FDA QMSR: Are You Ready?
January 2, 2026
FDA QMSR: Are You Ready?
Introduction:
FDA’s new Quality Management System Regulation (QMSR) replacing the current Quality System Regulation (QS Regulation) is nearly upon us. Specifically, after a generous two-year transitional period, the QMSR becomes effective in just a few weeks on February 2, 2026.
The QMSR represents a number of changes compared to the existing QS Regulation. Although FDA generally states that it is substantially similar to the outgoing QS Regulation, it nonetheless contains some significant changes about which firms need to be aware, and for which specific QMS solutions need to be documented, in the QMS.
As noted in previous blog posts, the QMSR amends FDA’s device current good manufacturing practice (CGMP) requirements of the 1996 QS Regulation (21 CFR Part 820) to harmonize and modernize it primarily by incorporating by reference ISO 13485:2016 3rd Ed., March 1, 2016, but with additional requirements and conforming edits to clarify the device CGMP requirements. The devil is in the details of those additional requirements.
Although FDA’s QMSR doesn’t require firms to have an ISO 13485 certification, and although conformity with FDA’s QMSR doesn’t result in an ISO 13485 certification, it remains true for practical intents and purposes that conformity with the principles and contents of ISO 13485 is still of paramount importance. Moreover, FDA’s various unique aspects that FDA has retained or added on top of ISO 13485’s core elements, and in variation from the current Part 820, mean that firms have their work cut out for them during their transitional efforts.
Indeed, there are some 83 separate stakeholder/FDA interpretive discussions that FDA recorded in the QMSR preamble when promulgating the revised Part 820 QMSR. Thus, in addition to getting carefully familiar with the revised Part 820, and on top of building / assuring an ISO 13485 QMS, firms need to also be intimately familiar with the QMSR’s preamble so as to see how the QMSR differs from ISO 13485 and from the outgoing QS Regulation. It is not sufficient to simply read the revised Part 820, as such details are not published there. Remember that the preamble can be used by FDA (a law enforcement agency) in court to show FDA’s intentions.
Here is a snapshot of some key take-aways from the revised Part 820 itself along with particulars from the QMSR preamble:
Overview of QMSR Basic Structure/Contents:
Subpart A—General Provisions
-
-
-
820.1 Scope.
-
820.3 Definitions.
-
820.5 [Reserved]
-
820.7 Incorporation by reference (see ISO 13485:2016).
-
820.10 Requirements for a quality management system: (a) document a QMS; (b) partial identification of other FDA regulatory requirements related to ISO 13485; (c) design control device scope; (d) traceability of life supporting/sustaining devices; (e) adulteration warning
-
-
Subpart B—Supplemental Provisions
-
-
-
820.20–820.30 [Reserved]
-
820.35 Control of records: (a) complaint handling and records; (b) service records; (c) UDI and UDI records; (d) Confidentiality of records
-
820.40 Reserved]
-
820.45 Device labeling and packaging controls.
-
-
Subparts C–O [Reserved]
QMSR Requirements Unique From ISO 13485:
-
-
-
Scope
-
Terminology/definitions
-
Device traceability (Part 821, life-supporting/sustaining, initial consignee)
-
Complaint investigation scope, records,
-
Service records,
-
UDI and UDI records
-
Confidentiality of records
-
Labeling and packaging controls (prescriptive, copy of primary label/labeling)
-
Design reviews in general and regarding reviews of design verification
-
Design change control time zero
-
Clinical evaluation is limited to FDA IDE / GCP scope
-
All processes require some form of qualification, verification, or validation
-
Customer property handling shall assure S&E
-
Scientific evidence for, and close monitoring of, acceptance by concession
-
Verify or validate process/device CAPA
-
-
New Items Not Covered by the Current QS Regulation:
-
-
-
Structure, order, descriptions, of ISO 13485
-
QMSR has a different structure and order than the QS Reg
-
QS Reg now called QMSR
-
DHF, DMR, DHR are still required, yet not called by these names
-
MDF (analogous to DMR) has some differences
-
“established” (defined, documented, and implemented) is now “documented” (established, implemented, and maintained)
-
FDA no longer taking enforcement discretion for review of internal audit, management review, and supplier audit reports
-
Process validation required where the process cannot be or is not fully verified
-
All processes require some form of qualification, verification, or validation
-
Risk-based storage added to existing extensive QS Reg risk-based approach
-
Requested records to be provided by FDA’s deadline
-
Electronic records/signatures (Part 11) allowed but must meet ISO 13485 too
-
Automated readers for labels/packaging must be supplemented by human sampling inspection
-
Clarification of existing practice: Packaging to be included in the label accuracy inspection
-
Corporate procedural control required for multi-site complaint handling operations
-
-
Implementation Approach Recommended by FDA:
-
-
-
Familiarize yourself with FDA regulations and applicable standards
-
Gap Analysis
-
Revise and implement robust documentation
-
Foster a culture of compliance
-
Train
-
Implement
-
Monitor
-
-
-