FDA Publishes Final Rule on QMSR

On January 31st, 2024, FDA issued their final rule amending the Quality System Regulation (QSR) to better align with ISO 13485:2016, the international standard for quality management systems for medical devices.

The final rule also changes the title of 21 CFR Part 820 from the Quality System Regulation to the Quality Management System Regulation (QMSR). In other words, so long QSR; hello, QMSR. 

If you’re concerned about what this means for your business, your QMS, and your devices, don’t worry. We’re going to cover everything you need to know in this article. Also keep in mind that the effective date for enforcement of the QMSR is Feb. 2, 2026. And while two years may seem like plenty of time, it’s best to start thinking about how you’ll comply with QMSR now. 

Let’s talk about what that will entail.

BONUS RESOURCE: Click here to download a free, customizable FDA QMSR and ISO 13485:2016 Internal Audit Checklist.

How does the new QMSR compare to the QSR?

The truth is, the major requirements for your QMS are not changing under the QMSR. As FDA has pointed out numerous times, the requirements in ISO 13485:2016 are substantially similar to the requirements in 21 CFR Part 820. 

In fact, FDA estimates that aligning 21 CFR Part 820 with ISO 13485:2016 will result in increased efficiency and cost savings for MedTech companies, stating: 

There is redundant effort for some manufacturers in complying with both the QS regulation and ISO 13485. The redundancy of effort to comply with two substantially similar requirements creates inefficiency. For example, FDA expects that the aligned requirements will reduce the burden on industry to prepare documents and/or records for inspections and audits.

In other words, companies that need to comply with both the QSR and ISO 13485:2016 shouldn’t have to do everything twice—in slightly different ways. 

FDA explicitly states that, “Where ISO 13485 diverges from the QS regulation, these differences were generally consistent with the overall intent and purposes behind FDA's regulation of QMSs. Almost all requirements in the QS regulation corresponded to requirements within ISO 13485.”

So, FDA is incorporating ISO 13485:2016 “by reference”, meaning the new QMSR will address specific requirements by referencing their location in ISO 13485:2016. FDA is also incorporating by reference Clause 3 of ISO 9000:2015, Quality management systems—Fundamentals and vocabulary. This is because FDA deems ISO 9000 to have terms and definitions that are “indispensable for the application of ISO 13485.”

What does “incorporated by reference” look like in practice with QMSR?

I know that “incorporation by reference” is in some ways an abstract term. The reality is that this will change the way 21 CFR Part 820 looks once the QMSR goes into effect. You can find the written version of the new QMSR at the very end of the final rule, in Chapter XII, References (an odd place for it, I know). 

To give you a sense of how this will affect the written regulation that you access, here is a screenshot of the table of contents of Part 820 as we know it.

Now, here is a screenshot of the table of contents of Part 820 from the final rule. 

“Incorporation by reference” simply means you’ll be directed to the part of ISO 13485:2016 (or ISO 9000:2105) that contains the specific QMS requirement you’re looking for. So, Part 820 will look significantly shorter, as fewer requirements will be listed there. 

If you’re wondering how you’ll access these standards, ISO 13485:2016 is available in a free, read-only format at the ANSI Incorporated by Reference (IBR) Portal (at least for U.S.-based companies). The terms and definitions you’ll need from ISO 9000:2015, can be found for free on the ISO web portal. 

What are the major changes between the proposed rule and final rule for QMSR?

A large portion of the QMSR final rule is given over to Chapter V, Comments on the Proposed Rule and FDA Response. Here, you can find the comments that FDA received on the proposed rule, organized by topic. 

FDA also includes its response to these comments. Sometimes FDA disagreed with the commenters, and other times they agreed—and decided to make changes to the final rule based on commenters' concerns or proposals. For instance, pushing back the effective date to Feb. 2, 2026 occurred in response to commenters’ concerns about preparing for the change. 

You can find the list of changes from the proposed rule to the final rule in Section F, General Overview of the Final Rule. However, if you want to find the reasoning for a change, or the lack thereof, you should head to Chapter V and review the comment and FDA response.

For example, one of the changes from the proposed rule to the final rule, noted in Chapter III, Section F, is:

• Revise clarification of term “safety and performance” in § 820.3(b) to apply only to Clause 0.1 of ISO 13485.

You can find the reasoning for this revision in the responses to Comment 6 and Comment 51 in the comments chapter. If you were already familiar with the proposed rule and hoping to see a specific change, I’d encourage you to search for it in the comments and responses to get a sense of why FDA did or didn’t make that change to the final rule. If you didn’t pay much attention to the proposed rule, you may still find the comments section helpful as you begin working towards compliance with the QMSR.

What else should I know about QMSR?

Keep in mind, the final rule has just been published, and this article will certainly not be the last word on all things QMSR. There are a few other items I want to highlight as we move forward and start preparing for the transition period. 

• The final rule also amends 21 CFR Part 4 — Regulation of Combination Products. FDA has made “conforming edits” to clarify QMS requirements for combination products. Note that these edits do not affect the CGMP requirements for combination products.

• FDA does intend to change its inspection process (QSIT) to ensure that it is using an inspection approach consistent with the requirements in QMSR, but isn’t ready to share how just yet. You can find more information on inspections in Comment 81 and its response.

• Getting or having ISO 13485:2016 certification does not mean you will automatically be in compliance with the new QMSR. You will not be exempt from FDA inspections if you are already ISO 13485-certified. You will not be issued an ISO 13485 certification of conformance after an FDA inspection.

BONUS RESOURCE: Click here to download a free, customizable FDA 21 CFR Part 820 & ISO 13485 Internal Audit Checklist.

Stay compliant and up-to-date with all the latest ISO and FDA best practices with Greenlight Guru Quality

The truth is that the requirements for establishing and maintaining a compliant quality management system aren’t changing all that much. But even small changes can have a big effect in an industry as important as MedTech. That’s why at Greenlight Guru, we think it’s wise to use a QMS solution that’s built specifically for MedTech companies. 

With Greenlight Guru Quality, you can ensure compliance from the very start, with purpose-built QMS software that comes aligned with 21 CFR Part 820, ISO 13485:2016, and ISO 14971:2019. And you can rest easy knowing that we’re also keeping up with the latest regulatory changes and best practices in the MedTech industry, so you’ll never be caught off guard by a change.

Ready to see how Greenlight Guru Quality can help you ensure compliance and make your next audit a breeze? Get your free, personalized demo today →