Introduction
For nearly three decades, medical device manufacturers built quality programs around two separate rulebooks: FDA's Quality System Regulation (21 CFR Part 820) for the US market, and ISO 13485 for international markets.
Quality teams learned both fluently, but often kept parallel documentation just to satisfy each auditor.
That separation ended on February 2, 2026, when FDA's harmonization rule folded QSR into a new Quality Management System Regulation (QMSR) built around ISO 13485:2016. Many companies still aren't clear on what actually changed versus what just got renamed.
The shift affects which markets you can sell into, how your next FDA inspection will unfold, and which records you must keep on hand. This guide breaks down both frameworks, compares them side by side, and walks through exactly what the harmonization rule changed.
Key Takeaways
- FDA retired the standalone QSR on February 2, 2026, replacing it with QMSR, which incorporates ISO 13485:2016 by reference
- ISO 13485 certification alone is not QMSR compliance — FDA neither issues nor recognizes ISO certificates
- Section 820.180(c) audit-record exemption is gone; FDA can now review internal audit and management review reports
- Multi-market manufacturers typically need both ISO 13485 certification and independent QMSR compliance
- DHF, DMR, and DHR terms are replaced by ISO-aligned medical device file and recordkeeping concepts
FDA QSR vs ISO 13485: Quick Comparison
Use this side-by-side view to see where FDA QSR/QMSR and ISO 13485 align—and where they still diverge for US device makers.
| Dimension | FDA QSR/QMSR | ISO 13485 |
|---|---|---|
| Legal status | Binding federal regulation under the FD&C Act. Noncompliance can adulterate a device and trigger enforcement. | Voluntary international standard. ISO does not mandate certification, but many regulators and customers do. |
| Structure | QMSR keeps Subpart A (General Provisions) and Subpart B (Supplemental Provisions); former Subparts C–O are removed/reserved. | Clause-based QMS covering documentation, management responsibility, resources, and product realization. |
| Market recognition | Required for US market access only. | Backbone for EU, Canada, Australia, and MDSAP countries. |
| Certification | No certificate—FDA inspects directly under its compliance program. | Third-party registrars certify after a typical 12–24 month prep timeline. |
| Risk & audit access | Full FDA access to management review, internal audit, and supplier audit records. | Risk management tied to ISO 14971; grants no government inspection rights on its own. |
Understanding the Frameworks: What is FDA QSR and What is ISO 13485?
What is FDA QSR (21 CFR Part 820)?
FDA QSR was the device-specific Current Good Manufacturing Practice regulation, codified under Section 520(f) of the FD&C Act. The rule dates to a 1996 revision and became legally binding for any company distributing devices in the US, regardless of where they were manufactured.
QSR required documented evidence across design and production. Three records were mandatory:
- Device Master Record (DMR) — how the device is built
- Design History File (DHF) — how the device was designed
- Device History Record (DHR) — proof of how a specific unit was actually manufactured
As of February 2, 2026, the standalone QSR no longer exists as separate text. If your internal procedures still reference "QSR," they're referencing a regulation that's now folded into QMSR — the underlying obligations largely carry over, but the terminology and structure have changed.
QSR historically governed the entire device lifecycle: premarket submissions like 510(k) and PMA, routine FDA inspections, and post-market surveillance for anything sold domestically.
What is ISO 13485:2016?
ISO 13485 is the process-based quality management standard for medical devices. Published by the International Organization for Standardization, it is the compliance foundation across the EU, Canada, and MDSAP countries.
Its defining features:
- Explicit risk management requirements tied to ISO 14971
- A structured, clause-based approach rather than prescriptive US-style rules
- Third-party certification that demonstrates conformity to regulators and customers globally
Unlike FDA, ISO doesn't inspect or enforce anything directly. Certification comes from accredited registrars, and that certificate, not FDA, is what regulators and customers expect in markets like the EU, Canada, and Australia. Companies pursuing multi-market registration (EU MDR, Health Canada's Medical Device Licence, Australia's TGA) rely on ISO 13485 certification as their baseline.
The QMSR: How FDA Harmonized QSR With ISO 13485
FDA published its final rule on January 31, 2024, and the Federal Register version appeared February 2, 2024. Mandatory compliance begins February 2, 2026.
The 1996 QSR had gone unchanged for nearly 30 years, while ISO 13485 is revised regularly and already anchors the international MDSAP audit program.
"Incorporation by reference" doesn't mean FDA rewrote ISO 13485 into its own words. It means the QMSR text largely points directly to ISO 13485 clauses instead of restating requirements. Practically, this means:
- DHF, DMR, and DHR terminology no longer appears in the regulation
- Their contents now map to ISO 13485's Medical Device File and design-and-development file concepts under Clauses 4.2 and 7
- Manufacturers must still track the same information — just organized under different labels
FDA requirements still layer on top of ISO 13485 in several places:
- Labeling and packaging controls under Section 820.45, covering integrity checks, storage, and release verification
- Complaint and UDI recordkeeping under Section 820.35, tied to Part 803 reportability
- FDA-specific definitions, including "safety and effectiveness," that don't exist in the ISO text
A major structural shift: the historic audit exemption under old Section 820.180(c) is gone. FDA can now inspect management review, internal audit, and supplier audit reports that were previously off-limits during routine inspections — including records created before the February 2026 cutover.
This leads to the most common misconception in the industry: ISO 13485 certification does not automatically equal QMSR compliance. FDA doesn't issue or rely on ISO certificates, and it doesn't follow the MDSAP audit plan during its own inspections.
Industry analysts at RAPS have flagged smaller, US-focused manufacturers and combination-product makers as facing the steepest transition curve—especially companies with no prior international audit experience.
FDA QSR vs ISO 13485: Which Framework Applies to You Now?
The answer depends entirely on where you sell.
- US-only manufacturers must comply with QMSR regardless of ISO status.
- Manufacturers selling internationally (EU, Canada, Australia) still need separate ISO 13485 certification alongside QMSR compliance — the two frameworks don't merge into one certificate.
Companies already ISO 13485-certified have a genuine head start. Much of the documentation infrastructure already exists. But certification alone doesn't close FDA-specific gaps around:
- Labeling and packaging release verification
- Complaint records tied to Part 803 reportability
- Audit-record accessibility now that the old inspection exemption is gone
Oceanz, a 3D-printing manufacturer of prosthetic limbs and anatomical models, faced rising demand for printed devices. The company built risk assessment, traceability, labeling, and packaging controls to align with ISO 13485 and achieved certification through LRQA.
Stronger client assurance and wider EU and international access followed, even though the case was not an FDA action. The same documentation discipline tends to strengthen every regulatory relationship a device maker holds.
QMS Learning's Medical Device & Life Sciences QMS pathway (pilot cohort opening Q3 2026) bundles ISO 13485, FDA 21 CFR Part 820, and ISO 14971 risk management into one curriculum.
It is built so quality teams can enter the next FDA inspection or registrar audit with both rulebooks already reconciled.
Conclusion
With QMSR now in effect, ISO 13485 functions as the shared foundation underneath both US and global compliance, with FDA-specific requirements layered on top. What matters next is scope: single-market coverage or multi-market reach.
Teams that understand exactly where these two frameworks overlap and diverge tend to prepare for audits faster, carry less regulatory risk, and move through multi-market registration with fewer surprises.
Frequently Asked Questions
What are the key differences between FDA QSR and ISO 13485?
FDA QSR (now QMSR) is a binding US federal regulation with FDA-specific audit-record access and recordkeeping terms. ISO 13485 is a voluntary international standard used for global market certification. QMSR now incorporates ISO 13485 but adds US-specific labeling and complaint requirements.
Does FDA recognize ISO 13485?
Yes, indirectly. QMSR incorporates ISO 13485:2016 by reference, but FDA does not issue or rely on ISO certificates for its own oversight. It still conducts independent inspections regardless of certification status.
Is 21 CFR 820 still valid?
Yes. Part 820 still exists but has been retitled the Quality Management System Regulation and restructured to incorporate ISO 13485, effective February 2, 2026.
What is the QMSR and how does it differ from the original QSR?
QMSR is FDA's harmonized regulation that incorporates ISO 13485:2016 by reference while retaining FDA-specific additions like labeling controls and complaint recordkeeping. The original QSR restated all requirements independently.
Do I need ISO 13485 certification to sell medical devices in the US?
No, certification is not legally required for US-only sales under QMSR. It becomes essential the moment you want to sell into the EU, Canada, Australia, or other MDSAP-participating markets.
When did the QMSR become mandatory, and what happens if my company isn't compliant?
QMSR is mandatory and enforceable as of February 2, 2026. Noncompliance with an applicable requirement can render a device adulterated under the FD&C Act, exposing the company to FDA enforcement action.
