IN Brief:
- Harmonised QMS expectations reduce divergence between US and international regimes.
- ISO 13485:2016 is now embedded in the US device CGMP framework via Part 820.
- Inspection records and audit artefacts face sharper regulatory visibility from day one.
As of 2 February 2026, the US Food and Drug Administration’s Quality Management System Regulation is in force, replacing the long-standing Quality System Regulation framework for medical devices. The change is structural rather than cosmetic: the updated 21 CFR Part 820 now incorporates ISO 13485:2016 by reference, with additional provisions intended to avoid conflicts with other FDA requirements.
For medical electronics designers and manufacturers — particularly those building connected devices that ship globally — the practical impact is that a single quality management system can be aligned more directly to both US expectations and the ISO 13485 model already used widely outside the US. That does not mean the FDA is turning device regulation into an ISO certification exercise. The agency has been explicit that it will not require certificates of conformance to ISO 13485, and ISO certification will not exempt a manufacturer from FDA inspection.
Inspection mechanics also change immediately. On 2 February 2026, the FDA stopped using the Quality System Inspection Technique and moved to a revised inspection approach described in Compliance Program 7382.850. That matters because inspections are where quality systems stop being paperwork and start being evaluated under real-world constraints: how traceability is maintained across design changes, how supplier controls work in practice, and whether CAPA processes are actually closing the loop on field performance.
One of the more concrete shifts is visibility into records that were previously carved out. Under the QMSR, the FDA states it has authority to inspect management review, quality audit, and supplier audit reports — exemptions that existed under the prior rule are not maintained. For organisations that treated those artefacts as internal governance rather than inspection-facing evidence, the change raises the bar on consistency, retention, and the ability to demonstrate that actions discussed in reviews are being executed.
The harmonisation agenda also lands in the engineering workflow. ISO 13485 is built around risk-based thinking, documented processes, and lifecycle control, which links quality requirements more directly into design transfer and change management. For electronics teams, that means tighter linkage between design history files, software configuration management, cybersecurity-related updates, and postmarket signals. The QMSR does not rewrite cybersecurity rules by itself, but it does increase the expectation that quality processes cover the way software-enabled devices evolve after release.
For companies already operating under ISO 13485, the QMSR reduces the number of parallel processes needed for the US. For those that built a US-only QSR compliance stack, the effective date is a hard pivot point: audits, management reviews, and supplier controls now sit more squarely in the inspection frame, and the inspection playbook has changed alongside the regulation.
