QMSR: FDA's Quality Management System Regulation Explained

The Quality Management System Regulation (QMSR) is the current text of 21 CFR Part 820. It took effect on 2 February 2026, two years after FDA published the final rule (89 FR 7496, 2 February 2024). It replaced the Quality System Regulation (QSR), which FDA wrote itself, with a regulation that incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015 by reference.

FDA's QMSR page says the purpose is to harmonize device CGMP with the framework other regulators use. Its FAQ says FDA found ISO 13485, "when taken in totality", substantially similar to the QSR. The agency adds six short sections of its own to cover what ISO 13485 leaves out. For the section-by-section text, see the 21 CFR 820 page. This page covers what changed and how inspections work now.

QSR and QMSR compared

Sources: the final rule preamble (89 FR 7496, comments 19, 31, 46 and 55), FDA's QMSR FAQ (questions 8 and 13), and 21 CFR 820.10 and 820.35 on eCFR.

Independent review. FDA states in the preamble that the final rule "does not include the explicit requirement" that each design review include someone without direct responsibility for the stage. It considers clause 7.3.5 flexible enough, and leaves the choice of reviewers to the manufacturer. Guides written before 2026 still describe the old requirement as current. If your procedure keeps it, that is your choice and a reasonable one. It is no longer FDA's text.

Audit and management review records. Under QSIT, investigators did not ask for them. FDA's FAQ says that on or after 2 February 2026 it intends to review management review, quality audit and supplier audit reports. Its reasoning is that manufacturers already show them to other regulators and auditors.

What ISO 13485 does not cover

FDA kept its own text where it judged ISO 13485 incomplete or in tension with the FD&C Act. Where the two conflict, § 820.1(b) says the Act and its regulations control.

• Other FDA regulations. § 820.10(b) ties ISO 13485 clauses to unique device identification (part 830), tracking (part 821), medical device reporting (part 803) and corrections and removals (part 806).
• Design controls by class. § 820.10(c) requires clause 7.3 for class II, class III and certain class I devices: those automated with software, and five listed devices. FDA's FAQ adds that devices made under an IDE are not exempt from design and development requirements.
• Traceability. § 820.10(d) extends the implantable-device traceability clause (7.5.9.2) to devices that support or sustain life.
• Records. § 820.35 lists the fields a complaint record and a servicing record must hold, and requires the UDI to be recorded.
• Labeling. § 820.45 requires labeling and packaging to be examined for accuracy before release, including the UDI or UPC, expiry date and storage and handling instructions.

Exempt class I devices still must keep complaint files and the records § 820.35 requires, according to FDA's QMSR page.

How FDA inspects under the QMSR

On 2 February 2026 FDA stopped using QSIT and began using Compliance Program 7382.850, Inspection of Medical Device Manufacturers. The same date retired CP 7382.845 and CP 7383.001 (PMA preapproval and postmarket inspections).

The program sorts requirements into six QMS areas and four other applicable FDA requirements (OAFRs): medical device reporting, reports of corrections and removals, tracking, and UDI. It also lists registration and listing, marketing authorizations and prior 483 observations as general items.

In Model 1 the investigator identifies product risks, then picks at least one element in each of the six areas and each OAFR. In Model 2 the program fixes a minimum set of elements in every area. The investigator can add elements if something looks wrong.

Surveillance inspections are not conducted at sites actively enrolled in MDSAP. For-cause and compliance follow-up inspections can still reach them. FDA's FAQ is explicit that inspections under the QMSR do not follow the MDSAP audit plan.

For design and development, the program tells investigators not to put observations on the Form 483 about "the adequacy, safety, or efficacy of a particular design". Observations are to concern the adequacy of the manufacturer's procedures and controls and adherence to them. Read the Form 483 response page for what follows an observation.

The six areas and the ISO 13485 clauses behind them

Attachment A of CP 7382.850 lists the elements in each area and the clauses an investigator evaluates. This is the closest thing FDA has published to a map from inspection to clause.

FDA does not publish a clause-by-clause table from every old QSR section to ISO 13485. It points to AAMI TIR102:2019, a paid document we have not read, so this page does not reproduce a full mapping. The table above comes from FDA's own program and can be checked against it.

The "software changes" element lists clauses about software used in the quality system, production and measurement. The program does not say which element covers changes to device software. Clause 7.3.9 sits under product and process changes, so that is where a design change to device software fits. The change control post follows one such change through the records.

Preparing for an inspection

FDA's FAQ says investigators may review records created before 2 February 2026, and that a manufacturer "may find it useful" to compare older records with the QMSR. Its inspection advice is short: be ready to discuss and show records that demonstrate compliance with the QMSR.

1. Find the stale citations. Procedures, templates and training that cite § 820.30, § 820.100 or "the DMR" still describe a working process. They need a clause reference ISO 13485 and Part 820 use now.
2. Check the four FDA additions. Complaint records must carry the § 820.35(a) fields, labeling release must follow § 820.45, UDI must be recorded, and the part 803, 806 and 821 procedures must exist.
3. Pull the audit trail. Internal audit reports, supplier audit reports and management review minutes were out of scope under QSIT. Read them as an investigator would.
4. Walk one change end to end. The program has a change control area of its own. Pick a recent design change and confirm the record shows the significance assessment, risk file update, verification, approval before implementation, and effect on product already delivered.
5. Do not rename for its own sake. FDA eliminated the DMR, DHF and DHR terms because ISO 13485 covers their content. A file you still call a DHF is fine if it meets clause 7.3.10 and your procedures cite the clause. See design history file.

To see whether a device establishment already has posted inspection results, use the FDA inspection search. For the device's clearance record, use the 510(k) search. To see which Part 820 rules a device's product code points to, use the FDA product code lookup. Risk management practice is covered in ISO 14971, and software lifecycle requirements in IEC 62304.

Not covered here

MDSAP audit planning and EU MDR are outside this page. The standard itself, clause by clause, is on the ISO 13485 page. For combination products, FDA made conforming edits to 21 CFR part 4. It says they do not change the CGMP requirements for those products. Some FDA guidance written before February 2026 still cites old QSR section numbers. FDA's note on its 2017 software-change 510(k) guidance says it was issued before the effective date and tells manufacturers to check the QMSR.