At the beginning of 2024, the US FDA published a final rule to amend the device CGMP requirements of Quality System Regulation (QSR, CFR 21, Part 820) to closely align with ISO 13485, which is used by regulatory authorities in other countries. This alignment was achieved by referencing the current 2016 version of ISO 13485 and the current 2015 version of Clause 3 of ISO 9000. This revised part 820 is now referred to as the Quality Management System Regulation (QMSR), replacing the QSR. This rulemaking marks the first major revision of part 820 since 1996.
The new QMSR is substantially similar to the current QMS; therefore, the effort for firms to update its current QMS is limited. Hence, a two-year transitional period is set for firms to align their QMSs, processes, and documents with the QMSR. The new rule becomes effective on 02 February 2026. Until the effective date of the new rule, the current QSR still applies. However, firms may choose to begin complying with the QMSR before the effective date.
1. Scope remains unchanged
The US FDA’s new QMSR has the same scope as the QSR, but aims to harmonize with international standards ISO 13485 where possible. For instance,
- like the QSR, the new QMSR also only applies to the finished medical devices manufacturers; third-party services such as manufacturers of components or parts of finished devices and refurbishers are excluded from its scope. However, these manufacturers are encouraged to consider provisions of the QMSR.
- The final rue incorporates the entire section of Introduction from ISO 13485, which sets forth important concepts towards harmonization.
2. Definitions harmonized to the greatest extent
The FDA has integrated definitions outlined in ISO 9000 into the new QMSR, mirroring ISO 13485’s practice of referencing ISO 9000 as a normative standard. In alignment with ISO 13485, the FDA adopted this approach to ensure as much harmonization as possible with ISO 13485, incorporating its terms and definitions.
a) To harmonize with ISO 13485, US FDA also eliminated the terms “device master record” (DMR), “design history file” (DHF), and “device history record” (DHR) from the new QMSR because those records are largely required to be documented by ISO 13485, including Clause 4.2 and 7, and will be located in the manufacturer’s medical device file (MDF).
b) However, a few terms don’t appear in ISO 13485, but are defined in the QSR and therefore, remain in the new QMSR.
- Components means any raw material, substance, piece, part, software, firmware, labeling, or assembly that is intended to be included as part of the finished, packaged, and labeled device.
- Rework means action taken on a nonconforming product so that it will fulfil the specified requirements in the medical device file (MDF) before it is released for distribution.
Additionally, terms such as “finished device” and “remanufacturer” are used specially by US FDA in the QMSR, but have substantially the same meaning as the definition of medical device and system and procedure packer (SPPP) in the EU MDR.
- Finished device means any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.
- Remanufacturer means any person who processes, conditions, renovates, repackages, restores, or does any other act to a finished device that significantly changes the finished device’s performance or safety specifications, or intended use.
3. Other changes with the QMSR
- Under the QSR, management review, internal audit and supplier audit reports are exempted from FDA inspection. With the introduction of QMSR, these reports must be made available to FDA inspector as in a normal ISO 13485 audit.
- CFR 820.45 Device Labeling and Packaging Control is retained from the QSR and is an additional requirement compared ISO 13485 7.5.1 regarding labeling requirements. These requirements explicitly mandate manufacturers to ensure labeling and packaging, such as, UDI, expiration date, storage instructions, handling instruction, and any additional processing instructions, have been examined prior to release or storage. The aim of adding this requirement is to strengthen controls for labeling and packaging operations, given that many device recalls are related to labeling and packaging.
4. Conclusion
Incorporation by reference ISO 13485 enables US FDA to give legal effect to privately developed technical standards like ISO 13485 and ISO 9000. With the incorporation of ISO 13485 in the QMSR, the requirements of ISO 13485 become the foundational requirements for device CGMPs. However, the FDA also imposes limited additional requirements such as labelling and reporting requirements, as a part of the QMSR, which manufacturers must comply with in addition to those set forth in ISO 13485.
With the issuance of the new QMSR, the FDA doesn’t intend to require medical devices manufacturers to obtain ISO 13485 certificate, nor will an ISO 13485 certificate replace FDA inspection. This is because the FDA inspection covers also other FDA medical device requirements such as parts 803 (medical device reporting), 806 (reports of corrections and removals), 821 (medical device tracking requirements), and 830 (unique device identification).
When ISO 13485 is updated in the future, the FDA will evaluate these changes to determine the impact and whether the QMSR should be amended.