDA inspection, 820.180(c) | FDA can inspect management review, quality audit and supplier audit reports |
| Terms | Management with executive responsibility | Top management, as defined in ISO 9000 |
| Approval signatures | Signature for each individual who approved a record | Requirement removed |
| Inspections | QSIT, compliance program 7382.845 | Compliance Program 7382.850, issued February 2, 2026 |
Requirements FDA kept on top of ISO 13485
- Design and development controls (ISO 13485 clause 7.3) apply to class II and III devices and to listed class I devices, including devices automated with computer software (820.10(c)).
- Links to unique device identification (Part 830), tracking (Part 821), medical device reporting (Part 803) and corrections and removals (Part 806), per 820.10(b).
- Extra content for complaint, servicing and UDI records (820.35) and labeling and packaging controls (820.45).
How FDA now inspects
Compliance Program 7382.850 organizes the QMSR into six QMS areas: change control; design and development; management oversight; measurement, analysis and improvement; production and service provision; outsourcing and purchasing. Four other FDA requirements are checked alongside: reporting, corrections and removals, tracking and UDI. Investigators review risk management documentation throughout the inspection. Baseline inspections must cover management review and internal audits. Sites actively enrolled in MDSAP do not get routine surveillance inspections.
The program also tells investigators to consider cyber devices, as defined in section 524B(c) of the FD&C Act, for review. See FDA cybersecurity requirements for medical devices.
Related FDA actions
- A technical amendments rule (90 FR 55978, December 4, 2025) corrected references and added no new requirements.
- A draft guidance from October 2025, Quality Management System Information for Certain Premarket Submission Reviews, was still a draft in October 2026.
- The premarket cybersecurity guidance was reissued on February 3, 2026 with QMSR terms and clause references.
What this means during development
- Design inputs, verification, validation, design transfer and risk files are now judged against ISO 13485 clause 7.3 and its subclauses; build the design and development file that way from the start.
- Management review and supplier audits can be read by an investigator, so write them as if they will be.
- If your engineering partner works under an ISO 13485 QMS, ask how its design records will transfer into your Medical Device File.
Sources
- Federal Register: Quality System Regulation Amendments, final rule, 89 FR 7496
- FDA: Quality Management System Regulation (QMSR)
- FDA: QMSR frequently asked questions
- FDA: Compliance Program 7382.850, Inspection of Medical Device Manufacturers
- Federal Register: QMSR technical amendments, 90 FR 55978
- FDA draft guidance: QMS information for certain premarket submission reviews
What OVA does here, and where our responsibility ends
OVA Solutions is a medical device engineering group working under an ISO 13485:2016 certified quality system: 62 engineers, 220 devices developed, $125 per hour, offices in New York, Florida, the United Kingdom, Estonia and Ukraine. We design electronics, firmware and mechanics and take a device from concept to design for manufacturing. We are not a regulatory consultancy and not a contract manufacturer: the regulatory strategy and the submission stay with you or your regulatory consultant.
More from OVA: what medical device development costs, how to choose a development firm, answers from Lisa Voronkova, our quality system.
Updated on October 8, 2026.