QMSR: What Actually Changes for an ISO 13485 QMS

The sentence heard in many quality departments since February goes: "We are certified to ISO 13485, so we are QMSR compliant." It is understandable and still wrong. Since 2 February 2026, 21 CFR Part 820 is no longer the Quality System Regulation but the Quality Management System Regulation, and the FDA incorporates ISO 13485:2016 into it by reference. The certificate becomes the foundation. It is not the evidence towards the FDA, and in three places the agency asks for more than the standard.

What incorporation by reference actually means

The FDA did not rewrite the text of the standard; it bound it in under Section 820.7. Two documents are named there: ISO 9000:2015(E) for the vocabulary in Section 820.3, and ISO 13485:2016(E) for Sections 820.1, 820.3, 820.10, 820.35 and 820.45. One practical consequence is regularly overlooked: the standard is part of the legal position, but it is not freely available. A company that does not hold a licensed copy in house does not have the binding text.

The vocabulary changes with it. Section 820.3 declares the definitions of ISO 13485 and of Clause 3 of ISO 9000 to be authoritative, with the exceptions named there. And the old structure is empty: Sections 820.20 through 820.30 are marked "Reserved". Anyone whose SOP points to subpart numbers of the former version is pointing at nothing.

The FDA additions sit in three places

This is the part a certificate does not cover.

Section 820.10, requirements for a quality management system. What is required is a documented QMS that complies with the applicable requirements of ISO 13485. The design and development requirements apply to manufacturers of class II and III devices and to those class I devices expressly listed in Section 820.10(c)(1) and in Table 1 of Section 820.10(c)(2). This is the point at which classification, not the standard, determines the scope of the system.

Section 820.35, control of records. In addition to Clause 4.2.5 of ISO 13485:

• Complaint records must include the records of review, evaluation and investigation where a complaint concerns the possible failure of a device, its labeling or its packaging to meet any of its specifications.
• The UDI must be recorded for each device or each batch of devices, in addition to the requirements of Clauses 7.5.1, 7.5.8 and 7.5.9.
• Records the manufacturer regards as confidential may be marked accordingly. That helps the FDA in determining what may be released under the public information rules.

Section 820.45, device labeling and packaging controls. ISO 13485 requires defined operations for labeling and packaging but does not specifically address inspection of the labeling by the manufacturer. The FDA therefore retained the corresponding requirements from the former version: labeling and packaging are to be inspected for accuracy before use, and both the inspection and the release are to be documented.

Three additions, three processes that stay invisible in an audit against the standard and surface in an FDA inspection.

Inspections have run differently since the same day

On 2 February 2026 the FDA stopped using the Quality System Inspection Technique (QSIT) for device inspections and moved to the updated compliance program 7382.850 (Inspection of Medical Device Manufacturers). Also out of use: the former program 7382.845 and 7383.001 for PMA preapproval and postmarket inspections.

For preparation this means a mock inspection built on QSIT's four-subsystem model trains a procedure that no longer exists. The difference is not cosmetic, because the procedure determines the order in which an investigator walks through the system.

DHF, DMR and DHR: gone from the regulation, not from the records

The QMSR no longer uses the terms design history file, device master record and device history record; ISO 13485 works with the medical device file and the design and development file instead. Two misunderstandings about this are common:

• The loss of the terms brings no relief in substance. What has to be documented now follows from the standard plus the additions, not from the old records logic.
• Existing records do not have to be renamed. The FDA states in its FAQ that records predating 2 February 2026 may keep the terms of the 1996 version.

Read together, the two points give the right order of work: do not rewrite the records, rewrite the process descriptions and the references inside them.

What expressly did not change

On 4 December 2025 the FDA published technical amendments (Docket FDA-2025-N-4635). They cover 179 sections across 18 parts of Title 21, among them parts 801, 803, 812, 860 and the product-specific parts 862 to 892. The purpose is editorial: references still pointing to the old Quality System Regulation are moved to the QMSR, errors are corrected, cross-references are aligned.

For combination products, the references in 21 CFR Part 4 were conformed to clarify the device QMS requirements. The CGMP requirements for combination products do not change as a result.

That is good news with a catch: anyone searching their SOPs for references will find new citations in many places after 4 December 2025 without anything having changed in substance. That work is unavoidable and it is pure text maintenance. Mixing it with the actual gap analysis costs time and obscures the three points that matter.

What to do now

• Run the gap analysis against the additions, not against the standard. A certified company does not need a second ISO 13485 comparison. What is called for is Sections 820.10, 820.35 and 820.45, as evidence inside the process rather than as a reference in a manual.
• Open the complaint records and read them against the text. Do they contain review, evaluation and investigation even where the possible failure concerns labeling or packaging rather than the device? That is the most frequent finding at this point.
• Check the UDI in the records. For each device or batch, and consistent with the labeling. Holding the UDI in a database only does not satisfy Section 820.35.
• Document the release of labeling and packaging. Inspection for accuracy before use, with evidence. A four-eyes principle without a record is not evidence here.
• Determine the design and development scope per class. Class II and III always; for class I only the devices expressly listed. That assignment belongs in writing, because it justifies the scope.
• Move inspection readiness to 7382.850. Existing QSIT material remains useful as a knowledge base, not as a running order.
• Keep the standard available in house. Incorporation by reference means the binding text sits behind a licence. Without the current edition at hand, no defensible check is possible.

Entourage supports MedTech and IVD manufacturers through exactly this reconciliation: a gap analysis that starts from the certificate and treats the three FDA additions as the checkpoints, determination of the design and development scope per device class, moving inspection readiness to the current program, and the text maintenance in process descriptions so that references point to where the requirement lives today. The starting point is usually the uncomfortable question of whether the complaint records of the last twelve months would carry the requirements of Section 820.35.