FDA QMSR Eight Months In: Why an ISO 13485 Certificate Is Not Enough

Introduction: The US FDA Quality Management System Regulation (QMSR) took effect and became enforceable on 2 February 2026. It incorporates ISO 13485:2016 directly into 21 CFR Part 820 — yet “ISO 13485 certified ≠ meeting FDA requirements”. With a timeline, a comparison table, an MDSAP roadmap and a self-check list, this article helps device manufacturers exporting to the US focus on what matters.

1. Get the dates straight

The key QMSR dates are as follows:

QMSR key dates

Date	Milestone	Note
23 Feb 2022	Proposed rule published	Comments accepted until 24 May 2022
2 Feb 2024	Final rule published	89 FR 7496 (announced by FDA on 31 Jan 2024)
15 Oct 2024	Correction to the final rule	Correction notice in the Federal Register
2 Feb 2026	Effective date + start of enforcement	QSIT retired; inspection program CP 7382.850 in use
2 Oct 2026	FDA FAQ updated	Clarifies certificates, record inspection and other questions

Source: compiled by EVERBIZ from FDA / Federal Register

• Publication date: the final rule was published in the Federal Register on 2 February 2024 (89 FR 7496, Docket No. FDA-2021-N-0507); FDA announced it on 31 January 2024.
• Effective date: 2 February 2026, two years after publication. FDA began enforcing the QMSR on that day.
• Deadline: the QMSR has no additional transition period after it takes effect. 2 February 2026 is the compliance deadline, and all FDA inspections since then are conducted under the QMSR.
• New inspection program: from the same day, FDA stopped using the QSIT inspection technique and switched to Compliance Program CP 7382.850; the former CP 7382.845 and 7383.001 are no longer used.

2. What has the QMSR actually changed?

FDA’s approach is “ISO 13485 as the foundation, plus a small number of US-specific requirements”. The new Part 820 is much shorter, consisting only of Subpart A (General Provisions) and Subpart B (Supplemental Provisions); the former Subparts C–O have all been removed. FDA considers the two to be “substantially similar” overall, so this is a harmonisation rather than a complete overhaul.

Old vs. new at a glance:

Item	Former QSR (until 1 Feb 2026)	Current QMSR (from 2 Feb 2026)
Regulatory basis	21 CFR 820 as a self-contained system, Subparts A–O	ISO 13485:2016 + Clause 3 of ISO 9000:2015 incorporated by reference; Part 820 retains only a few supplemental provisions
FDA-specific provisions	Spread across the Subparts	§820.10 (link to other FDA regulations), §820.35 control of records, §820.45 labeling and packaging controls
Document terminology	DHF / DMR / DHR / QSR	No longer used; replaced by ISO 13485 design and development file (7.3.10), medical device file MDF (4.2.3) and batch records (7.5.1)
Management term	Management with executive responsibility	Top management (ISO 9000 definition)
Management review / internal audit / supplier audit reports	Exempt under §820.180(c); inspectors generally did not review them	Exemption removed; FDA may review them during inspections
Risk management	Mainly reflected in design validation, §820.30(g)	Throughout the QMS (several ISO 13485 clauses); ISO 14971 is not incorporated by reference
Inspection approach	QSIT; CP 7382.845, 7383.001	QSIT retired; replaced by CP 7382.850

— EVERBIZ —

3. Three “US-specific” provisions FDA has kept

1. §820.10 Requirements for a quality management system. Makes clear that, in addition to meeting ISO 13485, manufacturers must comply with other applicable FDA regulations, such as medical device reporting (21 CFR 803), corrections and removals (21 CFR 806) and UDI (21 CFR 830).

2. §820.35 Control of records. On top of the general ISO 13485 record requirements, it specifies additional content for complaint investigation records, servicing records and UDI-related records. Even devices exempt from GMP must still maintain complaint files and comply with the general record requirements of §820.35.

3. §820.45 Device labeling and packaging controls. FDA considers ISO 13485’s coverage of label inspection insufficient and has therefore kept specific controls to prevent labeling errors and mix-ups.

Also note: where ISO 13485 conflicts with the US Federal Food, Drug, and Cosmetic Act (FD&C Act) and its implementing regulations, US law prevails. For example, the definitions of “device” and “labeling” follow the FD&C Act, not ISO 13485.

4. The most common misconception: a certificate is enough

FDA is very direct about this in its QMSR FAQ (question 13):

• FDA neither requires nor issues ISO 13485 certificates of conformity;
• An ISO 13485 certificate does not exempt a company from FDA inspection;
• FDA inspections do not follow the MDSAP audit schedule; inspection frequency is based on risk factors;
• MDSAP remains a voluntary third-party audit program that companies can continue to join (see Section 6 for the roadmap).

In its responses to comments on the final rule, FDA also made clear that compliance with ISO 13485 alone does not fully satisfy the QMSR: companies must also meet the supplemental requirements in Part 820 and all other applicable FDA regulations.

5. What inspectors will look at

Management reviews, internal audits and supplier audit reports are no longer exempt. The exemption in the former QSR §820.180(c) has not been kept in the QMSR. FDA’s reasoning is that companies already have to provide these documents to regulators in other countries, so making them available to FDA adds no burden.

Records from before February 2026 may also be reviewed. According to FDA FAQ question 7, inspectors may review historical records in the quality system, including those created before the effective date. FDA recommends preparing a gap/mapping analysis showing that older records also meet QMSR requirements.

Risk management must be visible. FDA’s official page notes that by incorporating ISO 13485, the QMSR explicitly requires risk management throughout design, purchasing, production, monitoring and measurement. Note that ISO 14971 itself is not incorporated by reference into the QMSR, but it can serve as a reference for understanding and implementation.

6. Planning your MDSAP route

By making ISO 13485 the legal foundation for FDA, the QMSR makes MDSAP (Medical Device Single Audit Program) more attractive to exporters: one quality system and one audit for several regulators at once.

1. What MDSAP is. Five regulators take part — the US FDA, Health Canada, Brazil’s ANVISA, Japan’s MHLW/PMDA and Australia’s TGA. A recognised Auditing Organization (AO) carries out a single audit against ISO 13485 plus country-specific requirements. Audits follow a three-year cycle: a full certification audit in year 1, surveillance audits in years 2 and 3, and recertification in year 3.

2. What changed after the QMSR took effect. On the same day as the QMSR (2 February 2026), the MDSAP audit approach documents were revised: references to the former QSR were removed and audit tasks remain organised around ISO 13485 clauses. FDA-specific requirements such as 21 CFR 820 are still audited in areas including record control, marketing authorisation and registration, complaints and post-market surveillance, adverse event reporting, design and development, and production and traceability records.

3. What it means for FDA. In the final rule, FDA stated that it will accept certain MDSAP audits in place of its routine quality system surveillance. Keep three points in mind: MDSAP is voluntary; FDA’s own inspections do not follow MDSAP procedures; and regulators can still carry out for-cause inspections or follow-up audits at any time.

4. Choose your route based on your target markets:

Target market combination	MDSAP recommendation	Planning points
US only	Optional	First complete the QMSR transition and prepare for FDA inspections; if you want MDSAP audits to replace routine FDA inspections, apply once your system is stable.
US + Canada	Prioritise	Canada requires an MDSAP certificate for Class II–IV device licences (check Health Canada’s latest requirements); one audit also covers FDA.
US + Brazil / Japan / Australia	Worth evaluating	One audit covers several participating countries and reduces duplicate audits; each country uses audit results differently, so confirm registration requirements country by country.
Already hold EU MDR / ISO 13485 certificates	Natural extension	The core system is already in place; the gaps are mainly country-specific requirements. Check whether your current certification body is also an MDSAP Auditing Organization (AO).

5. Indicative implementation timeline:

Phase	Main activities	Indicative duration
Phase 1 Gap analysis	ISO 13485 / QMSR / target-country specific requirements	About 1 month
Phase 2 System upgrade	Document updates, training, internal audit + management review	About 2–3 months
Phase 3 Choose an auditing organization	Confirm AO recognition, sign contract, schedule	About 1 month
Phase 4 Initial certification audit	Stage 1 + Stage 2, close nonconformities	About 1–2 months
Phase 5 Certificate maintenance	Surveillance audits in years 2 and 3, recertification in year 3	Ongoing

Note: durations are indicative and depend on company size, number of products and the maturity of the existing quality system.

— EVERBIZ —

7. Self-check list for exporters

• Quality system documents: have QSR clause numbers and old terms such as DHF/DMR/DHR been replaced with the corresponding ISO 13485 clauses and terms?
• Supplemental provisions: do procedures cover complaint, servicing and UDI records under §820.35 and labeling and packaging inspection under §820.45?
• Links to other regulations: do procedures set out how MDR reporting (803), corrections and removals (806) and UDI (830) are carried out?
• Open to inspection: can your management review, internal audit and supplier audit reports withstand being read directly by an FDA inspector?
• Historical records: have you prepared an old-vs-new requirements analysis to show that records created before the effective date comply?
• Risk management: does risk management run through purchasing, production, complaint handling and CAPA, rather than stopping at design?
• Training: have quality, regulatory and production staff been trained on the new inspection program CP 7382.850 and taken part in mock inspections?
• MDSAP decision: have you evaluated MDSAP for your target markets and settled the auditing organization, audit timing and each country’s registration requirements?

Tip: ISO 13485:2016 and Clause 3 of ISO 9000:2015 can be viewed free of charge (read-only) on the American National Standards Institute (ANSI) IBR portal.

How EVERBIZ can help

For support with QMSR gap analysis, quality system document conversion, MDSAP route planning or preparing for FDA inspections, please contact the EVERBIZ consultant team.

— EVERBIZ —