What Changed

QMSR became effective on February 2, 2026, and it amends 21 CFR Part 820 by incorporating ISO 13485:2016 by reference (and ISO 9000:2015 Clause 3 for terms and definitions). The QMSR final rule was published February 2, 2024, with technical amendments issued December 4, 2025.

FDA also shifted how it inspects. As of February 2, 2026, FDA began using an updated inspection program and stopped using QSIT for device inspections.

What This Means in Practice

Your QMS should be ISO 13485-aligned in structure and language, but you still must meet FDA-specific requirements where they apply. FDA is clear that when there is a conflict, FDA statutory and regulatory requirements control.

FDA can now review records that some firms historically treated as "off-limits." FDA's QMSR FAQ explicitly states FDA may inspect management review, quality audits, and supplier audit reports (the old QS Regulation exception is not maintained).

Do not assume an ISO certificate replaces FDA inspection expectations. FDA states it will not require certificates of conformance to ISO 13485, and a certificate does not exempt you from FDA inspection.

What to Do Now — Quick Checklist

  • Run a QMSR gap assessment: map your current QMS against ISO 13485:2016 and identify where FDA supplemental provisions still apply.
  • Prepare an inspection-ready index of key records (including management review and internal audit outputs).
  • Update supplier controls and risk management integration so they are consistent with ISO 13485 expectations and FDA enforcement reality.

FDA Updated Cybersecurity Expectations for "Cyber Devices"

Cybersecurity continues to tighten, and FDA is actively updating its expectations.

FDA's cybersecurity guidance page notes the current guidance addresses recommendations for FD&C Act section 524B for cyber devices and that it supersedes the June 27, 2025 final guidance.

What to Do Now

  • Treat cybersecurity as a QMS topic, not only a premarket document topic.
  • Ensure your premarket cybersecurity content, risk controls, and postmarket processes are consistent with FDA's latest expectations.