ISO 13485 · Expert · 15 min lesson
FDA QMSR (21 CFR 820) for auditors: structure, differences from ISO 13485 and inspection process
21 CFR Part 820 as amended by the QMSR final rule (89 FR 7496), sections 820.3, 820.7, 820.10, 820.35 and 820.45; ISO 13485:2016; FD&C Act sections 501(h) and 704
What you will learn
- Explain how the QMSR incorporates ISO 13485:2016 and what happened to the old QSR sections.
- Identify the added FDA-specific requirements in sections 820.3, 820.10, 820.35 and 820.45.
- Read a Form FDA 483 and a warning letter, and map an old QSR citation to the ISO 13485 clause that now applies.
Key takeaways
- The QMSR took effect on 2 February 2026; section 820.7 incorporates ISO 13485:2016 and clause 3 of ISO 9000:2015, and the FD&C Act controls where they conflict.
- FDA kept its own requirements in sections 820.3, 820.10, 820.35 and 820.45; ISO certification is not required and not an exemption.
- Old QSR citations map to the standard: 820.22 to clause 8.2.4, 820.50 to clause 7.4, 820.30 to clause 7.3, 820.100 to clauses 8.5.2 and 8.5.3.
- Inspections use Compliance Program 7382.850, which is risk driven and replaced QSIT from 2 February 2026.
- A Form FDA 483 lists observations and is not a final determination; a warning letter rests on the FD&C Act and requires a documented, verified correction.
Free practice question
A 2025 warning letter extract for Zenvale says: section 820.22, the firm did not conduct quality audits of design control activities in the last two years. The company is now preparing a response in March 2026.
Which requirement should the response map to?
Section 820.22 only, because the letter used that number.
Not quite. Section 820.22 is reserved after 2 February 2026, so the response should also use the current requirement in section 820.10.
ISO 13485 clause 7.5.6 on process validation.
Not quite. Clause 7.5.6 concerns validation of processes and does not address planned internal audits, which clause 8.2.4 covers.
ISO 13485 clause 8.2.4 on internal audit, incorporated through sections 820.7 and 820.10, in addition to the cited number.
Correct. Clause 8.2.4 requires planned audits with criteria, scope and frequency, and replaces the content of old section 820.22.
No requirement, because the audits are optional.
Not quite. Internal audits are required by clause 8.2.4 of the incorporated standard, so they are not optional for the firm.
Key terms
- QMSR: The amended 21 CFR Part 820, effective 2 February 2026, which incorporates ISO 13485:2016 by reference (section 820.7).
- incorporation by reference: A legal technique by which the text of a standard becomes binding without being copied into the regulation (section 820.7).
- Form FDA 483: Inspectional Observations issued to firm management at the end of an inspection; it is not a final agency determination of a violation.
- warning letter: A public FDA letter to a firm describing significant violations of the FD&C Act or its regulations and requiring corrective action.
- adulterated device: A device whose manufacturing methods, facilities or controls do not conform to quality system requirements, under section 501(h) of the FD&C Act.
- Compliance Program 7382.850: The FDA inspection program for medical device manufacturers used from 2 February 2026 in place of QSIT.
Official sources
- FDA: Quality Management System Regulation (QMSR) page
- Federal Register: Medical Devices; Quality System Regulation Amendments, 89 FR 7496 (2 February 2024)
- FDA: Form FDA 483 frequently asked questions
- FDA: QMSR final rule summary document
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.