February 2026 marked a significant milestone for U.S. MedTech companies. The FDA's new Quality Management System Regulation (QMSR) officially replaced the long-standing 21 CFR Part 820 framework, aligning U.S. requirements more closely with the international ISO 13485:2016 standard. For companies that have been operating under Part 820 for years, the transition raises important questions about what needs to change.
The good news is that the core intent remains the same. A quality system must still ensure devices are designed and manufactured to meet specifications, risks are controlled, and processes are documented and traceable. But the language, structure, and specific expectations have shifted in ways that matter for audits, inspections, and submissions.
One of the most significant changes is the expanded emphasis on risk management throughout the product lifecycle. While risk analysis was always required under Part 820, QMSR makes it a more explicit and recurring obligation. Companies now need to demonstrate that risk is evaluated not just during design, but continuously through manufacturing, post-market surveillance, and complaint handling.
Another practical change is the expectation for documented management review and resource planning. QMSR requires clearer evidence that leadership is actively engaged in the quality system, not just passively aware of it. For smaller companies, this can mean formalizing processes that previously happened informally.
Document control and record retention rules have also tightened. Electronic records are now the default expectation, and teams need to demonstrate that their systems provide integrity, traceability, and accessibility for the full required retention period. Paper-based fallback systems are no longer sufficient as primary evidence.
For teams already certified to ISO 13485, the transition is more about documentation alignment than process overhaul. But for U.S.-only companies that never pursued ISO certification, QMSR represents a meaningful upgrade in discipline and structure. The best-prepared teams started their gap analyses in late 2025 and are now in implementation mode. Those just starting in 2026 still have time, but the window is narrowing.
QualiVerse Editorial
Insights and updates from the team building the future of MedTech regulatory compliance.
