FDA QMSR Consultant for 21 CFR 820 Compliance and ISO 13485 Alignment

What Is FDA QMSR?

The QMSR is the current version of 21 CFR Part 820. It replaced the legacy Quality System Regulation (QSR) by incorporating ISO 13485:2016, and Clause 3 of ISO 9000:2015 for terminology, by reference. Part 820 now works as an overlay on ISO 13485: the standard supplies the core QMS requirements, and Part 820 adds FDA-specific definitions and requirements on top.

The objectives are straightforward:

• Harmonize U.S. requirements with global expectations

• Reduce duplication between FDA and ISO audits

• Modernize quality system structure

• Strengthen risk-based controls across the lifecycle

For organizations still running on legacy 820 structures, this is not a cosmetic update. It requires structural realignment. FDA's official overview is on its Quality Management System Regulation page.

What Is 21 CFR 820, and Who Must Comply?

21 CFR Part 820 is FDA's current good manufacturing practice (CGMP) regulation for medical device quality systems. Since February 2, 2026, Part 820 is the QMSR; the legacy QSR text it replaced no longer applies. Unlike ISO certification, which is voluntary, Part 820 requirements are legally enforceable, and inspection outcomes directly affect a company's ability to distribute products in the U.S. market.

21 CFR 820 applies to:

• Medical device manufacturers

• Contract manufacturers

• Specification developers

• Repackagers and relabelers

• Initial importers

Distributors may also be subject to complaint handling and purchasing control requirements depending on their role. Organizations managing broader compliance structures often strengthen QMSR implementation through ISO Compliance Consulting.

What Changed When QMSR Took Effect

The move from QSR to QMSR changes both the requirements and how FDA checks them. The changes that most often affect existing quality systems:

• ISO 13485 is now the core requirement. Part 820 requires manufacturers to document a quality management system that complies with the applicable requirements of ISO 13485:2016.

• FDA-specific requirements remain. Part 820 keeps FDA definitions that take precedence where they conflict with ISO terminology, and it carries forward explicit labeling and packaging controls that go beyond ISO 13485.

• Design controls follow ISO 13485 structure. The regulation relies on the ISO 13485 design and development framework rather than the legacy "design controls" section.

• Inspections use a new process. FDA retired the Quality System Inspection Technique (QSIT) and now inspects under an updated compliance program aligned to QMSR.

• Other FDA device regulations still apply. Medical device reporting, corrections and removals, tracking, and unique device identification requirements sit alongside the QMSR and must connect to your QMS processes.

The practical result: a system that passed QSR inspections or ISO 13485 certification audits may still have gaps against the combined requirements.

Why You May Need an FDA QMSR Consultant

Organizations typically seek support when they are:

• Completing a late or partial transition from the legacy QSR

• Aligning existing ISO 13485 systems with FDA's Part 820 requirements

• Preparing for their first FDA inspection under QMSR

• Responding to Form 483 observations

• Updating risk management integration

• Revising design and development documentation

• Strengthening supplier oversight

In many cases, companies already certified to ISO 13485 assume they are "covered." In practice, inspection defensibility depends on implementation depth and evidence quality.

If your system requires structural reinforcement rather than surface updates, our ISO 13485 Consultant Services can be aligned directly to QMSR requirements.

Our FDA QMSR Consulting Approach

We use a clause-aligned, risk-driven implementation structure.

1. Regulatory Gap Assessment

We compare your current QMS against ISO 13485:2016 and the FDA-specific requirements of Part 820, mapping legacy QSR procedures to the clauses that now govern them. We identify structural gaps, including:

• Design and development alignment

• CAPA process strength

• Risk integration across processes

• Supplier and purchasing controls

• Labeling and packaging controls

• Documentation hierarchy and traceability

The output is a prioritized remediation roadmap, not a generic checklist. For organizations earlier in the ISO 13485 journey, our ISO 13485 gap analysis covers the standard itself in more depth.

2. System Alignment & Documentation Updates

We then align your documentation architecture to support inspection defensibility:

• Update quality manual and procedure structure

• Align terminology and cross-references

• Integrate risk management across lifecycle processes

• Strengthen complaint handling workflows

• Reinforce CAPA documentation depth

The objective is integration — not parallel systems.

For organizations rebuilding their full quality architecture, we also support broader Medical Device QMS design and reinforcement.

3. Design & Risk Integration

QMSR reinforces risk-based thinking across design and development, supplier management, production and process controls, and post-market surveillance. Because ISO 13485 addresses risk throughout its clauses, risk management can no longer sit in one procedure.

We ensure your risk framework aligns with ISO 14971 Risk principles and is operationally embedded — not isolated in a standalone file.

4. Inspection Readiness Support

Inspection readiness is not theoretical. We conduct structured readiness evaluations built around how FDA now inspects under QMSR:

• Mock FDA inspection simulations

• Objective evidence review

• Training record validation

• Complaint file review

• Traceability testing

• Change control verification

• Leadership interview preparation

Regulatory confidence comes from tested systems.

Key Focus Areas Under QMSR

Management Responsibility

Executive leadership must establish and maintain control over the quality system, from quality policy and resource allocation to management review oversight. Organizations lacking structured governance often reinforce this through ISO 9001 Quality Management System principles.

Risk-Based Thinking

Risk must be embedded across the QMS — design, purchasing, production, CAPA, and post-market.

Design and Development

Bidirectional traceability must be demonstrable from user needs through verification and validation, now structured under ISO 13485 design and development requirements.

Supplier Controls

Purchasing controls and supplier performance monitoring are increasingly scrutinized.

Corrective and Preventive Action (CAPA)

Root cause depth and effectiveness verification must withstand inspection review. Complaint data must feed directly into this system.

Labeling and Packaging Controls

Part 820 keeps explicit FDA labeling and packaging requirements beyond ISO 13485, so these controls need their own review rather than an assumption of ISO coverage.

Documentation & Record Control

Controlled, accessible, and audit-ready documentation is foundational.

Common Gaps We Identify

Across medical device organizations, recurring weaknesses include:

• Legacy procedures not aligned with ISO 13485 structure

• Superficial risk integration

• Weak CAPA root cause documentation

• Incomplete supplier evaluations

• Complaint trending gaps

• Limited management review outputs

• Internal audit programs that verify compliance but not effectiveness

These issues frequently lead to inspection findings when not proactively addressed. Left unresolved, they carry real exposure: Form 483 observations, warning letters, import alerts, and in serious cases, product recalls or seizures. Strengthening ISO Internal Audit Services is one of the fastest ways to surface these gaps before an inspector does.

Benefits of Structured QMSR Compliance Support

Professional QMSR support provides:

• Reduced inspection risk

• Harmonized ISO and FDA alignment

• Stronger design and development traceability

• Defensible CAPA structure

• Clear supplier oversight evidence

• Improved regulatory confidence

Remediating after an inspection finding typically costs more than closing the same gaps on your own schedule.

Who We Support

We work with:

• Medical device manufacturers

• Contract manufacturers

• Software as a Medical Device (SaMD) organizations

• Startup device companies

• Established ISO 13485-certified organizations

• Companies responding to FDA findings

If your organization also markets in Europe, QMSR compliance should be coordinated with EU MDR 2017/745 alignment to avoid duplicated system architecture. Organizations managing multiple overlapping frameworks alongside QMSR may also benefit from an integrated management system approach to avoid fragmented systems.

Why Wintersmith Advisory?

Wintersmith Advisory builds defensible management systems — not templated documentation sets.

Our approach is:

• Regulatory-focused

• ISO-aligned

• Risk-driven

• Evidence-based

• Operationally practical

We design systems that survive inspection, certification audits, and internal scrutiny.

Frequently Asked Questions

Is 21 CFR 820 the same as FDA QMSR?

Yes, as of February 2, 2026. The QMSR amended 21 CFR Part 820, so Part 820 is now the QMSR. The legacy Quality System Regulation (QSR) text was replaced by a framework that incorporates ISO 13485:2016 by reference and adds FDA-specific requirements.

When did the QMSR take effect?

FDA published the final rule on February 2, 2024, and it took effect on February 2, 2026. FDA inspections of device manufacturers now follow a QMSR-aligned process instead of the legacy QSIT approach.

Is compliance with QMSR mandatory?

Yes. Compliance is mandatory for any organization that designs, manufactures, packages, labels, stores, installs, or imports medical devices for the U.S. market. Unlike ISO certification, it is not voluntary.

Does ISO 13485 certification automatically satisfy QMSR?

No. Certification does not exempt you from FDA inspection, and Part 820 adds FDA-specific requirements, such as definitions and labeling and packaging controls, that ISO 13485 does not fully cover. Inspection defensibility also depends on implementation depth and evidence quality.

How long does a QMSR gap assessment take?

Duration depends on the size of your organization, the number of sites and device types, and how closely your current system already follows ISO 13485. The assessment ends with a prioritized remediation roadmap, so documentation, risk integration, and CAPA work are sequenced by inspection risk.

Get QMSR-Ready Before Your Next FDA Inspection

The QMSR is now in force, and FDA inspects against it. Meeting it requires disciplined evaluation, documentation alignment, and leadership engagement.

If you need:

• A QMSR gap assessment

• Remediation of an incomplete QSR-to-QMSR transition

• Inspection readiness preparation

• Risk management integration

• CAPA and design and development reinforcement

We can structure a clear, defensible path to compliance. Schedule a free consultation to discuss where your system stands.

Next Strategic Considerations

Organizations working toward QMSR compliance often evaluate:

• ISO 13485 Consultant Services

• Medical Device QMS

• ISO 14971 Risk

• EU MDR 2017/745

Strategic alignment across these areas strengthens both compliance posture and commercial readiness.