FDA Quality Management System Regulation (QMSR), 21 CFR Part 820

FDA Quality Management System Regulation (QMSR), 21 CFR Part 820

Brief type: Shared compliance brief (Biomedical flagship record; the U.S. QMS regime) Record ID: biomedical-reg-001 (Biomedical · regulation · license) Issuing body / enforcer: U.S. Food and Drug Administration (FDA), Center for Devices and Radiological Health (CDRH) Jurisdiction: United States (applies to domestic manufacturers and importers of devices sold in the U.S.)

1. What it is

The QMSR is FDA's quality-system regulation for medical devices, codified in 21 CFR Part 820. It is a regulation, not guidance — it carries the force of law under the Federal Food, Drug, and Cosmetic Act. It replaced the legacy Quality System Regulation (QSR) on 2 February 2026 after a two-year transition, harmonizing U.S. requirements with ISO 13485:2016, the international device-QMS standard.

The practical effect: U.S. device quality systems are now judged against ISO 13485:2016 (incorporated by reference) plus a small FDA-specific overlay. FDA retained its inspection and enforcement authority in full — this is harmonization of requirements, not of regulators.

2. Scope and who it applies to

• Applies to manufacturers of finished medical devices intended for human use placed on the U.S. market, including importers where the foreign manufacturer does not meet the requirements (the importer becomes the responsible party).
• Covers Class I, II, and III devices, subject to scope and exemptions in the regulation (some low-risk Class I devices are exempt from most QMS requirements — verify exemption status by device classification at fda.gov).
• Applies to specification developers, contract manufacturers performing manufacturing functions, and repackagers/relabelers to the extent they perform regulated functions.
• Trigger: Manufacturing, distributing, or importing a finished device in the U.S. post-2-February-2026 means operating under QMSR. Existing manufacturers had to transition during the two-year window that ended on that date.

3. Key requirements and compliance obligations

QMSR 21 CFR Part 820 now works as follows: most substantive requirements are satisfied by complying with ISO 13485:2016 (incorporated by reference in §820.7). Six sections retain their own FDA-written text because FDA concluded ISO 13485 did not adequately cover them:

1. §820.1 — Scope. Defines what the regulation covers and its exemptions.
2. §820.3 — Definitions. FDA definitions take precedence where they differ from ISO's (this is deliberate — e.g., terms tied to statutory language).
3. §820.7 — Incorporation by reference. The legal mechanism making ISO 13485:2016 (and Clause 3 of ISO 9000:2015 for vocabulary) enforceable under the FD&C Act.
4. §820.10 — Requirements for a quality management system. The top-level QMS obligation.
5. §820.35 — Control of records. FDA-specific records requirements — inspection focus area.
6. §820.45 — Device labeling and packaging controls. FDA retained its own labeling/packaging controls.

Everything else in Part 820 is marked "Reserved" — meaning the requirement lives in the cited ISO 13485:2016 clause, not in CFR text.

Key terminology shifts engineers must adopt (old QSR → QMSR language):

• Device Master Record (DMR) → Medical Device File (MDF).
• Corrective and Preventive Action (CAPA) → split into separate Corrective Action and Preventive Action processes.
• Terminology generally aligned to ISO 13485 wording (e.g., "organization" vs. "manufacturer" contexts), with FDA definitions prevailing on conflict.

Inspection reality (LIVE since 2 Feb 2026): FDA retired the QSIT inspection framework (Compliance Program 7382.845) and now inspects under Compliance Program 7382.850, built around QMSR. Investigators may review management review records, internal audit records, and supplier audit records — areas some firms previously treated as internal-only. Certification to ISO 13485 does not replace FDA compliance or excuse FDA inspection: FDA does not require ISO 13485 certification, does not issue GMP/QMSR certificates, and will still inspect certified firms.

Interaction with premarket submissions: A 510(k) clearance is generally not conditioned on a pre-clearance QMS inspection — the clearance decision rests on substantial equivalence. QMSR compliance is enforced through inspections, Form 483s, Warning Letters, consent decrees, and injunction/seizure — i.e., through a separate enforcement track from premarket review. But design-control and risk-management weaknesses found in a submission can trigger inspection attention, and vice versa.

4. Penalties and consequences of non-compliance

Non-compliance with Part 820 renders a device adulterated under the FD&C Act. Enforcement tools:

• Form FDA 483 observations at inspection close-out — the public signal that drives downstream action.
• Warning Letters — public, and they freeze the firm's ability to get new clearances/approvals until resolved.
• Seizure of adulterated devices (21 U.S.C. §334) and injunction against further manufacture/distribution (§332).
• Criminal prosecution for prohibited acts (§331) — misdemeanor or felony depending on intent; responsible corporate officers can be liable under the Park doctrine.
• Import detention: Foreign-manufactured devices can be refused admission at the border.
• Consent decrees: For chronic violators — court-supervised shutdowns or remediation costing tens of millions.
• Practical business consequence: a Warning Letter or consent decree is frequently a termination trigger in distribution and supply contracts.

5. Version and status — VERIFIED against current sources (September 2026)

• Final rule published 31 January 2024 (89 FR 7496), "Medical Devices; Quality Management System Regulation."
• Effective 2 February 2026 — the two-year transition is complete; QMSR is the law now, not a future event.
• Part 820 today = QMSR incorporating ISO 13485:2016 by reference. References to "the QSR" are out of date.
• QSIT retired the same day; inspections now run under Compliance Program 7382.850.
• No further QMSR rulemaking is pending as of September 2026 (flag: confirm at fda.gov before citing in regulatory filings — FDA occasionally issues technical corrections).

6. Related certifications (Biomedical)

From the catalogue (record_type=certification, importance=license/flagship, Biomedical):

• RAC-Devices (RAPS) — the primary credential whose exam covers QMSR/21 CFR 820 requirements; regulatory-affairs professionals are the typical owners of QMSR compliance strategy.
• CCE (Certified Clinical Engineer) — touches QMS in healthcare-technology management contexts.
• PE licensure — no biomedical PE exam exists; the PE does not test QMSR.

7. Honest flags

• Verified via multiple 2026 regulatory-industry sources (Greenlight Guru, Intuition Labs, ISO consultants' postings, MedDeviceGuide) — consistent on the 2 Feb 2026 effective date, the six retained sections, and the QSIT→7382.850 transition.
• Exact current text of the six retained sections and the incorporated-by-reference edition should be confirmed in the eCFR (ecfr.gov) before use in regulatory submissions — summaries are no substitute for the codified text.
• FDA inspectional posture under 7382.850 is still being characterized by industry as the first inspection cycles complete; expect guidance updates.

Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.