Guide
FDA QMSR Readiness Guide
On February 2, 2024, FDA published the Quality Management System Regulation (QMSR) Final Rule, amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. Compliance is required by February 2, 2026. FDA rewrote Part 820 almost entirely, retired long-standing QSR terminology, and embedded ISO 14971 risk management across the product lifecycle.
What the rule is, and when it hits
The Final Rule was published in the Federal Register on February 2, 2024 (89 FR 7496). Compliance is required by February 2, 2026. FDA is retiring the Quality System Inspection Technique (QSIT) and introducing a new inspection approach aligned to the ISO 13485 clause structure.
ISO 13485:2016 incorporated by reference
New 21 CFR 820.10 requires manufacturers to comply with ISO 13485:2016 Clauses 4–8. FDA-specific additions remain in Part 820 Subparts A and B — definitions, supplemental requirements for labeling and UDI, complaint handling tied to MDR, and servicing records.
Retired QSR terminology (DHR, DMR, DHF)
The Device History Record, Device Master Record, and Design History File are no longer defined in Part 820. They are subsumed into ISO 13485's broader concepts:
- Medical Device File (Clause 4.2.3) replaces the DMR.
- Records of production and service provision (Clause 7.5.1) replace the DHR.
- Design and development files (Clause 7.3.10) replace the DHF.
You can keep the legacy shorthand internally, but the documentation must satisfy the ISO 13485 structure so auditors can trace it clause-by-clause.
Risk management per ISO 14971 is now explicit
ISO 13485 requires risk-based thinking across design controls (7.3), purchasing (7.4), production (7.5), and CAPA (8.5). In the preamble, FDA clarified that risk management activities must follow ISO 14971 principles across the entire product-realization lifecycle — not just as a design-phase artifact.
Supplemental Part 820 requirements retained
§820.35 (records including complaint files and servicing), §820.45 (device labeling and UDI), and cross-references to 21 CFR Part 803 (MDR) and Part 806 (corrections and removals) remain FDA-specific obligations on top of ISO 13485.
Definitions harmonized
"Manufacturer," "rework," "validation," and "verification" are pulled from ISO 13485. FDA-specific definitions are retained for "component," "finished device," "labeling," and "remanufacturer" in the updated §820.3.
Scope your workflow
Turn this into a working system.
Bring one audit you're dreading. We'll wire it against your ERP and QMS and hand back a working version.