ISO 13485 guide
ISO 13485 and FDA QMSR: what a certified manufacturer needs to check, and when you need both
Part 820 now incorporates ISO 13485:2016, but a certificate is not FDA compliance. How the two compare, the six checks a certified manufacturer should make, how an FDA inspection differs from a certification audit, and when you need both.
Key points
- An ISO 13485 certificate and FDA QMSR compliance answer to different people: an accredited certification body decides the first, while the FDA inspects for the second and issues no certificate at all.
- Since 2 February 2026, 21 CFR Part 820 incorporates ISO 13485:2016 by reference, so a certified system already covers most of the ground, but not all of it.
- The checks that matter are the FDA's definitions, the cross-references to Parts 803, 806, 821 and 830, the extra complaint, service and UDI records, labelling controls, and which devices need design files.
- Selling in the United States and in other regulated markets usually means holding both: one system, two kinds of scrutiny.
The short answer: one standard, two kinds of scrutiny
If your devices reach patients in the United States, the Quality Management System Regulation applies to you whether or not you hold a certificate. If they also go to other regulated markets or to buyers who ask for proof of a device quality system, you will want ISO 13485 certification too, built on the same procedures.
The reason is structural. The FDA's final rule of 2 February 2024 rewrote Part 820 around ISO 13485:2016 and a short list of American additions, and the new text took effect on 2 February 2026. Your certified system is the right foundation but not, on its own, evidence of compliance: the FDA has said that meeting ISO 13485 alone does not fully satisfy the regulation, and a certificate does not spare you an inspection.
Starting from the regulation instead? The FDA QMSR hub has a companion guide (ISO 13485 vs the FDA QMSR).
How ISO 13485 certification and the FDA QMSR compare
The requirements overlap heavily; almost everything around them differs.
| What is compared | ISO 13485 certification | FDA QMSR (21 CFR Part 820) |
|---|---|---|
| Who is covered | Any organisation at any life-cycle stage, including component and service suppliers | Manufacturers of finished devices made in, imported into or offered for import into the US, for the operations they perform; component makers are encouraged, not required, to follow it |
| Requirements | Clauses 4 to 8 of ISO 13485:2016 | ISO 13485:2016 by reference, plus FDA definitions, cross-references to other FDA parts, § 820.35 records and § 820.45 labelling and packaging controls |
| Who assesses | An accredited certification body, under medical device rules that forbid sampling design and manufacturing sites | FDA investigators, under Compliance Program 7382.850 |
| Output | A certificate with a defined scope, and audit findings graded major or minor | No certificate; an inspection that may end with Form FDA 483 observations and, where warranted, enforcement |
| Cycle | Stage 1 and Stage 2, surveillance every year, recertification in the third year | Annual establishment registration; inspections on the FDA's schedule, including for-cause visits at any time |
| Cost drivers | Audit time set by the device-specific accreditation rules, sites, scope and travel | No certification fee; the annual registration fee and any other FDA user fees, plus engineering time to close the FDA gap |
| Who asks for it | Notified bodies, MDSAP regulators, distributors, hospitals and tender panels | The FDA, and US customers who audit their suppliers against it |
What a certified manufacturer needs to check
For a mature system the gap review is short, but it must be deliberate. These are the points where certified systems usually fall short of Part 820.
1. The words your procedures use
§ 820.3 keeps the standard's definitions but overrides several. "Organisation" is read as the manufacturer, and the FDA's manufacturer includes contract sterilisers, relabellers, remanufacturers, repackers and specification developers. "Safety and performance" becomes "safety and effectiveness", and an implantable device takes the FDA's definition of an implant. Procedures that keep the ISO meanings silently can say one thing to an auditor and another to an investigator.
2. The four FDA cross-references
§ 820.10(b) lists the other parts you must meet to fully comply with named clauses: unique device identification under Part 830 for identification (7.5.8), medical device tracking under Part 821 where it applies (7.5.9.1), adverse event reporting under Part 803 for reporting to regulatory authorities (8.2.3), and corrections and removals under Part 806 for advisory notices (7.2.3, 8.2.3 and 8.3.3). Each belongs inside the procedure it changes.
3. Which devices need design files
Under § 820.10(c), clause 7.3 applies to class II and class III devices, to class I devices automated with computer software, and to five class I device types the regulation lists. A design exclusion for a class I software-driven device needs revisiting.
4. Complaint, service and UDI records
§ 820.35 adds data points to clause 4.2.5. A complaint file that is reportable or investigated must hold the device name, the date received, the UDI or UPC, the complainant's contact details, what happened, any correction or corrective action and any reply. Service records need the identifier, date, technician, work done and test data. The UDI must be recorded for each device or batch.
5. Labelling and packaging controls
§ 820.45 goes beyond clause 7.5.1: documented procedures, examination of labelling for accuracy before release or storage, a documented release, and operations designed to prevent mix-ups, with inspection results recorded.
6. Reports written for a certification body
The FDA can now inspect management review, internal audit and supplier audit reports; the protection the old regulation gave them has gone. Write them so a stranger can follow the evidence and the decision.
Many of these checks meet in the medical device file and the design file, which has its own guide.
How an FDA inspection differs from a certification audit
A certification audit follows an agreed plan and ends in a certification decision. An FDA inspection starts from product risk. On 2 February 2026 the FDA withdrew its Quality System Inspection Technique and moved to Compliance Program 7382.850, under which investigators identify risks to patients and users and choose the records to review accordingly.
The programme groups the quality system into six areas: change control; design and development; management oversight; measurement, analysis and improvement; outsourcing and purchasing; and production and service provision. Four other FDA requirements are added: medical device reporting, corrections and removals, tracking and UDI. Investigators may review records created before the effective date. Expect records to be requested by device, lot or complaint as the investigator's picture of risk develops.
MDSAP sits between the two. For manufacturers enrolled in it, the FDA uses MDSAP audit reports in place of routine surveillance inspections, but for-cause, compliance follow-up and pre-approval inspections still happen. A plain ISO 13485 certificate has no such effect.
When one is enough and when you need both
- ISO 13485 certification alone fits a component or subassembly supplier outside Part 820, a distributor or servicer whose customers ask for the certificate, or a manufacturer with no US sales.
- QMSR compliance without a certificate is legally sufficient for a manufacturer selling only in the United States.
- Both is the normal position for a manufacturer, contract manufacturer or steriliser serving the US and any other regulated market. The system is built once; the certification body and the FDA examine it separately.
- MDSAP on top is worth weighing if you also sell into Australia, Brazil, Canada or Japan, since one audit programme then serves several regulators.
Two things never change the answer. Registration and listing with the FDA is not approval, and presenting it as such is misbranding under § 807.39. And no one, including Sterling, can issue a certificate of FDA compliance.
Running one system for the certificate and the regulation
Keep a single quality manual that states both bases: ISO 13485:2016 for certification, and Part 820 with the other FDA parts that apply. Keep a register of Parts 803, 806, 807, 821 and 830 against the procedures they touch, and plan internal audits that cover the standard's clauses and the inspection programme's areas. One management review can then serve both, provided its minutes show the FDA inputs: reportable events, corrections and removals, and inspection readiness.
Planning that programme is covered in the ISO 13485 internal audit guide.
How Sterling prepares certified manufacturers for the QMSR
A certified system, extended for the FDA and rehearsed before an investigator arrives
Sterling's expert and experienced consultants test your certified system against Part 820, write the FDA's cross-references into the procedures they change, bring complaint, service, UDI and labelling records up to the regulation's detail, and run a mock inspection on the risk-based model. Everything lives in Effivity, used in 50+ countries. We ensure successful certification for our clients; the certification body decides the certificate and the FDA inspects and decides on compliance.
Book a free discovery callISO 13485 and the FDA QMSR: questions buyers ask
Which edition of ISO 13485 does the FDA QMSR use?
The QMSR uses ISO 13485:2016, the third edition dated 1 March 2016, named in § 820.7 together with clause 3 of ISO 9000:2015. Map your system to that exact text; ISO confirmed the 2016 edition in October 2025 and no revision is listed.
Will the FDA accept our certification body's audit report instead of inspecting?
No, an ISO 13485 certificate does not exempt a manufacturer from FDA inspection. The FDA uses audit reports in place of routine surveillance inspections only under MDSAP, and only for manufacturers enrolled in it.
Does our certificate scope limit what the FDA looks at?
No, the FDA looks at the devices and operations covered by § 820.1, not at your certificate's scope statement.
Do we need a separate quality manual for the FDA?
No, one manual is better than two, as long as it names Part 820 and the other FDA parts that apply and uses the FDA's definitions where they override the standard's.
Can we show our FDA registration number as proof that the FDA approved us?
No, registration and listing do not denote FDA approval, and suggesting otherwise is misbranding under § 807.39.
How long does it take a certified manufacturer to become QMSR-ready?
Usually three to four months for a certified manufacturer, because the FDA provisions must be written in and then run long enough to produce complaint, service and labelling-release records. A system without certification takes longer; the certification process guide sets out the ISO 13485 steps.
More ISO 13485 guides
Every guide in the ISO 13485 series is written for one question and links back to the hub for the whole picture.
- ISO 13485 certification process, step by step
- ISO 13485 certification cost: what moves the price
- The medical device file and the design file: what goes in them
- Effivity for ISO 13485: the guide
- ISO 13485 internal audit: planning, conduct and reporting
- ISO 13485 and the FDA QMSR: what to check
- ISO 13485 vs ISO 9001: what the device standard adds
- MDSAP audit readiness
- ISO 13485 requirements explained, clause by clause
- ISO 13485 training: who needs what
Keep exploring
Explore more about ISO 13485
Watch a video on how to implement ISO 13485 here.
Watch a video on ISO 13485 requirements here.
ISO 13485 resources
Services for ISO 13485
Industries
Talk to a consultant
Ask how to extend your certified ISO 13485 system to meet the FDA QMSR.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice