The QMSR Transition: What Actually Changes in Your Quality System

The FDA's Quality Management System Regulation replaces the bulk of the old Quality System Regulation by incorporating ISO 13485:2016 directly into 21 CFR Part 820. If your quality system was already built to ISO 13485, the change is smaller than you fear. If it was built to the old Part 820 clause structure, the work is real — but it is mostly mapping, terminology, and records, not a rebuild.

What the QMSR actually is

For decades, US device manufacturers ran quality systems against 21 CFR Part 820 while most of the rest of the world ran against ISO 13485. The two were philosophically aligned and structurally different, which meant global companies maintained one quality system with two sets of clothing: a Part 820 mapping for FDA and an ISO 13485 mapping for notified bodies and MDSAP.

The QMSR ends that duplication. FDA amended Part 820 to incorporate ISO 13485:2016 by reference, so conformance with the standard is now the substantive requirement, supplemented by a set of FDA-specific provisions that the standard does not cover.

The most useful way to think about it: ISO 13485 is now the body of the regulation, and Part 820 is the wrapper that adds what FDA still needs on top. Your job in transition is to make sure the body is genuinely conformant and the wrapper is explicitly addressed.

What does not change

A surprising amount. Teams sometimes treat the QMSR as a green light to rewrite everything; it is not.

• FDA's inspection authority. Your facility is still subject to FDA inspection, and findings are still issued on Form 483 with warning letters where warranted.
• Separate regulations still stand. Medical Device Reporting (Part 803), corrections and removals (Part 806), establishment registration and device listing (Part 807), and labeling (Part 801) are not part of this change and continue to apply on their own terms.
• The substance of good quality practice. Design controls, CAPA, supplier controls, process validation, and complaint handling all still exist. They live under different clause numbers with somewhat different emphasis, but nobody is being told to do less.
• Your obligation to be inspection-ready every day. The regulation changed; the expectation of an operating, evidenced quality system did not.

What genuinely changes

1. Structure and cross-references

This is the largest volume of work and the least intellectually difficult. Every procedure, work instruction, form, quality manual section, and training record that cites an old Part 820 section now points to the wrong place. A quality system of any maturity contains hundreds of these references.

The trap is doing this as a blind find-and-replace. Old Part 820 sections do not map one-to-one onto ISO 13485 clauses — some split across several clauses, and some ISO clauses have no old Part 820 equivalent. Build a genuine mapping table first, then remediate against it.

2. Terminology

The vocabulary US device professionals have used for thirty years shifts toward ISO 13485's language. The most visible casualties are the three "records" everyone knows:

You are not forbidden from using the familiar names internally, and many companies keep them as aliases to avoid retraining an entire organisation overnight. But your documented system needs to make the equivalence explicit, and an auditor asking to see your "medical device file" should not be met with a blank stare.

3. Risk-based thinking becomes structural

The old Part 820 mentioned risk narrowly, chiefly in design validation. ISO 13485 threads a risk-based approach through the entire standard — processes, training, suppliers, software validation, monitoring. In practice this means you must be able to show the reasoning behind where you apply controls heavily and where you apply them lightly.

This is where organisations with a strong ISO 14971 risk management file have a real advantage: the analysis already exists and simply needs to be connected to quality system decisions.

4. Records and documentation control

FDA retained device-specific records expectations that ISO 13485 does not fully cover on its own — including provisions relating to device identification such as UDI, complaint records, and servicing records. These sit on top of the standard's general control-of-records clause. Treat them as a distinct checklist item during your gap assessment; they are easy to lose in the assumption that "ISO covers records."

The FDA overlay you cannot skip

The single most common misconception is that adopting ISO 13485 completes the job. It does not. The QMSR keeps a set of United States-specific provisions in Part 820 that sit alongside the standard — covering scope and applicability, FDA-specific definitions, the mechanics of incorporation by reference, the records provisions noted above, and controls for device labeling and packaging.

Certification is not compliance

FDA does not require ISO 13485 certification, and holding a certificate does not establish QMSR compliance. This matters for two reasons.

First, notified body and registrar audits are sampled and scheduled; FDA inspections are not the same exercise and may probe differently. A clean certificate is evidence of a functioning system, not a shield.

Second, certified organisations sometimes discover that their certified scope does not cover everything FDA cares about — for example, activities performed at a site excluded from the certificate, or FDA-specific provisions no registrar was ever assessing. Map your certified scope against your FDA obligations explicitly rather than assuming they are the same shape.

How inspections change

FDA's long-standing Quality System Inspection Technique was built around the old Part 820 subsystems. With the underlying regulation restructured, the agency has been moving to an inspection approach aligned to the new framework and better harmonised with international audit practice such as MDSAP.

The practical implication for you is less about predicting the investigator's route and more about navigability: an investigator should be able to ask for any element of the standard and be shown, quickly, where it lives in your system and what evidence supports it. Systems that were built to satisfy a specific inspection script tend to struggle when the script changes. Systems built around genuine process ownership do not.

If you make a combination product

Manufacturers operating under 21 CFR Part 4 should not assume their arrangement is untouched. Part 4's streamlined approach works by naming specific provisions from the device and drug regulations that must be layered onto a base quality system — and those device-side citations were conformed to the new structure.

If your Part 4 rationale document, quality manual, or internal audit programme names old Part 820 sections, it now cites a regulation that reads differently. The underlying obligations are broadly preserved; the references need updating and the mapping needs re-verification.

A practical transition sequence

The order matters. Most struggling transitions went straight to document revision without doing the mapping work first, then discovered halfway through that the mapping was wrong.

1. Build the mapping table. Old Part 820 section to ISO 13485 clause to FDA-retained provision. This is the backbone of everything downstream and the artefact an auditor will want to see.
2. Run a true gap assessment against the standard. Not against your old system. Assess clause by clause, and record objective evidence for each — where the requirement is met, and by which document or record.
3. Separate real gaps from naming gaps. Most findings will be "we do this, but we call it something else and cite the wrong section." Those are fast. The genuine gaps — often risk-based process controls, or FDA-retained records provisions — deserve the real effort.
4. Remediate documents in dependency order. Quality manual and mapping first, then core procedures, then forms and work instructions. Reversing this order guarantees rework.
5. Retrain on the changes, not on everything. Focused training on new terminology, new clause references, and any genuinely changed process. Record it — training records are a routine inspection target.
6. Run an internal audit against the new structure. Audit to ISO 13485 clauses plus the FDA-retained provisions, using the mapping table. This is your dry run and your evidence that the transition was verified rather than assumed.

Where teams get it wrong

• Global find-and-replace on section numbers. Creates confident-looking documents that cite the wrong requirement. Map first.
• Assuming a certificate closes the gap. It closes part of it. The FDA-specific provisions are a separate workstream.
• Treating it as a documentation project. The risk-based expectations of ISO 13485 change how some processes should actually operate, not just how they are described.
• Leaving Part 4 rationale documents untouched. Combination product manufacturers frequently miss this because it lives outside the core QMS document set.
• No verification step. Without an internal audit against the new structure, you have a plan and a pile of revised documents, but no evidence the transition worked.

The bottom line

The QMSR is a harmonisation exercise, not a reinvention. Companies with mature, genuinely operating quality systems tend to find the transition administratively tedious and substantively manageable. Companies whose systems were built to pass a specific inspection script find it harder, because the script changed.

The work that pays off is the mapping table and the honest gap assessment. Everything else follows from those two artefacts — and both are exactly what you will be asked to show when an investigator wants to understand how you got here.

This article is general information, not regulatory advice, and is not a substitute for reading the final rule and the standard as they apply to your specific device, scope, and organisation. Requirements and FDA guidance evolve; verify current text before making compliance decisions.