Short answer: ISO 13485:2016 is now the foundation of the FDA's Quality Management System Regulation, but an ISO 13485 certificate is not FDA compliance. Since 2 February 2026, manufacturers subject to 21 CFR Part 820 must comply with the applicable ISO 13485 requirements incorporated into US law and the FDA-specific requirements that sit around them.
This article compares the two systems as they apply today. It replaces the old “ISO 13485 versus QSR” comparison: the former Quality System Regulation (QSR) and its familiar Subparts A–O are no longer the operative structure for FDA inspections.
What changed on 2 February 2026?
The FDA renamed 21 CFR Part 820 the Quality Management System Regulation (QMSR) and incorporated ISO 13485:2016 by reference. The current Part 820 is compact: it contains scope and definitions, incorporation by reference, the core QMS requirement, supplemental record controls, and labeling and packaging controls. Most of the detailed process requirements now come from ISO 13485 rather than from the old QSR subparts.
The change is structural, not a deregulation. A device can still be adulterated under the Federal Food, Drug, and Cosmetic Act when its manufacturer does not comply. FDA can still inspect, issue observations and warning letters, detain imports, and take other enforcement action.
The inspection method changed too. FDA withdrew the Quality System Inspection Technique (QSIT) on the effective date and began using the risk-based process in Compliance Program 7382.850. You should therefore retire procedures, audit checklists and training material that treat QSIT or the old Part 820 subparts as the current inspection framework.
How ISO 13485 and QMSR fit together
Think of QMSR as a US legal wrapper around a specific edition of an international standard:
- ISO 13485:2016 supplies the main QMS requirements, including management responsibility, resource management, product realization, measurement, analysis and improvement.
- 21 CFR Part 820 makes the applicable ISO clauses mandatory for covered manufacturers and adds US definitions and supplemental requirements.
- Other FDA regulations remain applicable, including medical device reporting under Part 803, corrections and removals under Part 806, registration and listing under Part 807, UDI under Part 830, and device tracking under Part 821 where relevant.
- The FD&C Act and FDA definitions control if an incorporated ISO term or clause conflicts with US law.
FDA incorporated the 2016 edition. A later ISO revision does not silently become US law: FDA has said it will evaluate a revision and amend QMSR through rulemaking if appropriate.
What is genuinely aligned?
The two frameworks now share the same basic clause structure and core expectations. A well-implemented ISO 13485 system gives you a strong starting point for:
- a documented, risk-appropriate QMS and medical device file;
- management responsibility, quality objectives and management review;
- competence, training, infrastructure and controlled work environments;
- design and development planning, inputs, outputs, review, verification, validation, transfer and changes;
- supplier qualification and purchasing controls;
- production, process validation, identification, traceability, preservation and servicing;
- feedback, complaint handling, internal audit, nonconformity, CAPA and data analysis; and
- control of documents and records.
This alignment should reduce duplicate procedures for manufacturers serving the US and other ISO-based markets. You generally do not need a separate “FDA QMS.” You do need one QMS that clearly maps each applicable US requirement to controlled procedures and records.
The FDA-specific gaps an ISO certificate does not close
1. FDA scope and legal definitions
QMSR applies to the design, manufacture, packaging, labeling, storage, installation and servicing of finished devices intended for human use. Its definition of manufacturer includes functions such as contract sterilization, relabeling, remanufacturing, repacking, installation and specification development. FDA definitions for terms such as device, labeling, manufacturer, finished device and rework supersede correlating ISO definitions.
Do not copy a generic ISO applicability statement into your quality manual. Document which US-regulated activities, establishments and devices are in scope, and which legal role each site performs.
2. US regulatory reporting and traceability
Section 820.10 explicitly connects ISO processes to other FDA rules. Your system must identify complaints reportable under 21 CFR Part 803, handle advisory notices consistently with Part 806, assign UDI under Part 830, and meet Part 821 tracking requirements where applicable. These are legal decisions with prescribed timelines, not merely ISO feedback activities.
3. Design and development applicability
ISO 13485 Clause 7.3 applies under QMSR to class II and III devices, automated-with-computer-software class I devices, and the specific class I devices listed in § 820.10(c). Preserve a documented applicability decision for each product. A broad statement such as “class I is exempt from design controls” is unsafe.
4. Complaint records
Section 820.35 supplements ISO 13485. Complaint records involving a possible failure of a device, labeling or packaging to meet specifications need review, evaluation and investigation records. Where the regulation requires the data, the record includes device identification, receipt date, complainant contact information, complaint details, corrections or corrective action, and any reply. If a similar complaint was already investigated, retain the justification for not repeating the investigation.
5. Servicing records
For servicing activities, QMSR specifies minimum records such as device identification, service date, the people performing service, work performed, and test or inspection data. Make sure field-service tools and outsourced service arrangements capture these fields and feed reportable trends into the QMS.
6. Labeling and packaging controls
Section 820.45 adds explicit controls for labeling and packaging integrity, examination, storage and operations. Before release or storage where applicable, manufacturers must examine details such as the correct device identifier, expiry date, storage instructions, handling instructions and additional processing instructions. Release and inspection results must be documented, and operations must prevent mix-ups.
7. FDA inspections are not certification audits
An accredited ISO 13485 certificate does not exempt a manufacturer from FDA inspection. FDA does not issue ISO certificates, and its inspections do not simply follow the MDSAP audit plan. The agency assesses compliance with US law and schedules inspections using risk factors.
A major practical change is record access: the old § 820.180(c) inspection exceptions were not retained. FDA states that investigators may review management-review, quality-audit and supplier-audit reports. They may also review QMS records created before 2 February 2026 when assessing current compliance. Write reports as accurate regulatory records, resolve open issues, and make access responsibilities clear in your inspection procedure.
Practical gap assessment: ISO 13485 to FDA QMSR
- Replace the old map. Map ISO 13485 clauses to §§ 820.1, 820.3, 820.10, 820.35 and 820.45, then map the linked FDA regulations. Do not use an obsolete QSR Subpart A–O checklist as the master cross-reference.
- Confirm scope. List US devices, establishments, outsourced processes and manufacturer functions. Record any justified non-applicability.
- Update terminology carefully. You can keep familiar labels such as DHF, DMR and DHR as internal names, but ensure their contents satisfy the current ISO medical-device-file and record requirements. Do not claim that the old defined terms are still sections of Part 820.
- Connect regulatory processes. Test links among complaints, MDR reporting, corrections and removals, UDI, tracking, recalls, CAPA and risk management.
- Review design applicability. Apply Clause 7.3 to the QMSR device groups, including applicable software-driven class I devices.
- Expand record fields. Verify complaint, service, UDI, labeling-release and labeling-inspection records against §§ 820.35 and 820.45.
- Prepare previously protected reports. Make internal, supplier and management-review audit records inspection-ready. Resolve unclear conclusions and missing follow-up evidence.
- Retrain the inspection team. Remove QSIT-only scripts, update the front-room and back-room playbook, and practice retrieving records under the current Compliance Program.
- Audit implementation. Sample real records created before and after the effective date. A rewritten SOP without reliable operational evidence is not a closed gap.
If you are starting from the old FDA QSR
Do not perform a word-for-word rename exercise. Build your gap analysis around ISO 13485:2016, retain controls and records that remain useful, and identify where ISO is more explicit. Common work includes the quality manual, the medical device file, lifecycle risk management, regulatory-authority communication, feedback beyond complaints, evaluation of training effectiveness, and validation of software used in the QMS.
Legacy terms can remain if your staff and auditors understand them. What matters is that the current controlled system covers every applicable clause and US supplement, not that every folder has a fashionable new name.
Sources and next steps
Use the current 21 CFR Part 820 text as the legal starting point and the FDA's QMSR frequently asked questions for implementation and inspection clarifications. FDA also links to read-only access for the incorporated standards through the ANSI Incorporated by Reference portal.
For practical documents, browse our ISO 13485 templates, including procedures for document and record control, management review and purchasing and supplier controls. Adapt them to your devices, roles and regulatory scope; a template is a starting point, not evidence of implementation.
