ISO 13485 and the QMSR: what changed in FDA's quality system rule, and what device manufacturers must do now

FDA has replaced the long-standing Quality System Regulation (QSR) with the Quality Management System Regulation (QMSR). The rule keeps its home at 21 CFR Part 820 but abandons the old prescriptive subsystem-by-subsystem structure and instead incorporates ISO 13485:2016 by reference as the core of the U.S. device quality management system framework. Part 820 now reads as a short set of FDA-specific overlays sitting on top of the international standard, rather than a self-contained U.S. rulebook. The current codified Part 820 consists of just six sections: 820.1 Scope, 820.3 Definitions, 820.7 Incorporation by reference, 820.10 Requirements for a quality management system, 820.35 Control of records, and 820.45 Device labeling and packaging controls ¹²³⁴⁵⁶.

The headline change: ISO 13485:2016 is now the backbone of Part 820

The central structural shift is that the QMSR incorporates ISO 13485 by reference and builds FDA's remaining device-specific requirements around it, rather than restating a full quality system in U.S. regulatory language ⁶⁷. Section 820.7 fixes the exact editions that are legally binding: ISO 13485:2016(E), Medical devices, Quality management systems, Requirements for regulatory purposes, Third edition, dated March 1, 2016, is incorporated by reference for sections 820.1, 820.3, 820.10, 820.35, and 820.45; and ISO 9000:2015(E), Clause 3 (Terms and definitions), Fourth edition, dated September 15, 2015, is incorporated for the definitions in 820.3 ⁹.

Because a specific dated edition is codified, conformance means conformance to that edition. A manufacturer cannot substitute a newer or differently dated version of the standard and assume it satisfies Part 820; the incorporated text is the one FDA has adopted ⁹.

Two points of legal hierarchy matter here. First, where any ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or FDA's other implementing regulations, the FD&C Act and those regulations control ⁶. Second, the QMSR supplements the requirements in other parts of the chapter unless a provision says otherwise, and where a conflict exists between Part 820 and another part, the device-specific requirements prevail ⁶. ISO 13485 is therefore the operating framework, but it does not displace U.S. statutory obligations.

Scope: substantively the same reach, in QMSR language

Section 820.1 confirms that these are the current good manufacturing practice (CGMP) requirements for devices, now labeled the "quality management system regulation (QMSR)." They govern the methods, facilities, and controls used for the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use, and any manufacturer engaged in those activities must establish and maintain a quality management system appropriate for its specific device(s) ⁶¹¹.

The population of regulated manufacturers is broad and explicitly includes contract sterilizers, installers, relabelers, remanufacturers, repackagers, specification developers, and the initial distributors of foreign entities performing those functions. A manufacturer engaged in only some of these operations need only comply with the requirements applicable to those operations ⁶. The rule applies to finished devices manufactured in the United States or imported/offered for import, and imported devices remain subject to refusal of admission under section 801(a) if they appear adulterated ⁶¹¹.

Scope carve-outs and special cases carried over into the QMSR:

• Component and parts manufacturers are not subject to Part 820, though FDA encourages them to consider its provisions ⁶¹¹.
• Blood and blood components used for transfusion or further manufacturing are excluded and remain under subchapter F ⁶¹¹.
• HCT/Ps that are regulated as devices are covered, and are additionally subject to the donor-eligibility and current good tissue practice requirements in Part 1271, subparts C and D ⁶¹¹.

The FD&C Act section 520(f) mechanism for exemptions and variances survives: a manufacturer may petition for an exemption or variance under section 520(f)(2) via the 10.30 petition process, and FDA may itself grant a variance where it is in the best interest of public health, for example where there is a public health need for a device that would not otherwise be sufficiently available ⁶.

Importantly, the use of ISO terminology such as "safety and performance" does not change the U.S. statutory standard. Section 820.1 states expressly that this language does not alter the requirement that finished devices be safe and effective and otherwise compliant with the FD&C Act ⁶.

Definitions: a two-source vocabulary with a clear tie-breaker

Section 820.3 is the interpretive hinge of the QMSR because it reconciles ISO vocabulary with U.S. statutory vocabulary ⁸. The default rule is that the definitions in ISO 13485 and in Clause 3 of ISO 9000 apply to Part 820, except as specified in 820.3(b), and that they do not change the meaning of similar terms already defined elsewhere in Title 21 ⁸.

On top of that default, the section establishes a definitional hierarchy:

• All definitions in section 201 of the FD&C Act apply and supersede the correlating ISO 13485 terms. FDA gives the operative examples: "device" and "labeling" as defined in FD&C Act section 201(h) and (m) supersede ISO 13485's "medical device" and "labelling" ⁸.
• A specific set of terms in 820.3(b) supersede the correlating ISO 13485 or ISO 9000 terms, including "manufacturer," "organization" (defined as the manufacturer for purposes of Part 820), "implantable medical device" (tied to the meaning of "implant" in 860.3), "rework," and "safety and performance" (mapped to "safety and effectiveness" in Clause 0.1 of ISO 13485, with an added clarification that it does not reduce FDA-required controls) ⁸.
• Additional FDA terms not used or defined in the ISO standards are listed in 820.3(a): batch or lot, component, Federal Food, Drug, and Cosmetic Act, finished device, HCT/P regulated as a device, and remanufacturer ⁸.

For RA and quality teams, the practical takeaway is that "organization" in an ISO 13485 procedure means "manufacturer" for FDA purposes, and that where the standard and the statute both define a term, the statutory definition wins ⁸.

Requirements: ISO 13485 plus explicit FDA overlays

Section 820.10 is where the QMSR ties the two systems together. A manufacturer must document a quality management system that complies with both the applicable requirements of ISO 13485 (as incorporated) and the other applicable requirements of Part 820, and must also comply with other applicable Title 21 requirements as needed to fully satisfy specified ISO 13485 clauses ⁷. In other words, meeting ISO 13485 alone is not sufficient for U.S. compliance; the standard is read together with a defined set of FDA cross-references.

The FDA overlays that 820.10 layers onto specific ISO 13485 clauses:

• Unique Device Identification: for ISO 13485 Clause 7.5.8 (Identification), the manufacturer must document a system to assign a UDI in accordance with Part 830 ⁷.
• Traceability: for Clause 7.5.9.1 (Traceability, General), traceability procedures must conform to Part 821, where applicable ⁷.
• Complaint reporting: for Clause 8.2.3 (Reporting to regulatory authorities), the manufacturer must notify FDA of complaints meeting the Part 803 (Medical Device Reporting) criteria ⁷.
• Advisory notices: for Clauses 7.2.3, 8.2.3, and 8.3.3, advisory notices must be handled under Part 806 (Reports of Corrections and Removals) ⁷.

Two device-population requirements are also spelled out:

• Design and development: manufacturers of class II, class III, and certain class I devices must comply with ISO 13485 Clause 7.3 and its subclauses ⁷. This preserves the reach of design controls, now expressed through the ISO clause rather than the former 820.30.
• Traceability for implantable and life-sustaining devices: manufacturers of devices that support or sustain life, where failure could reasonably be expected to cause significant injury, must comply with ISO 13485 Clause 7.5.9.2 (Traceability for implantable devices) in addition to other applicable Part 820 requirements ⁷.

The enforcement consequence is unchanged in substance: failure to comply with any applicable Part 820 requirement renders a device adulterated under section 501(h) of the FD&C Act, and the responsible person is subject to regulatory action ⁷.

Records: FDA-specific content beyond the ISO clause

Section 820.35 requires compliance with ISO 13485 Clause 4.2.5 (Control of records) and then adds record-content requirements that the ISO clause does not itself dictate ¹⁰.

Complaint records. For complaints involving the possible failure of a device, its labeling, or its packaging to meet specifications, the manufacturer must keep records of the review, evaluation, and investigation. For complaints reportable under Part 803, complaints the manufacturer decides to investigate, and complaints actually investigated, the record must include: the device name; the date the complaint was received; any UDI or UPC and other device identifier(s); the complainant's name, address, and phone number; the nature and details of the complaint; any correction or corrective action taken; and any reply to the complainant ¹⁰.

Servicing records. For servicing activities, the record must include at a minimum: the device name; any UDI or UPC and other device identifier(s); the date of service; the individual(s) who serviced the device; the service performed; and any test and inspection data ¹⁰.

UDI and confidentiality. A UDI must be recorded for each device or batch of devices ¹⁰. Confidential records may be marked to help FDA determine whether the information may be disclosed under Part 20 ¹⁰.

Labeling and packaging: procedures and pre-release checks

Section 820.45 supplements ISO 13485 Clause 7.5.1 with device-specific labeling and packaging controls ¹³. Manufacturers must document and maintain procedures describing the activities that ensure the integrity, inspection, storage, and operations for labeling and packaging under customary conditions of processing, storage, handling, distribution, and, as appropriate, use ¹³.

Before release or storage, labeling and packaging must be examined for accuracy, including the correct UDI/UPC or other device identifier(s), expiration date, storage instructions, handling instructions, and any additional processing instructions ¹³. Release of labeling for use must be documented in accordance with Clause 4.2.5 ¹³. Labeling and packaging operations must be established and maintained to prevent mix-ups, including inspection before use so that all devices carry the correct labeling and packaging as specified in the device file, with inspection results documented under Clause 4.2.5 ¹³.

What a manufacturer needs to do now

The QMSR is in force. The codified Part 820 carries an amendment date in February 2026, and the six-section, ISO-based structure described above is the current regulation ¹²³⁴⁵⁶. Practical implications for a device manufacturer:

• Obtain and work from the exact incorporated editions. The binding texts are ISO 13485:2016(E) Third edition (March 1, 2016) and, for definitions, ISO 9000:2015(E) Fourth edition (September 15, 2015). Conformance is to those specific editions ⁹.
• Read ISO 13485 together with the FDA overlays, not in isolation. Map your QMS to the 820.10 cross-references so that Clause 7.5.8 is executed through Part 830 (UDI), Clause 7.5.9.1 through Part 821, Clause 8.2.3 through Part 803, and the advisory-notice clauses through Part 806 ⁷.
• Confirm design controls coverage. Class II, class III, and certain class I devices must satisfy ISO 13485 Clause 7.3; life-supporting/life-sustaining devices must also satisfy Clause 7.5.9.2 traceability ⁷.
• Align terminology in your documented system. Treat "organization" as "manufacturer," and recognize that FD&C Act section 201 definitions (for example, "device" and "labeling") supersede the ISO terms where they correlate ⁸.
• Update complaint-handling and servicing records to capture the specific data elements enumerated in 820.35, including UDI/UPC and the reportability linkage to Part 803 ¹⁰.
• Verify labeling and packaging procedures include the documented pre-release accuracy checks and mix-up prevention controls required by 820.45, with results retained under Clause 4.2.5 ¹³.
• Keep the statutory standard in view. ISO phrasing such as "safety and performance" does not lower the U.S. safe-and-effective standard, and noncompliance with any applicable Part 820 requirement still makes a device adulterated under section 501(h) ⁶⁷.

A reasonable next step for a regulatory team is to run a clause-by-clause gap assessment of the existing quality system against ISO 13485:2016 as incorporated, then layer the 820.3, 820.10, 820.35, and 820.45 FDA-specific requirements on top, documenting how each ISO cross-reference is satisfied through the corresponding Title 21 part.