The FDA is moving from its QSR via referencing ISO 13485 to the new QMSR. The DMR is being replaced by the MDF, the concept is becoming more international. Find out what manufacturers should implement as of February 2026

Current QMS requirements in the USA – what is required?

A quality management system (QMS) for medical devices comprises a large number of crucial elements, including

  • Design and development,
  • Manufacture,
  • Supplier management,
  • Risk assessment,
  • Complaint handling,
  • Evaluation of clinical data,
  • Storage,
  • Distribution,
  • Product labeling

and various other aspects, all aimed at ensuring user and patient safety and minimising the potential risks of medical devices.

The implementation of legal requirements depends on the characteristics, specifications and classification of the respective product in order to guarantee and produce reliable and safe products. The quality systems for FDA-regulated products (food, drugs, biologics and medical devices) have a long history and are known as Current Good Manufacturing Practices (CGMP). The CGMP requirements for medical devices (21 CFR Part 820) were first authorised by Section 520(f) of the Federal Food, Drug, and Cosmetic Act in July 1978 and became effective in December 1978 under 21 CFR Part 820.

In October 1996, the FDA significantly revised Part 820 by means of a final rule, which introduced the Quality System Regulation (QSR). The QSR included requirements for the methods, facilities and controls used in the design, manufacture, packaging, labeling, storage, installation and service of devices for human use. These requirements have proven to be effective in ensuring that devices are safe, effective and in general compliant with the FD&C Act. The FDA has not made any significant changes to Part 820 since the 1996 Final Rule. Also in 1996, the International Standards Organisation published the first version of ISO 13485, “Quality Systems-Medical Devices-Particular Requirements for the Application of ISO 9001” as a voluntary consensus standard that, in conjunction with the application of ISO 9001, specified the QMS requirements for the design and development and, where applicable, the installation and servicing of medical devices. Over time, ISO 13485 has developed into an independent standard that describes the QMS requirements for medical devices and has separated itself from ISO 9001.

With each version, the requirements of ISO 13485 have become more closely aligned with the requirements of the FDA QSR. This alignment has been particularly true since the publication of the ISO 13485 version in 2016. Considering this development, the FDA now saw an opportunity to harmonise the regulations by amending Part 820 to incorporate the QMS requirements of ISO 13485 by reference. This step will replace the Quality Systems Regulation with the new Quality Management System Regulation (QMSR).

This harmonisation offers hope of relief for international manufacturers, as ISO 13485 is used by many regulatory authorities as the basis for implementing QMS requirements. Harmonisation programmes such as the Medical Device Single Audit Program (MDSAP), where the FDA participates together with regulatory authorities from four other countries, are also based centrally on ISO 13485.

Proposed Rule and Final Rule for the transition to the QMSR

In February 2022, the FDA published the proposed rule to amend 21 CFR Part 820. The FDA proposed to incorporate the provisions of the international standard for quality management systems for medical devices, ISO 13485:2016, by reference into Part 820. Thus, the following sections should be added to align Part 820 with ISO 13485:

Two years later, on 2 February 2024, the FDA published a final rule amending the CGMP requirements of Part 820 by incorporating the ISO 13485:2016 edition by reference. The final rule remained largely identical to the 2022 proposal except for minor changes. For example, the proposal included a shorter transition period, but the final rule provides for a two-year transition period beginning on the date of publication in the Federal Register.

Thus, the deadline for implementing the QMSR regulated in 21 CFR Part 820 is 2 February 2026.

As already known from the implementation of the European ISO 13485 with regard to the MDR/IVDR or within the framework of the MDSAP, the sole application of ISO 13485 is usually not sufficient to fulfil all country-specific requirements for a QM system. This is also the case with the QMSR. Compliance with ISO 13485 alone will not be sufficient to fulfil the QMSR. With the inclusion or referencing of ISO 13485 in Part 820, the requirements of ISO 13485 become the basic requirements of CGMPs for medical devices. As part of the QMSR, further requirements have been added that product manufacturers must fulfil in addition to the requirements specified in ISO 13485. And even this section itself (820.10(b)), which requires manufacturers to identify all applicable regulatory requirements, is novel and has resulted in a lot of feedback to the FDA. Any additional requirements are intended to help manufacturers to meet the requirements of the FD&C Act or other FDA regulations. In principle, the FDA also recognises that manufacturers are responsible for complying with all applicable regulatory requirements, in this example the FD&C Act and its implementing regulations, and that any lists such as those included by the FDA in the Proposed Rule are only exemplary, but not exhaustive. This view should have been familiar to manufacturers in Europe for some time.

Practical implementation

Both the Proposed and the Final Rule clearly show that the amendments to Part 820 are not intended to change the FDA’s existing way of thinking or to fundamentally reorganise the QA requirements, but rather to bring the aspects that prevail in both sets of regulations to a common denominator. Similar to Article 10 of the MDR or IVDR in Europe, Part 820 remains the leading standard and ISO 13485 is used to implement these requirements. Gaps or discrepancies are specifically explained in Part 820. Also, a revision of ISO 13485 does not automatically mean that it would then be accepted by the FDA. The FDA clarifies: 

FDA is proposing to incorporate by reference the current 2016 version of ISO 13485. Any future revisions to this standard would need to be evaluated to determine the impact of the changes and whether this rule, if finalised, should be amended. If deemed necessary and appropriate, FDA will update the final regulation in accordance with the Administrative Procedure Act (5 U.S.C. 553) and obtain approval of any changes to the incorporation by reference in accordance with 1 CFR part 51.

The draft also contains a high-level overview of which parts of Part 820 correlate with the requirements of ISO 13485 in terms of content, as well as an indication of the extent to which they predominantly correspond or deviate from each other.

Table 1FDA High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

Current part 820

ISO 13485 requirements

Proposed rule

Subpart A-General Provisions

Clause 1 Scope, Clause 4 Quality Management System

Requirements substantively similar

Subpart B-QS Requirements

Clause 4 Quality Management System, Clause 5 Management Responsibility, Clause 6 Resource Management, Clause 8 Measurement, Analysis, and Improvement

Requirements substantively similar

Subpart C-Design Controls

Clause 7 Product Realization

Requirements substantively similar

Subpart D-Document Controls

Clause 4 Quality Management System

Differences addressed in 820.35.

Subpart E-Purchasing Controls

Clause 7 Product Realization

Requirements substantively similar

Subpart F-Identification and Traceability

Clause 7 Product Realization

Requirements substantively similar

Subpart G-Production and Process Controls

Clause 4 Quality Management System, Clause 6 Resource Management, Clause 7 Product Realization

Requirements substantively similar

Subpart H-Acceptance Activities

Clause 7 Product Realisation, Clause 8 Measurement, Analysis, and Improvement

Requirements substantively similar

Subpart I-Nonconforming Product

Clause 8 Measurement, Analysis, and Improvement

Requirements substantively similar

Subpart J-Corrective and Preventive Action

Clause 8 Measurement, Analysis, and Improvement

Requirements substantively similar

Subpart K-Labeling and Packaging Control

Clause 7 Product Realization

Differences addressed in 820.45.

Subpart L-Handling, Storage, Distribution, and Installation

Clause 7 Product Realization

Requirements substantively similar

Subpart M-Records

Clause 4 Quality Management System

Differences addressed in 820.35.

Subpart N-Servicing

Clause 7 Product Realization

Differences addressed in 820.35.

Subpart O-Statistical Techniques

Clause 7 Product Realization, Clause 8 Measurement, Analysis, and Improvement

Requirements substantively similar

An important deviation of the QMSR from ISO 13485:2016 are the definitions and terminology. For example, the terms defined in ISO 13485 are not adopted in Part 820; instead, the definitions set out in Section 201 of the FD&C Act (21 U.S.C. 321) apply. Important deviations that reflect a fundamentally different understanding than in Europe are

  • “Device” – i.e. the medical device or product/device
  • “Finished device” – i.e. the finished / ready-to-use product
  • “Labeling” – i.e. labelling / marking
  • “Manufacturer” – i.e. the manufacturer of the product

This aspect must be taken into account when implementing a QM system that is structured in accordance with ISO 13485 and is to apply to both the US market and Europe.

DHF, DMR and DHR – also in the future?

Probably the biggest upheaval will be triggered by the cancellation of the “Device Master Record” on the part of the FDA and in Part 820. The triumvirate of DHF, DMR and DHR form the basis for many documentation concepts, especially in companies that are FDA-orientated or had already established QM systems long before the establishment of ISO 13485 and were based on Part 820.

However, anyone who has dealt intensively with the implementation of MDR Annex II within a QMS in accordance with ISO 13485 may have already recognised this point in the last 7 years: Annex II of the MDR and ISO 13485 contain all the requirements for the technical documentation that are also called for by the DHF, DMR and DHR.

The FDA comments as follows:

[…] we believe the elements that comprise those records are largely required to be documented by ISO 13485, including Clause 4.2 and its subclauses, and Clause 7 and its subclauses. For example, many of the requirements previously in the DHR are largely required to be in the medical device or batch record, as described in Clause 7.5.1.

Similarly, consistent with the former DHF, Clause 7.3.10 requires the design and development file […].

Clause 4.2.3 requires that the MDF will contain or reference the procedures and specifications that are current on the manufacturing floor. The final design output from the design phase, […] forms the basis or starting point for the MDF. Previously, product specifications, procedures for manufacturing, measuring, monitoring, and servicing, and requirements for installation were included in a manufacturer’s DMR and will now be located in the manufacturer’s MDF.

The recordkeeping requirements in ISO 13485 are substantially similar to those in the QS regulation […]

FDA disagrees that compliance with the concept of a MDF in the QMSR will be overly burdensome as we expect the burden to be similar to requirements associated with record types in the QS regulation […]

 Therefore, there is a lot to do when it comes to reformulating existing QM systems if they are to comply with both ISO 13485 and Part 820 of the FDA. However, there are also opportunities to harmonize structures that were previously often conceived in parallel and to streamline these processes.

The future of the MDSAP

Another question with a view to the future could arise in relation to the Medical Device Single Audit Program (MDSAP), which has been designed by the IMDRF in 2012, having the FDA as a participant from the outset.

The recitals for the adaptation of Part 820 indicate that it was the MDSAP that led the FDA to recognise that ISO 13485 provides a comprehensive and effective approach to establishing a QMS for medical devices.

However, it is not expected that FDA will recognise MDSAP certificates instead of an inspection or end its participation in the MDSAP due to the alignment. The FDA clarifies that participation in the MDSAP is voluntary for manufacturers with regard to the FDA requirements under Part 820, and that the associated FDA certificates provide additional support for the regulatory monitoring of manufacturers. In particular, as other parts of Code 21 CFR are not necessarily audited, such as correct reporting in accordance with Part 803 or UDI labelling in accordance with Part 830, the FDA will continue to carry out inspections in the future. Then also with reference to ISO 13485.

Have you previously shied away from Part 820 or MDSAP, but would like to make your product fit for the US market? Or are your processes for DHF, DMR and DHR a bit outdated, and ready for an update? Feel free to contact us. We will work with you to develop a suitable solution for implementing several catalogues of requirements in a quality management system.

Please note that all details and listings do not claim to be complete, are without guarantee and are for information purposes only.