QMSR is in force. What changes for a small manufacturer

On February 2, 2026, FDA’s Quality Management System Regulation took effect, replacing the Quality System Regulation that had governed device manufacturing since 1997. The new Part 820 incorporates ISO 13485:2016 by reference. For a large manufacturer with a quality department, this was a two-year project that is now complete. For a small manufacturer with a quality system built by whoever was available at the time, it is the moment that system gets read against a regulation for the first time.

What did not change. The obligation is what it always was: a quality management system appropriate to the device and its risks. Design controls, corrective and preventive action, complaint handling, supplier controls, production and process controls, and management responsibility are all still required. An inspector still arrives with the same fundamental question — can this company show that its devices are designed, built, and monitored in a controlled way? If your system genuinely did those things before, it still does.

What changed, in practice. Four things matter for a small company.

The vocabulary. ISO 13485 and the old QSR describe the same activities in different words, and the regulation now uses ISO’s. A procedure written in the QSR’s terms — device master record, design history file, management representative in the old sense — is a procedure that no longer maps cleanly to the regulation it claims to satisfy. The activity may be right; the document is now wrong, and an inspector reads documents.

Risk management throughout. The old QSR mentioned risk analysis in design controls and largely left it there. ISO 13485 expects a risk-based approach across the system — in supplier controls, in process validation, in how CAPA is prioritized. A quality system with a risk file attached to the design history and nothing else has a gap the inspection will find.

The document and record structure. ISO 13485 has expectations about how a quality manual, procedures, work instructions and records relate to one another, and about what a medical device file contains. Companies that built their system from a QSR template usually have the pieces; they often do not have the structure.

What FDA kept on top of the standard. The QMSR is not ISO 13485 alone. The agency retained requirements that the standard does not cover to its satisfaction — device labeling and packaging controls, its own record-keeping provisions, and definitions where FDA’s differ from ISO’s. A company that adopts ISO 13485 and stops there has not complied with the QMSR.

Why small manufacturers are the most exposed. Not because their systems are worse, but because of how those systems came to exist. A startup’s quality system is usually built once, early, under time pressure, from a template, by a person who has since moved on. It satisfied the auditor for the first ISO certification or the notified body for the first CE mark, and it has not been read as a whole since. The QMSR transition is a forcing event: it changes the regulation the system is measured against, and it changes what the inspector expects to see. Systems that were never quite coherent become visibly incoherent.

There is a second exposure. FDA has retired the inspection approach it used under the QSR and is inspecting to the new regulation’s structure. A quality manager who has prepared for inspections before has prepared for a process that no longer exists.

The gap assessment, concretely. This is not an abstract exercise, and it does not need a consultant to start. Take every clause of the QMSR — the incorporated ISO 13485 clauses and the additions specific to FDA — and map each procedure in your system to the clause it satisfies. The map will show three things. Where a clause has no procedure against it, you have work to do. Where a procedure satisfies a clause but in the old terminology, you have rewriting to do. And where a procedure maps to nothing — and every inherited system has a few — you have documents to retire. Do this before you buy anything.

The map also tells you something about priority. A gap in design controls or CAPA is a gap in the things an inspector always looks at first. A gap in the terminology of the quality manual is a rewrite. Fix them in that order.

Certification is not compliance. This is the confusion that costs small companies the most. ISO 13485 certification is issued by an accredited certification body after an audit. It is not required by FDA, and it is not what FDA inspects. Compliance with the QMSR is assessed by FDA investigators against the regulation, certification or not. A company can be certified and non-compliant — because the certification audit sampled procedures that FDA’s inspection did not — or compliant and uncertified. Both are common. Know which you need, and when: certification opens markets and reassures partners; compliance is what keeps the establishment registered.

What a good outcome looks like. Not a new quality system. A small manufacturer that treats the QMSR transition as a rebuild will spend a year producing documents nobody reads. A good outcome is a system that is coherent — every procedure mapped to a clause, every clause covered, the vocabulary current, and the risk-based approach visible where the regulation expects it — and that the company can actually operate at its size. The transition is a chance to build the quality system the company needs for its next stage, rather than patch the one it inherited.

The regulation changed on a date. Whether the quality system changed is the question the next inspection will answer.