FDA QMSR · 21 CFR Part 820 · Medical device CGMP

FDA QMSR compliance consulting for a device quality system ready for FDA inspection, wherever you manufacture.

Meet the FDA's Quality Management System Regulation with one device quality system: ISO 13485:2016 as the core and the FDA's own provisions written in, from UDI and complaint records to labelling controls and adverse event reporting. Sterling's expert and experienced consultants put it in place with your engineers and quality team in 60+ countries, rehearse the inspection with you and stay through it and after it. We ensure a successful FDA QMSR compliance programme for our clients.

Book a free discovery call Start the free readiness check

One all-inclusive proposal for a fixed scope: QMSR consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard
A team of expert and experienced medical device regulatory consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the QMS and the evidence; the FDA inspects and decides

FDA QMSR at a glance

Purpose: Current good manufacturing practice for medical devices: the quality management system behind every finished device for human use sold in the United States
Relevant to: Manufacturers of finished devices made in or imported into the United States, wherever located, including contract manufacturers, sterilisers, relabellers and specification developers
Edition: 21 CFR Part 820 as amended by the final rule of 2 February 2024, in force since 2 February 2026, with ISO 13485:2016 incorporated by reference
Certification: None issued by FDA. The FDA inspects; it neither requires nor issues ISO 13485 certificates, and one does not exempt you from inspection
Sterling's role: Gap analysis against Part 820 and ISO 13485, implementation, Effivity, training, internal audit, mock inspection and inspection support, then Sustain™
Cost and timing: Total investment for an FDA QMSR-compliant quality management system depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 12 months

8,100+ client engagements in 60+ countries.

Client letters and engagements

What it is

What is the FDA QMSR and what is it used for?

The Quality Management System Regulation (QMSR) is what 21 CFR Part 820 is now called: the US Food and Drug Administration's current good manufacturing practice requirements for medical devices. It governs the methods, facilities and controls used to design, manufacture, package, label, store, install and service finished devices for human use, whether made in the United States or imported or offered for import into it. The final rule of 2 February 2024 replaced most of the old Quality System regulation's own requirements with ISO 13485:2016, incorporated by reference, plus a short list of FDA provisions, and gave the industry two years to prepare.

The QMSR changes the text your system is written to more than the stakes. The requirements are now the ISO standard most other device regulators use, so one system can answer the FDA, a certification body and an MDSAP auditor. Enforcement stays American: where ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or FDA regulations, the Act and the regulations control, investigators inspect, and failure to comply with an applicable requirement renders a device adulterated under section 501(h) of the Act.

Current text. 21 CFR Part 820 as amended by the final rule "Medical Devices; Quality System Regulation Amendments" (89 FR 7496), published on 2 February 2024 and effective on 2 February 2026. It incorporates ISO 13485:2016, the third edition dated 1 March 2016, and the terms and definitions in clause 3 of ISO 9000:2015. The preparation period is over: the FDA withdrew its Quality System Inspection Technique (QSIT) on 2 February 2026, now inspects under Compliance Program 7382.850, and its investigators may review QMS records created before that date. Read-only copies of the incorporated standards are on the ANSI Incorporated by Reference portal.

Who it is for

Who needs to comply with the FDA QMSR?

The regulation follows the device to the US market, not the manufacturer's address: any finished device for human use made in the United States, or imported or offered for import into it, is in scope, so a plant in Penang supplying US customers answers to the same Part 820 as one in Minnesota. The FDA defines a manufacturer as anyone who designs, manufactures, fabricates, assembles or processes a finished device, including those who carry out contract sterilisation, installation, relabelling, remanufacturing, repacking or specification development, and initial distributors of foreign entities performing these functions. A company performing only some of these operations meets the requirements for those operations. Makers of components or parts are outside the regulation, though the FDA encourages them to consider it. Four situations bring device companies to Sterling:

You hold ISO 13485 and sell devices in the United States. The QMSR starts from the same standard, but the FDA has stated that compliance only with ISO 13485 does not fully satisfy it. The FDA provisions on UDI, tracking, reporting, record content and labelling sit on top, and each needs its own evidence.
You are preparing for the US market for the first time. Registration and listing, a premarket submission where the device type requires one, and a quality system producing records before the FDA first inspects. A foreign establishment also names a United States agent.
An FDA inspection is due, or observations are still open. Investigators now follow a risk-based compliance programme built on six QMS areas, and management review and audit reports are no longer shielded from them. Prepare the records, the people and the responses for that model, not for QSIT.
A US device company is qualifying you as a contract manufacturer or critical supplier. A contract manufacturer of finished devices is a manufacturer in its own right under Part 820. Expect to show procedures, records and inspection readiness, not only a certificate.

Part 820 compliance supports access to the US market; it does not grant it. Device clearance or approval, where required, and registration and listing are separate FDA processes the system must support.

Business benefits

How FDA QMSR compliance supports US market access and patient safety

A device quality system proves its worth on particular days: the morning an investigator asks for a complaint file, the afternoon a labelling error has to be traced to the lots it touched, the week a customer audits your controls. We build the system around those days, so the evidence exists before anyone asks.

One system for the FDA and other regulatorsProcedures that satisfy ISO 13485 and an MDSAP auditor also serve Part 820 once the FDA provisions are written in: one document set, maintained once.
Inspections that confirm rather than discoverManagement review and audit reports written for an investigator to read, with findings stated plainly and actions followed through.
Complaints handled to the FDA's standardEvery complaint evaluated for reportability under Part 803, investigated or justified, and recorded with the data Part 820 lists.
Labelling errors stopped before releaseLabels and packaging examined for the correct identifier, expiry date, storage and handling instructions before release, in operations designed to prevent mix-ups.
Traceability through the UDIThe unique device identifier recorded for each device or batch and carried into complaint and service records, so a correction or removal reaches the right units.
Supplier risk under controlOutsourcing and purchasing is one of the six areas investigators cover; suppliers are controlled in proportion to what their failure would do to the device.

Track what shows the system working: days from complaint receipt to reportability decision, complaint files holding every required data point, labelling errors caught before shipment and CAPAs verified effective. An inspection reads the records those numbers come from.

Requirements

What are the main FDA QMSR requirements?

Part 820 is now short. Subpart A holds the scope, the definitions, the incorporation by reference and the core duty to document a QMS meeting the applicable requirements of ISO 13485 and Part 820; subpart B adds the FDA's own provisions on records and on labelling and packaging; the remaining sections are reserved. The substance therefore sits in ISO 13485 clauses 4 to 8, read with the FDA's definitions and cross-references. The table is a plain-language map; during the programme your system is checked against the regulation and the standard themselves.

Clause	What it requires of you	What it looks like in practice
§ 820.1 Scope	Apply current good manufacturing practice to the design, manufacture, packaging, labelling, storage, installation and servicing of finished devices for human use made in or imported into the United States, for the operations you perform; the FD&C Act and FDA regulations prevail over conflicting ISO 13485 clauses	A scope statement naming devices, operations and sites under Part 820, and a register of the other FDA parts that apply
§ 820.3 Definitions	Use the definitions of ISO 13485 and clause 3 of ISO 9000:2015, except where the FDA's own apply: manufacturer, component, finished device, remanufacturer and rework carry FDA meanings; ISO 13485's organisation is read as the manufacturer, an implantable medical device as an implant under § 860.3, and "safety and performance" as safety and effectiveness	A quality manual and procedures that use the FDA's meanings, so each term means the same in your records as in the regulation
§ 820.7 Incorporation by reference	ISO 13485:2016, the third edition of 1 March 2016, and clause 3 of ISO 9000:2015 form part of the regulation	Controlled access to those exact editions, and a system mapped to the 2016 text rather than a later revision
§ 820.10(a)–(b) Requirements for a quality management system	Document a QMS that meets the applicable requirements of ISO 13485 and Part 820, and meet the FDA's related rules to fully comply with the linked clauses: UDI under Part 830 for clause 7.5.8, tracking under Part 821 where applicable for 7.5.9.1, adverse event reporting under Part 803 for 8.2.3, and advisory notices under Part 806 for 7.2.3, 8.2.3 and 8.3.3	ISO 13485 clauses 4 to 8 implemented, each FDA cross-reference written into the procedure it changes: identification, traceability, complaints, reporting and advisory notices
§ 820.10(c)–(e) Design, life-supporting devices and enforcement	Apply design and development (clause 7.3) to class II and class III devices, class I devices automated with computer software and five listed class I device types; apply the traceability requirements for implantable devices (7.5.9.2) to devices that support or sustain life; failure to comply with an applicable requirement renders the device adulterated	Design and development files, from inputs to transfer and changes, for every device the rule covers, and clause 7.5.9.2 traceability records for life-supporting and life-sustaining devices
§ 820.35 Control of records	Beyond clause 4.2.5: investigation records for complaints involving a possible failure to meet specifications; for reportable or investigated complaints, the device name, date received, UDI or UPC, complainant's contact details, nature and details, any correction or corrective action and any reply; servicing records with device, identifier, date, who serviced it, service performed and test data; the UDI recorded for each device or batch; confidential records may be marked	Complaint and service forms that capture every data point, a documented justification where a similar complaint was already investigated, and the UDI captured at production and carried into later records
§ 820.45 Device labelling and packaging controls	Beyond clause 7.5.1: documented procedures for the integrity, inspection, storage and operations of labelling and packaging; examination for accuracy before release or storage (device identifier, expiry date, storage, handling and any additional processing instructions); documented labelling release; operations that prevent mix-ups, with inspection results recorded	Line clearance and a labelling check against the medical device file before each run, release and inspection results recorded, and packaging integrity kept through storage and distribution

What does useful FDA QMSR evidence look like?

A regulatory register tying Parts 803, 806, 807, 821 and 830 to the procedures they change; procedures carrying the FDA's cross-references; a medical device file per device and, where required, a design and development file; complaint files with every data point and a reportability decision; service, UDI and labelling release records; audit and review reports written for an outside reader; and CAPA closed with proof of effect, all in Effivity from the first workshop.

FDA QMSR requirements explained, section by section

Compliance process

How do you become FDA QMSR compliant?

There is no application to file and no certificate at the end. You register your establishment and list your devices, the FDA reviews devices where premarket review applies, and it inspects your quality system when its risk-based scheduling reaches you, or sooner for a PMA or a signal. Compliance means a system that already works on that day. Sterling prepares the system, the records and the people; the FDA inspects and decides.

01
Map the devices, operations and rules.Confirm devices, classes, premarket status, operations, sites, registration and listing, and every other FDA part that applies to you.
02
Gap analysis: test the current system against Part 820 and ISO 13485.Procedures, device and design files, complaint and service records, UDI, labelling controls and reporting procedures reviewed; what works is kept; actions, owners and dates agreed.
03
Implement the FDA provisions and produce the records.Cross-references written into procedures, design files completed where required, labelling examination and release in use, people trained, records generated by the work.
04
Audit and review the way an investigator would.An internal audit across the compliance programme's six QMS areas and four other applicable FDA requirements, a management review that decides, CAPA closed with evidence.
05
Rehearse the inspection.A mock inspection on the risk-based model: records retrieved on request, front and back rooms briefed, subject-matter experts ready, and a practised response to any Form FDA 483 observations.
06
Stay inspection-ready.Annual registration, current complaint and reporting files, and FDA surveillance inspections or, if you participate, MDSAP audits in their place; for-cause inspections can come at any time.

Judge an offer by what it can truthfully deliver: the FDA issues no QMSR, registration or ISO 13485 certificate, and compliance promised without an implemented system will not survive an investigator's first request for records. How to choose a credible FDA QMSR consultant · The certification buyer's checklist

Cost

How much does FDA QMSR compliance cost?

No reliable figure exists before scoping. An ISO 13485-certified maker of class II devices adding the FDA provisions is a different programme from a first-time manufacturer of a software-driven class III device with a PMA ahead. We commit to a proposal with every component visible and a fee that does not move.

Cost component	What affects it
Consulting and implementation	Device classes and families, design responsibility, sterile or software-driven product, your ISO 13485 status, sites, and whether your team implements (Design™) or Sterling carries the agreed work (Drive™)
FDA and third-party fees	The annual FDA establishment registration fee and any other FDA user fees that apply, plus ISO 13485 or MDSAP audit fees where relevant, all paid to others and shown separately
Internal resources	Engineering time on design files, labelling line changes, complaint file remediation and validation, and the people who will face the investigator
Software and learning	Included in a Sterling engagement: Effivity and Sterling Academy access, with users, courses and access period set out in the proposal
Continued support	Internal audits, mock inspections, regulatory change reviews and help with inspection responses under Sustain™

What moves the price

Design responsibility, and whether class II, class III or software-driven class I devices are in scope
Whether an ISO 13485 system exists today, and how much of it works
The number of devices, sites and countries feeding the US market
Open inspection observations, customer findings or a PMA timetable
Your team's capacity, and how much of the work it carries

What a Sterling proposal always shows

Deliverables, owners, assumptions and exclusions, written down
FDA fees and any certification or MDSAP audit fees shown separately
Effivity, training and Academy access itemised at no additional cost
Payments linked to delivered milestones, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does FDA QMSR compliance take?

Most programmes take three to twelve months. A manufacturer already certified to ISO 13485 usually needs three to four: the FDA provisions have to be written in, operated long enough to produce complaint, service and labelling-release records, then audited and rehearsed. A first device quality system for class II or III devices takes nine to twelve, because design files, process validation and a complaint history cannot be produced convincingly in a hurry. You do not choose the inspection date: the system has to be running before the FDA's scheduling reaches you, and a PMA brings a pre-approval inspection into the launch plan.

Phase	What determines the pace
Scope and gap analysis	Access to device and design files, complaint and reporting history, labelling operations, supplier records and registration details
Build and implementation	The size of the FDA gap, design files to complete, labelling and UDI changes on the line, validation lead times and engineering capacity
Evidence, internal audit and review	Processes running long enough to generate complaint, service, labelling-release and CAPA records, then internal audit and management review
Mock inspection, then regulator or customer review	Closing the mock inspection's findings; then the FDA's scheduling, a PMA pre-approval inspection or a customer's supplier audit, none of which runs to your calendar

If a launch date, a PMA, a customer audit or open observations drive the timeline, tell us on the first call. We will say what is achievable and which files to start first. A compliance date promised before anyone has read your complaint files is a sales line, not a plan.

Challenges

Common FDA QMSR implementation challenges

QMSR programmes tend to stall on the same five problems. Each has a practical fix.

The team treats the ISO 13485 certificate as FDA compliance.

The FDA's position is explicit: compliance only with ISO 13485 does not fully satisfy the QMSR. We map each FDA provision to the procedure it changes and close each gap with records, not new wording.

Management review and audit reports were written for a certification body, not for the FDA.

The QMSR does not keep the old exception at § 820.180(c), so the FDA can inspect management review, quality audit and supplier audit reports. Write them candidly: a report that avoids problems describes a system that cannot find them.

Complaint files lack a reportability decision or the data the FDA lists.

One complaint process in Effivity: every complaint recorded, evaluated against Part 803, investigated or justified by reference to a similar investigation, and unable to close while a required field is missing.

Labelling mix-ups and wrong identifiers surface as corrections in the field.

Labelling examined before release and the release documented, lines cleared and checked against the medical device file before each run, so an error stops at the bench, not at the customer.

Procedures were renamed from the QS regulation, not rebuilt.

We rebuild procedures that still follow the old regulation's structure on ISO 13485's clauses with the FDA's cross-references, keeping every control that works, so an investigator finds one coherent system rather than two vocabularies.

Your engagement

What your FDA QMSR engagement includes

A QMSR programme touches engineering, production, labelling, complaints and regulatory affairs at once. Many providers deliver a procedure pack and leave the files, records and inspection rehearsal to you; a Sterling engagement covers the whole journey, one team, one all-inclusive proposal.

Regulatory map, scope and gap analysis
Devices, classes, operations, sites and FDA parts mapped; responsibilities, dates and decision owners agreed before work starts.
Procedures and files with the FDA provisions built in
Written with your engineers on Sterling's own medical device template sets, from complaints and servicing to UDI, labelling and reporting.
Effivity ISO & GRC software
The QMS, its records and the FDA additions run in Effivity from the first week, included with the engagement at no additional cost.
Training for everyone
Internal auditor training, as applicable to your standard, for the people who will audit the system, plus preferential Sterling Academy access that includes complimentary awareness training for your people as part of the engagement.
Internal audit, management review and mock inspection
Conducted or facilitated as agreed, across the six QMS areas, with findings closed before an investigator arrives.
Inspection support and response
Support around an FDA inspection as agreed, and help with responses and corrective actions for any observations.

Inspection outcomes and enforcement decisions remain with the FDA.

How we deliver

How Sterling supports your FDA QMSR implementation

Every QMSR engagement runs on Sterling OS™, our delivery operating system: five phases, each with defined deliverables, decision owners and evidence. The depth of support matches your team's capacity; the method, software and accountability stay the same.

01
Design™Guided implementation: your quality and engineering teams build the QMSR system with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants carry the agreed documentation, file completion and inspection preparation alongside your process owners.
03
Sustain™After implementation: internal audits, mock inspections, registration and reporting checks, refresher training and support when the FDA visits.
04
Automate™The QMSR system in Effivity: procedures, design files, complaints, reporting decisions, labelling release, CAPA, audits and management review in one workspace.
05
Revise™Regulatory change: new FDA guidance or inspection practice, amendments to Part 820, new markets and device families.

At kick-off we agree the engagement team, a weekly working session, the deliverables and who decides what; progress is reviewed against them, so a missing labelling release shows in the second month, not on inspection day.

How Sterling OS™ works

Often combined with

Standards organisations pair with FDA QMSR (21 CFR 820)

Effivity · FDA QMSR device QMS software, included in every engagement

How Effivity helps you fulfil, automate and simplify the requirements of 21 CFR Part 820 and ISO 13485:2016.

Every Sterling FDA QMSR engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so procedures, device and design files, complaints and reportability decisions, service and labelling records, suppliers, CAPA, audits and management review sit in one system your people use daily, and a record an investigator selects is retrieved, not reconstructed. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Effivity: Context of the Organisation dashboard with issues, interested parties and scope — Effivity · Context of the Organisation dashboard

Requirements for a quality management system

Regulatory register and QMS documentation

Each applicable FDA part linked to the procedures it changes, documents controlled with approvals and revisions, and a current medical device file for each device.

Management responsibility

Management review an investigator can read

Policy, objectives and review inputs drawn from the system, from complaints to audit results and regulatory change, with decisions and actions recorded where the FDA may ask for them.

Resource management

Competence, training and work environment

Training and competence records for everyone whose work affects device quality, linked to Sterling Academy; maintenance, calibration and environmental checks scheduled and logged.

Product realisation

Design and development, and risk management

Design stages, reviews, verification, validation, transfer and changes tracked for the devices the rule covers, beside the risk management records investigators review throughout an inspection.

Product realisation

Purchasing, suppliers and outsourced processes

Supplier evaluation and monitoring in proportion to risk, purchasing data, incoming verification and supplier audit reports, each contract manufacturer shown with its agreement and actions.

Device labelling and packaging controls

Labelling examination, release and UDI

Labelling checked for identifier, expiry, storage and handling instructions before release, release and inspection results recorded, and the UDI captured per device or batch.

Control of records

Complaint and servicing records with the FDA's data points

Complaint forms that cannot close without the data points § 820.35 lists; service records with the technician, date, service performed and test data; confidential records marked.

Measurement, analysis and improvement

Reporting, corrections and removals, CAPA and internal audit

Reportability decisions under Part 803 logged, corrections and removals tracked under Part 806, CAPA with root cause and proof of effect, and the internal audit programme with its findings.

What this means at the inspection

An FDA investigator selects records by product risk: a complaint file, the reportability decision behind it, the CAPA it opened, the design change that followed, the labelling release for the affected lot. In Effivity those are linked screens with dates, owners and evidence, retrieved in minutes rather than assembled overnight. Sustain™ continues there, so the next inspection or MDSAP audit finds the system as it runs every day.

Effivity for the FDA QMSR: the guide Effivity QMS on effivity.com

In your engagement

Effivity subscription: included with the engagement, at no additional cost
Set up by your Sterling consultant for the agreed scope
Existing procedures, device files and complaint records migrated, not retyped
Admin and user training for quality, engineering and regulatory staff
Further modules ready when you add ISO 9001, ISO/IEC 27001 or other standards

Client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for FDA QMSR are available on request. The client feedback wall lists every letter by standard.

Engagements with the FDA QMSR in scope

How a QMSR programme runs in practice.

All case studies

01
US market readiness: ISO 13485 and the FDA QMSR in one device quality system
A description of how such a programme typically runs, not a single client's result. The ISO 13485 procedures stay the backbone; each FDA part is tied to the procedure it changes; complaint, servicing and labelling records gain the content Part 820 specifies; design and development files are completed where the rule requires them; the internal audit follows the six QMS areas investigators use; and a mock inspection closes the programme. Devices also sold in Europe or Canada carry the MDR or MDSAP additions in the same procedures.
How an FDA-ready device programme runs

Sterling Academy · FDA QMSR e-learning

Train everyone whose work touches a US device, not only regulatory affairs.

Part 820 carries ISO 13485's competence requirements with it: the operator releasing labels, the technician logging a service call and the engineer approving a design change all need training records that match the work. Sterling Academy trains the whole workforce with short video lessons, practice checkpoints, a final exam and a numbered Certificate of Completion per learner, verifiable online. Sterling consulting clients receive preferential Sterling Academy course access and special pricing through their consultant, including complimentary awareness training for their people as part of the engagement.

FDA QMSR awareness for every employee, so competence evidence covers the whole site
Documented information, nonconformity and risk management courses for process owners
Internal auditor training for the people who will audit the system, as applicable to your standard, as part of the engagement
Training status by department, ready when an investigator or customer asks
Staff moving into labelling, complaint handling or servicing trained before they start
A Sterling consultant available when a learner has a question

Keep exploring

Explore more about FDA QMSR (21 CFR 820)

Watch a video on how to comply with FDA QMSR here.
Watch a video on FDA QMSR requirements here.

FDA QMSR resources

Services for FDA QMSR (21 CFR 820)

Why Sterling

Want successful FDA QMSR compliance? Come to Sterling.

Device companies selling in the United States often design in one country and manufacture in another. Sterling builds one quality system that answers Part 820 and ISO 13485 together, each site clear about what it owns, so an FDA inspection at any of them finds the same system.

60+ countries, one accountable lead

Management systems implemented since 2003 for device makers, laboratories, pharmaceutical and healthcare organisations among many sectors, with offices in 21 countries and one engagement team for every site in scope.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with FDA fees and any certification or MDSAP audit fees shown separately. No surprises, ever.

Evidence created by the work

Complaint, service, labelling and design records captured as the work is done, in software your people use, so the evidence exists before an investigator asks.

Expert and experienced consultants

Consultants who have advised on quality management systems in regulated sectors since 2003, read Part 820, ISO 13485 and the FDA's compliance programme together, and build your system right the first time so an inspection confirms it.

Sterling vs the rest: the full comparison Explore medical device client experience

The Sterling Promise

What our FDA QMSR compliance success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed FDA QMSR compliance outcome is achieved: the system implemented and evidenced, the internal audit and mock inspection closed, and support through an inspection and any response as agreed. Included software and workforce training leave you with a system that keeps working after we step back.

The engagement letter sets out the devices, scope, outcome and responsibilities. Your organisation provides accurate information and operates the agreed controls. The FDA decides when to inspect, what it observes and what follows; clearance, approval and enforcement are the FDA's alone. Our commitment covers the agreed compliance support, not any FDA decision or a complaint-free device.

After implementation

What happens after you become FDA QMSR compliant?

Compliance is kept, not achieved once. Registration is renewed every year between 1 October and 31 December, and a new operation registers within 30 days of starting. Complaints are assessed for reportability under Part 803, corrections and removals handled under Part 806, design changes controlled, suppliers monitored and CAPA verified. The FDA returns on its own schedule: surveillance inspections, or MDSAP audit reports in their place if you participate, and for-cause, follow-up or product-risk inspections whenever a signal arises.

Under Sterling OS™ Sustain™ we run the internal audits, management reviews and mock inspections with you, watch FDA guidance and inspection practice and keep the files current, so the next investigator finds a system that has run all along.

FAQs

Frequently asked questions about the FDA QMSR

Is there an FDA QMSR certificate?

No. The FDA assesses QMSR compliance by inspection. It has said it will not require certificates of conformance to ISO 13485, will not issue them, and that such a certificate does not exempt a manufacturer from an FDA inspection. An ISO 13485 certificate from an accredited body may still matter to customers and other regulators.

Our ISO 13485 certificate is current. Do we already comply with the QMSR?

Not on its own. The FDA has stated that compliance only with ISO 13485 does not fully satisfy the QMSR, while it expects compliance with the QMSR to largely satisfy ISO 13485. The gap is the FDA's own provisions: its definitions, UDI under Part 830, tracking under Part 821, adverse event reporting under Part 803, advisory notices under Part 806, the complaint and servicing record content of § 820.35 and the labelling and packaging controls of § 820.45.

When did the QMSR take effect, and is any transition left?

The final rule was published on 2 February 2024 and took effect on 2 February 2026. No transition remains: the FDA inspects against the QMSR now, and investigators may review QMS records created before 2 February 2026.

What replaced QSIT, and how does the FDA inspect now?

The FDA withdrew the Quality System Inspection Technique on 2 February 2026 and inspects under Compliance Program 7382.850, Inspection of Medical Device Manufacturers. It is risk-based: investigators weigh product risks to patients and users throughout, review your risk management documentation, and cover six QMS areas (management oversight; design and development; change control; outsourcing and purchasing; production and service provision; measurement, analysis and improvement) and four other applicable FDA requirements: medical device reporting, reports of corrections and removals, device tracking and unique device identification.

Can the FDA now read our management review and internal audit reports?

Yes. The QS regulation's exception at § 820.180(c) is not kept in the QMSR, so the FDA has the authority to inspect management review, quality audit and supplier audit reports.

Does MDSAP replace FDA inspections?

Partly. For manufacturers that volunteer to participate, the FDA uses MDSAP audit reports as a substitute for its surveillance inspections, which are not conducted at sites actively enrolled. Every manufacturer remains subject to non-surveillance inspections, such as compliance follow-up, for-cause and specific product-risk assignments, and FDA inspections under the QMSR do not follow the MDSAP audit plan or procedures.

Do foreign manufacturers and contract manufacturers have to comply?

Yes, where they make finished devices for human use that are imported or offered for import into the United States. The FDA's definition of manufacturer covers anyone who designs, manufactures, fabricates, assembles or processes a finished device, contract sterilisers and specification developers included. Foreign establishments register with the FDA and name a United States agent, and a device that appears adulterated can be refused admission. Makers of components or parts are outside Part 820.

Do class I devices need design and development controls?

Only some. Clause 7.3 of ISO 13485 applies to class II and class III devices, to class I devices automated with computer software, and to five listed class I device types: tracheobronchial suction catheters, non-powdered surgeon's gloves, protective restraints, manual radionuclide applicator systems and radionuclide teletherapy sources.

Does Sterling issue a certificate or letter of FDA compliance?

No. Sterling builds the QMS and the evidence; the FDA inspects and decides. We do not issue certificates or compliance letters, and a provider that offers an "FDA certificate" is offering its own paper, not an FDA decision.

What does Sterling's 100% success guarantee mean for the FDA QMSR?

We stay with you until the QMSR compliance outcome your engagement defines is achieved, from implementation and evidence to the mock inspection and support through an FDA inspection and any response. Inspection timing, observations and enforcement remain FDA decisions; the guarantee covers our support, not the FDA's conclusions.

Before the first call

Prepare a useful FDA QMSR readiness brief

No finished procedure set is needed for the first conversation; a short account of your devices, operations and route to US customers is enough. Seven questions cover it:

Which devices and classes are sold, or planned, for the US market, and what is their premarket status?
Which operations do you perform yourselves: design, manufacture, sterilisation, labelling, installation, servicing, relabelling or specification development?
Is your establishment registered, are your devices listed, and who is your United States agent if you are outside the US?
Do you hold ISO 13485 or MDSAP certification, and when were you last inspected by the FDA, with what outcome?
How are complaints received, evaluated for reportability and recorded, and how are service activities documented?
How is labelling examined and released, and where is the UDI recorded?
Who decides, how much quality and engineering time is available each week, and which date matters most: a launch, a PMA, a customer audit or open observations?

Your answers let us scope the work and prepare a realistic proposal; they are not a scored assessment or a compliance opinion.

Don’t be fooled by certification scams

If it takes ten days, it is not FDA QMSR compliance.

The device market is full of official-looking paper: "FDA certificates", registration "certificates" with seals, "QMSR certified" badges and compliance letters from firms that have never seen your plant. The FDA issues none of them, and none will help when an investigator asks for your complaint files. They are cheap until an inspection, a refused import or a customer audit tests them.

How to choose a credible FDA QMSR consultant

Ask what document you will receive and who issues it. The FDA issues no registration certificates and will neither require nor issue ISO 13485 certificates; a private firm's "certificate of FDA compliance" is its own paper, not an FDA decision.
Treat claims built on registration with caution. Registering an establishment, or holding a registration number, does not denote FDA approval of the establishment or its devices, and a representation that creates that impression is misbranding under 21 CFR 807.39.
Ask how the programme covers the FDA's provisions as well as ISO 13485. UDI, tracking, adverse event reporting, corrections and removals, record content and labelling controls should each have an owner and a record.
Ask how you will be prepared for the way the FDA inspects now. Material that still presents QSIT as current predates 2 February 2026; preparation should follow the risk-based compliance programme and its six QMS areas.
Identify who does each task, which fees go to the FDA or auditors, what your people will learn and which software the system runs in once the consultant leaves.
Walk away from "FDA compliant in 10 days", "we handle everything" and "guaranteed no observations". A device quality system has to operate and generate records before it can stand up to an inspection, and nobody can promise what an investigator will observe.

All ten warning signs of shortcut compliance

What genuine FDA QMSR compliance always involves

Months of implementation, scaled to your devices, classes and operations
ISO 13485 clauses 4 to 8 in operation, with the FDA's provisions written in
Registration renewed each year, listing kept current and, outside the US, a United States agent
Complaint, servicing, UDI and labelling records with the content Part 820 specifies
Management review and internal audit records you would be content to show an investigator
Tested procedures for reporting adverse events and for corrections and removals
Inspection by the FDA, or MDSAP audits in place of surveillance inspections if you participate

Sterling's position. Sterling does not certify and is not a regulator. We build the QMS and the evidence with you; the FDA inspects and decides. We never sell a certificate or a compliance letter in place of an implemented system, and if an offer you have received is one, we will tell you. An accredited ISO 13485 certificate is worth holding for customers and other regulators; it is not a substitute for Part 820 compliance.

Holding or been offered an "FDA certificate" you are unsure about? Send it to us and we will tell you, at no charge, what it is and what it is not.

Keep exploring

More on FDA QMSR (21 CFR 820) and related standards

More in Healthcare, medical devices & life sciences

Talk to a consultant

Plan your FDA QMSR compliance with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Build an FDA QMSR-compliant quality systemUnderstand cost, scope and timingClose the gaps between our ISO 13485 system and the QMSRPrepare for an FDA inspection or respond to observations

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice