Here's the misconception tripping up quality teams right now: QMSR is not "ISO 13485 certification with an FDA stamp on it." Having a current ISO 13485 certificate does not guarantee you meet every FDA-specific requirement still baked into Part 820.
This article breaks down how ISO 13485, the former QSR, and the current QMSR actually relate. We'll cover what changed in practice, which FDA-specific requirements survived the merger, and a step-by-step approach for aligning your procedures, records, training, and audit evidence.
Key Takeaways
- QMSR is the current FDA regulation; ISO 13485:2016 is the standard it incorporates by reference
- Many requirements overlap, but FDA-specific definitions, records, and labeling rules still need separate review
- A documented crosswalk and gap assessment beats assuming your existing certificate covers everything
- Alignment requires working evidence: controlled procedures, trained staff, functioning CAPA, and retrievable records
ISO 13485 vs FDA QSR vs QMSR: How the Frameworks Relate
Three terms, three distinct things. Here's the plain-language version:
- ISO 13485:2016 is the international quality management standard for organizations across the medical device lifecycle, from design through servicing.
- The former FDA QSR was the United States-specific quality system regulation, built independently in Part 820 with its own terminology (device master record, design history file, and so on).
- QMSR is the amended Part 820 that keeps its regulatory structure but now incorporates ISO 13485:2016 for the core quality system requirements, layering FDA-specific provisions on top.
Why FDA Harmonized the Requirements
FDA determined that the legacy QSR and ISO 13485 were, taken as a whole, substantially similar. Rather than maintain two parallel systems, the agency folded one into the other to cut duplication and align with international regulators, according to the final rule.
When FDA requirements and ISO 13485 clauses differ, the FDA regulation and applicable US statutory obligations control. That's not a technicality worth skipping. It's the basis for how inspectors will evaluate you.
Certification Versus Compliance: Why They're Not the Same
This distinction is critical:
- FDA does not require manufacturers to hold ISO 13485 certification to satisfy QMSR
- FDA does not issue ISO 13485 certificates, and it does not treat certification as an inspection exemption
- Certification may still matter commercially for international markets, MDSAP participation, or customer contracts
Think of the practical relationship as an ISO 13485 foundation with an FDA-specific overlay on top. Confirm current wording against the eCFR and FDA's published materials before finalizing internal documentation, since regulatory text gets refined over time.
What Changed Under the QMSR?
The biggest shift isn't new requirements. It's reorganization. Many provisions formerly spelled out directly in Part 820 now point to ISO 13485 clauses instead. A shorter regulation doesn't mean fewer controls.
Same Controls, Different Names
FDA eliminated the separate requirements for device master records (DMR), device history records (DHR), and design history files (DHF) because their core elements now live inside ISO 13485 concepts:
| Legacy QSR term | ISO 13485 equivalent | What it contains |
|---|---|---|
| Device Master Record | Medical device file (Clause 4.2.3) | Current manufacturing procedures and specs |
| Device History Record | Batch/device record (Clause 7.5.1) | Production evidence per unit or batch |
| Design History File | Design and development file (Clause 7.3.10) | Records proving design control compliance |
Don't delete or weaken existing files just because the legacy label disappeared. The underlying evidence still has to exist, and inspectors will still expect to find it, whatever you call the folder.
FDA-Specific Provisions That Didn't Go Away
Several sections remain distinctly FDA, layered on top of the incorporated ISO text:
- Section 820.3: FDA-specific definitions (batch/lot, finished device, remanufacturer) override or supplement ISO 9000 terms
- Section 820.35: Adds complaint records, servicing records, device identification, and confidentiality provisions beyond what ISO 13485 requires
- Section 820.45: Adds documented labeling/packaging procedures, inspection requirements, and mix-up prevention controls
Design and development requirements under ISO 13485 Clause 7.3 apply to Class II and III devices, plus a short, specific list of Class I devices (software-automated devices, certain surgical gloves, radionuclide applicators, among others).
Risk Management and What Replaced QSIT
QMSR weaves risk-based thinking throughout the quality system, but it does not incorporate ISO 14971 directly. FDA references it as a useful approach to risk management, not a mandatory incorporated standard.
UDI, medical device reporting, corrections and removals, and traceability obligations all remain active alongside the QMSR, connected through specific cross-references in Section 820.10.
On the inspection side, FDA retired the Quality System Inspection Technique (QSIT) and moved to Compliance Program 7382.850. The program is organized around six QMS areas, including design and development, management oversight, and change control.
Inspection scope also tightened in two practical ways:
- Management review, quality audit, and supplier audit reports are now inspectable (a change from the prior exception)
- ISO 13485 certification does not reduce FDA inspection scope or frequency
How to Align Your QMS with the QMSR
Alignment isn't a find-and-replace exercise on your quality manual. It's a six-step process.
- Establish scope. Identify which devices, facilities, outsourced processes, and FDA obligations (design controls, servicing, traceability, combination products) actually apply to your organization.
- Build a controlled crosswalk. Map legacy QSR subparts and your internal procedures to the relevant ISO 13485 clauses and current QMSR sections, citing primary FDA sources rather than secondhand comparison charts.
- Document a gap assessment. Review management responsibility, CAPA, complaints, supplier controls, internal audits, labeling, and post-market processes. Prioritize gaps by patient risk and inspection exposure.
- Update controlled documents. Revise quality agreements, supplier requirements, training materials, and audit checklists, while preserving historical QSR references needed for prior records or investigations.
- Verify records and evidence. Sample complaint, CAPA, design, and labeling records. Confirm an inspector could retrieve and explain each one without relying on an employee's memory.
- Train, audit, and sustain it. Train staff on changed terminology and FDA-specific overlays, not just awareness slides. Run an internal audit against both ISO 13485 and QMSR-specific provisions, then use management review to track unresolved gaps.
This is where tooling earns its keep. QMS Learning's QMS Workbench generates gap analyses, drafts design history file entries, and produces SOPs and nonconformity reports scoped to the standard you're auditing against. That cuts the manual mapping work in steps two and three.
The Medical Device & Life Sciences pathway (covering ISO 13485, FDA 21 CFR Part 820, and ISO 14971) opens for pilot in Q3 2026, so confirm availability before building a training plan around it. Treat any training resource as support for your transition, not a substitute for a documented regulatory assessment or legal review.
What QMSR Means for Audits, Certification, and Inspection Readiness
Three different evaluations, three different purposes:
| Evaluation type | Conducted by | What it checks |
|---|---|---|
| ISO 13485 certification audit | Accredited registrar | Conformance to the ISO standard |
| FDA inspection | FDA investigators | Compliance with QMSR and related FDA regulations |
| Internal QMS audit | Your own team | Both standards, plus operational effectiveness |
Being audit-ready means more than updated documents. You need objective evidence:
- Current procedures
- Training completion records
- Effective CAPA closures
- Complaint and servicing files
- Documented management review
Here's where teams get caught out. A revised labeling procedure might look perfect on paper, but if batch records still reference the old version, training completion isn't logged, or release checks don't reflect the update, the procedure is effectively meaningless to an inspector. Effectiveness, not existence, is what gets evaluated.
According to FDA's QMSR FAQ, management review, quality audit, and supplier audit reports are now part of what investigators can review. Gaps between documented procedures and actual practice are more visible than before.
QMS Learning's Audit-Evidence Package exports training records, completed scenarios, and time-stamped activity into a single PDF, which helps close that paper-versus-practice gap when an inspector or registrar asks for proof.
Common QMSR Transition Mistakes to Avoid
Watch for these five errors as you move through your transition:
- Assuming certification equals compliance. An ISO 13485 certificate doesn't guarantee QMSR compliance, and FDA doesn't issue certificates after an inspection.
- Deleting DHF, DMR, or DHR controls outright. Map them to the applicable ISO 13485 records instead of discarding them because the terminology changed.
- Updating citations but not operations. A revised quality manual means nothing if training records, forms, and supplier agreements still reference outdated procedures.
- Dropping FDA-specific requirements. Complaints, servicing, UDI, traceability, MDR, and labeling/packaging controls stay active regardless of how much ISO 13485 overlaps.
- Treating this as a one-time project. Build recurring internal audits, regulatory monitoring, and management review into your ongoing QMS, not a single transition sprint.
Frequently Asked Questions
What is the FDA Quality Management System Regulation (QMSR)?
QMSR is FDA's quality system regulation in 21 CFR Part 820. It incorporates ISO 13485:2016 by reference with FDA-specific provisions and took effect February 2, 2026, replacing the former QSR. See FDA's QMSR overview.
What are the main differences between ISO 9001 and ISO 13485?
ISO 9001 is a general quality standard for any industry. ISO 13485 is medical-device-specific, with stronger requirements for regulatory compliance, risk management, and product safety documentation. ISO 9001 alone does not satisfy QMSR.
Which clause of ISO 13485 can be excluded?
Exclusions depend on your organization's activities and must be documented and justified. Review the standard's scope and your regulatory context before excluding any clause, especially design and development.
What are Class I, Class II, and Class III medical devices?
FDA classifies devices by risk and required controls. Class I has the lightest controls, Class II needs special controls, and Class III (highest risk) typically requires premarket approval. Check FDA's classification database for device-specific determinations.