Compliance walkthrough
How to comply with the FDA QMSR (21 CFR Part 820): video walkthrough
A walkthrough of preparing a medical device quality system for the FDA's Quality Management System Regulation, in force since 2 February 2026.
Key takeaways
- The QMSR incorporates ISO 13485:2016 by reference, with FDA provisions added.
- It has applied since 2 February 2026.
- The FDA inspects; it does not issue or require ISO 13485 certificates.
- An ISO 13485 certificate does not exempt a manufacturer from inspection.
- Prepare for inspection with internal audit and a mock inspection.
Part 820 now incorporates ISO 13485
The Quality Management System Regulation is what 21 CFR Part 820 is now called: the US Food and Drug Administration's current good manufacturing practice requirements for medical devices. It governs the methods, facilities and controls used to design, manufacture, package, label, store, install and service finished devices for human use, whether made in the United States or imported into it. The final rule of 2 February 2024 replaced most of the old Quality System regulation's own requirements with ISO 13485:2016, incorporated by reference, plus a short list of FDA provisions, and it has been in force since 2 February 2026.
There is no application to file and no certificate at the end. The FDA inspects; it neither requires nor issues ISO 13485 certificates, and holding one does not exempt a manufacturer from inspection. This short film walks through how a manufacturer prepares.
A system that works on inspection day
Start by mapping the devices, operations and rules: which devices and classes, which premarket pathways, which operations the organisation performs, from design to servicing, and which sites are involved, including contract manufacturers, sterilisers and relabellers. A gap analysis then compares the existing quality system with Part 820 and the applicable clauses of ISO 13485, read with the FDA's definitions, cross-references and its own provisions on records and on labelling and packaging.
Implementation closes the gaps and rewrites procedures to the new text where needed, because the QMSR changes the text a system is written to more than the stakes. Internal audit and a mock inspection then test whether the system already works, because the FDA inspects when its risk-based scheduling reaches an establishment, or sooner for a premarket approval or a signal. Establishment registration and device listing remain the manufacturer's duties.
Sterling's expert and experienced consultants support the gap analysis, implementation, training, internal audit, mock inspection and inspection support under Sterling OS™. The FDA inspects and decides.
FDA QMSR (21 CFR 820) at a glance
- Purpose
- Current good manufacturing practice for medical devices: the quality management system behind every finished device for human use sold in the United States
- Relevant to
- Manufacturers of finished devices made in or imported into the United States, wherever located, including contract manufacturers, sterilisers, relabellers and specification developers
- Edition
- 21 CFR Part 820 as amended by the final rule of 2 February 2024, in force since 2 February 2026, with ISO 13485:2016 incorporated by reference
- Certification
- None issued by FDA. The FDA inspects; it neither requires nor issues ISO 13485 certificates, and one does not exempt you from inspection
- Sterling's role
- Gap analysis against Part 820 and ISO 13485, implementation, Effivity, training, internal audit, mock inspection and inspection support, then Sustain™
- Cost and timing
- Total investment for an FDA QMSR-compliant quality management system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months
FDA QMSR (21 CFR 820): questions people ask
Is there an FDA QMSR certificate?
No. The FDA assesses QMSR compliance by inspection. It has said it will not require certificates of conformance to ISO 13485, will not issue them, and that such a certificate does not exempt a manufacturer from an FDA inspection. An ISO 13485 certificate from an accredited body may still matter to customers and other regulators.
Our ISO 13485 certificate is current. Do we already comply with the QMSR?
Not on its own. The FDA has stated that compliance only with ISO 13485 does not fully satisfy the QMSR, while it expects compliance with the QMSR to largely satisfy ISO 13485. The gap is the FDA's own provisions: its definitions, UDI under Part 830, tracking under Part 821, adverse event reporting under Part 803, advisory notices under Part 806, the complaint and servicing record content of § 820.35 and the labelling and packaging controls of § 820.45.
When did the QMSR take effect, and is any transition left?
The final rule was published on 2 February 2024 and took effect on 2 February 2026. No transition remains: the FDA inspects against the QMSR now, and investigators may review QMS records created before 2 February 2026.
What replaced QSIT, and how does the FDA inspect now?
The FDA withdrew the Quality System Inspection Technique on 2 February 2026 and inspects under Compliance Program 7382.850, Inspection of Medical Device Manufacturers. It is risk-based: investigators weigh product risks to patients and users throughout, review your risk management documentation, and cover six QMS areas (management oversight; design and development; change control; outsourcing and purchasing; production and service provision; measurement, analysis and improvement) and four other applicable FDA requirements: medical device reporting, reports of corrections and removals, device tracking and unique device identification.
Can the FDA now read our management review and internal audit reports?
Yes. The QS regulation's exception at § 820.180(c) is not kept in the QMSR, so the FDA has the authority to inspect management review, quality audit and supplier audit reports.
Keep exploring
Related to this video
The complete guide
Everything on FDA QMSR (21 CFR 820)
Start with the FDA QMSR (21 CFR 820) page, or go straight to the guide you need.
On the FDA QMSR (21 CFR 820) page
- What are the main FDA QMSR requirements?
- How do you become FDA QMSR compliant?
- How much does FDA QMSR compliance cost?
- How long does FDA QMSR compliance take?
- Who needs to comply with the FDA QMSR?
- How FDA QMSR compliance supports US market access and patient safety
- Frequently asked questions about the FDA QMSR
Often combined with FDA QMSR (21 CFR 820)
More videos: Healthcare, medical devices and life sciences
- How to implement GMP for medicines (PIC/S, EU, WHO)Implementation walkthrough · 3 min 15 s
- GMP requirements explained (PIC/S, EU, WHO)Two-minute brief · 2 min
- How to implement HITRUST CSFImplementation walkthrough · 3 min 15 s
- HITRUST CSF requirements explainedTwo-minute brief · 2 min
- How to implement ISO 14971Implementation walkthrough · 3 min 15 s
- ISO 14971 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 13485Implementation walkthrough · 3 min 24 s
- ISO 13485 requirements explainedTwo-minute brief · 2 min
- How to implement ISO 22716Implementation walkthrough · 3 min 24 s
Talk to a consultant
Plan your FDA QMSR compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice