QMSR: what FDA's Quality Management System Regulation changed for device teams in 2026

The QMSR (Quality Management System Regulation) is the FDA rule at 21 CFR Part 820 that sets current good manufacturing practice for finished medical devices by incorporating ISO 13485:2016, and it replaced the Quality System Regulation (QSR) on February 2, 2026.

Most QMSR pages were written before the rule took effect. This one uses what happened after it: 349 device Form 483s issued from February 2 to July 17, 2026 in the Atlas Form 483 directory (release of August 15, 2026), and FDA inspection and citation data pulled October 21, 2026.

Key facts:

• FDA published the QMSR final rule on February 2, 2024 (89 FR 7496) and gave manufacturers two years; there has been no further transition period since February 2, 2026.
• The Atlas Form 483 directory holds 349 device Form 483s issued from February 2 to July 17, 2026, naming 131 different FDA investigators.
• FDA device compliance inspections that ended in January 2026, the last QSR month, fell to 42, against 85 to 138 in every month of 2025.
• ISO 13485 clause 5.6, management review, appeared at 25 of 377 QMSR-era device inspections with citations (6.6%), against 9.4% for its QSR counterpart, 820.20(c), in 2025.
• Risk management wording appears on 110 of the 349 QMSR Form 483s (31.5%).
• 21 CFR 820.1(a) says the ISO phrase "safety and performance" does not change the statutory standard: devices still have to be safe and effective.

What is the QMSR?

The QMSR is FDA's device current good manufacturing practice regulation, 21 CFR Part 820, in the form that took effect on February 2, 2026. The QMSR requires every manufacturer of finished devices for the US market to document a quality management system that meets ISO 13485:2016, plus a short list of US-only requirements written into Part 820 itself.

The QMSR covers the same firms the QSR did: manufacturers, contract sterilizers, relabelers, remanufacturers, repackagers, specification developers and initial distributors of foreign devices. Section 820.3 imports the ISO 13485 and ISO 9000 clause 3 definitions, then sets FDA's own where they matter. "Organization" in ISO 13485 means "manufacturer" under Part 820, and "safety and performance" means "safety and effectiveness." A device that fails the QMSR is adulterated under section 501(h) of the FD&C Act, the same legal hook as before.

Our 21 CFR Part 820 guide maps every old QSR section to its ISO 13485 clause. This page covers the operational side: what your team writes, files and shows an investigator differently.

QMSR vs QSR: what is the difference?

The QSR wrote device quality requirements out in full in 15 subparts of Part 820, while the QMSR points to ISO 13485:2016 and keeps only the US additions. The statutory bar did not move. What moved is the vocabulary in your procedures, which records an investigator can read, and the program FDA uses to inspect.

The record names matter more than they look. An investigator reading your quality manual under the QMSR expects ISO 13485 clause order and ISO terms. A procedure still titled "Device Master Record" draws no citation by itself, but it slows the walk-through and tells the investigator the QMS was relabeled rather than rebuilt.

How did FDA inspections change under the QMSR?

FDA stopped using the Quality System Inspection Technique (QSIT) for device inspections on February 2, 2026 and now inspects under Compliance Program 7382.850. Investigators can read internal audit, supplier audit and management review reports, which the QSR kept out of routine review.

The switch shows up in the inspection counts. In FDA classification data for device compliance inspections, every month of 2025 had between 85 and 138 inspections end. January 2026, the last month under the QSR, had 42. February 2026 came back to 104 and March to 118.

Outcomes have held steady so far. Of 696 device compliance inspections that ended on or after February 2, 2026, 52.3% were classified Voluntary Action Indicated (VAI), against 50.1% of 1,309 in the QSR period from January 2025. Official Action Indicated (OAI) reads 2.4% against 7.3%, but OAI decisions take longer to post, so the 2026 figure will rise as FDA finalizes cases. For the QSIT method these inspections replaced, see our guide to FDA QSIT inspections.

Which records can FDA now review under the QMSR?

Under the QMSR, FDA investigators can review management review reports, internal audit reports and supplier audit reports. The QSR exempted those three from routine inspection under 820.180(c), so investigators could confirm the reviews and audits happened but not read the findings. The QMSR removed that exemption, and 820.35 lets a manufacturer mark records it considers confidential so FDA can weigh them under its public information rules.

The early citations are about whether the process exists at all. At 377 device inspections with citations ending February 4 to October 1, 2026, from Atlas analysis of the FDA Data Dashboard citations dataset:

Management review, clause 5.6, appeared at 25 of the 377 inspections (6.6%). In 2025, its QSR counterpart, 820.20(c), appeared at 70 of 747 (9.4%). Internal audit appeared at 32 (8.5%). The Encompass Group McDonough Form 483 of July 2, 2026 shows the pattern: internal audits not conducted, personnel competence records not maintained, and QMS changes not identified. As investigators read full reports at firms that do run reviews, expect citations about what the reports say as well as whether they exist.

Our guide to GMP audits covers how to scope an internal audit program that holds up when the report itself is evidence.

Who wrote the first QMSR Form 483s?

FDA investigators issued the first QMSR Form 483s within days of the effective date: the Atlas directory lists forms dated February 4, 2026 at BBS Enterprises in Mishawaka, Indiana, and February 5 at IPAX, B&B Medical Technologies, Amigo Mobility International, Life Recovery Systems HD and Ecotec Manufacturing. From February 2 to July 17, 2026, 131 investigators put their names to 349 device Form 483s.

Individual habits show through. Matthew D Schnittker, with 185 inspections at 131 sites on record since 2015, wrote risk management wording on 9 of his 10 QMSR forms, including those at First Source in Rochester and CooperSurgical. Across all 349 forms, risk management wording appears on 110 (31.5%), and "risk-based approach not applied to QMS processes," the ISO 13485 clause 4.1.2 wording, on 42.

The earliest QMSR forms with public detail on Atlas include Perryman Company in Houston (March 10, 2026: risk-based approach, product monitoring and QMS changes) and National Dentex in Fenton (April 6, 2026: a missing unique device identifier on the label, risk-based approach and design and development files). Drug companies are not exempt when they make devices: UCB Pharma's Braine-l'Alleud site in Belgium received a device Form 483 on June 4, 2026 citing risk management and corrective action procedures. Of the 349 forms, 52 went to facilities outside the US.

Which investigator walks into your facility shapes which clauses get read first, so check their past QMSR forms before the visit.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What should a device team do now under the QMSR?

A device team should treat the QMSR as an inspection-readiness project: update record names, write management reviews and audits as evidence, mark confidential records, carry risk management through the QMS, close the US add-ons, and study the investigator. The six steps follow what FDA has cited since February 2, 2026.

1. Rename the records. Retitle the design history file, device master record and device history record to the design and development file, medical device file and batch records, and cite the ISO 13485 clause in each procedure.
2. Write management reviews and audits as evidence. Each report should state findings, owners, due dates and closure, because an investigator can now read it.
3. Mark confidential records. Use 21 CFR 820.35 to flag records you consider confidential before the inspection starts.
4. Carry risk management through the QMS. Show ISO 14971 risk files feeding planning, suppliers, nonconformances and corrective action, the gap behind 31.5% of QMSR forms.
5. Close the US add-ons. Part 803 medical device reporting appeared at 45 of 377 QMSR inspections (11.9%) and Part 830 unique device identification at 28 (7.4%); see our 21 CFR Part 803 guide for the reporting rules.
6. Check your investigator. Search the FDA Form 483 database for the forms your likely investigator wrote under the QMSR.

Design teams can pair step 4 with our guide to medical device design controls under the QMSR, and purchasing teams with the supplier qualification guide. FDA keeps adding QMSR inspections to its public data as it finalizes them, and the digest sends new device Form 483s as they appear.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe