FDA QMSR (21 CFR Part 820): the ISO 13485 harmonization, explained

FDA's QMSR page states the amended Part 820 works by incorporating ISO 13485:2016 ("Medical devices — Quality management systems — Requirements for regulatory purposes") by reference, along with Clause 3 (definitions) of ISO 9000:2015, rather than reprinting the ISO text as US regulatory language. That is the harmonization long requested by manufacturers who sell into both the US and markets (like the EU, under MDR/IVDR) that already require ISO 13485 conformance — one quality system, one set of underlying requirements, instead of maintaining parallel US and international documentation.

But FDA was explicit that this isn't a wholesale handoff to ISO: per FDA's own page, "to the extent any clause of ISO 13485 conflicts with any provision of the FD&C Act and its implementing regulations, the FD&C Act and/or its implementing regulations will control." In other words, ISO 13485:2016 sets the baseline structure, and FDA's own statutory authority under the Federal Food, Drug, and Cosmetic Act fills in or overrides it wherever the FD&C Act demands something ISO 13485 alone doesn't guarantee. This guide has not catalogued every specific point of divergence — that detail lives in the rule's own preamble and FDA's QMSR guidance documents, not in a general explainer.

A common point of confusion is whether QMSR means a manufacturer now needs third-party ISO 13485 certification to sell in the US. FDA's QMSR FAQ answers this directly (FAQ #13): "The FDA will not require certificates of conformance to ISO 13485 and will not issue certificates of conformance to ISO 13485. A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection." The same FAQ draws the underlying distinction: "FDA inspections assess compliance to FDA regulations and are scheduled based on risk factors. Third-party audits assess conformance to a standard and occur annually based on a three-year plan." A manufacturer already ISO 13485-certified for the EU market doesn't get an inspection pass from that certificate, and a manufacturer with no certificate at all can still be fully QMSR-compliant — FDA inspects against its own regulation, not against a certification body's audit report.

Per FDA's QMSR page, the agency retired the Quality System Inspection Technique (QSIT) and its supporting compliance program documents (7382.845 and 7383.001) that FDA investigators used to structure inspections under the old Part 820. Starting on the February 2, 2026 compliance date, FDA investigators use an updated "Inspection of Medical Device Manufacturers Compliance Program: 7382.850" instead. A quality system built and trained around the old QSIT subsystem checklist (management, design, corrective/preventive action, production/process controls, and so on) should be re-checked against the new compliance program's structure rather than assumed to carry over unchanged, even where the underlying process documentation itself didn't need to change.

QMSR governs the quality management system a device manufacturer runs generally — design controls, complaint handling, corrective and preventive action, document control — and is a different FDA requirement from the premarket cybersecurity information FDA now requires under Section 524B of the FD&C Act for "cyber devices" (see our FDA premarket cybersecurity guide) or FDA's postmarket cybersecurity expectations (see FDA postmarket cybersecurity). A cybersecurity management plan and SBOM submitted under Section 524B live inside a quality system that QMSR now governs — a design-control or document-control deficiency found during a QMSR-era inspection can implicate the same records a premarket cybersecurity submission relied on, so the two shouldn't be treated as unrelated compliance tracks run by separate teams. Device software lifecycle practices under IEC 62304 and risk management practices from AAMI SW96 both feed the design-control records a QMSR-era quality system has to maintain.