FDA QMSR for small device makers

Read the sheet from the top and the shape of the change is clear. The old regulation's sections are gone, six short sections now make up the part, the standard carries the requirements, and the date that mattered was February 2, 2026, not the day the rule was published. FDA's own summary is that ISO 13485 is, “when taken in totality, substantially similar” to what it replaced.

The old Quality System regulation ran from § 820.1 to § 820.250. The QMSR keeps six live sections in two subparts and reserves the rest. Almost every requirement now lives in ISO 13485; the six sections tell you how to read the standard in FDA's world and what FDA wants on top of it.

Read 2026-10-22 on the eCFR (version of 2026-10-20). Section text paraphrased; quotes are the rule's words.

Most procedures at a small device maker still cite the old numbers. This map follows FDA's own pointers in the rule's preamble and in the CSA guidance; it names ISO 13485 clauses only where FDA names them, because the standard's text is copyrighted and is not quoted here.

Two rows matter most for software. Design and development controls cover class I devices “automated with computer software” (§ 820.10(c)(1)), so a small maker of a software-driven class I device is in, and CAPA lives in two clauses instead of one section, which changes how a CAPA form should label its corrective and preventive halves.

FDA did not rewrite ISO 13485. It added what the standard does not say and FDA's other rules need. The preamble calls the record additions “specific and limited requirements”, there so that the information part 803 reporting needs is captured on complaint and servicing records. For a small maker, three of them turn straight into form fields.

If your complaint form lives in an eQMS, these are configuration items: required fields, a UDI field that cannot be left blank, and a reason field that opens when someone closes a complaint without an investigation. Whether a vendor ships those fields out of the box is part of what our medical device QMS software comparison reads.

The ties to other FDA rules

The rest of FDA's additions hook ISO clauses to rules a device maker already lives under. None is new law, but a procedure written only against ISO 13485 will miss them.

• § 820.10(b)(1)For Clause 7.5.8 (identification): document a system to assign a unique device identifier under part 830.
• § 820.10(b)(2)For Clause 7.5.9.1 (traceability): document traceability procedures under part 821, if it applies to you.
• § 820.10(b)(3)For Clause 8.2.3 (reporting to regulatory authorities): notify FDA of complaints that meet the part 803 criteria.
• § 820.10(b)(4)For Clauses 7.2.3, 8.2.3 and 8.3.3: handle advisory notices under part 806.
• § 820.10(c)Design and development (Clause 7.3) for class II and class III devices, class I devices “automated with computer software”, and five listed class I devices.
• § 820.10(d)Clause 7.5.9.2 traceability for devices that support or sustain life.
• § 820.3(b)FD&C Act definitions override ISO 13485's, and “safety and performance” reads as “safety and effectiveness” in Clause 0.1.

One more line carries weight: § 820.10(e) says a failure to comply with any applicable requirement “renders a device adulterated” under section 501(h) of the FD&C Act, and that the device and “any person responsible for the failure to comply” are subject to regulatory action.

The old regulation let a firm hold back three kinds of report from an FDA investigator: management review, quality audits and supplier audits (§ 820.180(c)). Comments on the proposed rule asked FDA to keep that shield. FDA refused, because MDSAP auditors and other regulators already see those reports. Its FAQ is blunt:

The inspection method changed on the same day. On February 2, 2026 FDA stopped using the Quality System Inspection Technique (QSIT) and began working from Compliance Program 7382.850, Inspection of Medical Device Manufacturers. FDA also says investigators may review records made before that date, and that a comparative analysis showing older records meet the QMSR may be useful.

What will not happen: FDA inspections do not follow the MDSAP audit plan, do not issue ISO 13485 certificates, and a certificate does not exempt you from an inspection. MDSAP stays voluntary. If your audit findings feed a CAPA system, the CAPA software comparison reads which tools link a finding to its corrective action with a signed closure.

Much of the noise about the QMSR is about vocabulary. Under it, FDA's position is that the substance held still. Until February 2, 2026 firms had to comply with the old Quality System regulation; from that day the QMSR applies.

The level of control

FDA judged ISO 13485, “when taken in totality, substantially similar” to the old regulation, and says the rule “does not fundamentally alter” what a quality system must do.

Who is covered

FDA kept the scope: design, manufacture, packaging, labeling, storage, installation and servicing of finished devices (§ 820.1(a)).

Inspection authority

Section 704 of the FD&C Act is untouched; only Part 820 changed.

Other FDA rules

The QMSR “supplements” the rest of Title 21 (§ 820.1(b)), so Part 11, part 803, part 806 and part 830 all still apply.

Risk and CAPA

FDA says its risk management expectations “remain consistent”, now written through the whole standard, and that its reading of preventive action has not changed.

Drug CGMP

Parts 210 and 211 are not altered by the rule.

So a small maker with a working Quality System does not start over. It renames, re-cites, adds a handful of record fields, and gets its audit reports ready to be read.

Part 11 did not move. The QMSR “supplements regulations in other parts of this chapter except where explicitly stated otherwise” (§ 820.1(b)), and nothing in Part 820 carves out Part 11. FDA's CSA guidance, in its current version of February 3, 2026, says it in one line:

The guidance gives two examples. The records showing that an enterprise system correctly checks materials before production use are evidence of a validated state, so Part 11 generally applies to them. Routine activity logs a commercial program saves at startup are not needed as evidence, so Part 11 does not. The Part 11 applicability checker walks the same test for any one record.

Signatures

The proposed rule wanted a signature and date from every person who approved or re-approved a record. FDA dropped that after comments. What stands: where ISO 13485 says “approved”, FDA reads a signature and a date, and it accepts electronic methods that meet its e-signature rules. “Our focus is on whether the substance of the requirements is met and not the physicality of the record or signature methodology.” For an eQMS that means the approval must carry what Part 11's signature sections ask: the manifestation of § 11.50, the record link of § 11.70 and the two components of § 11.200.

Software validation

§ 820.70(i) no longer exists. The CSA guidance places software validation in ISO 13485 Subclauses 4.1.6, 7.5.6 and 7.6, and says the approach must be proportionate to the risk of the software's use. That is where CSA comes in: it is FDA's advice on how to size that validation, feature by feature. The CSA vs CSV guide sets out what changed, and the CSA validation scope planner does the risk call per feature. For cloud storage that holds quality records, FDA asks you to focus assurance on record integrity and the Part 11 requirements that apply to those records.

Which rule answers which question, for a device maker running its quality system in software:

Here is the order we would work in at a small device maker that ran a working Quality System before February 2026. It is our practice, not a list FDA publishes; each step names the rule text it leans on. Set your start date, put a name on each row, then print it or copy it into your change control.

The order is deliberate. The gap map in the first month tells you which forms to change in the second, and the third month is spent on the two things an investigator now reads that they could not before: your audit reports and your management review. If the first month shows your document control cannot carry the new cites cleanly, the document control software comparison reads which tools keep version, approval signature and audit trail together.

Regulation text quoted from the Federal Register and the eCFR; FDA positions quoted from FDA's pages and guidance. ISO 13485 is named by clause only. General information, not regulatory advice.

1. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (February 2, 2024), Federal Registerread 2026-10-22
2. Medical Devices; Quality System Regulation Amendments; Correction, 89 FR 82945 (October 15, 2024), Federal Registerread 2026-10-22
3. 21 CFR Part 820, Quality Management System Regulation, eCFRread 2026-10-22
4. Quality Management System Regulation (QMSR), FDAread 2026-10-22
5. Quality Management System Regulation: Frequently Asked Questions, FDAread 2026-10-22
6. Computer Software Assurance for Production and Quality Management System Software (February 3, 2026), PDF, FDAread 2026-10-22
7. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
8. Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22