For years, comparing ISO 13485 with the U.S. Quality System Regulation meant maintaining two parallel frameworks: the international standard and the detailed requirements of 21 CFR Part 820. As of February 2, 2026, the FDA has been enforcing the Quality Management System Regulation (QMSR), which amended Part 820 and incorporated ISO 13485:2016 by reference.
Harmonization reduces duplication, but it does not make an ISO 13485 certification an automatic authorization for the United States. The FDA retains its own requirements, inspection authority, and obligations under the Federal Food, Drug, and Cosmetic Act and other provisions of 21 CFR.
The Role of ISO 13485 in the QMSR
ISO 13485:2016 establishes requirements for a quality management system specific to the medical device industry. It applies to organizations that design, manufacture, install, or provide related services, and serves as a recognized basis for demonstrating process control and regulatory compliance.
The QMSR is the U.S. regulation on good manufacturing practices for manufacturers of finished products subject to FDA regulation. Part 820 incorporates ISO 13485:2016 and portions of ISO 9000:2015, adds definitions and provisions from the FDA, and must be read in conjunction with the rest of the applicable U.S. regulatory framework.
What has been harmonized and what remains different
| Area | ISO 13485:2016 | FDA 21 CFR Part 820 (QMSR) |
| Nature | International management system standard; certification is voluntary unless required by regulation or contract. | Mandatory federal regulations for manufacturers covered by the scope of the regulations. |
| Basic Structure | Requirements of ISO 13485:2016. | It incorporates ISO 13485:2016 by reference, with FDA additions and clarifications. |
| Evaluation | Certification audits conducted by an independent entity, if the organization decides to seek certification. | FDA inspections and compliance measures; an ISO certificate does not replace an inspection. |
| Records | Compliance with applicable standards and regulatory requirements. | The FDA may review SGC records, including certain records that were previously exempt under the old regulation. |
| Terminology | “Medical device” and ISO definitions. | U.S. Regulatory Definitions; “device,” “manufacturer,” and concepts from the FD&C Act. |
| External obligations | It depends on each jurisdiction where the standard is used. | It must integrate with reporting, corrections and recalls, registration/listing, UDI, and applicable submission requirements. |
A single SGC, multiple layers of regulation
For a manufacturer that sells in the European Union and the United States, the most efficient strategy is to build a common core based on ISO 13485 and add annexes or procedures specific to each jurisdiction. Duplicating manuals, CAPAs, or design controls often creates inconsistencies and makes it difficult to demonstrate that the organization operates as a single entity.
The common core may cover document control, competencies, suppliers, design and development, production, process validation, nonconforming products, complaints, internal audits, and corrective actions. The local layers must specify the responsible parties, deadlines, formats, and regulatory references for each market.
ISO certification does not equate to FDA compliance
An ISO 13485 audit and an FDA inspection share much of the same evidence, but they pursue different outcomes. The certification body determines compliance with the standard within a specific scope; the FDA assesses legal compliance and may take regulatory action. The company must be able to explain not only its procedures but also how it implements them and how it links quality data to effective decisions.
In addition, the FDA has indicated that, during post-implementation inspections, its investigators may review system records created before February 2, 2026. It is advisable to maintain a transition matrix showing how historical documents meet current requirements or how discrepancies were corrected.
Review procedures that affect the United States
Harmonization does not eliminate specific obligations. The gap analysis must cover, at a minimum, the interaction of the QMS with:
- Medical Device Reporting (21 CFR Part 803) and escalation of reportable claims.
- Corrections and Removals (21 CFR Part 806) and management of field actions.
- Facility registration and product listing (21 CFR Part 807).
- UDI and labeling, in accordance with the applicable classification and requirements.
- Premarket submissions and product-related commitments.
- Controls over records, electronic signatures, and retention, where applicable.
Aligning Design, Risks, and Validation
A European dossier and a U.S. submission may require different formats, but both benefit from common traceability between user requirements, design inputs, risks, verifications, validations, and changes. Testing must be planned to produce reusable data, including protocols, acceptance criteria, and representative samples.
For implantable devices, mechanical and biomechanical testing is not an isolated laboratory task: it is part of the design verification process. If the protocol does not reflect the intended use or the worst-case scenario, the same problem will arise during audits, inspections, or premarket reviews, even if the report is technically correct.
Suppliers and contract manufacturers
International supply chains introduce additional risk: critical components, sterilization, surface treatments, and contract manufacturing may be spread across different countries. The legal manufacturer must define controls commensurate with the risk, approval criteria, quality agreements, indicators, reportable changes, and access to records.
For OEM organizations in India or Southeast Asia, it is important to define responsibilities with the owner of the brand or specification. A commercial contract does not replace the regulatory definition of a manufacturer nor does it eliminate the need to maintain evidence of control over outsourced processes.
Preparing for Inspections Under QMSR
The FDA stopped using QSIT on February 2, 2026, and implemented an inspection process aligned with QMSR. Preparation should focus on real-world evidence: management review, audits, suppliers, complaints, CAPA, design changes, validations, and release decisions.
| Priority | Recommended Action | Expected evidence |
| Governance | Appoint a transition lead and approve the scope. | Plan, responsible parties, milestones, and management review. |
| Gaps | Map ISO 13485, QMSR, and external FDA requirements. | Table showing action, owner, and close date. |
| Documentation | Update references, definitions, and procedures. | Approved versions, training, and change control. |
| Historical Records | Review documents created before February 2, 2026. | Justification for Equivalency or Remediation. |
| Simulation | Conduct an internal audit or a mock inspection. | Findings, CAPA, and effectiveness verification. |
| Supply Chain | Review critical agreements and controls. | Supplier Evaluation and Reportable Changes. |
How to Avoid Duplicates When Exporting
The key is not to create a procedure for each country, but to design global processes capable of triggering local requirements. A complaint, for example, is submitted through a common channel, evaluated using harmonized criteria, and then subject to specific reporting requirements for each authority. The same applies to changes, recalls, monitoring, and technical documentation.
A controlled regulatory framework helps ensure that deadlines, responsible parties, and forms are maintained without fragmenting the system. It should be reviewed whenever products, markets, or regulations change and should be part of change management.
Roadmap for Multi-Market Manufacturers
- Confirm the regulatory role of each entity, facility, and provider.
- Define the ISO 13485 common core and the EU/FDA layers.
- Update the process map and the requirements matrix.
- Review historical records and references to the former QS Regulation.
- Coordinate complaints, monitoring, CAPA, changes, and on-site actions.
- Verify that tests and validations can be reused in both markets.
- Conduct an evidence-based internal audit and resolve findings.
How Med-Lab IBV Can Help
Med-Lab IBV can assist in generating technical evidence for medical devices through mechanical and biomechanical testing, protocol development, and evaluation of results. This evidence can be incorporated into design control and market-specific documentation when the plan is defined from the outset.
Learn about the capabilities of the implant testing laboratory and find out how to plan a validation program tailored to the EU and the United States.
