From Quality System Regulation to Quality Management System Regulation — the U.S. chapter of a global structural realignment.
Effective February 2, 2026, the U.S. Food and Drug Administration replaced the legacy Quality System Regulation (QSR) with the Quality Management System Regulation (QMSR). This is not an administrative update. It is a structural realignment that incorporates by reference the international standard ISO 13485:2016 directly into federal law (21 CFR Part 820).
The incorporation of ISO 13485:2016 into the Code of Federal Regulations converts what was a prescriptive domestic framework into a risk-based, process-oriented international one. The regulatory cycle has arrived at the regulated environments it governs — and U.S. medical device and IVD manufacturers now operate under a rule whose architecture was written outside their jurisdiction.
One Movement, Many Jurisdictions
The QMSR is not an American improvisation. It is the U.S. chapter of a deliberate global convergence that has been taking shape for over a decade.
The International Medical Device Regulators Forum (IMDRF) — in which the FDA co-chairs most working groups — develops the harmonized technical documents that national regulators then translate into law. Its instruments give that convergence an operational spine: the Medical Device Single Audit Program (MDSAP), through which one third-party audit satisfies five regulatory authorities simultaneously, and the reliance pathways through which jurisdictions increasingly accept each other’s assessments.
The direction of movement is unambiguous. Europe, Japan, and Australia built their quality frameworks on ISO 13485; the United States has now aligned with them. The FDA has removed exemptions from its legacy rule precisely to complete that alignment, chairs the MDSAP Regulatory Authority Council for the 2026–2027 term, and is pressing for the program’s expansion across Asia.
For manufacturers, this convergence has a consequence that cuts both ways: the barriers between markets are falling — but a single weakness in the quality system is now visible to every jurisdiction at once.
An Alignment That Is Not Total
The convergence carries a critical caveat: the QMSR retains FDA-prescribed requirements that fall outside the scope of ISO 13485:2016.
Controls for labeling and packaging integrity (§ 820.45) extend beyond the requirements of the incorporated standard.
Definitions and terminology diverge from ISO 13485 in areas where federal law required its own vocabulary.
Adherence to 21 CFR Part 11 (Electronic Records and Electronic Signatures) and 21 CFR Part 4 (Combination Products) remains a separate and mandatory obligation.
Harmonization is also not uniformity. The European model retains its notified bodies, its clinical evidence regimes, its vigilance requirements. The regulatory cycle is converging on a common architecture — while each jurisdiction still asks its own questions on top of it.
An organization whose quality system was built to a single reference — whether the legacy QSR or a generic alignment exercise — holds a partial answer to a question the new regulation asks in full. That partiality is the gap that inspections expose.
Why Certification Is the Control Mechanism
Adhering to the standard is not, by itself, a controlled state. A quality system that no independent body audits is a self-declared system: it generates its own evidence, judges its own conformity, and discovers its failures when an inspector finds them first.
Certification by an accredited third party places the system under continuous external verification — initial audit, annual surveillance, recertification. It is the difference between claiming a controlled process and demonstrating one.
The certification also carries consequences far beyond the U.S. border. Canada, Australia, and Brazil require it as a condition of market access. Major OEMs impose it as a condition of vendor qualification. MDSAP — the instrument of global convergence itself — is built upon it.
The QMSR has made ISO 13485 the common architecture of the U.S. system, and of the wider movement now unifying device regulation worldwide. Certification is what turns that architecture into a demonstrably controlled one — and what every jurisdiction in the movement reads as proof.