For decades, 21 CFR Part 820 was written in FDA’s own words. As of February 2, 2026, most of it isn’t anymore. The Quality Management System Regulation, or QMSR, replaced the bulk of Part 820’s home-grown text with a single move: incorporating ISO 13485:2016 by reference. If your quality system already ran on ISO 13485, the change is smaller than the anxiety around it suggested. If it didn’t, here is what actually moved.
What actually moved
The old Part 820 had its own subparts, written independently of any international standard — Subpart C for design controls, Subpart G for production and process controls, Subpart J for corrective and preventive action, and so on. Large stretches of that language are now replaced by reference to ISO 13485:2016’s own structure: Clause 4 for the quality management system generally, Clause 6 for resource management, Clause 7 for product realization (7.3 covers design and development), Clause 8 for measurement, analysis, and improvement, including CAPA. The old defined terms carry over conceptually more than literally — what a device master record and device history record captured under the old language now maps onto ISO 13485’s medical device file and related recordkeeping clauses, not word for word. In practice, audit findings and submissions increasingly cite the ISO 13485 clause number alongside or instead of the old subpart letter. A response that still argues purely from “820.30” without acknowledging the clause now doing that work reads as out of date.
What FDA kept anyway
ISO 13485:2016 is an international standard, not a creature of the FD&C Act, so it does not cover everything the Act requires. The QMSR kept a layer of US-specific provisions on top of it: definitions tied to US law, requirements about keeping records in a form FDA can actually access, and the connective tissue to parts of the regulation this rule didn’t touch — complaint handling and medical device reporting under Part 803, corrections and removals under Part 806, UDI requirements. An ISO 13485 certificate is necessary evidence for a US quality system now. It has never been sufficient proof on its own, and the QMSR didn’t change that either.
Where this goes wrong
Assuming ISO 13485 certification alone equals QMSR compliance
The US-specific layer sits on top of the standard, not inside it, and a certificate audit doesn’t cover that layer.
Citing the old subpart letter without the clause that replaced it
A rationale or response written purely in 820-era language reads as though nobody updated it for the current regulation.
Rebuilding the quality system from scratch
Most of what a functioning QMS was already doing didn’t change. What changed is mostly where it’s written down and what it’s called.
This matters for regulatory affairs specifically because the two dialects now sit side by side in the same documents — an FDA 483 response or an MDSAP audit report will reference both the regulation and the standard, sometimes in the same finding. Anyone moving from quality into regulatory affairs will recognize the shift immediately; anyone who hasn’t worked in quality is better off learning the cross-walk now than the first time it shows up in a submission.
Sources & further reading
- eCFR — 21 CFR Part 820, the Quality Management System Regulation, incorporating ISO 13485:2016 by reference ecfr.gov
- Regulatory Academy — How to write an FDA 483 response regulatoryacademy.com
- Regulatory Academy — How to read an MDSAP audit report regulatoryacademy.com
- Regulatory Academy — Moving from quality into regulatory affairs regulatoryacademy.com
This essay is provided for general educational purposes and reflects the regulatory landscape as of its publication date. It is not legal, regulatory, or career advice.
