Part 820 – the FDA is changing its QM requirements as of 2026

The FDA is moving from its QSR via referencing ISO 13485 to the new QMSR. The DMR is being replaced by the MDF, the concept is becoming more international. Find out what manufacturers should implement as of February 2026

Current QMS requirements in the USA – what is required?

A quality management system (QMS) for medical devices comprises a large number of crucial elements, including

• Design and development,
• Manufacture,
• Supplier management,
• Risk assessment,
• Complaint handling,
• Evaluation of clinical data,
• Storage,
• Distribution,
• Product labeling

and various other aspects, all aimed at ensuring user and patient safety and minimising the potential risks of medical devices.

The implementation of legal requirements depends on the characteristics, specifications and classification of the respective product in order to guarantee and produce reliable and safe products. The quality systems for FDA-regulated products (food, drugs, biologics and medical devices) have a long history and are known as Current Good Manufacturing Practices (CGMP). The CGMP requirements for medical devices (21 CFR Part 820) were first authorised by Section 520(f) of the Federal Food, Drug, and Cosmetic Act in July 1978 and became effective in December 1978 under 21 CFR Part 820.

In October 1996, the FDA significantly revised Part 820 by means of a final rule, which introduced the Quality System Regulation (QSR). The QSR included requirements for the methods, facilities and controls used in the design, manufacture, packaging, labeling, storage, installation and service of devices for human use. These requirements have proven to be effective in ensuring that devices are safe, effective and in general compliant with the FD&C Act. The FDA has not made any significant changes to Part 820 since the 1996 Final Rule. Also in 1996, the International Standards Organisation published the first version of ISO 13485, “Quality Systems-Medical Devices-Particular Requirements for the Application of ISO 9001” as a voluntary consensus standard that, in conjunction with the application of ISO 9001, specified the QMS requirements for the design and development and, where applicable, the installation and servicing of medical devices. Over time, ISO 13485 has developed into an independent standard that describes the QMS requirements for medical devices and has separated itself from ISO 9001.

With each version, the requirements of ISO 13485 have become more closely aligned with the requirements of the FDA QSR. This alignment has been particularly true since the publication of the ISO 13485 version in 2016. Considering this development, the FDA now saw an opportunity to harmonise the regulations by amending Part 820 to incorporate the QMS requirements of ISO 13485 by reference. This step will replace the Quality Systems Regulation with the new Quality Management System Regulation (QMSR).

This harmonisation offers hope of relief for international manufacturers, as ISO 13485 is used by many regulatory authorities as the basis for implementing QMS requirements. Harmonisation programmes such as the Medical Device Single Audit Program (MDSAP), where the FDA participates together with regulatory authorities from four other countries, are also based centrally on ISO 13485.

Proposed Rule and Final Rule for the transition to the QMSR

In February 2022, the FDA published the proposed rule to amend 21 CFR Part 820. The FDA proposed to incorporate the provisions of the international standard for quality management systems for medical devices, ISO 13485:2016, by reference into Part 820. Thus, the following sections should be added to align Part 820 with ISO 13485:

• Section 820.7 – Incorporation by reference
• Section 820.10 – Requirements for a quality management system
• Section 820.15 – Clarification of concepts
• Section 820.35 – Control of records
• Section 820.45 – Device labeling and packaging

Two years later, on 2 February 2024, the FDA published a final rule amending the CGMP requirements of Part 820 by incorporating the ISO 13485:2016 edition by reference. The final rule remained largely identical to the 2022 proposal except for minor changes. For example, the proposal included a shorter transition period, but the final rule provides for a two-year transition period beginning on the date of publication in the Federal Register.

Thus, the deadline for implementing the QMSR regulated in 21 CFR Part 820 is 2 February 2026.

As already known from the implementation of the European ISO 13485 with regard to the MDR/IVDR or within the framework of the MDSAP, the sole application of ISO 13485 is usually not sufficient to fulfil all country-specific requirements for a QM system. This is also the case with the QMSR. Compliance with ISO 13485 alone will not be sufficient to fulfil the QMSR. With the inclusion or referencing of ISO 13485 in Part 820, the requirements of ISO 13485 become the basic requirements of CGMPs for medical devices. As part of the QMSR, further requirements have been added that product manufacturers must fulfil in addition to the requirements specified in ISO 13485. And even this section itself (820.10(b)), which requires manufacturers to identify all applicable regulatory requirements, is novel and has resulted in a lot of feedback to the FDA. Any additional requirements are intended to help manufacturers to meet the requirements of the FD&C Act or other FDA regulations. In principle, the FDA also recognises that manufacturers are responsible for complying with all applicable regulatory requirements, in this example the FD&C Act and its implementing regulations, and that any lists such as those included by the FDA in the Proposed Rule are only exemplary, but not exhaustive. This view should have been familiar to manufacturers in Europe for some time.

Practical implementation

Both the Proposed and the Final Rule clearly show that the amendments to Part 820 are not intended to change the FDA’s existing way of thinking or to fundamentally reorganise the QA requirements, but rather to bring the aspects that prevail in both sets of regulations to a common denominator. Similar to Article 10 of the MDR or IVDR in Europe, Part 820 remains the leading standard and ISO 13485 is used to implement these requirements. Gaps or discrepancies are specifically explained in Part 820. Also, a revision of ISO 13485 does not automatically mean that it would then be accepted by the FDA. The FDA clarifies: 

The draft also contains a high-level overview of which parts of Part 820 correlate with the requirements of ISO 13485 in terms of content, as well as an indication of the extent to which they predominantly correspond or deviate from each other.

Table 1FDA High-Level Summary of 21 CFR Part 820 Proposed Rule Differences and Additions

An important deviation of the QMSR from ISO 13485:2016 are the definitions and terminology. For example, the terms defined in ISO 13485 are not adopted in Part 820; instead, the definitions set out in Section 201 of the FD&C Act (21 U.S.C. 321) apply. Important deviations that reflect a fundamentally different understanding than in Europe are

• “Device” – i.e. the medical device or product/device
• “Finished device” – i.e. the finished / ready-to-use product
• “Labeling” – i.e. labelling / marking
• “Manufacturer” – i.e. the manufacturer of the product

This aspect must be taken into account when implementing a QM system that is structured in accordance with ISO 13485 and is to apply to both the US market and Europe.

DHF, DMR and DHR – also in the future?

Probably the biggest upheaval will be triggered by the cancellation of the “Device Master Record” on the part of the FDA and in Part 820. The triumvirate of DHF, DMR and DHR form the basis for many documentation concepts, especially in companies that are FDA-orientated or had already established QM systems long before the establishment of ISO 13485 and were based on Part 820.

However, anyone who has dealt intensively with the implementation of MDR Annex II within a QMS in accordance with ISO 13485 may have already recognised this point in the last 7 years: Annex II of the MDR and ISO 13485 contain all the requirements for the technical documentation that are also called for by the DHF, DMR and DHR.

The FDA comments as follows: