FDA QMSR Explained: Key Changes & ISO 13485 Alignment (2026)

Blogs

Author

Regulatory Specialist

Mon Mar 16 2026•6 min read•Regulatory Insights

Understanding FDA's New QMSR

The most significant change, considering the past 30 years has occurred in the field of Medical Device Quality and Regulatory Industry. On February 2, 2024, the U.S. Food and Drug Administration published the Final Rule for the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference and formally replaces the previous 21 CFR Part 820 (QSR). QMSR goes fully into effect and become mandatory on February 2, 2026. Now that the transition period is over, manufacturers must demonstrate ongoing compliance in order to be inspected under the updated framework. This blog is designed to help you understand and practically apply the “hybrid” structure of QMSR, particularly the FDA-specific supplemental requirements that go beyond ISO 13485.

1. Understanding the Nature of QMSR

The QMSR is a combined regulation.In each sub part of Part 820, the FDA have documented specific “supplemental” requirements, these requirements are additional obligations apart from the ISO 13485 provisions.As per Section 501(h) of the FD&C Act, Medical Devices will be deemed illegal, if these QMSR requirements are not followed.

2. How to read the QMSR

The FDA-specific additional requirements that expand upon ISO 13485:2016 are included in Subpart B of 21 CFR Part 820, which is part of the updated QMSR. The bulk of quality system requirements are directly derived from ISO clauses since ISO13485:2016 is now referenced by incorporation; however, Subpart B offers clarifications in cases where the FDA wanted to maintain stronger or more detailed regulations in the United States. These points include things like record control (UDI and confidentiality expectations), labelling and packaging controls to prevent mix-ups, and some inspection-related clauses. It is crucial to look at the relevant ISO clause first when analysing the QMSR, then look through Subpart B to see if the FDA has made any additions or changes. For compliance in the US, the FDA's supplement takes precedence in the event of any discrepancies.

In 21 CFR Part 820, you may notice that some sections are marked as "Reserved." This merely shows that the FDA removed the prior regulatory text while intentionally retaining that section number. Since ISO 13485:2016 has been incorporated, the relevant sections are now covered. In order to maintain consistency in numbering and to enable potential future rulemaking without having to renumber the entire regulation, the FDA keeps these placeholders. "Reserved" means that there is currently no enforceable content in that section.

By using the “Compare” or “View Historical Versions” option and choosing a date prior to February 2, 2026, you can locate historical versions of the regulation (the legacy QSR as described in the former 21 CFR Part 820) on the eCFR (Electronic Code of Federal Regulations) website.

This helps you to identify the updates that are added in the QMSR in reference with the QSR.

3. QMSR Supplemental Requirements: What the FDA Added Beyond ISO 13485

• Control of Records (§ 820.35)

The FDA has added several mandatory data points that must be included in your records, supplementing ISO Clause 4.2.5.

A. Enhanced Complaint Handling

Even if you follow ISO 8.2.2, the FDA requires you to maintain records of the review, evaluation, and investigation for any complaint involving a possible failure of a device, labeling, or packaging. If you decide NOT to investigate a similar complaint, you must document the specific justification. For all complaints, you must now record:

The name of the device
The date the complaint was received
The Unique Device Identifier (UDI) or UPC, and any other device identification(s);
The name, address, and phone number of the complainant.
The nature and details of the complaint.
Any reply sent back to the complainant and any corrective actions taken.

B. Servicing Activities

In addition to ISO 7.5.4, your servicing records must now explicitly include:

The UDI or UPC and the name of the device.
The date of service.
The specific individual(s) who performed the service.
All test and inspection data generated during the service

C. Unique Device Identification

In addition to the requirements of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be recorded for each medical device or batch of medical devices.

D. Confidentiality.

Records deemed confidential by the manufacturer may be marked to aid the FDA in determining whether information may be disclosed under the public information regulation in part 20 of this chapter

• Labeling and Packaging Controls (§ 820.45)

The FDA maintained high-intensity requirements here to prevent "mix-ups," a leading cause of recalls.

A. Mandatory Pre-Release Examination

You must document and maintain procedures that ensure the integrity of labeling and packaging. Before release or storage, you must examine labels for accuracy, specifically checking:

The correct unique device identifier (UDI) or universal product code (UPC).
Expiration dates and Storage/Handling instructions.
Any additional processing instructions.

B. The "Anti-Mix-up" Protocol

The QMSR mandates that you establish operations to prevent mix-ups. This includes a mandatory inspection of labeling and packaging before use to ensure they match the specifications in your Medical Device File (MDF). These results must be documented in accordance with Clause 4.2.5 of ISO 13485.

4. QMSR Implementation Checklist

Amendment of Forms: Make sure that the complaint and servicing forms have specific field for UDI/UPC and Complainant Phone Numbers
Design & Development: If your device is Class II, Class III, or software-based Class I devices, align fully with Clause 7.3 of ISO 13485.
Confidentiality: Mark your records as "Confidential”, to direct FDA to identify which data can be disclosed under Public Information Part 20.
Advisory Notices: Link your QMS documents to 21 CFR Part 806(Reports of Corrections and Removals) with ISO Clauses 7.2.3 and 8.3.3 directly.