FDA QMSR now in effect: 21 CFR Part 820 aligned with ISO 13485
| Document | Medical Devices; Quality System Regulation Amendments (final rule), 89 FR 7496, document 2024-01709 ↗ |
|---|---|
| Issued by | FDA |
| Issued | 2 Feb 2024 |
| Effective | 2 Feb 2026 |
In short: FDA published a final rule on 2 February 2024 (89 FR 7496) amending the device quality system regulation in 21 CFR Part 820 to incorporate ISO 13485:2016 by reference. Per the Federal Register and FDA, the rule became effective on 2 February 2026, and Part 820 is now titled the Quality Management System Regulation (QMSR).
What changed
- FDA harmonised its device CGMP requirements with ISO 13485:2016 and clause 3 of ISO 9000:2015 (terms and definitions), both incorporated by reference. FDA describes the standard’s requirements as substantially similar to the old QS regulation taken as a whole.
- The rule adds requirements that clarify how ISO 13485 fits with FDA law. Where an ISO clause conflicts with the FD&C Act or its regulations, the Act and regulations control.
- FDA states the QMSR now specifically requires risk management.
- The old exceptions at 820.180(c) are not kept: FDA can inspect management review, quality audit and supplier audit reports.
- Conforming edits to 21 CFR Part 4 clarify device quality system requirements for combination products; FDA says these do not change CGMP requirements for combination products.
- Devices made under an investigational device exemption remain subject to design and development requirements (820.10(c) and ISO 13485 clause 7).
- From 2 February 2026 FDA stopped using QSIT and began using Compliance Program 7382.850 for inspections.
Who it affects
Manufacturers of devices marketed in the US, and those making combination products with a device constituent. Indian exporters supplying devices to the US are affected through the same requirements.
Key dates
- 2 February 2024: final rule published.
- 2 February 2026: effective date.
- FDA says investigators may review quality system records created before 2 February 2026.
What to do now
- Compare your QMS to ISO 13485:2016 and to the additional QMSR requirements (example in-house approach: a clause-by-clause gap table).
- Make management review, internal audit and supplier audit records ready for inspection.
- Check risk management coverage across design, production and supplier control.
- An ISO 13485 certificate does not exempt a site from FDA inspection, according to FDA’s FAQ. MDSAP stays voluntary.
Related reading: Pharmaceutical Quality System (ICH Q10), Optimizing Ethylene Oxide Sterilization for Medical Device Manufacturers.