ISO 13485 and FDA's QMSR: What US Device Makers Need to Know

• Done for you, end to end

  We write the policies, set up the controls and evidence, run the internal audit and coordinate the independent audit. You deal with one team from first call to final report.

• Simple and quick

  A free gap assessment, then one plan with dates from day one. Effivity, our GRC automation platform, is included to keep the evidence moving.

• 8,100+ client engagements

  In 60+ countries over 20+ years, with experts who bring 30+ years of experience.

• A fixed quote

  A fixed quote follows a free gap assessment, so you know the full cost before you commit.

Every Sterling consulting engagement comes with the following, so you are not buying extras to get to the finish line:

• Effivity, Sterling's GRC automation platform, with a full-year subscription, to run your controls, evidence, tasks and audits in one place.
• Sterling Academy: preferential course access, with complimentary awareness training for your people.
• Internal auditor training for your audit team, as applicable to your standard.
• For information-security engagements, a vulnerability assessment.

These are part of the engagement, not a separate purchase. The details depend on the standard you are working toward, which we confirm during the free gap assessment.

Consulting and auditing are always separated: the people who consult never audit you. That keeps your internal audit objective and protects the independence of the CPA firm, Qualified Security Assessor or certification body that performs the final step.

Behind this are 8,100+ client engagements in 60+ countries over 20+ years, led by experts with 30+ years of experience.

The outcome. A quality system that satisfies FDA's rule and the international standard at the same time, so one set of records serves an FDA inspection, OEM customer audits and a certification audit.

FDA's own words on timing: "The rule is effective February 2, 2026, and is now titled Quality Management System Regulation (QMSR)."^[1] FDA issued the final rule on January 31, 2024^[2], and its FAQ notes the rule took effect two years after publication in the Federal Register^[2].

The old Quality System regulation had been in effect since June 1, 1997^[1]. The QMSR replaces most of its text by pointing to ISO 13485:2016, then adds FDA-specific provisions. FDA has determined that the requirements of ISO 13485, taken in totality, are substantially similar to those of the old regulation^[2]. Similar is not identical: the differences sit in the records you keep, what FDA can see and how inspections run.

The outcome. No guesswork about which document governs what.

• The standard. ISO 13485:2016(E), Medical devices, Quality management systems, Requirements for regulatory purposes, third edition, March 1, 2016^[3].
• The vocabulary. Clause 3 of ISO 9000:2015, terms and definitions^[3].
• US definitions on top. The Federal Food, Drug, and Cosmetic Act's definitions, such as device and labeling, supersede the standard's corresponding terms, and "organization" means the manufacturer^[3].
• The tie-breaker. Where an ISO 13485 clause conflicts with the Act or FDA's other regulations, the Act and those regulations control^[3].
• Access. FDA points manufacturers to read-only copies of both incorporated standards on the ANSI Incorporated by Reference Portal and the ISO Online Browsing Platform^[2].

FDA also states that incorporating ISO 13485 now specifically requires risk management^[1]. In Sterling's experience, this is where many US firms built on the old regulation need the most new work.

The outcome. A checklist of the US-only requirements your system must cover beyond the standard. Each line below comes from Part 820^[3].

The outcome. A clear answer on whether the rule reaches you, and for which operations.

• Finished-device manufacturers. Part 820 applies to the design, manufacture, packaging, labeling, storage, installation and servicing of finished devices intended for human use^[3]. FDA's page says it applies to finished device manufacturers who intend to commercially distribute medical devices^[1].
• Contract operations. Contract sterilizers, relabelers, remanufacturers, repackers and specification developers are manufacturers under the rule, as are initial distributors of foreign entities performing these functions^[3].
• Imports. Devices made in the US or imported or offered for import into the US are covered^[3].
• Partial operations. A firm doing only some covered operations needs to comply only with the requirements for those operations^[3].
• Component makers. The rule does not apply to manufacturers of components or parts, though FDA encourages them to consider its provisions^[3].
• Exempt devices. Some devices are exempt from CGMP by their classification regulations, but FDA notes that complaint files and records under 820.35 still apply, and that devices under an investigational device exemption are not exempt from design and development requirements^[1].

The outcome. You describe your status accurately to US buyers, investors and FDA, and prepare for both kinds of scrutiny.

FDA's FAQ is direct: "The FDA will not require certificates of conformance to ISO 13485 and will not issue certificates of conformance to ISO 13485. A certificate of conformance to ISO 13485 will not exempt a manufacturer from an FDA inspection."^[2] FDA inspections assess compliance with FDA regulations and are scheduled based on risk factors; third-party audits assess conformance to a standard^[2].

• New inspection process. On February 2, 2026, FDA stopped using the Quality System Inspection Technique and began using Compliance Program 7382.850^[1].
• Records FDA can now see. FDA states the QMSR gives it authority to inspect management review, quality audit and supplier audit reports, which the old rule excepted^[2].
• Older records count. Investigators may review records created before February 2, 2026^[2].
• MDSAP is different. FDA states it may accept MDSAP audit reports as a substitute for routine inspections^[4].
• Registration is separate. Establishments involved in producing and distributing devices for US use must register annually with FDA under 21 CFR Part 807^[5]. A certificate does not do this for you.

So a certificate proves conformance to the standard to your customers; it never stands in for FDA.

This is Sterling's recommendation, not an FDA requirement.

1. Run a comparative analysis. FDA notes a manufacturer may find it useful to show that records created before the effective date meet the QMSR^[2]. Map your procedures to ISO 13485 and to the table above. 2. Make risk management visible. Show it in design, purchasing, production and feedback, not only in a standalone file. 3. Treat internal audits as FDA-readable. Write findings and management review minutes on the assumption that an investigator will read them. 4. Tighten supplier records. Supplier audit reports are now inspectable^[2]; keep them current and closed out. 5. Decide on certification by market. If OEM customers or regulators abroad require a certificate, or MDSAP fits your plans, build once for all of them.

We run the free gap assessment, prepare the documentation, train your team, run the internal audit and coordinate the accredited certification body's audit. Sterling does not certify, and the people who consult never audit you. Need a scoped plan? Get a proposal.

ISO management system standards such as ISO/IEC 27001, ISO/IEC 42001 and ISO 9001 are certified by an accredited certification body, not by a consultant^[1]. Sterling never certifies. The certificate carries the name of the body that issued it, and that independence is what makes it credible to your buyers.

What Sterling does is prepare your company so that the certification body's audit goes smoothly. We coordinate:

• a gap assessment against the standard;
• the management system itself: scope, risk assessment, policies, procedures and records, sized for your company;
• training for your people and an internal audit before the certification audit;
• management review and corrective actions;
• the certification audit process, from choosing an accredited body to closing any findings.

Consulting and auditing are always separated. The people who consult never audit you, so the internal audit is a genuine test and the certification body's audit is independent.

Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years, and our experts bring 30+ years of experience.

^[1] About the IAF MLA (multilateral recognition arrangement). International Accreditation Forum (functions transferred to Global Accreditation Cooperation Inc., 1 Jan 2026). accessed October 23, 2026.

• ISO 13485: standard overviewStandard overview
• Meet US Contract, MSA and RFP Compliance Clauses FastUnited States
• Win Buyers Abroad: Compliance for US Companies ExpandingUnited States
• ISO 13485 Cost and Timeline for US Medtech Start-upsUnited States
• ISO 13485 for US Medtech Companies: What FDA and Device Buyers ExpectUnited States
• Sterling in the United StatesUnited States

1. Quality Management System Regulation (QMSR). U.S. Food and Drug Administration. accessed October 26, 2026.

2. Quality Management System Regulation: Frequently Asked Questions. U.S. Food and Drug Administration. accessed October 26, 2026.

3. 21 CFR Part 820, Quality Management System Regulation (sections 820.1, 820.3, 820.7, 820.10, 820.35, 820.45). eCFR (Office of the Federal Register). accessed October 26, 2026.

4. Medical Device Single Audit Program (MDSAP). U.S. Food and Drug Administration. accessed October 26, 2026.

5. Device Registration and Listing. U.S. Food and Drug Administration. accessed October 26, 2026.

The information on this page is provided for general informational purposes only. It is not legal advice, and it is not a substitute for advice from a qualified attorney about your own situation.

Requirements depend on your scope, your customers' contracts, your industry and the regulations that apply to you. Two companies asking for the same standard can have very different obligations. We confirm yours during a gap assessment, and we update our content as standards change, but you should check the current text of any standard or rule that matters to you.

Sterling consults and prepares. It does not decide whether you meet a standard. That decision belongs to the independent party that performs the final step: the US-licensed CPA firm for a SOC 2 report, the Qualified Security Assessor or acquirer for PCI DSS, and the accredited certification body for ISO certificates. Timelines and outcomes depend on your readiness and on those parties.

Standards and marks named on this site belong to their respective owners.