Medical Device QMSR Compliance: ISO 13485 Alignment Guide

By Jackson T on October 21, 2026

medical-device-qmsr-compliance-iso-13485-alignment-guide

On February 2, 2026, FDA's Quality System regulation gave way to the Quality Management System Regulation. 21 CFR 820 now incorporates ISO 13485:2016 by reference, and records that investigators could not ask for before, such as management reviews and internal audits, are now open to inspection. This guide explains what changed, what stayed, and how to keep the records ready. To see how a records toolkit maps to ISO 13485, book a short QMSR records demo.

QMSR TOOLKIT · MEDICAL DEVICES

Keep Every QMSR Record One Click From the Investigator

iFactory QMSR Toolkit maps your quality records to ISO 13485:2016 clauses, links complaints to UDI and MDR decisions, and keeps management review and audit reports organized for FDA inspection access.

Inspection view · Plant 2QMSR
Records mapped to ISO 13485:2016
5.6Management review, Q3Ready
8.2.4Internal audit, line 4Ready
7.4Supplier audit reports2 missing
8.2.2Complaint C-2291UDI linked
803MDR decision, C-2291Documented
18 of 20 requested records ready · 2 owners notified
FDA QMSR

What Happened on February 2, 2026

FDA published the final rule on February 2, 2024 and gave manufacturers two years to prepare. On the effective date, the rule renamed the regulation and replaced most of the old Part 820 text with a requirement to follow ISO 13485:2016, plus Clause 3 of ISO 9000:2015 for vocabulary. FDA also stopped using the Quality System Inspection Technique (QSIT) that day and moved to Compliance Program 7382.850. FDA's FAQ notes that investigators may still review records made before that date. Check your own position with our quality team.

Feb 2, 2024Final rule published in the Federal Register
Two yearsTransition time to align procedures and records
Feb 2, 2026QMSR in force, QSIT retired, CP 7382.850 in use
Not a certificate schemeFDA does not issue or require ISO 13485 certificates, and a certificate does not exempt a site from inspection.
Still Part 820The rule amends 21 CFR 820. It does not remove it, and FDA-specific clauses remain.
Same inspection powerFDA's authority to inspect under section 704 of the FD&C Act is unchanged.
ISO 13485 ALIGNMENT

A Crosswalk From the Old QS Regulation to ISO 13485:2016

Most of the work is mapping. Requirements you already meet under the old sections usually have a home in an ISO 13485 clause, but the wording, the record names and sometimes the depth differ. The crosswalk below is a starting point for a gap check, not a legal opinion, so confirm each line against the standard and your own procedures. Walk through your mapping in a crosswalk session.

Topic
Former QS regulation
ISO 13485:2016
What to check now
Management responsibility
820.20
Clause 5, review in 5.6
Review inputs and outputs documented and ready to show
Internal audit
820.22
8.2.4
Audit reports and follow-up, now open to FDA
Design controls
820.30
7.3
Design history content mapped into design and development files
Purchasing
820.50
7.4
Supplier criteria, evaluation, monitoring and audit reports
Production and process
820.70, 820.75
7.5, process validation in 7.5.6
Validation records and process monitoring
Measuring equipment
820.72
7.6
Calibration status and traceability
CAPA
820.100
8.5.2, 8.5.3
Corrective and preventive action records
Complaints
820.198
8.2.2, plus 820.35(a)
Complaint records with UDI and MDR decision
Labeling and packaging
820.120, 820.130
Kept as 820.45
FDA-specific controls still apply
TERMINOLOGY

Old Words, New Homes

FDA retired several familiar record names because ISO 13485 organizes the same content differently. The device master record, design history file and device history record are no longer QMSR terms. The content still has to exist, but it now sits in the files ISO 13485 describes, and definitions come mainly from ISO 9000:2015 Clause 3, with FDA exceptions in 820.3. Ask our support team how to relabel records without rebuilding them.

Quality System regulationQuality Management System Regulation
Device master recordMedical device file, clause 4.2.3
Design history fileDesign and development file, clause 7.3.10
Device history recordRecord for each device or batch, clause 7.5.1
QSIT inspectionsCompliance Program 7382.850
MANAGEMENT REVIEW ACCESS

Three Record Sets That Are No Longer Off Limits

Under the old rule, section 820.180(c) kept management reviews, quality audit reports and supplier audit reports out of routine FDA inspection. FDA states plainly that these exceptions are not kept in the QMSR, and that the records should be readily available on inspection. That changes how they should be written: clear, factual and complete, with actions tracked to closure. See how review packs are organized in a records walkthrough.

Management review
Before: exempt under 820.180(c)
Now: inputs, decisions and actions under ISO 13485 clause 5.6 can be reviewed by FDA
Internal quality audits
Before: exempt under 820.180(c)
Now: audit reports, findings and follow-up under clause 8.2.4 can be reviewed
Supplier audit reports
Before: exempt under 820.180(c)
Now: part of purchasing evidence under clause 7.4 and open to FDA
Medical device QMSR compliance best practices for review and audit records
1Write findings as facts with evidence, not opinions or blame.
2Give every action an owner, a due date and a closure record.
3Cover every input ISO 13485 clause 5.6.2 lists, including complaints and feedback.
4Link audit findings to the CAPA that closed them, so the trail is complete.
Confidential is not the same as hidden

Section 820.35(d) lets you mark records you consider confidential. That helps FDA decide what may be disclosed under 21 CFR part 20. It does not keep the record from an investigator.

Answer the Records Request Before the Coffee Gets Cold

iFactory QMSR Toolkit keeps each record tagged to its ISO 13485 clause, links complaints to UDI and MDR decisions and shows what is ready, what is missing and who owns it.

Inspection prep · QA manager and iFactory
QA managerWhich supplier audit reports for critical suppliers are missing or older than our procedure allows?
iFactoryTwo. The resin supplier's report is past the interval in your purchasing procedure, and the sterilizer's latest report was never filed. Both owners have been notified.
QA managerAny open complaints without an MDR decision?
iFactoryOne, C-2304, received four days ago. The UDI is recorded. The reportability decision is still blank.
WHAT FDA KEPT

ISO 13485 Is the Base, Not the Whole Rule

The QMSR is ISO 13485:2016 plus a set of FDA requirements on top. Section 820.10 ties the standard to other parts of FDA's rules, including medical device reporting, corrections and removals, tracking and UDI. Section 820.35 adds record content, and 820.45 keeps labeling and packaging controls. A plant that is certified to ISO 13485 alone can still miss these. Review your FDA-specific layer with our regulatory support team.

Linked FDA rules
Part 803 MDRPart 806 corrections and removalsPart 821 trackingPart 830 UDI
QMSR additions
820.10 links and scope820.35 complaint, servicing and UDI records820.45 labeling and packaging820.3 FDA definitions
Incorporated by reference
ISO 13485:2016ISO 9000:2015 Clause 3
MEDICAL DEVICE INSPECTION

How FDA Now Organizes a Device Inspection

Compliance Program 7382.850 replaces the four QSIT subsystems with six QMS areas and four other applicable FDA requirements. Investigators look at elements within each area, and risk to patients and users guides where they dig deeper. In practice that means complaint trends, reportable events and recalls can steer an inspection toward the processes behind them. Management oversight now includes the reviews and audits that were once exempt. Prepare your area owners in a readiness session.

Six QMS areas
Change Control Design and Development Management Oversight Measurement, Analysis and Improvement Outsourcing and Purchasing Production and Service Provision
Other applicable FDA requirements
Medical Device Reporting Reports of Corrections and Removals Medical Device Tracking Unique Device Identification
MEDICAL DEVICE QMSR COMPLIANCE TEMPLATE

A Complaint Record That Meets 820.35(a)

Complaint records are where ISO 13485 and FDA's own rules meet. Section 820.35(a) lists seven items every complaint record must hold, and complaints that must be reported under Part 803 need extra detail on top. Use the fields below as a template, and add your own investigation and trend fields. Request an editable version from our support team.

Complaint recordC-2291 · illustration
1 · Device nameInfusion set, gravity
2 · Date receivedRecorded at intake
3 · UDI or UPCDevice identifier and lot
4 · ComplainantName, address, phone
5 · Nature and detailsWhat happened, as reported
6 · Correction or corrective actionLinked CAPA, if any
7 · Reply to complainantDate and summary
Part 803 checkReportable? Decision, reason and who decided
MEDICAL DEVICE QMSR COMPLIANCE FOR PLANT MANAGERS

The Shop-Floor Records That Carry the Most Weight

Quality owns the system, but much of the evidence is made on the floor. Production and Service Provision is one of the six inspection areas, and the records behind it come from maintenance, metrology and operations. Plant managers who keep these complete make every other part of an inspection easier. Review your floor records with our plant quality specialists.

6.3Equipment maintenanceDocumented maintenance with intervals and records where it can affect quality
7.6CalibrationStatus, traceability and what was done when a gauge was found out of tolerance
7.5.6Process validationValidated processes, revalidation triggers and monitoring
7.5.1Batch recordsQuantity made, quantity released and identification for each batch
8.3Nonconforming productIdentified, segregated, evaluated and dispositioned with records
MEDICAL DEVICE QMSR COMPLIANCE IMPLEMENTATION GUIDE

Five Steps From Gap Check to Inspection-Ready

If the transition work is not finished, or was done in a hurry before the deadline, these steps are a practical order. Each one produces something an investigator can see, which keeps the effort focused on evidence rather than paperwork for its own sake. FDA's FAQ suggests a comparative analysis showing that records made before the effective date also meet the QMSR, so build that into step two. Plan your steps on a support call.

1MapProcedures and records to ISO 13485 clauses
2CompareClose gaps, including older records
3Add FDA layer820.35, 820.45 and Parts 803, 806, 821, 830
4Rewrite reviewsManagement review and audits written for FDA eyes
5RehearseMock inspection by QMS area
MEDICAL DEVICE QMSR COMPLIANCE COST AND ROI

Sizing the Time Spent Finding Records

The clearest cost to size is the time it takes to pull records during an inspection or audit. Every input below is an assumption to show the arithmetic, so replace each with your own figures. Our team can help you build the full case.

Record requests per inspection or audit, assumed40
Minutes to find each record by hand, assumed25
Retrieval time by hand40 × 25 = 1,000 min
Minutes per record when indexed by clause, assumed5
Retrieval time when indexed40 × 5 = 200 min
Time saved per inspection or audit1,000 − 200 = 800 min, about 13.3 h
TURNKEY AI DEPLOYMENT

QMSR Toolkit and AI Server in One Package

iFactory delivers the QMSR Toolkit as a turnkey bundle. A pre-configured NVIDIA AI server ships racked and ready with the ISO 13485 clause map, record connectors and search pre-loaded, so quality records stay on site under your control. You rack it, plug in power and Ethernet, and the AI is live. To scope it for your plant, request a turnkey quote.

What's Included
  • Pre-configured NVIDIA AI edge server, racked and ready
  • ISO 13485:2016 clause map for your records
  • Complaint, UDI and MDR decision links
  • Management review and audit report library
  • Connectors to your QMS, ERP and CMMS records
  • Inspection view with readiness and owners
  • 24×7 remote monitoring of software and hardware
Live in 6–12 weeks
Wk 1–4
Connect and Map

Server installed, record sources linked, procedures and records mapped to clauses.

Wk 5–8
Close Gaps

Missing records flagged to owners, complaint and UDI links checked.

Wk 9–12
Go-Live and Rehearse

Inspection view switched on, teams trained, mock inspection run.

HOW iFACTORY FITS

A Records Layer Built for QMSR Inspections

iFactory sits across the systems where quality evidence already lives and organizes it the way the QMSR and FDA investigators expect. Book a pilot planning call to see it on your records.

1
ISO 13485-mapped records. Every procedure and record is tagged to its clause and QMS area.
2
Complaint and UDI links. Complaints carry the UDI, the MDR decision and any CAPA.
3
Review and audit reports organized. Management reviews, internal audits and supplier audits are ready for inspection access.
4
Floor records included. Maintenance, calibration and batch records come from the plant systems that make them.
1000+
Industrial clients running iFactory
99.9%
Platform uptime for regulated plants
6-12 wks
From racked server to inspection-ready view
FREQUENTLY ASKED QUESTIONS

What Quality and Plant Managers Ask About the QMSR

When did the QMSR take effect?
The final rule was published on February 2, 2024 and took effect on February 2, 2026. From that date, FDA enforces the QMSR and inspects under Compliance Program 7382.850 instead of QSIT.
Do we need ISO 13485 certification to comply?
No. FDA does not require or issue ISO 13485 certificates. The QMSR requires a quality management system that meets the applicable parts of ISO 13485:2016 plus FDA's own additions. A certificate does not exempt a site from FDA inspection, although the work behind it helps.
Can FDA now read our management reviews?
Yes. The exceptions in former section 820.180(c) for management reviews, quality audit reports and supplier audit reports are not kept in the QMSR. FDA says these records should be readily available on inspection, so write them as evidence, not as private notes.
Do we still need a DMR, DHF and DHR?
Not under those names. The QMSR no longer uses them, but the content still has to exist in the files ISO 13485 describes: the medical device file, design and development files and records for each device or batch. Many plants keep their existing records and map them.
What FDA-specific requirements remain?
Section 820.35 sets content for complaint, servicing and UDI records, and 820.45 keeps labeling and packaging controls. Section 820.10 links the QMS to medical device reporting under Part 803, corrections and removals under Part 806, tracking under Part 821 and UDI under Part 830.
Are records made before February 2, 2026 still reviewed?
They can be. FDA's FAQ says investigators may review earlier records and suggests a comparative analysis showing they meet QMSR requirements. Our support team can help you plan that analysis.

Every Record Mapped, Every Request Answered

Map records to ISO 13485, link complaints to UDI and MDR decisions and keep reviews and audits ready for FDA. The full system is delivered turnkey and goes live in 6 to 12 weeks.

Example readiness summary · Plant 2
Records mappedTo ISO 13485:2016 clauses
ComplaintsUDI and MDR decision linked
Reviews and auditsReady for inspection access
GapsFlagged to named owners
Every record traceable to a clause

Share This Story, Choose Your Platform!