The FDA QMSR replaced legacy 21 CFR Part 820 on February 2, 2026, harmonizing US device QMS requirements with ISO 13485:2016. Affinity QMS is built for the QMSR — risk-based, performance-based, and ISO 13485 aligned from the ground up.
The FDA Quality Management System Regulation (QMSR) is the revised 21 CFR Part 820 that became effective February 2, 2026. It replaces the prescriptive, checklist-style requirements of legacy Part 820 with performance-based outcomes that incorporate ISO 13485:2016 by reference. The QMSR is the most significant change to US medical device QMS requirements in over 25 years. The core intent: FDA now expects manufacturers to demonstrate that their QMS produces compliant, safe, and effective devices — not just that they follow a specific procedural checklist.
The Four Major QMSR Changes From Legacy Part 820
Explicit Risk Management
Risk management (ISO 14971) is now an explicit, pervasive requirement throughout the device lifecycle — not just in design controls.
Design Transfer
ISO 13485 Clause 7.3.7 design transfer requirements are now incorporated — ensuring production procedures are adequate before scale-up.
Updated Records
Records terminology and requirements updated to align with ISO 13485 — moving from Device History Records to batch/device traceability records.
Stronger CAPA
CAPA methodology requirements are strengthened and more explicitly tied to risk management outcomes and post-market surveillance data.
The QMSR maps to ISO 13485:2016 clauses. Affinity QMS is configured clause-by-clause — your QMSR compliance evidence is built into the system from day one.
| ISO 13485 Clause (QMSR) | Requirement | Affinity QMS Module | What It Does |
|---|---|---|---|
| Clause 4.2 | Documentation Requirements | Document Control | Quality Manual, SOPs, work instructions, forms; version control; approval workflows; change control; controlled distribution |
| Clause 6.2 | Human Resources & Training | Training Management | Training records, competency assessments, training matrix, SOP acknowledgment, annual requalification tracking |
| Clause 7.1 | Risk Management (ISO 14971) | Risk Management | Risk register, hazard identification, risk estimation, risk evaluation, risk controls, FMEA, residual risk assessment |
| Clause 7.3 | Design & Development | DHF / DMR | Design History File with inputs, outputs, verification, validation, design transfer, design change records; Device Master Record |
| Clause 7.4 | Purchasing Controls | Supplier Management | Approved vendor list, supplier evaluation, purchasing information, verification of purchased product, supplier audits |
| Clause 8.2.2 | Complaint Handling | Complaint Management | Complaint intake, MDR triage and 30-day tracking, investigation workflow, adverse event trending, post-market surveillance data |
| Clause 8.2.4 | Internal Audits | Audit Management | Internal audit scheduling, audit plans, finding records, CAPA linkage, closure verification, audit program management |
| Clause 8.5.2–8.5.3 | Corrective & Preventive Action | CAPA Management | CAPA initiation from all sources, root cause analysis, effectiveness verification, trend analysis, risk-linked CAPA outcomes |
Three buyer profiles are urgently searching for QMSR compliance guidance as of February 2026. Affinity QMS serves all three.
Medtech Startup Building a New QMS
Starting fresh with a QMS for a 510(k) or De Novo submission. Does not want to build a legacy Part 820 system that immediately needs to be migrated to QMSR. Wants a QMSR-native QMS that is ISO 13485-aligned from day one, without a consulting firm required to configure it.
Established Device Company Transitioning
Has a legacy 21 CFR Part 820 QMS that needs to be updated for QMSR. Needs a gap assessment and a migration path. Specifically concerned about: adding explicit risk management documentation, updating design control records for design transfer, and strengthening CAPA methodology documentation.
ISO 13485-Certified Company Expanding to US
Has ISO 13485 certification for EU MDR / global market access and is now entering the US market. Needs a QMS platform that satisfies both ISO 13485 and FDA QMSR without duplicating systems. Understands that QMSR alignment is built into ISO 13485 but needs the right software to demonstrate it to FDA inspectors.
The FDA QMSR is the center of the US medical device regulatory universe. Explore the related frameworks and modules that complete a QMSR-compliant quality system.
The QMSR makes four major changes from legacy Part 820: (1) Risk management is now an explicit, pervasive requirement throughout the device lifecycle — ISO 14971 risk management principles are incorporated by reference, not just implied; (2) Design controls are updated to align with ISO 13485 Clause 7.3, including the new requirement for design transfer documentation; (3) Records requirements are updated to align with ISO 13485 terminology and requirements; (4) CAPA methodology is strengthened, with more explicit requirements for the relationship between CAPA, risk management, and post-market surveillance data. The broader philosophical shift is from prescriptive procedural requirements to performance-based outcomes — FDA expects your QMS to produce safe, effective devices, and you have more flexibility in how you demonstrate that.
The FDA QMSR became effective February 2, 2026. From that date, the QMSR — not legacy 21 CFR Part 820 — is the applicable regulation. Manufacturers who were inspected against legacy Part 820 before February 2, 2026 must now operate under QMSR requirements. FDA inspectors use the QMSR as their inspection framework for all Quality System Inspections (QSIT) conducted after the effective date. Manufacturers should review their QMS documentation, procedures, and records to ensure they reflect QMSR requirements, particularly the new risk management and design transfer provisions.
No. The QMSR incorporates ISO 13485:2016 by reference as the QMS framework, but FDA does not require manufacturers to obtain ISO 13485 certification from a third-party certification body to comply with QMSR. Manufacturers must conform to the substantive requirements of ISO 13485 as incorporated into the QMSR, but they demonstrate this conformance through FDA inspections, not through a separate certification process. That said, if a manufacturer does obtain ISO 13485 certification, that certification provides significant evidence of QMSR conformance. Manufacturers seeking MDSAP — which satisfies Health Canada, TGA, and other requirements — must obtain ISO 13485 certification through the MDSAP audit process.
The QMSR is a US federal regulation — a legal requirement enforced by FDA CDRH through inspections. MDSAP (Medical Device Single Audit Program) is a multi-national audit program administered by recognized auditing organizations that allows a single audit to satisfy the regulatory requirements of five countries (US, Canada, Australia, Brazil, Japan). MDSAP uses ISO 13485 as its QMS framework and incorporates QMSR requirements as the US-specific component. A manufacturer who successfully completes MDSAP satisfies FDA QMSR requirements (the audit report substitutes for an FDA inspection), plus satisfies Health Canada, TGA, ANVISA, and MHLW requirements simultaneously. Not all manufacturers need MDSAP — it is primarily relevant for manufacturers selling in multiple MDSAP-participating countries.
Affinity QMS is configured to the QMSR / ISO 13485 framework natively — not retrofitted from a generic QMS. Every module maps to specific ISO 13485 clauses: Document Control for Clause 4.2, DHF/DMR for Clause 7.3, Risk Management for ISO 14971 / Clause 7.1, CAPA for Clauses 8.5.2–8.5.3, Audit Management for Clause 8.2.4, and Complaint Management for Clause 8.2.2. When FDA inspectors conduct a QSIT inspection, they follow seven processes: Management, Measurement, Design, Purchasing, Production, Supporting, and Complaint Handling. Affinity QMS organizes all documentation and records in those same process categories so your team can respond to investigator requests immediately.
If your QMS was built for legacy 21 CFR Part 820, the key updates needed for QMSR include: (1) Add or formalize an ISO 14971-compliant risk management process — this must be documented and linked to design controls, CAPA, and post-market surveillance; (2) Add design transfer documentation to your design control procedures — ISO 13485 Clause 7.3.7 requires explicit evidence that design outputs are adequate for manufacturing before transfer to production; (3) Review CAPA procedures for alignment with ISO 13485 Clause 8.5 requirements, particularly the linkage between CAPA and risk management outcomes; (4) Review records terminology and structure for alignment with ISO 13485; (5) Update your Quality Manual to reference ISO 13485:2016 as incorporated by the QMSR. Affinity QMS can serve as the platform for all of these updates while maintaining continuity of your existing quality records.
Affinity QMS is the only QMS platform built native to the QMSR and ISO 13485:2016 — not retrofitted from legacy Part 820. Get your QMS QMSR-ready before your next FDA inspection.