Mastering FDA QMSR: Guide to 21 CFR Part 820 Harmonization
On February 2, 2026, FDA’s Quality Management System Regulation (QMSR) replaced the legacy Quality System Regulation (QSR) approach in 21 CFR Part 820. This is not a paperwork exercise. It affects how FDA evaluates current good manufacturing practice (cGMP) across your company, your suppliers, and your post-market processes.
If a manufacturer does not meet the applicable QMSR requirements, FDA can treat the device as “adulterated” under the Food, Drug, and Cosmetic (FD&C) Act. For leadership teams, the practical risks are straightforward: inspection findings that delay commercialization, distribution disruption, and avoidable remediation costs.
Executive takeaway: QMSR aligns Part 820 with ISO 13485:2016, but it also retains FDA-specific requirements. You need both: ISO clause coverage and the “FDA supplemental” pieces.
From QSR to QMSR: what harmonization actually means
QMSR incorporates ISO 13485:2016 by reference into 21 CFR Part 820. The prior subparts that described detailed QSR requirements are now reserved and point to the ISO 13485 clauses for the core quality system expectations.
“The design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use.”
Start with terminology and definitions. QMSR uses ISO 13485:2016 definitions and Clause 3 of ISO 9000:2015. Your Quality Manual, SOPs, forms, and training materials should be updated so the language is consistent.
If definitions conflict, the FD&C Act and 21 CFR 820.3 still take precedence. Treat this as a controlled documentation project: plan it, assign owners, and verify the changes through internal audit.
At a high level, the updated Part 820 is organized as follows:
- Subpart A – General Provisions: authority, scope, and incorporation of ISO standards.
- Subpart B – Supplemental Provisions: FDA-specific requirements retained where ISO 13485 is not explicit enough.
- Reserved Subparts C–O: refer to ISO 13485:2016 clauses for core QMS requirements.
Navigating Subpart B: the retained FDA supplemental requirements
FDA kept Subpart B because ISO 13485:2016 does not specify certain details FDA considers essential for US public health protection. Two sections commonly drive inspection focus: § 820.35 (Control of Records) and § 820.45 (Labeling and Packaging Controls).
§ 820.35 is often where companies underestimate the level of specificity expected during an FDA inspection. For complaint investigations, records must be complete, traceable, and inspection-ready. That typically includes: device identification, date received, any Unique Device Identifier (UDI) information, investigation outcomes, and a clear determination on whether the device met specifications.
Under § 820.45, FDA expects documented label and packaging controls before release. This is a practical control to prevent mislabeling and packaging errors that can trigger recalls.
“Failure to comply with QMSR will render a device ‘adulterated’ and subject to regulatory action.”
Operationalizing ISO 13485 under QMSR
FDA has described ISO 13485 requirements as substantially similar to the legacy QSR in many areas. The operational difference is how consistently risk-based thinking is applied across the quality system, not only to product risk but to QMS processes (e.g., supplier controls, software validation, change control, complaint handling, CAPA effectiveness).
Outsourced processes that affect product conformity need tighter control. For many manufacturers, that means formal quality agreements, defined change notification requirements, and evidence that supplier changes are assessed before implementation.
Software validation also needs realistic lead time. Under QMSR expectations, quality-related software should be validated for intended use before it is relied on (e.g., eQMS, complaint handling systems, labeling systems, ERP/MRP modules used for quality records).
QMSR implementation cheat sheet (by ISO 13485 clause)
- Clause 4 (QMS): Maintain a Medical Device File per device family. Validate QMS software for intended use.
- Clause 7 (Product realization): Ensure design and design validation evidence is representative and defensible. Under § 820.10, traceability applies beyond implantables to devices that support or sustain life. Supplier controls should include change notification where relevant.
- Clause 8 (measurement, analysis, improvement): CAPA actions should be verified for effectiveness and checked for unintended safety/performance impact. Internal audits should cover ISO clauses and Subpart B supplements.
The traceability signal in § 820.10 is worth executive attention. If your devices support or sustain life, your records should be able to link critical components, materials, and relevant production conditions to finished device history.
Competence, infrastructure, and the production environment
ISO 13485 Clause 6 emphasizes documented competence and suitable infrastructure. QMSR reinforces that this is not optional. Personnel performing work that affects quality should have documented evidence of education, training, and skills.
Facilities, workspace, and equipment controls should prevent mix-ups and support orderly handling. For sterile devices, contamination control should be documented and implemented (microbial and particulate controls during assembly and packaging).
Maintenance that affects product quality should also be documented and recorded. The point is simple: during an inspection, you need an audit trail that shows planned maintenance was done and that deviations were assessed for quality impact.
Executive implementation checklist (practical and inspection-focused)
- Run a Part 820 to ISO 13485 mapping: confirm clause coverage and identify where Subpart B adds requirements.
- Fix terminology and definitions: update the Quality Manual and top-level SOPs to align with ISO 13485 vocabulary and FDA precedence rules.
- Strengthen complaint records: ensure complaint files consistently capture device ID, dates, UDI when applicable, investigation outcomes, and specification conformance decisions.
- Confirm labeling controls: add documented label inspection/verification steps prior to release under § 820.45.
- Lock down supplier change controls: where outsourced processes affect conformity, establish written agreements and change notification expectations.
- Validate QMS-relevant software: define intended use, perform validation, and retain objective evidence.
- Audit like FDA will: schedule an internal audit that tests ISO clauses plus Subpart B supplements with real records and samples.
- Train and document competence: role-based training for complaint handling, labeling release, CAPA, and change control.
QMSR FAQ
What should we update first for QSR-to-QMSR transition?
Start with (1) your Quality Manual and definitions, (2) a mapping of Part 820 structure to ISO 13485 clauses, and (3) Subpart B gaps—especially records and labeling controls.
Is Subpart B optional if we already follow ISO 13485?
No. Subpart B contains retained FDA supplemental requirements. QMSR compliance means meeting the applicable ISO 13485 clauses and the supplemental provisions.
How does QMSR affect complaint handling?
Expect tighter expectations on completeness and traceability of complaint investigation records. In practice, your forms, workflow, and record content should be inspection-ready and consistent across sites and products.
Does QMSR change labeling release controls?
FDA continues to expect documented label verification/inspection prior to release. Build the control into your release workflow and retain objective evidence.