The FDA QMSR Is in Effect: A 10‑Point Compliance Checklist

On February 2, 2026, the FDA's Quality Management System Regulation (QMSR) took effect, replacing the Quality System Regulation (QSR) that had governed medical device manufacturing under 21 CFR Part 820 since 1996. The final rule was published on February 2, 2024, giving industry a two-year transition window — and that window is now closed. There is no grace period and no phased enforcement: if your company makes, imports, or distributes finished medical devices for the US market, the QMSR is the standard your quality system is inspected against today.

The core of the change is simple to state: the QMSR incorporates ISO 13485:2016 by reference, harmonizing the FDA's quality system requirements with the international standard most of the world already uses. But "harmonized" does not mean "identical," and it definitely does not mean "automatic." The FDA kept a set of US-specific requirements layered on top of ISO 13485, changed inspection-relevant terminology, and removed some old comforts manufacturers had grown used to.

Use the ten checks below as a self-audit. If you can answer "yes, and I can show the record" to all ten, you're in good shape. Anything less is a gap worth closing now — on your schedule — rather than during an inspection, on the FDA's.

1. Have you run a documented gap assessment against ISO 13485:2016 plus the QMSR additions?

A gap assessment is the foundation of every defensible transition. It should map each of your existing procedures to the clauses of ISO 13485:2016 and to the QMSR's US-specific sections, note where terminology, records, or process steps differ, and assign owners and dates for remediation. If your transition consisted of "we renamed some documents," an investigator will find what the renaming missed. If you haven't done a formal assessment at all, start here — it typically takes a small company one to three weeks and drives every other item on this list. BushmanQC performs these as part of Quality System Remediation.

2. Do you actually have a licensed copy of ISO 13485:2016?

It sounds trivial, but it matters: the QMSR incorporates ISO 13485:2016 by reference, and the standard itself is copyrighted — the text of the requirements is not reproduced in the CFR. You cannot demonstrate conformity to a document your quality team has never read. Buy a licensed copy (and ISO 14971 for risk management while you're at it), reference it properly in your Quality Manual, and make sure the people who own your procedures have access to it.

3. Have you updated your Quality Manual and terminology?

The QMSR retires vocabulary that has been on FDA forms and in FDA procedures for decades. The most visible shifts:

• Design History File (DHF), Device Master Record (DMR), and Device History Record (DHR) as standalone defined terms give way to ISO 13485's medical device file concept (clause 4.2.3). You don't have to physically reorganize your records, but your procedures need to speak the new language and map old structures to it.
• "Management with executive responsibility" becomes ISO's "top management."
• Where the FD&C Act defines a term differently than ISO 13485 — device, labeling, manufacturer, and others — the statutory definition controls under the QMSR. Your procedures shouldn't rely on ISO definitions where the FDA's differ.

4. Do your records meet the QMSR's added records requirements?

The QMSR did not simply adopt ISO 13485's documentation rules; it added US-specific records controls (codified at § 820.35). In practice, check that:

• Complaint handling and servicing records capture the information needed to support Medical Device Reporting (21 CFR Part 803) decisions, and the rationale when you decide an event is not reportable;
• Records include the unique device identifier (UDI) or other identification where applicable;
• Signatures and dates are applied and controlled the way your procedures say they are — which, in a Virtual QMS, means 21 CFR Part 11-compliant electronic signatures.

5. Are your labeling and packaging inspection controls still in place?

The FDA concluded that ISO 13485 alone is not specific enough on labeling and packaging, so the QMSR retains dedicated requirements (codified at § 820.45) consistent with the old QSR's labeling controls. Label mix-ups remain one of the most common causes of recalls. Keep your labeling inspection, release, and reconciliation activities — and their records — exactly as rigorous as before. This is one area where "ISO 13485 says less" must not translate into "we do less."

6. Are your management reviews and internal audits inspection-ready?

Under the old QSR, FDA policy was not to routinely review management review minutes, internal quality audit reports, or supplier audit reports during inspections. That carve-out did not survive the transition: ISO 13485 treats these as ordinary QMS records, and under the QMSR you should expect that an investigator can ask to see them. Two practical consequences:

• Run management reviews at their planned frequency, with the required inputs and documented outputs — the meeting you skipped during a busy quarter is now a visible gap.
• Write audit findings and management review minutes professionally, as documents an outside reader may someday examine: factual, specific, and paired with CAPAs where they identify problems.

7. Is risk management woven through your processes — not just your design file?

ISO 13485:2016 applies a risk-based approach across the whole QMS: supplier controls, process validation, training, software validation, outsourced processes — not only product risk analysis during design. Check that your procedures say how risk informs decisions in each area, and that records show it happening. A supplier file that contains a risk-based justification for its qualification level is worth more in an inspection than a thick file with no rationale.

8. Have you retrained your team — and documented it?

Every procedure you touched during the transition triggers training for the people who execute it. An investigator who sees a procedure revised in January 2026 and no corresponding training records will write the finding in minutes. Make sure your training matrix reflects the new revisions, the training happened, and effectiveness was assessed where your procedures require it.

9. Have you re-evaluated suppliers and updated quality agreements?

If your quality agreements and purchasing controls reference "21 CFR 820 (QSR)" clauses or old terminology, update them. More substantively: apply the risk-based approach to your supplier evaluations, confirm critical suppliers can support your QMSR obligations (records, traceability, change notification), and document the re-evaluation. Supplier controls are a perennial top-five inspection finding, and the transition is a natural moment to tighten them.

10. Have you run a mock inspection under the new framework?

The FDA has been aligning its inspection approach with the QMSR's ISO-based structure, which changes the rhythm of an inspection even where requirements carried over. A half-day internal mock inspection — pulling your Quality Manual, a CAPA, a complaint file, a supplier file, and your latest management review, and challenging each against the QMSR — is the cheapest insurance you can buy. It tells you whether items 1 through 9 actually hold up under questioning.

How a Virtual QMS makes QMSR compliance simpler

Most QMSR gaps come down to records: procedures that don't match practice, training that wasn't logged, reviews that weren't documented. A Virtual QMS attacks that problem structurally — every document, training record, CAPA, and signature lives in one controlled, cloud-based system with 21 CFR Part 11-compliant electronic signatures, so the record exists the moment the work happens. BushmanQC implements a complete Virtual QMS in seven defined steps, aligned to the QMSR and ISO 13485 from day one, and remediates existing systems that haven't caught up to the new rule.

Related reading: FDA 21 CFR 820 vs ISO 13485 under the QMSR · What a QMS really costs a startup · Virtual QMS FAQ