What changed on February 2, 2026
QSR 21 CFR 820 is no longer the regulation many medical device teams knew under the former Quality System Regulation. As of February 2, 2026, FDA’s revised 21 CFR Part 820 is titled the Quality Management System Regulation, or QMSR. The central change is the incorporation by reference of ISO 13485:2016 as the core quality management system framework. At the same time, FDA retained U.S.-specific requirements for areas such as UDI, complaints, reporting, traceability, records, labeling, packaging, and enforcement.
For manufacturers, this is not just a renumbering exercise. The practical compliance task is to show that an ISO 13485-based system also meets the additional FDA requirements that remain in Part 820 and related medical device regulations.
FDA issued the final rule on January 31, 2024. It was published in the Federal Register on February 2, 2024, with a two-year implementation period. The effective date also matters because FDA changed its inspection approach on February 2, 2026. The former Quality System Inspection Technique, commonly called QSIT, is no longer the inspection model for device inspections. FDA now uses the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850, which organizes inspections around risk, quality management system areas, and other applicable FDA requirements.
For more regulatory explainers and updates, see the Regulatory section.
What 21 CFR Part 820 requires now
The current Part 820 is much shorter than the former QSR as printed in the CFR, but the regulatory burden did not disappear. The structure changed because many detailed quality system requirements now come through ISO 13485:2016, incorporated by reference through 21 CFR 820.7, together with FDA-specific provisions in Part 820 and other device regulations.
The current Part 820 framework includes general provisions, definitions, incorporation by reference, QMS requirements, and supplemental provisions for records and labeling or packaging controls. Many former subparts are now reserved. That structural change can mislead teams if they only compare section headings. A better approach is to map the quality system by process: design and development, production and service provision, supplier controls, complaint handling, CAPA, risk management, traceability, labeling, packaging, records, and reporting.
| Current Part 820 area | Practical meaning for manufacturers |
|---|---|
| 820.1 Scope | Applies to finished devices intended for human use, including design, manufacture, packaging, labeling, storage, installation, and servicing activities. |
| 820.3 Definitions | Uses ISO 13485 and ISO 9000 terminology, with FDA definitions and FD&C Act definitions controlling where applicable. |
| 820.7 Incorporation by reference | Brings ISO 13485:2016 and ISO 9000:2015 Clause 3 into the Part 820 framework. |
| 820.10 QMS requirements | Requires a documented QMS that complies with applicable ISO 13485 requirements and additional FDA requirements. |
| 820.35 Control of records | Adds FDA-specific record requirements for complaints, servicing activities, UDI, and confidentiality marking. |
| 820.45 Labeling and packaging controls | Requires documented procedures to protect labeling and packaging integrity, accuracy, storage, inspection, and mix-up prevention. |
Part 820 applies to finished device manufacturers. It also covers functions such as contract sterilization, installation, relabeling, remanufacturing, repacking, specification development, and initial distributors of foreign entities performing those functions. Manufacturers of components or parts are not directly subject to Part 820 as component manufacturers, although FDA encourages them to consider the regulation as appropriate. For imported devices, failure to meet applicable requirements can support refusal of admission if the device appears adulterated under the FD&C Act.
The ISO 13485 connection does not remove FDA-specific obligations
The QMSR aligns U.S. medical device quality system rules more closely with an international quality management system standard, but it does not turn U.S. compliance into ordinary ISO certification. FDA remains the regulator, the FD&C Act remains controlling, and several U.S.-specific rules continue to apply through cross-references in 21 CFR 820.10.
For example, Part 820.10 links ISO 13485 requirements to FDA rules on unique device identification, medical device tracking, Medical Device Reporting, and reports of corrections and removals. In practice, a manufacturer’s QMS must show how the organization handles:
- UDI assignment and documentation under Part 830 where applicable.
- Traceability procedures under Part 821 where medical device tracking requirements apply.
- Complaint evaluation and Medical Device Reporting decisions under Part 803.
- Advisory notices, corrections, and removals under Part 806.
- Design and development controls under ISO 13485 Clause 7.3 for Class II, Class III, and specified Class I devices.
Design and development deserves close attention. The revised Part 820 requires manufacturers of Class II and Class III devices, plus certain Class I devices, to comply with ISO 13485 design and development requirements. The listed Class I category includes devices automated with computer software, as well as specific devices identified in the regulation, such as non-powdered surgeon’s gloves and certain radionuclide devices. Teams that historically relied on the old design history file vocabulary should map their design procedures and records to ISO 13485 requirements for design and development planning, inputs, outputs, review, verification, validation, transfer, changes, and design and development files.
Records, complaints, servicing, UDI, labeling, and packaging are key FDA add-ons
A common mistake is to assume that an ISO 13485 clause map is enough. The QMSR adds targeted U.S. record and labeling controls that should be visible in procedures, forms, electronic systems, training records, and inspection responses.
Complaint records
Under 21 CFR 820.35, manufacturers must maintain records of the review, evaluation, and investigation of complaints involving possible failure of a device, labeling, or packaging to meet specifications. If a similar complaint has already been investigated, the manufacturer does not have to repeat the investigation, but it must document the justification. For reportable complaints and investigated complaints, records need to capture core details such as the device name, date received, device identifiers, complainant information, complaint details, corrective action or correction taken, and any reply to the complainant.
Servicing records and UDI
For servicing activities, records must include information such as the device serviced, device identifiers, service date, who performed the service, what service was performed, and test or inspection data. UDI information must also be recorded for each medical device or batch of medical devices where applicable. During inspection, this can make the link between field performance, complaint handling, traceability, and product risk easier for FDA to follow.
Labeling and packaging controls
Part 820.45 requires documented procedures that protect labeling and packaging integrity through processing, storage, handling, distribution, and use where appropriate. Before release or storage, labeling and packaging must be examined for accuracy where applicable, including device identifiers, expiration date, storage instructions, handling instructions, and additional processing instructions. Procedures also must prevent mix-ups and document labeling inspection results. See also: Implants.
How FDA inspections changed after QSIT
The inspection shift may be the most operationally important change for quality and regulatory teams. FDA’s updated Compliance Program 7382.850 uses a risk-based inspection strategy. Instead of following the former QSIT subsystems in the same way, investigators evaluate how the manufacturer identifies and controls risks that could affect patients or users.
The compliance program organizes QMSR inspection coverage into six QMS areas and four other applicable FDA requirements. This structure gives manufacturers a practical way to test inspection readiness.
| Inspection category | Areas FDA may evaluate |
|---|---|
| QMS areas | Change control; design and development; management oversight; measurement, analysis, and improvement; outsourcing and purchasing; production and service provision. |
| Other applicable FDA requirements | Medical Device Reporting; reports of corrections and removals; medical device tracking requirements; unique device identification. |
FDA’s compliance program states that investigators review risk management documentation throughout the inspection to understand product risks and related controls. Sources of risk information may include MDRs, reports of corrections and removals, GUDID device identifier records, consumer complaints, total product lifecycle information, facility walkthroughs, postmarket surveillance, feedback, servicing data, monitoring and measurement results, and process or product trends.
This means a strong inspection file is not just a binder of procedures. It is an evidence trail showing how risk information moves through the QMS. A complaint trend, for example, should connect to evaluation, investigation, MDR decision-making, CAPA where needed, supplier controls if a purchased product is involved, production controls if the issue relates to process performance, and design change controls if the root cause points back to design.
A practical QMSR transition checklist
For organizations that still use legacy QSR terminology, the first step is not necessarily to rename everything. The higher-value work is to confirm that each procedure, record type, software workflow, and assigned responsibility supports the current QMSR and ISO 13485-based structure.
- Confirm applicability. Identify which sites, activities, devices, accessories, imported products, and outsourced processes fall within Part 820.
- Map the QMS to ISO 13485 and FDA additions. Include Part 803, Part 806, Part 821, Part 830, 820.35, and 820.45 where relevant.
- Review design control coverage. Check Class II, Class III, and affected Class I devices, including software-automated Class I devices.
- Update complaint and servicing records. Make sure required fields are present in forms and electronic systems.
- Check UDI links. Confirm that UDI is assigned, recorded, and connected to labeling, packaging, traceability, complaints, servicing, and GUDID submissions where applicable.
- Strengthen supplier and outsourcing controls. FDA’s inspection model includes outsourcing and purchasing as a QMS area, so supplier risk should be documented and monitored.
- Prepare a risk-based inspection narrative. Be able to explain how risk management, feedback, complaints, nonconforming product, CAPA, change control, and management review interact.
- Do not rely only on an ISO certificate. Certification can support quality discipline, but QMSR compliance requires meeting FDA-specific requirements and applicable U.S. regulations.
Manufacturers with CGMP exemptions should also be careful. FDA materials explain that an exemption from CGMP requirements does not necessarily eliminate complaint file duties or general record requirements under 21 CFR 820.35. Devices manufactured under an investigational device exemption are also not exempt from applicable design and development requirements.
Frequently asked questions
Is 21 CFR Part 820 still called the QSR?
In everyday industry language, many people still say QSR when referring to FDA device quality system rules. Legally, however, revised 21 CFR Part 820 is now titled the Quality Management System Regulation, or QMSR, effective February 2, 2026.
Does ISO 13485 certification prove QMSR compliance?
No. ISO 13485 certification may be useful evidence of a quality management system, but QMSR compliance also depends on FDA-specific requirements, device-specific applicability, U.S. reporting rules, UDI obligations, records, labeling and packaging controls, and FDA’s interpretation under the FD&C Act.
What happened to QSIT inspections?
FDA stopped using QSIT for device inspections on February 2, 2026. The agency now uses the updated medical device manufacturer compliance program, CP 7382.850, which applies a risk-based inspection process aligned with QMSR.
Do old QSR records created before February 2, 2026 still matter?
Yes. FDA has stated that investigators may review records that are part of the manufacturer’s QMS, including records created before the QMSR effective date, to help determine compliance. Companies should retain and explain legacy records in a way that connects them to the current QMS framework.
What should manufacturers prioritize now?
The priority is to demonstrate a coherent, risk-based QMS. That means mapping procedures to ISO 13485 and FDA additions, confirming design and development applicability, tightening complaint and servicing records, validating UDI and traceability links, and preparing management to explain how the system protects patients and users throughout the product lifecycle.