United States (FDA)
21 CFR Part 820 (QMSR): Quality Management System Regulation
21 CFR Part 820 is the quality system rule every US medical device manufacturer is inspected against. On February 2, 2026 it became the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference and keeps a short list of FDA-specific requirements on top. The change touches your procedures, your records and the way FDA runs the inspection itself.
At a Glance
- Regulation
- 21 CFR Part 820 (QMSR)
- Subject
- Quality Management System Regulation
- Group
- United States (FDA)
- Industries
- 22 industry guides reference it
A plain-language summary, not legal advice. Always read the current official text.
What It Covers
The QMSR replaced the former Quality System Regulation's own requirement text with ISO 13485:2016, incorporated by reference. Design and development, purchasing, production and service provision, monitoring and measurement, nonconforming product, corrective and preventive action and management responsibility are now read through the structure and vocabulary of ISO 13485. FDA kept a small set of additions that the standard does not cover in the way US law requires, most visibly 820.35 on records (for example complaint and servicing records and UDI) and 820.45 on labeling and packaging controls.
Two changes matter most on inspection day. First, internal audit, management review and supplier audit records are now open to FDA inspection, because the former exception that shielded them was removed. Reports that were written for internal eyes only are now evidence. Second, FDA retired the QSIT inspection technique on February 2, 2026. Device QMS inspections now follow Compliance Program 7382.850, which groups requirements into six QMS areas (Change Control; Design and Development; Management Oversight; Measurement, Analysis, and Improvement; Outsourcing and Purchasing; Production and Service Provision) plus Medical Device Reporting, Corrections and Removals, Tracking and UDI.
Inspections under the compliance program are risk-based and start from the firm's risk management documentation. In practice that means investigators pick what to sample by following your own risk files into design, production, complaints and suppliers. A QMS with ISO 13485 certification is a strong starting point, but certification alone does not cover the FDA-specific additions or the other FDA requirements the compliance program pulls into scope.
Who It Applies To
- Manufacturers of finished medical devices intended for commercial distribution in the United States, domestic and foreign
- Specification developers, contract manufacturers, relabelers and others whose activities bring them under the regulation, depending on what they do
- Firms holding ISO 13485 certification that now need to close the gap to the FDA-specific additions
- Device makers whose class I devices are exempt from parts of the regulation should confirm which requirements still apply under their classification regulation
What Auditors Check
Risk Management as the Starting Point
Investigators begin with your risk management documentation and use it to choose which designs, processes, complaints and suppliers to sample. Risk files that are out of date or disconnected from field data are an early signal.
Internal Audit and Management Review Records
These records are now open to inspection. Investigators look for audits that actually cover the QMS, findings that lead to action, and management reviews that use real inputs rather than a template.
Supplier Controls and Supplier Audit Records
Supplier evaluation, purchasing controls proportionate to risk, and the supplier audit reports themselves. Gaps between an approved supplier list and the evidence behind it are common findings.
Records Under 820.35
Complaint and servicing records, UDI and the other record content FDA added on top of ISO 13485. Investigators check that the records exist, are complete and can be retrieved.
Labeling and Packaging Controls Under 820.45
How labeling is reviewed and released, how mix-ups are prevented, and whether the controls match the records. Labeling errors are a recurring source of recalls, so this area gets attention.
Change Control Across the QMS
Design, process, supplier and software changes, with evidence that each was assessed, verified or validated as needed, and approved before it took effect.
Reporting Obligations Tied to Quality Data
Whether complaint handling feeds Medical Device Reporting and corrections and removals decisions correctly, and whether UDI and tracking obligations are met where they apply.
Related Services
QMSR Transition
Bringing a QSR-era or ISO 13485 quality system in line with FDA's QMSR, which is now in effect.
FDA Inspection Readiness (CP 7382.850)
FDA device inspection preparation built around Compliance Program 7382.850 and its risk-based approach.
AI-Assisted QMS Gap Assessment
An AI-assisted first pass over the QMS documents you already have, with every result reviewed by an advisor.
Mock FDA Inspection
A practice FDA inspection in our Inspection Simulator, with an advisor playing the investigator.
Industry Guides That Reference 21 CFR Part 820 (QMSR)
- Class I Device Manufacturers
- Class II Device Manufacturers
- Class III Device Manufacturers
- Software as a Medical Device and AI-Enabled Devices
- In Vitro Diagnostics
- Combination Products
- Implantable Devices
- Electromedical and Capital Equipment
- Orthopedic Devices
- Cardiovascular Devices
- Diagnostic Imaging
- Dental Devices
- Ophthalmic Devices
- Wearables and Digital Health
- Contract Manufacturers and Component Suppliers
- Startups and First-Time Submitters
- Medical Supply Manufacturers
- Durable Medical and Home-Use Equipment
- Distributors and Importers
- Relabelers, Repackagers and Kit Assemblers
- Reprocessors, Refurbishers and Servicers
- Specification Developers
Questions
Is the QMSR just ISO 13485?
No. The QMSR incorporates ISO 13485:2016 by reference and then adds FDA-specific requirements, such as 820.35 on records and 820.45 on labeling and packaging controls. It also sits alongside other FDA requirements, like Medical Device Reporting and UDI, that the inspection covers. An ISO 13485 certificate helps, but it is not the same as meeting Part 820.
Can FDA now read our internal audit reports?
Yes. Under the QMSR, internal audit, management review and supplier audit records are open to FDA inspection because the former exception was removed. It's worth reviewing how those reports are written, whether findings were closed, and whether the records would make sense to an outside reader.
How are inspections different now that QSIT is gone?
Since February 2, 2026, device QMS inspections follow Compliance Program 7382.850. It organizes the inspection around six QMS areas plus reporting, corrections and removals, tracking and UDI, and it is risk-based, starting from your risk management documentation. Preparing by subsystem checklist alone is less useful than preparing to explain how risk drives your decisions.
Where should we start if we haven't fully transitioned?
Start with a gap assessment of your existing procedures and records against ISO 13485:2016 and the FDA-specific additions, then rank the gaps by risk. The records now open to inspection (internal audit, management review, supplier audits) deserve an early look. Our QMSR transition work begins with an AI-assisted first pass over the documents you already have, reviewed by an advisor.
21 CFR Part 820 (QMSR)
Check Your Quality System Against 21 CFR Part 820 (QMSR)
An AI-assisted first pass maps your existing documents against the requirements in scope, and an advisor reviews every result. Please don't send confidential documents yet: secure upload is set up after onboarding.
