The QMSR adds FDA rules on top of ISO 13485

A quality team that spent last year preparing for the Quality Management System Regulation tends to arrive at one comfortable conclusion: we hold an ISO 13485:2016 certificate, so the transition is a paperwork exercise. The certificate matters, and it does most of the work. But the QMSR that took effect on 2 February 2026 is not a re-badge of ISO 13485 — it is ISO 13485 with a short list of FDA-specific requirements bolted on top, and the additions are exactly the parts a certificate does not audit. A file built to the standard and stopped there is compliant with the standard, not with Part 820.

The QMSR replaced the old Quality System Regulation, but it did not throw the regulation open. FDA incorporated ISO 13485:2016 into 21 CFR Part 820 by reference, so most of the text a manufacturer used to read in the regulation now lives in the standard. What Part 820 retains is a small set of supplemental provisions — the requirements FDA decided the standard did not cover adequately for its own purposes. Those are the parts worth reading closely, because they are the parts an ISO audit never checked.

The rule is the standard plus a supplement

Compliance now means two things at once: conformance with ISO 13485:2016, and conformance with the FDA-only requirements that Part 820's Subpart B layers on top. Section 820.10 sets the quality management system requirement and points to the standard. Then the supplement adds duties the standard states differently or not at all. Section 820.35 requires records beyond ISO 13485's clause 4.2.5 — including the review, evaluation, and investigation of any complaint alleging a device, its labeling, or its packaging failed to meet specification, and the unique device identifier where one is required. Section 820.45 adds device labeling and packaging controls beyond clause 7.5.1, including inspection of label accuracy before release. None of these is optional guidance; they are regulatory requirements, and a firm certified to ISO 13485 has demonstrated none of them by virtue of the certificate.

The vocabulary retired; the records did not

The old regulation defined a Device Master Record, a Device History Record, and a Design History File as named artifacts with their own sections. The QMSR removes those defined terms. That does not mean the records disappear — it means they now live under ISO 13485's structure, chiefly the medical device file of clause 4.2.3 and the record-control requirements of clause 4.2.5. The medical device file that absorbed the DMR is the clearest example: the same content the DMR carried is still required, under a different name and a different clause. A team that reads the retirement of a term as the retirement of the obligation has misread the transition in the most expensive possible direction.

Traceability and labeling are where the supplement bites

The additions cluster around the places FDA has always inspected hardest. Labeling control is one: the requirement to verify label accuracy before a device is released is an FDA addition, not a standard clause, because mislabeling has historically been one of the most common and most consequential device failures. Records control is the other: the QMSR's insistence that complaint investigations, UDI, and servicing information be captured is what lets a post-market signal be traced back to a specific device and forward to everyone who received it. A firm that built its document-control system to the standard alone can satisfy every clause of ISO 13485 and still be missing the specific records Section 820.35 names.

Inspection did not become an ISO audit

The most consequential thing the QMSR did not change is who shows up and how. FDA still inspects; it did not outsource oversight to notified bodies or certificate registrars. On the effective date the agency moved to an updated inspection approach under its own compliance program for device manufacturers, an FDA investigator working to FDA's expectations — not a third-party auditor working to a certification scheme. The two look at the same quality system, but they are not interchangeable, and the supplemental requirements are precisely the ground where an FDA investigator will find gaps a certification audit was never scoped to look for. A certificate answers “does this system conform to the standard?” An inspection answers “does this system conform to Part 820?” — and after February 2026 those are no longer the same question.

Where this meets the file

The practical readiness move is a crosswalk: every FDA-only requirement in Part 820's supplement mapped to where your quality system actually satisfies it, so the gaps the certificate hides become visible before an investigator finds them. A QMSR transition crosswalk built to that shape — standard clause on one side, FDA addition on the other, evidence in the middle — is previewed in the launch catalog. If your program has already run this transition and learned where the supplement bites hardest, the shelf takes that correction directly.