In the medical device industry, regulatory stability is the norm. The rules change slowly, often over decades. But every once in a while, a seismic shift occurs that forces every manufacturer, from the garage startup to the multinational giant, to fundamentally re-evaluate how they operate.
We are currently living through one of those shifts, and the deadline of February 2nd, 2026 is approaching quickly.
Here's everything medical device teams need to know about the FDA's QMSR transition and how to get ready for the upcoming deadline.
On February 2, 2024, the US Food and Drug Administration (FDA) published its final rule to amend the Quality System Regulation (QSR). After more than 20 years of operating under the specific text of 21 CFR Part 820, the FDA is effectively retiring its bespoke rulebook.
The new rule, known as the Quality Management System Regulation (QMSR), will take full effect on February 2, 2026.
For many Quality Leaders, this announcement brought a mix of relief and anxiety. The relief comes from "Harmonization", the promise that one standard (ISO 13485) will finally rule them all. The anxiety comes from the timeline. Two years might sound like a long time, but in the world of quality systems, it's a sprint.
If you are a Quality Manager or Founder at a medical device startup, you have a choice to make. You can view this transition as a simple paperwork exercise: a "find and replace" for your Quality Manual. Or, you can view it as the market signal it truly is: the end of the "US-Only" compliance era and the final warning for manual, patchwork quality systems.
Here is everything you need to know about the transition from QSR to QMSR, and how to get your organization ready before the clock runs out.
To understand the magnitude of this change, we have to look at how the FDA structured the rule. They did not simply rewrite Part 820 to sound more like ISO 13485. They engaged in a regulatory maneuver called "Incorporation by Reference."
Effectively, the FDA has deleted the vast majority of the specific requirements listed in the old 21 CFR Part 820. In their place, the new QMSR explicitly points to ISO 13485:2016.
The new regulation essentially says: “To comply with the FDA, you must comply with ISO 13485:2016, plus these few specific US additions.”
This is a profound change in philosophy.
For decades, the FDA maintained that their QSR was "substantially similar" to ISO standards, but they fiercely protected their unique terminology and structure. They used terms like "Device Master Record" (DMR) and "Design History File" (DHF) that didn't exist in the same way internationally.
By incorporating ISO 13485 by reference, the FDA is admitting that the international standard is sufficient for protecting US public health.
For the past 20 years, many US-based startups adopted a strategy of "FDA First." They would build a lean Quality Management System (QMS) focused strictly on 21 CFR Part 820. They ignored ISO 13485 because they had no immediate plans to sell in Europe or Canada.
This strategy often involved "lightweight" compliance:
Using Dropbox for document storage.
Using Excel for equipment logs.
Drafting a Quality Manual that copy-pasted the text of Part 820.
Under the QMSR, this strategy is obsolete. Even if you never plan to sell a single unit outside of the United States, your QMS must now be structured around ISO 13485. The "FDA First" strategy and the "Global" strategy are now the same strategy.
While the FDA and ISO 13485 share the same goals (safe and effective devices), they take different paths to get there. The shift to QMSR introduces three specific changes that will trip up legacy systems.
Under the old QSR (Part 820.30), risk analysis was explicitly required, primarily during Design Controls. Most startups met this requirement by creating a Design FMEA (Failure Mode and Effects Analysis) spreadsheet during product development, signing it, and then largely forgetting about it once the device launched.
ISO 13485 takes a radically different approach. It requires a risk-based approach to the entire Quality Management System.
This aligns with ISO 14971, the international standard for risk management. Under the QMSR, you cannot just assess risk when you design the device. You must assess risk when:
You choose a supplier (Purchasing Controls).
You train an employee (Competency).
You investigate a complaint (Feedback).
You plan an internal audit.
The Transition Trap: If your current "Risk Management" is just a static Excel file sitting in a "Design" folder, you are non-compliant under the new rules. You need a system that links risk to every process, not just engineering.
One of the most confusing aspects of the old US regulations was the Device Master Record (DMR). This was essentially the "recipe" for your device and included all drawings, specs, and instructions needed to build it.
ISO 13485 does not use the term DMR. Instead, it uses the term Medical Device File (MDF) (Clause 4.2.3).
While the content is similar, the structural requirement changes. The MDF requires a specific organization of documents that demonstrates conformity to requirements. It's a structured file that includes descriptions of the device, intended use, labeling, and manufacturing specifications.
The Transition Trap: Companies that built their file structures rigidly around the "DMR" acronym will need to retrain staff and potentially reorganize their document control systems to align with the MDF terminology and structure anticipated by ISO-trained auditors.
The FDA has historically focused on "Safety and Effectiveness." ISO 13485 focuses on "Safety and Performance."
While this sounds like semantics, "Performance" is a broader concept. It raises the bar from the device simply "working" to it performing as specified in the Medical Device File.
That said, the QMSR does clarify that when ISO 13485 says "Safety and Performance," US manufacturers should read that as "Safety and Effectiveness." But your documentation needs to reflect the language your auditors will use. If your Quality Policy and objectives are strictly using outdated FDA vernacular, that will likely create friction during an inspection.
The biggest risk in the 2026 transition is less about the regulation itself and more about the requirements for tools that medical device startups use to comply.
We estimate that 60% of pre-market medical device companies manage their quality system using a "patchwork" or DIY approach:
SharePoint/Google Drive for SOPs.
Excel for Training Matrices and Approved Supplier Lists.
DocuSign for signatures.
Jira for software bugs.
This approach was painful but manageable under the old QSR, because the QSR was somewhat flexible in how you documented things.
But ISO 13485 is process-centric. It demands linkages.
Clause 13.4 requires that if you change a document, you must evaluate the effect of that change on the function of the device and on devices already delivered.
Clause 8.5.2 requires that CAPA inputs come from complaints, audits, and service reports.
In a patchwork system, creating these links is manual. If you change a spec in SharePoint, you have to remember to update the Risk FMEA in Excel. If you close a CAPA in Word, you have to remember to update the Hazard Analysis.
Simply put, updating a patchwork system for QMSR is a nightmare. You will have to manually open every single SOP and rewrite the references from "21 CFR 820.xx" to "ISO 13485 Clause x.x." You will have to manually restructure your folders from DMR to MDF.
This is where "Compliance Debt" comes due. The cost of labor to manually update a paper-based or hybrid system often exceeds the cost of transitioning to a modern eQMS.
February 2026 is the deadline, but the work needs to start now. Waiting until late 2025 to begin your transition is a recipe for a failed audit.
If you've been using a patchwork system, here's what you should do instead of trying to make that system work heading into the February deadline.
You cannot fix what you don't measure. The first step is a line-by-line audit of your current Quality Manual against ISO 13485:2016.
Most US-based startups will find gaps in:
Clause 4.1.6 (Software Validation): ISO is stricter about validating the software tools used in the QMS (yes, including Excel).
Clause 7.4 (Purchasing): The criteria for supplier evaluation and re-evaluation are more prescriptive.
Clause 8 (Measurement, Analysis, Improvement): The requirement to use statistical techniques to monitor processes.
Action Item: Create a "QMSR Transition Plan" document. This serves as objective evidence to an auditor that you were proactive, even if the transition takes months to complete.
This is the heavy lift. You need to pull Risk Management out of the "Engineering" silo and weave it into the fabric of your Quality System.
Review your SOPs for CAPA, Non-Conformance, Complaint Handling, and Change Control. Add a mandatory step in each process: "Does this event impact the Risk Analysis?"
If you are using Excel for your Risk Table, this is the moment to stop. The complexity of linking post-market feedback back to a static FMEA spreadsheet is too high. A single broken link can result in a major audit finding.
ISO 13485 places a massive burden on "Top Management." In the old QSR days, a CEO could sometimes delegate quality to the Quality Manager and show up only for the Management Review meeting.
ISO 13485 Clause 5.1 requires evidence of management commitment. They must ensure that responsibilities and authorities are defined and communicated.
Action Item: Schedule a specific training session for your C-Suite on the QMSR transition. They need to know that their interviews with FDA inspectors will now likely follow the structure of ISO 13485 Management Responsibility clauses.
The QMSR clarifies that you are responsible for the quality of services provided by vendors. This is critical for virtual startups who outsource manufacturing and sterilization.
Under QMSR, you need to look at your "Quality Agreements" with contract manufacturers (CMOs). Do those agreements reference Part 820? If so, they are outdated. They need to reference ISO 13485 standards for manufacturing and process control.
Action Item: Send a letter to your critical vendors asking for their ISO 13485 certificates (if you haven't already) and reviewing their readiness for the QMSR shift.
If you are looking at the list above and thinking, "I don't have the headcount to rewrite all these SOPs and retrain everyone," you are right.
The QSR to QMSR transition is the single strongest business case you will ever have for upgrading to an electronic Quality Management System (eQMS) designed for medical devices.
Why? Because modern eQMS platforms like Kivo are built on ISO 13485 native architecture.
When you migrate from a manual system to Kivo:
The Structure is Done: We provide the folder structures for DHF, MDF, and DHR pre-configured to ISO standards.
The SOPs are Ready: We provide a library of pre-validated SOPs that are already written to comply with ISO 13485:2016 and the new QMSR.
The Links are Automatic: Kivo automatically links Risk to CAPA, and Training to Documents. You don't need to police the connections; the software does it for you.
Instead of spending 6 months manually rewriting a legacy system, you can spend 4 weeks implementing a system that is already future-proofed.
It is easy to view the QMSR transition as just another regulatory headache. But in reality, the FDA is doing the industry a favor.
By harmonizing with ISO 13485, the FDA is lowering the barrier to global entry. A US startup that complies with the QMSR is now 90% of the way to a CE Mark in Europe or a license in Canada. The "Double Tax" of maintaining two separate quality systems is disappearing.
But to capture this value, you have to survive the transition.
The companies that will struggle in 2026 are the ones clinging to their legacy, US-centric, manual processes. They will find themselves explaining to inspectors why their "Risk-Based Approach" is trapped in a folder no one has opened in two years.
The companies that will win are the ones using this transition as a catalyst. They are discarding the "Patchwork" tools of the past and adopting the Unified platforms of the future.
Don't wait until January 2026. The queue for consultants and validation experts will be out the door. Start your gap analysis today.
Is your QMS ready for the QMSR? Click below to consult with our experienced team of life sciences experts.