The short answer
Since February 2, 2026, FDA’s quality system rules for medical devices are the Quality Management System Regulation (QMSR) in 21 CFR part 820. The QMSR incorporates ISO 13485:2016 by reference, plus clause 3 of ISO 9000:2015 for definitions. It replaced the old Quality System Regulation (QSR). On the same day FDA stopped using its old QSIT inspection method and started inspecting under a new compliance program, 7382.850.
For foreign device makers this is mostly good news: a well-run ISO 13485 system is now the foundation of U.S. compliance. But an ISO 13485 certificate is not a substitute for meeting FDA’s extra requirements or for an FDA inspection.
| Item | Detail |
|---|---|
| Final rule | Medical Devices; Quality System Regulation Amendments — FR Doc. 2024-01709 (February 2, 2024) |
| Effective date | February 2, 2026 |
| Standard incorporated | ISO 13485:2016, plus clause 3 of ISO 9000:2015 |
| Inspections | QSIT retired; Compliance Program 7382.850, “Inspection of Medical Device Manufacturers” |
| Where FDA and ISO differ | If an ISO 13485 clause conflicts with the FD&C Act or FDA regulations, FDA’s requirements control |
What changed in practice
- Risk management is explicit. FDA notes that ISO 13485 specifically requires risk management throughout the quality system. Weak risk management can now lead to serious inspection findings.
- Records FDA used to leave alone are now in scope. Under the old QSR, FDA generally did not review internal audit reports, management reviews and supplier audit reports. Under the QMSR, management reviews and internal audits are part of the inspection areas, and FDA’s QMSR FAQ says supplier audit reports are also subject to review.
- FDA requirements still sit on top of ISO. For example, medical device reporting (MDR), corrections and removals, device tracking and Unique Device Identification (UDI) remain separate FDA requirements — and the new inspection program checks them.
- Complaint records still apply even for devices exempt from most quality system requirements.
How FDA inspects now
Compliance Program 7382.850 groups the quality system into six areas, and investigators choose elements based on patient risk:
- 1Change controlHow design, process and supplier changes are assessed and approved.
- 2Design and developmentDesign inputs, verification, validation, risk management and software.
- 3Management oversightQuality policy, management review and internal audits.
- 4Measurement, analysis and improvementComplaints, nonconformities, CAPA and data trends.
- 5Outsourcing and purchasingSupplier control, including contract manufacturers and component suppliers.
- 6Production and service provisionProcess validation, sterilization, labeling and packaging controls.
Investigators also check the other FDA requirements: MDR, corrections and removals, tracking and UDI.
Example: a glove maker in Malaysia
A factory making medical examination gloves already holds ISO 13485 certification. To be ready for an FDA inspection under the QMSR, it checks that its risk files cover each glove type, that management review and internal audit records are complete (FDA can now ask to see them), that its UDI and labeling controls meet FDA rules, and that its complaint handling feeds into MDR decisions. The certificate helps — but FDA judges the records.
Checklist for foreign device makers
- Update your quality manual and procedures to reference 21 CFR part 820 (QMSR) and ISO 13485:2016 — not the old QSR sections.
- Close gaps between ISO 13485 and FDA-specific rules: MDR, corrections and removals, UDI, labeling.
- Make management review, internal audit and supplier audit records inspection-ready.
- Strengthen risk management files across design, production and suppliers.
- Keep your FDA establishment registration and device listing current, renewed each year, with a U.S. Agent.
FDA medical device establishment registration with U.S. Agent $550. Device listing $50. GUDID account assistance $250. Device label review $550.
Frequently asked questions
When did the QMSR take effect?
February 2, 2026. The final rule was published on February 2, 2024, with a two-year transition.
Does ISO 13485 certification mean I comply with the QMSR?
It is a strong base, but not enough on its own. The QMSR adds FDA-specific requirements, and FDA inspects your records directly; a certificate does not replace an FDA inspection.
What replaced QSIT?
Compliance Program 7382.850, “Inspection of Medical Device Manufacturers”, which FDA began using on February 2, 2026.
Can FDA now review internal audit and management review reports?
Yes. Management reviews and internal audits are part of the new inspection areas, and FDA’s QMSR FAQ says supplier audit reports are also subject to review.
Sources
- FDA — Quality Management System Regulation (QMSR) (updated February 2, 2026)
- Federal Register — Quality System Regulation Amendments, FR Doc. 2024-01709 (February 2, 2024)
- Ropes & Gray — FDA adopts new inspection approach for medical devices (February 2026)
Dates and requirements checked on November 11, 2026. This article is general information, not legal advice.