What CFR 820 means after the QMSR effective date
CFR 820 is now best read as FDA’s Quality Management System Regulation, or QMSR, rather than the former Quality System Regulation, commonly called QSR. FDA issued the final rule in January 2024, published it in the Federal Register on February 2, 2024, and set the effective date as February 2, 2026. The practical result is not a reduction in FDA oversight of device quality systems. Instead, 21 CFR Part 820 now incorporates ISO 13485:2016 as the core quality management system framework, while keeping FDA-specific requirements where U.S. law and device regulations require them.
For medical device manufacturers, the compliance question has changed. It is no longer enough to check whether a procedure cites familiar legacy sections such as 820.30, 820.100, or 820.198. The more useful question is whether the quality management system demonstrates compliance with the current QMSR, the incorporated ISO 13485 clauses, and related FDA requirements such as medical device reporting, corrections and removals, tracking, and unique device identification.
This article is intended for regulatory, quality, and operations teams reviewing U.S. device quality system obligations. For additional regulatory coverage, visit the Regulatory section.
The current structure of 21 CFR Part 820
The current Part 820 is much shorter on its face than the former QSR. That shorter text can be misleading because many operative requirements now enter through incorporation by reference. The CFR does not reproduce every ISO 13485 requirement inside Part 820, but the incorporated clauses are part of the compliance framework for manufacturers subject to the regulation.
| Current section | Main function | Practical significance |
|---|---|---|
| 820.1 | Scope | Defines applicability to finished device manufacturers and clarifies that FDA law controls if there is a conflict with ISO 13485. |
| 820.3 | Definitions | Applies relevant FD&C Act definitions and adds QMSR-specific terms such as manufacturer, organization, rework, and safety and performance. |
| 820.7 | Incorporation by reference | Incorporates ISO 13485:2016 and Clause 3 of ISO 9000:2015 for specified purposes. |
| 820.10 | Requirements for a quality management system | Requires manufacturers to document a QMS that complies with applicable ISO 13485 requirements and additional FDA provisions. |
| 820.35 | Control of records | Adds FDA-specific record content for complaints, servicing activities, UDI, and confidentiality marking. |
| 820.45 | Device labeling and packaging controls | Adds detailed requirements for labeling and packaging integrity, inspection, release, storage, and prevention of mixups. |
The reserved subparts are also important. Subparts C through O, which previously contained many familiar QSR provisions, are reserved under the current structure. That does not mean design controls, purchasing controls, CAPA, production controls, complaint handling, or records have disappeared. It means the regulatory architecture has changed. Teams should now trace those processes through QMSR sections, ISO 13485 clauses, and other applicable FDA regulations.
What changed from the former QSR
The most visible change is terminology. FDA renamed the rule from the Quality System Regulation to the Quality Management System Regulation. The change aligns the rule more closely with global quality management system language, but it does not turn U.S. device compliance into a private certification exercise.
The second major change is structural. The former QSR set out detailed requirements directly across Part 820. The QMSR uses ISO 13485:2016 as the primary QMS framework. FDA has said the ISO 13485 requirements, taken as a whole, are substantially similar to the former QS regulation, but the organization, wording, and emphasis are different. That matters for SOP owners because old citations may now point to sections that are reserved or reorganized.
The third change is the stronger visibility of lifecycle risk management. FDA’s final rule explains that ISO 13485 integrates risk management throughout the quality management system. This is not a new FDA concern, but the QMSR makes the lifecycle nature of risk more explicit. Regulatory and quality teams should avoid treating risk as only a design file appendix. Risk linkages should be visible in design and development, supplier controls, production and process changes, complaint evaluation, servicing trends, CAPA, and postmarket feedback.
The fourth change is the inspection approach. FDA stated that on February 2, 2026, it began using an updated medical device manufacturer inspection compliance program aligned with QMSR and stopped using the former QSIT inspection approach. This does not mean inspections became optional or identical to third-party ISO audits. It means FDA inspections are now organized around the revised regulatory framework.
Scope and applicability under the current rule
Part 820 applies to manufacturers of finished devices intended for human use. The rule covers methods, facilities, and controls used for design, manufacture, packaging, labeling, storage, installation, and servicing. It also applies to imported devices and devices offered for import into the United States. A foreign manufacturer may therefore face U.S. import consequences if a device appears adulterated because applicable quality system requirements are not met.
The rule’s treatment of components and parts is narrower. Manufacturers of components or parts of finished devices are not directly subject to Part 820 solely on that basis, although FDA encourages them to consider the regulation where appropriate. In practice, finished device manufacturers often flow down quality, traceability, and change-control obligations through supplier agreements, purchasing controls, and quality agreements. That is a commercial and regulatory control strategy, not the same as making every component supplier independently subject to the entire rule.
Some devices are exempt from most CGMP requirements through classification regulations in 21 CFR Parts 862 through 892. However, FDA states that an exemption from CGMP requirements does not exempt finished device manufacturers from complaint files and general record requirements now tied to 21 CFR 820.35. Teams working with Class I exempt devices should therefore avoid reading “exempt” as “no quality records required.”
Human cells, tissues, and cellular and tissue-based products that are regulated as devices are also addressed in the scope provision. Where tissue regulations and device regulations overlap, the more specifically applicable requirement controls. This is a narrow but important point for combination and biologically derived product strategies.
How 820.10 connects ISO 13485 to FDA requirements
Section 820.10 is the central bridge between the CFR text and the incorporated ISO standard. It requires a manufacturer subject to Part 820 to document a quality management system that complies with applicable ISO 13485 requirements and other applicable requirements in Part 820.
Section 820.10 also links specific ISO 13485 clauses to FDA device regulations. For identification, manufacturers must document a system to assign UDI in accordance with Part 830. For traceability, applicable manufacturers must document procedures consistent with Part 821. For reporting to regulatory authorities, complaints that meet medical device reporting criteria must be handled under Part 803. For advisory notices, relevant activities must align with Part 806 requirements for corrections and removals.
Design and development is another key point. Under 820.10, manufacturers of Class II and Class III devices must comply with ISO 13485 design and development requirements. Certain Class I devices also remain subject to design and development requirements, including devices automated with computer software and specific listed devices such as tracheobronchial suction catheters, non-powdered surgeon’s gloves, protective restraints, manual radionuclide applicator systems, and radionuclide teletherapy sources.
For devices that support or sustain life, where failure during proper use can reasonably be expected to result in significant injury, additional traceability obligations apply through ISO 13485 traceability requirements for implantable devices. This shows how the QMSR combines a general ISO-based structure with targeted U.S. regulatory expectations. See also: Implants.
Records, complaints, and labeling are high-value review areas
Two current sections deserve close attention because they add FDA-specific content that may not be obvious from ISO 13485 alone.
Section 820.35 requires complaint records to include specific information for complaints that must be reported to FDA, complaints that the manufacturer determines must be investigated, and complaints the manufacturer actually investigated. Required details include the device name, complaint receipt date, device identifiers such as UDI or UPC where applicable, complainant information, the nature and details of the complaint, any correction or corrective action, and any reply to the complainant. The section also covers servicing activity records, UDI records for each device or batch, and the marking of confidential records.
This matters because complaint handling often sits at the intersection of quality, postmarket surveillance, medical device reporting, corrections and removals, and CAPA. A complaint record that is complete in a customer service system may still be incomplete for QMSR purposes if it lacks regulatory evaluation, device identification, investigation rationale, correction documentation, or linkage to trend analysis.
Section 820.45 addresses labeling and packaging controls. It requires documented procedures that describe activities ensuring labeling and packaging integrity, inspection, storage, and operations under customary processing, storage, handling, distribution, and use conditions. Manufacturers must examine labeling and packaging for accuracy before release or storage where applicable, including UDI or other device identification, expiration date, storage instructions, handling instructions, and additional processing instructions. Labeling release and inspection results must be documented.
For many manufacturers, this section is a reminder that labeling control is not only a document-control issue. It is also an operational control issue involving line clearance, packaging configuration, UDI accuracy, expiration dating, storage conditions, and prevention of mixups.
Inspection readiness under QMSR
FDA has made clear that an ISO 13485 certificate does not substitute for an FDA inspection and does not exempt a manufacturer from FDA oversight. FDA inspections assess compliance with FDA regulations, including QMSR and other device requirements. Certification may still support global market access or customer expectations, but it should not be treated as proof that every FDA-specific obligation has been met.
A practical QMSR readiness review should cover three layers. First, confirm that the QMS is mapped to the current Part 820 sections and applicable ISO 13485 clauses. Second, verify that FDA-specific obligations are addressed, especially MDR, corrections and removals, device tracking, UDI, complaint records, servicing records, and labeling controls. Third, test whether records show process effectiveness, not only procedural intent.
- Update SOP references that still cite former Part 820 sections without explaining the current QMSR basis.
- Map design and development procedures to ISO 13485 requirements and 820.10 applicability rules.
- Review complaint intake forms for all data elements required by 820.35.
- Check whether complaint investigations document when a similar investigation justifies not repeating work.
- Confirm that UDI is captured at device or batch level where required.
- Verify labeling release records, packaging inspections, and mixup prevention controls under 820.45.
- Review management review and internal audit records with the understanding that FDA may inspect quality system records that were previously treated differently under the former QSR.
- Ensure supplier controls and risk management show lifecycle connections rather than isolated files.
The value for manufacturers is in the mapping exercise. A simple “QSR to QMSR” replacement in document footers is not enough. A stronger approach is to maintain a living cross-reference that identifies current CFR sections, incorporated ISO clauses, related FDA regulations, responsible process owners, required records, and inspection evidence.
Frequently asked questions
Is CFR 820 the same as ISO 13485 now?
No. CFR 820 incorporates ISO 13485:2016 by reference as the main QMS framework, but FDA-specific requirements still apply. Where ISO 13485 conflicts with the FD&C Act or FDA implementing regulations, U.S. law and FDA regulations control.
Did QMSR remove design controls?
No. The old 820.30 section is no longer the current design-control citation in the same way, but design and development requirements continue through ISO 13485 and 820.10. Class II and Class III devices, and certain Class I devices, remain subject to design and development requirements.
Does ISO 13485 certification prevent an FDA inspection?
No. FDA has stated that it will not require ISO 13485 certificates, will not issue ISO 13485 certificates, and will not treat certification as a substitute for FDA inspection. FDA inspections remain focused on compliance with FDA regulations.
What should companies review first?
Start with procedures and records that still depend on old QSR citations. Then review complaint handling, labeling and packaging controls, UDI capture, design and development applicability, and links between risk management and postmarket processes. These areas show whether the QMS has actually been updated for the QMSR structure.
Are exempt devices free from all Part 820 obligations?
Not necessarily. Some devices are exempt from most CGMP requirements through classification regulations, but FDA states that CGMP exemption does not remove complaint file and general record obligations under 820.35 for finished device manufacturers.