Since 2 February 2026, the United States has a new regulatory framework for medical device quality management systems. The Quality Management System Regulation (QMSR) replaces the Quality System Regulation (QSR) set out in 21 CFR Part 820. The change is not cosmetic: the FDA now incorporates ISO 13485:2016 by direct reference into its positive law, together with Clause 3 of ISO 9000:2015 for definitions. What was a voluntary international standard becomes an enforceable regulatory requirement in the United States.
For an EU manufacturer already certified to ISO 13485, this is a favourable signal in principle. In the detail, several points call for a check before any FDA move.
What the QMSR actually changes
The QSR dated, in its last major revision, from 1996. It had its own definitions, its own terminology, its own documentary logic. The QMSR removes almost all of these specific sections and replaces them with a direct cross-reference to the clauses of ISO 13485:2016. The concepts inherited from the QSR disappear, with a precise mapping:
- Device Master Record (DMR) becomes Medical Device File (MDF), as defined by ISO 13485 §4.2.3.
- Design History File (DHF) becomes Design and Development File (DDF), structured according to §7.3.
- Device History Record (DHR) becomes Manufacturing Records, covered by §7.5 and §4.2.5.
US terminology also changes at the governance level. Management with Executive Responsibility is replaced by the Top Management of ISO 13485. The distinction is not cosmetic: it raises the level of commitment expected at the top of the company.
Second structural change, the FDA is abandoning its historic inspection model. The Quality System Inspection Technique (QSIT) is withdrawn as of 2 February 2026, replaced by Compliance Program 7382.850. Management reviews, internal audit reports and supplier audit reports, until now covered by an exemption under 21 CFR 820 under the QSR, become inspectable by the FDA. For an EU manufacturer used to preparing these documents for its notified body, the documentary burden does not increase. But a review of internal SOPs is required: what was reserved for third-party audits must now hold up in front of an FDA inspector.
Risk management becomes the backbone of the inspection
This is the most underestimated point of the new regime. Compliance Program 7382.850 organises inspections around six QMS Areas and four Other Applicable FDA Requirements. The entry point is no longer a functional subsystem (Design Controls, CAPA, Production, Management) as under QSIT. It is the ISO 14971 risk management file.
In practice, the inspector starts from the risk management file and follows the links to the other QMS processes: design, purchasing, production, post-market surveillance. Siloed risk management, kept up to date only at the time of initial design, will not withstand this type of inspection. The FDA expects a demonstration that risk flows through the entire system, from the supplier to the field return.
For an EU manufacturer, the implication is direct. A risk management file built to satisfy the MDR and the notified body is not automatically calibrated for CP 7382.850. The granularity, the traceability between risk analysis and verification, the connection with PMS data must be checked explicitly.
Certified to ISO 13485, are you therefore compliant with the QMSR?
Not automatically. ISO 13485 certification is not enough to claim QMSR compliance, and a third-party inspection under ISO does not exempt you from an FDA inspection (outside MDSAP recognition). The FDA retains requirements specific to US law that ISO 13485 does not cover:
- Unique Device Identification (UDI) under 21 CFR Part 830.
- Medical Device Tracking under 21 CFR Part 821, an obligation limited to devices designated by the FDA (permanent implants, life-supporting devices used outside a facility, certain high-risk devices). It is not a general traceability regime.
- Reporting of adverse events (Medical Device Reporting) under 21 CFR Part 803.
- Reports of corrections and removals under 21 CFR Part 806.
- Extended controls on labelling and packaging under 21 CFR 820.45.
These requirements are added on top of the ISO clauses. A solid ISO 13485 QMS narrows the gap, but a QMSR-specific gap analysis remains necessary for any manufacturer that distributes or plans to distribute in the United States.
What it means for European manufacturers
For an EU manufacturer of Classes I to IIb already under the MDR and certified to ISO 13485, the QMSR is a positive signal: global regulatory convergence is accelerating. A QMS well built on ISO 13485 constitutes a credible foundation for US market access.
But convergence is not equivalence.
Three questions to position your QMS against the QMSR
- Do your procedures still cite QSR terminology (DMR, DHR, DHF), or have you aligned it with ISO 13485 and the FDA mapping?
- Does your ISO 14971 risk management file serve as the entry point to your QMS, or does it remain an isolated design deliverable?
- Are your internal and supplier audit reports written in a way that holds up in front of an FDA inspector, and not only in front of a third-party auditor?
Each “no” is a reason to get in touch.
Our deliverable
At ISOFAC, we carry out a structured QMSR gap analysis: SOP-by-SOP mapping against ISO 13485:2016 and the Part 820 overlay, review of the risk management file against the requirements of CP 7382.850, review of internal and supplier audit records. Final deliverable: a gap report prioritised by criticality, a six-month action plan, preparation for the FDA inspection.
Thomas Trullen (ICA 13485 auditor, AFNOR assessor) and Jonathan Bedin lead each engagement directly. No subcontracting, no intermediary.
Let’s talk.