U.S. FDA Harmonization of 21 CFR Part 820 with ISO 13485:2016

Get tips and updates for the adoption of ISO 13485:2016 requirements under the Quality Management System Regulation for medical devices marketed in the U.S.

In a landmark move toward global regulatory harmonization, the U.S. Food and Drug Administration (FDA) issued a final rule on Jan. 31, 2024, amending the Quality System Regulation (QSR) under 21 CFR Part 820. This amendment incorporates by reference the international standard ISO 13485:2016, which governs the medical device quality management system (QMS) requirements in the U.S. The revised regulation, the Quality Management System Regulation (QMSR), is effective from Feb. 2, 2026.

This shift aims to streamline compliance for medical device manufacturers operating globally, reduce regulatory burdens and enhance product safety and effectiveness.

Gaps between QSR and ISO 13485:2016

The FDA now formally recognizes ISO 13485:2016 as the foundational quality management system (QMS) standard. While there are FDA-specific requirements that will remain — such as unique device identification (UDI) requirements, rules for combination and implantable products, complaint handling and reportability, and labeling requirements — there are notable differences between the requirements of the former QSR and ISO 13485:2016. When QMSR takes effect, manufacturers must understand and comply with these ISO 13485:2016 requirements:

Documentation requirements – ISO 13485:2016 requires more extensive documentation, including a quality manual and documented procedures for all QMS processes.
Management responsibility – ISO 13485:2016 emphasizes the accountability and active involvement of senior leadership.
Supplier controls – ISO 13485:2016 requires formal supplier evaluation and monitoring systems.
Training vs. competency – ISO 13485:2016 requires evidence of employee competency, not just training completion.
Design controls – ISO 13485:2016 integrates risk management throughout design and development, extending beyond the FDA’s traditional validation focus.
Terminology updates – The QSR terms device master record (DMR), design history file (DHF) and device history record (DHR) are replaced by the ISO 13485:2016 term medical device file (MDF).

Tips for compliance with QMSR

Conduct a gap analysis – Compare your current QMS against ISO 13485:2016 requirements.
Update documentation – Create or revise your quality manual, SOPs and MDFs.
Train for competency – Shift from training logs to competency assessments, which can include education, industry experience and professional training.
Strengthen risk management – Incorporate ISO 14971-based risk processes across all life cycle stages into your QMS.
Review supplier controls – Formalize supplier qualification, monitoring and re-evaluation.
Prepare for inspections – Familiarize staff with ISO-based audit expectations, especially if your organization’s QMS is not yet certified to ISO 13485:2016 or MDSAP by an accredited certification body (CB) and/or recognized Medical Device Single Audit Program (MDSAP) auditing organization (AO).
Clarify definitions – Confirm the quality manual and internal documents reflect updated terminologies.
Maintain FDA-specific records – Continue tracking UDI, complaints and reportability, and service records.
Engage top management – Confirm leadership is actively involved in QMS oversight and that this is recorded in the management review records.
Continue to monitor FDA publications – There are multiple reserved sections across Part 820 — Quality Management System Regulation, including 820.5, 820.20-30 and 820.40, indicating that requirements may continue to be expanded and refined.

Navigating challenges in the transition to QMSR

The FDA’s adoption of ISO 13485:2016 through the QMSR marks a pivotal shift in medical device regulation. While harmonization aims to streamline global compliance, it introduces nuanced challenges that manufacturers must address. Understanding the gaps, risks and expectations can help your organization navigate the transition more smoothly and support compliance in a globally harmonized regulatory landscape.

UL Solutions is an ISO 13485:2016-accredited CB and MSDAP-recognized AO. We can provide QMS certification for a broad array of medical devices. Visit our QMS Audit Service page and MDSAP page to learn more.

Is ISO 13485:2016 certification required for compliance with QMSR?: No. Compliance with ISO 13485:2016 is required, but certification is not mandatory.
What is the deadline for compliance with QMSR?: Feb. 2, 2026
Will FDA inspections change?: Yes. On Feb. 2, 2026, the QSR inspection process known as Quality System Inspection Technique (QSIT) will be withdrawn, and the new inspection process to assess a medical device manufacturer's compliance with QMSR will be implemented.
Pay particular attention to the new subclauses, such as 21 CFR 820.35 Control of Records, 21 CFR 820.45 Device Labeling and Packaging Controls, and 21 CFR 820.50 Purchasing Controls. Note that FDA inspections under the QMSR will not follow the MDSAP or its procedures.
What happens to existing QSR documentation?: Documents like the device master record (DMR), design history file (DHF) and device history record (DHR) are now incorporated into the term medical device file (MDF), but their content and requirements remain relevant.
How does the final FDA rule impact existing ISO 13485:2016 and MDSAP certification?: The FDA’s final rule does not affect organizations that have already obtained ISO 13485:2016 and/or MDSAP certification. Organizations responsible for designing, manufacturing or placing medical devices on the U.S. market should maintain their existing ISO 13485:2016 and MDSAP certifications, particularly if they intend to sell products globally.
However, organizations with an ISO 13485:2016-compliant quality management system (QMS) under an accredited certification body — and those with an MDSAP-compliant QMS audited by an MDSAP-recognized Auditing Organization (AO) where the scope includes the U.S. — will need to update certain documents and terminology to align with the new QMSR harmonization requirements.
How does this amendment impact startups intending to develop, manufacture, relabel/repackage or sell medical devices in the U.S. on or after Feb. 2, 2026?: Startups targeting the U.S. market must build their QMS to meet ISO 13485:2016 requirements, even if they are not formally certified. Certification is optional but highly recommended, especially for startups aiming for global market access. Aligning your QMS with ISO 13485:2016 can streamline access to international markets, including those participating in the MDSAP. Finding a Certification Body (CB) that can provide ISO 13485:2016 certification services may be more difficult than you expect, as your preferred CB may not have the required scope of accreditation.