QMSR 2026: FDA's Quality System Change, Explained

Status as of 21 July 2026, next review 1 October 2026.

If you're building toward a US medical device submission and your quality management system planning still references FDA's old Quality System Regulation by name, you're working from a superseded framework. This page sets out what actually changed in February 2026 and what to do if you haven't absorbed it yet. Building a lean ISO 13485 quality system serving the EU and US is the practical answer for most teams.

In short: The Quality Management System Regulation (QMSR) took effect on 2 February 2026, replacing FDA's Quality System Regulation (QSR) and incorporating ISO 13485 by reference. US-facing manufacturers must now run an ISO 13485-aligned QMS with FDA-specific additions on top, a convergence that benefits teams already building for CE marking. The short version for planning purposes: EU-first teams win the QMSR transition, because a quality system built to ISO 13485 from day one now serves both markets with far less duplicate work than under the old, more divergent framework.

What changed and when

FDA's Quality System Regulation, in force since 1996, was replaced by the Quality Management System Regulation, effective 2 February 2026. A precision point worth getting right: the QMSR revises 21 CFR Part 820 in place rather than repealing or relocating it — Part 820 remains the CFR home of FDA's device quality system requirements, now containing the QMSR instead of the QSR. The change was formally finalized well in advance of that date, with technical amendments issued in December 2025 ahead of the effective date, giving manufacturers a transition period, but the effective date itself is the point from which QMSR, not the legacy QSR, is the operative US quality system standard for medical device manufacturers.

FDA's own QMSR resource page, updated on the effective date, confirms the regulation "amends the device current good manufacturing practice (CGMP) requirements of 21 CFR Part 820, incorporating by reference the international standard specific for medical device quality management systems set by the International Organization for Standardization (ISO), ISO 13485:2016." That's the core of the change in FDA's own words, and it's worth reading directly rather than relying solely on secondary summaries, including this one. FDA's main QMSR page is at fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr, and FDA maintains a dedicated frequently-asked-questions page alongside it at fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions, which covers inspection authority, applicability to accessory manufacturers, and CGMP exemptions in more granular detail than a summary page like this one can responsibly attempt.

Status as of 21 July 2026. This page will be reviewed and updated if FDA issues further QMSR implementation guidance materially affecting the substance below; next scheduled review 1 October 2026.

QSR to QMSR: the substantive differences beyond renaming

The change is not merely a rebrand. The QMSR's central substantive move is incorporating ISO 13485:2016, the internationally recognized medical device quality management system standard, by reference, meaning US manufacturers are now held to a quality system standard built on the same international baseline the EU, and most other major medical device markets, already use, rather than a US-specific standard developed independently.

This is a genuine convergence, not a full unification. The QMSR incorporates ISO 13485 as its base but layers specific FDA additions on top, covering areas where FDA's regulatory expectations go beyond or diverge from the international standard, including specific US labelling and complaint-handling provisions and FDA's own inspection and enforcement authority, which operates independently of ISO 13485 certification itself. FDA's QMSR page also notes that where any clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or its implementing regulations, the FD&C Act controls, so the incorporation by reference doesn't hand interpretive authority over to the ISO standard wholesale.

The inspection process changed alongside the substantive standard. As of the 2 February 2026 effective date, FDA retired its longstanding Quality System Inspection Technique (QSIT), historically used for QSR inspections, and now inspects device manufacturers under an updated compliance program, "Inspection of Medical Device Manufacturers" (CP 7382.850), which supersedes QSIT and the previous QSR-era inspection compliance programs. The new approach drops QSIT's four-subsystem sampling in favour of assessing the quality system as an integrated whole, organised around six QMS areas aligned with ISO 13485's structure plus a set of other applicable FDA requirements. Manufacturers who built their inspection readiness around QSIT's specific structure should expect the mechanics of an FDA inspection, not just the underlying quality standard being assessed, to look materially different going forward.

The ISO 13485 convergence, and why EU-first teams win here

For a manufacturer that built its quality management system to ISO 13485 from the start, the common approach for any company also pursuing EU MDR conformity, the QMSR transition substantially reduces the incremental quality-system work needed to satisfy FDA. Rather than maintaining two structurally distinct quality systems, one built to the old US QSR and one to ISO 13485 for the EU, a single ISO 13485-aligned QMS now serves as the base for both markets, with FDA-specific additions layered on top rather than an entirely separate system built in parallel.

This is worth stating plainly rather than hedging: EU-first teams win the QMSR transition. A company that sequenced its regulatory strategy around CE marking first, and built its quality system to ISO 13485 as a natural consequence of that sequencing, now finds that same quality system carries most of the way toward FDA readiness with comparatively modest additional work. A company that built toward the old QSR specifically, without an EU relationship prompting ISO 13485 adoption, faces a more substantial rebuild rather than an incremental update, precisely because the standard it built to no longer exists as the operative US requirement.

This is one of the clearer practical arguments for building your quality management system to ISO 13485 as your default starting point, even if your first regulatory submission is US-focused: a QMS built this way now serves the QMSR baseline directly and positions you for EU MDR work later with meaningfully less rebuilding than under the previous, more divergent QSR framework. What a CE File Transfers to SFDA and the GCC covers this convergence as one part of a broader multi-market evidence reuse strategy.

Gaps that remain FDA-specific

Convergence is not equivalence, and a few areas remain distinctly FDA's own regardless of ISO 13485 alignment. FDA's specific complaint-handling and medical device reporting (21 CFR Part 803) requirements carry US-specific procedural detail beyond what ISO 13485 itself specifies. FDA's inspection authority and enforcement mechanisms operate under FDA's own statutory framework, independent of any ISO certification a manufacturer holds. The QMSR's incorporation of ISO 13485 doesn't itself grant, or substitute for, FDA clearance or approval of any specific device. A compliant quality system is necessary but separate from your specific device's premarket submission and review, whether that submission is a 510(k) clearance or a PMA approval.

Record retention is another area worth flagging specifically. FDA's QMSR guidance notes that investigators may review quality system records created before the 2 February 2026 effective date when assessing compliance, so manufacturers shouldn't treat the effective date as a clean line after which pre-existing records become irrelevant to an inspection.

Why the timing caught some teams off guard

Part of why this transition is still landing on some founders as news, months after the effective date, is that FDA finalized the rule well over a year in advance of it taking effect, and a rule announced that far ahead of its deadline is easy to file away as a future problem rather than something to plan around immediately. Teams mid-build on a first submission, focused on the immediate mechanics of getting a device to clearance or approval, understandably prioritized nearer-term deadlines over a quality system standard that wouldn't bind them for another year or more at the time.

That's a reasonable prioritization in the moment, but it means a meaningful number of companies are only now, past the effective date, working through what the QMSR actually requires of their specific quality system rather than having planned for it well in advance. If that describes your situation, you're not unusually behind. You're just past the point where treating this as a future problem is still an option.

Who needs to act now, and who's already covered

Manufacturers already ISO 13485 certified, most commonly companies with an existing or planned EU MDR relationship, face the smallest incremental burden: confirming their existing quality system addresses the specific FDA-layered additions the QMSR requires on top of the ISO 13485 base, rather than building a quality system from scratch. Manufacturers still operating under the legacy QSR framework without ISO 13485 alignment face more substantial work, effectively needing to build toward ISO 13485 as their new baseline rather than making incremental adjustments to their existing QSR-based system.

This second group is, in our experience, larger than the QMSR's February 2026 effective date might suggest. Many US-facing founders, particularly those without an existing EU relationship prompting ISO 13485 adoption earlier, have not fully absorbed that the QSR they may have been planning around no longer exists as the operative standard. If your regulatory roadmap, internal wiki, or vendor contracts still reference "21 CFR Part 820 QSR compliance" as a standalone target without mentioning ISO 13485, that's a reasonably reliable sign this transition hasn't been fully absorbed into your planning yet.

What changes if you're mid-submission

Teams with a submission already in progress when the QMSR took effect sometimes assume the transition doesn't apply to them until their next audit cycle. That's not a safe assumption. The QMSR's effective date applies to ongoing quality system obligations, not just to new product submissions filed after that date. A device already cleared or approved under the old QSR is still subject to QMSR-standard quality system compliance for as long as it remains on the market, and FDA's inspection process changed on the same date regardless of when any individual device was originally cleared.

Practically, this means a company partway through a 510(k) or PMA submission when the QMSR took effect should confirm its quality system documentation, particularly design controls and risk management records, aligns with ISO 13485's structure and terminology, not just the legacy QSR's, even if the underlying substantive practices barely changed. Reviewers and inspectors working from the new standard will expect to see it reflected in how the quality system is documented, not only in what it substantively does.

Vendor and supplier implications

The QMSR's reach extends beyond a manufacturer's own internal quality system. ISO 13485 places specific expectations on supplier and vendor management, including documented criteria for selecting and evaluating suppliers and monitoring their ongoing performance, that go somewhat further than what many QSR-era supplier management programs were built to track. A manufacturer that previously ran supplier qualification informally, or with lighter documentation than ISO 13485 expects, may find this is one of the more time-consuming areas to bring up to standard, particularly if a supply chain includes contract manufacturers or software vendors who themselves need to demonstrate an appropriate level of quality system rigor.

This has a practical knock-on effect for companies that rely heavily on contract manufacturing or outsourced software development. It's worth confirming early whether your key suppliers and vendors already operate to ISO 13485 or an equivalent standard, since a supplier that doesn't will require more oversight and documentation from your side to close that gap, and that oversight burden falls on your quality system regardless of whose facility the actual work happens in.

Building a transition timeline that survives scrutiny

Where a company's quality system sits today should determine the shape of its transition timeline more than the calendar does. A company that's ISO 13485 certified already is mostly doing a gap analysis against the FDA-specific additions and a documentation review, work that's realistically measurable in weeks rather than quarters for a team that's organized about it. A company rebuilding from a QSR-only baseline is looking at a genuine quality system build: procedures, training, internal audit cycles, and often a period of running the new system in practice before it's mature enough to withstand external scrutiny confidently.

Whichever position you start from, it's worth avoiding a transition plan that treats the QMSR as a documentation exercise to complete once and file away. ISO 13485 expects an operating quality system, one that's actually used to run design control, risk management, and corrective action processes day to day, not just a set of procedures that exist on paper to satisfy an inspector's checklist. A quality system that's been recently rebuilt but not yet actually exercised through a real design change, a real complaint, or a real corrective action tends to reveal its gaps exactly when an FDA inspector or a Notified Body auditor tests it against a live example rather than a hypothetical one.

Compliance checklist

Confirm your quality management system's foundational standard: is it built to the legacy QSR structure, or ISO 13485? If the latter, focus your remaining QMSR work on the FDA-specific additions layered on top: complaint handling, medical device reporting, and US-specific labelling and documentation practices. If the former, treat this as a substantive quality system rebuild toward ISO 13485 as the new baseline, not an incremental update, and budget the timeline accordingly.

If you're simultaneously planning EU MDR work, build to ISO 13485 once, with both the QMSR's FDA-specific additions and MDR's own requirements layered on top of that shared foundation, rather than building toward either framework's quality system requirements in isolation. And regardless of which group you're in, check whether your inspection readiness planning still assumes the legacy QSIT structure; if it does, update it against FDA's QMSR-era inspection compliance program, "Inspection of Medical Device Manufacturers" (CP 7382.850), rather than assuming the mechanics of an FDA inspection are unchanged.

Frequently asked questions

Does the QMSR change apply to devices already cleared under the old QSR? Yes, in the sense that ongoing quality system compliance for currently marketed devices is now assessed against the QMSR standard from its effective date forward, not against the QSR that was in force when the device was originally cleared. This is a live compliance obligation, not something that only affects new submissions.

Is ISO 13485 certification itself now mandatory for US manufacturers? The QMSR incorporates the ISO 13485 standard by reference into FDA's own regulation. Formal third-party ISO 13485 certification is a separate, related question: some manufacturers hold formal certification, others build to the standard without seeking separate certification, but either way, the QMSR's substantive requirements now track the ISO 13485 standard itself.

Does an ISO 13485 certificate mean we automatically satisfy the QMSR? Not entirely. It satisfies the substantial base the QMSR incorporates, but you still need to specifically address the FDA-layered additions, complaint handling, medical device reporting, and other US-specific provisions, that sit on top of the ISO 13485 base within the QMSR itself.

How does this affect a company planning its first-ever quality management system? Favorably, in the sense that there's now one converged standard to build toward rather than two meaningfully divergent ones, if you're planning both US and EU work. Build to ISO 13485 as your baseline from the start, and treat both the QMSR's and MDR's specific additional requirements as layers on top of that shared foundation.

Does the QMSR change how FDA inspects manufacturers, not just what standard it inspects against? Yes. On the QMSR's 2 February 2026 effective date, FDA retired the Quality System Inspection Technique (QSIT), the framework historically used for QSR inspections, and replaced it with an updated compliance program, "Inspection of Medical Device Manufacturers" (CP 7382.850). Instead of QSIT's subsystem sampling, inspections now assess the quality system as an integrated whole across QMS areas aligned with ISO 13485's structure. Manufacturers should expect both the standard being assessed and the inspection mechanics themselves to differ from pre-2026 FDA inspections; FDA's own QMSR pages remain the authoritative reference for the current detail.

Where can we find FDA's official QMSR guidance? FDA publishes QMSR-specific guidance and resources through its own official channels. Its main QMSR overview page is at fda.gov/medical-devices/postmarket-requirements-devices/quality-management-system-regulation-qmsr, and its dedicated FAQ page is at fda.gov/medical-devices/quality-management-system-regulation-qmsr/quality-management-system-regulation-frequently-asked-questions. Given the still-evolving implementation detail, we recommend checking those pages directly alongside this summary, and treating this page as directional context rather than a substitute for FDA's own primary guidance.

The free MedTech Compass can help clarify where your current quality management system likely stands relative to the QMSR baseline, as a starting point for a more detailed gap review.

---

Where next: Why Most 510(k)s Get an Information Request · 510(k) vs De Novo vs PMA: Which FDA Pathway · Building an MDR Technical File and CER