ISO 13485 and 21 CFR 820 under the FDA QMSR

What changed on February 2, 2026

ISO 13485 and 21 CFR 820 are no longer two quality system references that U.S. medical device manufacturers can treat as parallel frameworks. As of February 2, 2026, FDA’s Quality Management System Regulation, or QMSR, amended 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. The practical result is not that FDA simply accepts an ISO 13485 certificate. Manufacturers subject to Part 820 must document and maintain a quality management system that meets applicable ISO 13485 requirements, the remaining FDA-specific provisions in Part 820, and other applicable FDA regulations such as UDI, medical device reporting, corrections and removals, and device tracking where relevant.

The change is best viewed as regulatory harmonization with a U.S. overlay. FDA kept Part 820 as the legally binding regulation, retitled it the Quality Management System Regulation, and used ISO 13485:2016 as the core structure for medical device quality management system expectations.

Why this is more than a simple standards comparison

Before QMSR, companies often compared ISO 13485 with the legacy Quality System Regulation clause by clause. That comparison still helps with internal gap assessments, but it is not sufficient on its own. The current U.S. rule does not reproduce the full ISO 13485 text in the Code of Federal Regulations. Instead, Part 820 incorporates the standard by reference and adds U.S.-specific provisions where FDA considered clarification or additional controls necessary.

FDA’s final rule was published in the Federal Register on February 2, 2024, with a two-year implementation period. The agency explained that the previous Quality System Regulation and ISO 13485 were substantially similar when viewed as a whole. At the same time, FDA noted that relying on ISO 13485 without clarifying U.S. requirements could create conflicts with the Federal Food, Drug, and Cosmetic Act and related FDA regulations. That is why the current Part 820 contains fewer regulatory sections, while the incorporated ISO standard supplies much of the quality system framework.

ISO 13485:2016 remains the referenced edition. ISO’s own standards information identifies the 2016 third edition as current after systematic review and confirmation in 2025. If ISO publishes a future revision, FDA has stated that it would evaluate the revision and decide whether Part 820 should be amended through the appropriate rulemaking process.

Side by side view of ISO 13485 and 21 CFR 820

Topic	ISO 13485:2016	21 CFR 820 under QMSR	Practical effect
Legal status	An international standard for medical device quality management systems.	A U.S. regulation enforced by FDA.	Conformance to the standard supports compliance, but FDA compliance is assessed against the regulation and other applicable U.S. requirements.
Core QMS structure	Provides requirements for a medical device QMS, including documentation, management responsibility, resource management, product realization, measurement, analysis, and improvement.	Incorporates ISO 13485:2016 by reference and requires a documented QMS that complies with applicable ISO 13485 requirements and Part 820 provisions.	Procedures, records, and process maps should be aligned to ISO 13485 clauses and FDA-specific requirements.
Definitions and conflicts	Uses ISO terminology and ISO 9000 vocabulary where applicable.	Applies FDA statutory and regulatory definitions where they control.	Terminology in procedures should not override U.S. legal meanings for device, manufacturer, safety and effectiveness, or related terms.
Design and development	Clause 7.3 sets requirements for design and development.	Part 820.10 requires design and development controls for class II, class III, and specified class I devices.	Legacy design control procedures should be mapped to ISO 13485 Clause 7.3 and the device classes listed in Part 820.10.
UDI, tracking, MDR, and corrections	Includes identification, traceability, reporting to regulatory authorities, and advisory notice concepts.	Links relevant ISO clauses to FDA regulations including UDI, device tracking, medical device reporting, and corrections and removals.	Companies must connect QMS procedures to the specific U.S. postmarket and identification rules that apply to their devices.
Records	Clause 4.2.5 addresses control of records.	Part 820.35 adds detailed requirements for complaint records, servicing records, UDI recording, and confidentiality marking.	Record templates may need updates even where the underlying process already existed.
Labeling and packaging	Clause 7.5.1 addresses controlled production and service provision.	Part 820.45 adds procedures for labeling and packaging integrity, inspection, storage, release, and prevention of mixups.	Labeling and packaging controls need clear documented evidence, especially for accuracy checks and release.
Certification and inspection	May be audited by third-party certification bodies.	FDA does not require or issue ISO 13485 certificates, and a certificate does not exempt a manufacturer from FDA inspection.	ISO certification can be useful evidence, but it is not a substitute for inspection readiness under FDA rules.

The Part 820 sections regulatory teams should read first

The revised Part 820 is much shorter than the legacy Quality System Regulation. That can be misleading. The shorter text does not mean FDA expectations have disappeared. Many requirements now sit in the incorporated ISO 13485 standard, while Part 820 focuses on scope, definitions, incorporation by reference, clarification of concepts, and supplemental FDA provisions.

• 820.1 Scope: Sets out the applicability of QMSR to the methods, facilities, and controls used for design, manufacture, packaging, labeling, storage, installation, and servicing of finished devices intended for human use.
• 820.3 Definitions: Establishes how definitions are applied, including the relationship between FDA law, FDA regulations, ISO 13485, and ISO 9000 terminology.
• 820.7 Incorporation by reference: Identifies ISO 13485:2016 and ISO 9000:2015 Clause 3 as incorporated material.
• 820.10 Requirements for a quality management system: Requires a documented QMS that complies with applicable ISO 13485 requirements and other applicable Part 820 provisions.
• 820.15 Clarification of concepts: Explains how certain ISO 13485 concepts apply in the FDA regulatory context.
• 820.35 Control of records: Adds FDA-specific record content for complaints, servicing, UDI, and confidentiality markings.
• 820.45 Device labeling and packaging controls: Adds detailed requirements for labeling and packaging procedures, accuracy checks, release documentation, and prevention of mixups.

For companies that still use legacy SOP references such as 820.30 for design controls or 820.100 for CAPA, the immediate task is not cosmetic renumbering. The higher-value task is to show that each legacy process remains traceable to the applicable ISO 13485 clause, the current Part 820 provision, and any related FDA regulation.

Where existing quality systems may need adjustment

Design and development coverage

Design and development is one of the most important mapping exercises. Under QMSR, manufacturers of class II and class III devices, as well as specified class I devices, must comply with ISO 13485 design and development requirements. The listed class I devices include devices automated with computer software and specific device types identified in Part 820.10. Organizations should confirm that design inputs, outputs, reviews, verification, validation, transfer, and change controls remain clearly documented under the ISO 13485 structure.

Complaint, servicing, and UDI records

Part 820.35 adds concrete content expectations for complaint records and servicing records. Complaint records should capture details such as device identification, complaint receipt date, complainant information, the nature of the complaint, corrective action taken, and any reply to the complainant where applicable. Servicing records must include information such as the device serviced, device identification, service date, personnel involved, service performed, and test or inspection data. UDI must also be recorded for each medical device or batch of medical devices where applicable.

Labeling and packaging controls

Labeling and packaging remain a high-risk area because errors can directly affect identification, expiration dating, storage instructions, handling, and safe use. Part 820.45 requires documented procedures that address integrity, inspection, storage, and operations for labeling and packaging. It also requires controls to prevent mixups and documentation of labeling release. Companies should review whether their procedures cover both the physical control of labels and the evidence needed to show that each label or package was examined before release or storage when required.

Internal audits, supplier audits, and management review reports

One notable inspection impact is FDA’s position that the QMSR does not maintain the former 820.180(c) exception for certain records. FDA’s QMSR FAQ states that, for inspections on or after February 2, 2026, investigators may review management review, quality audit, and supplier audit reports. That makes it important to keep those records accurate, complete, objective, and consistent with the company’s escalation and CAPA procedures.

Inspection impact under the QMSR

QMSR also changed the inspection context. On February 2, 2026, FDA stopped using the Quality System Inspection Technique, commonly called QSIT, for device inspections and began using the updated Inspection of Medical Device Manufacturers Compliance Program, CP 7382.850. FDA describes the updated program as aligned with QMSR and risk-based medical device inspection processes.

For manufacturers, inspection readiness should not be limited to showing a certificate or a clause map. FDA inspections assess compliance with FDA regulations. The agency has also stated that FDA inspections under QMSR will not follow the MDSAP audit plan or procedures. MDSAP can remain useful for organizations that choose to participate, but it does not replace FDA inspection authority and does not create an exemption from inspection. See also: Implants.

FDA may also review QMS records created before February 2, 2026 to help determine compliance with QMSR. That does not mean every legacy record must be rewritten. It does mean companies should be ready to explain how records created under the old QSR structure correspond to current QMSR and ISO 13485 requirements. A concise comparative analysis can reduce confusion during inspection and help staff retrieve the right evidence quickly.

A practical compliance mapping approach

A useful QMSR transition file should show more than a one-column list of old and new citations. It should explain process ownership, required records, related FDA regulations, and the evidence that demonstrates effective implementation. The following approach is practical for manufacturers, specification developers, relabelers, contract sterilizers, installers, and other entities that may be considered manufacturers under FDA rules depending on their role.

1. Build a requirements matrix. Map legacy 21 CFR 820 procedures to ISO 13485:2016 clauses, current Part 820 sections, and related FDA regulations such as Parts 803, 806, 821, 830, and applicable labeling rules.
2. Identify FDA overlays. Give priority to Part 820.10, 820.35, and 820.45 because these sections add U.S.-specific expectations to the ISO framework.
3. Update controlled procedures where substance has changed. Avoid unnecessary renaming projects, but revise procedures where references, responsibilities, record content, or regulatory triggers are outdated.
4. Train by process, not just by clause. Personnel should understand how complaint handling, CAPA, design changes, supplier controls, production controls, and postmarket reporting connect across the QMS.
5. Test record retrieval. Inspection readiness depends on whether the organization can quickly retrieve objective evidence, including older records, and explain how it meets current requirements.
6. Review supplier and outsourced process controls. ISO 13485 and FDA expectations both require control over outsourced processes that affect conformity, but evidence must be specific to the role and risk of the supplier.
7. Prepare management review and audit records carefully. Because FDA may review reports that were previously treated as exempt under the old rule, the records should be complete, professional, and consistent with follow-up actions.

Frequently asked questions

Is ISO 13485 certification now required by FDA?

No. FDA has incorporated ISO 13485:2016 into Part 820 by reference, but FDA has stated that it does not require certificates of conformance to ISO 13485 and does not issue them. A certificate may support quality system maturity, but compliance depends on meeting FDA requirements.

Does QMSR replace 21 CFR 820?

No. QMSR is the current form of 21 CFR Part 820. The regulation has been retitled and reorganized, and it incorporates ISO 13485:2016 by reference. Part 820 remains the U.S. legal requirement for covered medical device quality management systems.

Do legacy QSR records need to be rewritten?

There is no general need to rewrite historical records solely because QMSR is now effective. However, FDA may review records created before February 2, 2026. Companies should maintain a clear comparison showing how legacy records and procedures meet current QMSR requirements.

What happens if ISO 13485 is revised?

FDA has stated that it would evaluate any future ISO 13485 revision and determine whether QMSR should be amended. Until FDA completes any necessary rulemaking, the incorporated edition remains ISO 13485:2016.

Is MDSAP still useful under QMSR?

Yes. MDSAP can still be useful for manufacturers that participate in the program, especially for multi-jurisdiction quality system planning. It should not be treated as a substitute for FDA inspection readiness because FDA inspections under QMSR follow FDA procedures and assess compliance with FDA regulations.

Key takeaway for regulatory teams

The most useful way to think about ISO 13485 and 21 CFR 820 is not standard versus regulation, but standard inside regulation. ISO 13485:2016 now provides the core QMS framework for FDA-regulated medical devices, while Part 820 and other FDA rules define the U.S. compliance overlay. Manufacturers that already had mature ISO 13485 systems may have less structural work to do, but they still need to verify FDA-specific records, labeling and packaging controls, UDI connections, postmarket reporting links, inspection readiness, and legacy record traceability.

For ongoing updates on medical device regulatory developments, visit the Regulatory section.