If your company manufactures or exports medical devices to the United States, 21 CFR Part 820 is mandatory. As of February 2, 2026, Part 820 has been amended and renamed the Quality Management System Regulation (QMSR) — the most significant change in over 25 years. This guide explains the current good manufacturing practice (CGMP) requirements of 21 CFR Part 820 and what manufacturers must do now.
What Is 21 CFR Part 820?
21 CFR Part 820 is the US FDA regulation that establishes current Good Manufacturing Practice (CGMP) requirements — in the form of a quality management system (QMS) — for medical device manufacturers. Its purpose is to ensure devices are designed, produced, packaged, labeled, stored, installed, and serviced to be safe, effective, and consistently of high quality.
The regulation applies to finished device manufacturers intending to commercially distribute devices in the United States, including foreign manufacturers exporting into the US. Failure to comply with any applicable requirement renders a device “adulterated” under Section 501(h) of the FD&C Act, exposing manufacturers to warning letters, import refusals, injunctions, and consent decrees.
The Big Change: From QSR to QMSR (Effective February 2, 2026)
In February 2024, the FDA issued the final rule “Medical Devices; Quality System Regulation Amendments.” Key points:
- Renamed: From Quality System Regulation (QSR) to Quality Management System Regulation (QMSR).
- Incorporates ISO 13485:2016 by reference (IBR): Most of the technical content of the old Part 820 is replaced by direct references to ISO 13485:2016, the international QMS standard for medical devices. Definitions draw on ISO 13485 and Clause 3 of ISO 9000:2015.
- Effective February 2, 2026: The legacy QSR was removed and the QMSR came into full force.
- Global harmonization: Aligns the FDA framework with other regulators (the basis of MDSAP), reducing burden for globally operating manufacturers.
Critical: ISO 13485 Compliance Does NOT Fully Satisfy the QMSR
This is a common and costly misconception. The FDA retained additional, FDA-specific requirements beyond ISO 13485 (mainly in §820.10, §820.35, and §820.45). An ISO 13485 certificate does not exempt a manufacturer from FDA inspection.
The New Structure of Part 820 (QMSR)
After incorporating ISO 13485, Part 820 is much shorter, with many sections marked “Reserved” (pointing directly to ISO 13485). The sections the FDA kept with unique content include:
- §820.1 – Scope.
- §820.3 – Definitions: uses ISO 13485 and ISO 9000 definitions, plus FDA-specific terms (e.g., “component,” “finished device”).
- §820.7 – Incorporation by reference: confirms references to ISO 13485:2016 and ISO 9000:2015.
- §820.10 – Requirements for a QMS: links applicable FDA requirements — Medical Device Reporting (Part 803), Unique Device Identification (Part 830), Corrections and Removals (Part 806), Device Tracking (Part 821), and implantable-device traceability.
- §820.35 – Control of records: more explicit content requirements for complaint and servicing records, plus UDI.
- §820.45 – Device labeling and packaging controls: added label-accuracy inspection before release.
Core Requirements (via ISO 13485:2016)
Because the QMSR incorporates ISO 13485:2016, manufacturers must meet its full requirements, including a risk-based approach throughout the QMS, management responsibility, resource and competence management, design and development controls (Clause 7), purchasing and supplier controls, production and process validation with traceability, and measurement, analysis and improvement (internal audit, control of nonconforming product, and CAPA).
Notable shift: “risk” appeared minimally in the old QSR but is emphasized throughout ISO 13485:2016 — so the QMSR effectively codifies risk management across the entire QMS.
Inspections, MDSAP & Combination Products
- On February 2, 2026, the FDA stopped using QSIT and adopted the inspection process in Compliance Program 7382.850.
- An ISO 13485 certificate does not exempt a manufacturer from FDA inspection.
- MDSAP participants remain exempt from routine FDA inspections.
- The QMSR includes conforming edits to 21 CFR Part 4 for combination products, clarifying device QMS requirements without changing their CGMP requirements.
Why Vietnamese & FDI Manufacturers Should Care
The US is the world’s largest medical device market. For Vietnamese and FDI manufacturers targeting export, building a QMS that meets the QMSR / ISO 13485:2016 is a prerequisite for lawful distribution, avoiding import refusals, and unlocking market growth.
Our End-to-End Services
We help Vietnamese and FDI manufacturers from gap analysis to certification and inspection readiness, working bilingually in English and Vietnamese:
- Gap analysis (QSR → QMSR / ISO 13485) with a mapping matrix.
- QMS planning & documentation integrating FDA-specific provisions (§820.10/35/45).
- Risk management (ISO 14971) & design controls with a complete Design History File.
- Training — awareness, role-specific, and internal auditor courses.
- Implementation, process/software validation & trial operation.
- Internal audit & mock FDA inspection (CAPA).
- ISO 13485 certification support & FDA / MDSAP readiness.
Frequently Asked Questions (FAQ)
1. Does 21 CFR Part 820 still exist after 2026? Yes. It was amended and renamed the QMSR, incorporating ISO 13485:2016 by reference instead of restating every requirement.
2. Is an ISO 13485 certificate enough for FDA compliance? No. ISO 13485 is the foundation, but manufacturers must also meet FDA-specific requirements (§820.10/35/45) and remain subject to FDA inspection.
3. Does the FDA issue a “certificate” under the QMSR? No. The FDA inspects and enforces; it does not certify. You may obtain ISO 13485 certification from a certification body while also complying with the QMSR.
4. We complied with the old QSR — what now? Run a QSR → QMSR gap analysis, update procedures to ISO 13485:2016 plus FDA-specific requirements, and prepare for the new inspection process.
Contact Us for a Business Consultation
Let us guide your journey to the US medical device market — compliant, inspection-ready, and built to last.
📞 Hotline: +84 933 096 426 – +84 868 591 260
✉️ Email: info@iscglobal.asia | van.pham@iscglobal.asia
🌐 Website: iscglobal.asia | iscglobal.edu.vn
Beyond the Acronym: 5 Surprising Ways the New FDA QMSR Changes Everything for MedTech
On February 2, 2026, the medical device industry crossed a regulatory Rubicon. It was the day the FDA officially retired its 1997-era Quality System Regulation (QSR) in favor of the new Quality Management System Regulation (QMSR). This wasn’t a minor patch; it was the most significant modernization of medical device oversight in over a quarter-century.
For decades, MedTech professionals have navigated a dense “acronym ocean,” anchoring their operations in the three-letter pillars of the DHF, DMR, and DHR. By incorporating ISO 13485:2016 by reference, the FDA has harmonized U.S. requirements with global standards, aiming to reduce administrative waste and “regulatory debt.” But don’t let the talk of “harmony” fool you. Beneath the surface, this transition contains hidden “sharp edges.” For the unprepared, the move from a rigid checklist to a risk-based “living system” creates new liabilities that move beyond the quality department and straight into the C-suite.
1. TAKEAWAY 1: The Death of the “Big Three” (DHF, DMR, DHR)
The most immediate shock to the system is the removal of the legacy terms that have defined FDA inspections for a generation. The Design History File (DHF), Device Master Record (DMR), and Device History Record (DHR) are no longer codified in the regulation.
In their place, the FDA has adopted the international lexicon of ISO 13485:
- Design and Development File (DDF): Replaces the DHF, documenting the design evolution.
- Medical Device File (MDF): Replaces the DMR. Critically, the MDF is broader than its predecessor; while the DMR was a “recipe,” the MDF serves as a comprehensive technical repository often including clinical evaluation, intended use, and risk management data.
- Batch Records: These replace the DHR, providing the production history and evidence of conformity for each unit or lot.
While the FDA allows firms to maintain these legacy terms internally, there is a catch: you must provide a documented crosswalk or mapping that explicitly links your old-school folders to the new QMSR structure. Sticking to the old language without this bridge is a tactical blunder. In the eyes of a modern investigator, a firm still “living in 1997” isn’t just behind on paperwork—it signals a stagnant quality culture that has failed to embrace the risk-based thinking required by the new law.
“The rename reflects the shift to align with the internationally used term ‘quality management system’ as defined in ISO 13485.”
2. TAKEAWAY 2: The “Open Books” Policy—Internal Audits Are No Longer Off-Limits
For years, the quality department operated behind a “transparency shield.” Under the old §820.180(c) exemption, internal audits, management reviews, and supplier audits were generally off-limits to FDA investigators. This allowed firms to document their “dirty laundry”—unresolved internal findings—without fear that an inspector would immediately turn them into a Form 483 observation.
That shield is officially dead. Under the QMSR, these records are now fully inspectable. FDA investigators can now walk into your facility and demand to see your management review minutes and internal audit reports.
The strategic risk here is visceral: unresolved internal findings are now an admission of adulteration. If an investigator finds a systemic issue in your internal audit that hasn’t yet been entered into a formal CAPA or addressed with a documented corrective action plan, it is no longer just a “finding”—it is evidence of a systemic failure to self-correct. This forces a transition from a “culture of compliance,” where records are polished for an auditor, to a “culture of quality,” where the QMS must proactively hunt for risk before the FDA does.
“FDA now has the authority to inspect these records… internal audits, management reviews, and supplier audits are now inspectable.”
3. TAKEAWAY 3: The “Certification Trap”—Why an ISO Badge Isn’t Enough
A dangerous misconception is circulating in executive boardrooms: “We are ISO 13485 certified, so we are QMSR compliant.” This logic is a trap. While the FDA has incorporated the ISO standard, it has anchored the QMSR with §820.10, a section that acts as a mandatory link to supplemental U.S. requirements that ISO auditors never touch.
To be truly compliant, ISO-certified firms must bridge the “FDA-Specific Extras” gap:
- Reporting & Tracking Anchors (§820.10): Your QMS must explicitly integrate Medical Device Reporting (Part 803), Recalls/Advisory Notices (Part 806), and Device Tracking (Part 821).
- Record Content Rigor (§820.35): The FDA requires specific data fields that ISO doesn’t—including seven required fields for complaints (like complainant contact info and specific UDI/UPC details) and six for servicing records.
- Labeling Accuracy (§820.45): A frequent point of failure for ISO firms is the FDA’s strict requirement to inspect labels for accuracy before release to prevent misbranding.
- Unique Device Identification (UDI): Mandatory recording of UDIs for each device or batch under Part 830.
“ISO 13485 certification does not mean you are automatically in compliance with QMSR.”
4. TAKEAWAY 4: From “Rep” to “Top”—The CEO is Now the Target
In the legacy QSR era, executive management often delegated quality oversight to a “Management Representative,” effectively creating a “Quality Manager Shield” for the C-suite. The QMSR effectively strips that shield away by adopting the ISO concept of “Top Management.”
This is not just a title change; it is a shift in legal accountability. The FDA now expects the CEO and the Board to direct and control the quality system at the highest level. This aligns with the “Responsible Corporate Officer” doctrine, where executives can be held personally liable for regulatory failures occurring under their watch.
We are seeing this evolve from a burden into a strategic advantage. Consider the shift at firms like Smith & Nephew, where regulatory data moved from “manual fire drills” to real-time dashboards. By integrating quality data into the business strategy, the regulatory team becomes a commercial partner—advising on budget cycles, renewal sequencing, and M&A readiness. A clean, QMSR-compliant system is no longer a downstream checkbox; it is a high-value commercial asset that accelerates speed to market.
“The role of ‘top management’ now implies CEO or board endorsement… a shift from the older QSR role of a delegated ‘management representative’.”
5. TAKEAWAY 5: The “Adulterated” Clause and the $532 Million Bet
The FDA is making a massive $532 million bet that harmonization will save the industry half a billion dollars in administrative waste and redundant audits. However, the price of admission for these savings is a heightening of legal stakes.
As of February 2, 2026, any device manufactured under a system that fails to meet QMSR requirements is legally “adulterated” under Section 501(h) of the FD&C Act. The threat is no longer just a sternly worded letter. “Adulteration” gives the FDA the power to trigger import refusals and product seizures. One bad batch or one missed procedure can now result in a total loss of market access, effectively killing the promised administrative savings in a single afternoon. The FDA has handed the industry a check for $532 million, but they’ve kept their hand on the “seizure” button to ensure every cent is earned through rigorous compliance.
CONCLUSION: A Living System, Not a Filing Cabinet
The move to QMSR represents a transition from reactive compliance to proactive, risk-based management. It is a realization that in a global MedTech market, quality cannot be siloed by geography or administrative legacy.
The heart of your regulatory operations is no longer a static filing cabinet filled with DHFs and DMRs; it is a living, connected system that integrates risk management across the entire product lifecycle. As the line between international standards and U.S. law vanishes, one question remains for leadership: Is your quality system a barrier to entry, or is it your most valuable commercial asset?
Contact us to download the bilingual English-Vietnamese PDF standard: from only $50
On the path toward integration and export, correctly understanding and applying international standards is essential. Yet language and technical terminology often pose real barriers. We are pleased to introduce our bilingual (English – Vietnamese) standards documentation service, translated by our own team of certification consultants.
What We Provide
• A clause-by-clause bilingual comparison, easy to consult and file.
• Professional Vietnamese translation in correct technical terminology, ready to use.
• Interpretation notes and application guidance from hands-on experts.
• Fast delivery in editable, easy-to-store PDF/Word format.
Standards Covered
ISO management systems (9001, 14001, 45001, 37001); sustainability certifications (ISCC, FSC, VFCS/PEFC); textiles and recycled materials (GRS, OCS, OEKO-TEX); social responsibility and ESG (SMETA, EcoVadis, Fairtrade), and many other industry standards upon request.
Why Choose Us
Our documents are translated by professionals who directly consult on and audit certifications, so the translation is accurate not only in language but also in real-world application — saving you time and reducing errors when preparing documentation.
Pricing
From only USD 50 per document, depending on length and complexity. Please send us the standard name to receive a free, accurate quotation.
How to Order
1. Contact us with the name of the standard you need.
2. Receive a quotation and delivery time.
3. Make payment and receive your document by email.
Payment
Bank transfer via QR code (provided with the quotation), or via PayPal: ducluongservices@gmail.com.
We look forward to accompanying you on your certification journey.
Best regards,
CONTACT INFORMATION
Hotline: +84 933096426 – +84 868 591 260
Email:
Website:
No responses yet