FDA 21 CFR 820 vs ISO 13485: Key Differences Explained

The Historical Divergence Between FDA QSR and ISO 13485

For decades, medical device manufacturers selling in both the United States and European markets maintained two partially parallel quality systems: one built to satisfy FDA's Quality System Regulation (21 CFR Part 820) and another certified to ISO 13485. While both systems addressed the same fundamental quality management objectives, they used different terminology, organized requirements differently, and in some areas had genuinely different content requirements.

FDA's QSR was issued in 1996, largely aligned with the then-current ISO 9001:1994 structure. ISO 13485 evolved separately, eventually becoming significantly aligned with ISO 9001:2008 in its 2003 version and then diverging again in the 2016 revision to better address the specific requirements of regulated medical device manufacturing. By 2020, the substantive gap between FDA QSR and ISO 13485:2016 had grown wide enough that FDA formally concluded that the QSR should be replaced with a regulation directly incorporating ISO 13485:2016 requirements.

The result is the Quality Management System Regulation (QMSR), published as a final rule in February 2024 with a compliance date of February 2, 2027. The QMSR does not simply merge the two documents — it replaces 21 CFR Part 820 with a new regulation that explicitly incorporates ISO 13485:2016 by reference while adding FDA-specific requirements on top. Understanding the differences between the old QSR, the new QMSR, and ISO 13485:2016 is essential for any quality professional planning the QMSR transition.

Structural Differences: QSR vs ISO 13485

The most immediately visible difference between FDA QSR and ISO 13485:2016 is structural. The QSR organized requirements into sections by functional area: production and process controls, corrective and preventive action, complaint handling, and so on. ISO 13485 uses the process-based management system structure from the ISO 9000 family, organizing requirements into sections corresponding to management responsibility, resource management, product realization, and measurement/analysis/improvement.

This structural difference meant that quality managers trained on the QSR had to mentally translate between the two frameworks when building harmonized procedures. Under QMSR, the structure follows ISO 13485:2016, which will require QSR-trained teams to reorganize their thinking and their documentation.

Documentation requirements also differ structurally. ISO 13485:2016 requires a Quality Manual (Clause 4.2.2), which was not explicitly required under FDA QSR (though many manufacturers maintained one for ISO certification purposes). ISO 13485 also has more prescriptive requirements for documented procedures, including specific clauses that require specific procedures to be documented — rather than the QSR's broader requirement for procedures "as necessary."

Management review requirements under ISO 13485 (Clause 5.6) are more specifically defined than under the QSR. ISO 13485 specifies required inputs to and outputs from management review, including review of post-market surveillance data, risk management activity results, and regulatory requirements changes. The QSR's management review provision (§820.20(c)) is comparatively brief.

Substantive Requirement Differences

Beyond structural differences, there are substantive areas where QSR, ISO 13485:2016, and QMSR diverge in their actual requirements.

Post-market surveillance: ISO 13485:2016 Clause 8.2.1 and MDR requirements have driven a much more systematic approach to post-market surveillance than the QSR's complaint handling and MDR reporting framework alone. The QSR focuses on complaint handling (§820.198) and MDR reporting (21 CFR Part 803), but ISO 13485 requires a comprehensive post-market surveillance system including feedback collection, analysis, and action. The QMSR aligns with the ISO 13485 approach.

Supplier controls: ISO 13485:2016 Clause 7.4 has more detailed requirements for supplier evaluation, selection, and monitoring than the QSR's §820.50. Notably, ISO 13485 explicitly addresses "outsourced processes" as a category requiring specific controls — a concept that maps to contract manufacturers, contract testing laboratories, and software development partners, all of which are pervasive in modern device manufacturing.

Risk management integration: ISO 13485:2016 explicitly integrates risk management (per ISO 14971) throughout the standard — risk management is not just a product development activity but a pervasive quality system responsibility. The QSR does not explicitly reference ISO 14971, though FDA has consistently expected risk-based approaches in practice. Under QMSR, risk management integration is formalized.

Software validation: Both QSR §820.70(i) and ISO 13485:2016 Clause 6.3 require validation of computer software used in the QMS. However, ISO 13485 provides somewhat more specific guidance on what validation of quality system software requires, particularly for software used in manufacturing control and inspection.

FDA-Specific Requirements That Remain in QMSR

While the QMSR incorporates ISO 13485:2016 by reference, it does not replace all existing FDA-specific requirements with ISO equivalents. Certain QSR provisions are retained and supplemented within the QMSR framework because they reflect FDA regulatory authority that goes beyond ISO 13485 scope.

Device History Record (DHR): FDA's requirement for a Device History Record — the production record for each manufactured unit or batch demonstrating that the device was manufactured in accordance with the DMR — is retained in QMSR. ISO 13485 does not have an exact equivalent concept under that specific terminology, though the record-keeping requirements achieve similar purposes.

Design History File (DHF): The DHF requirement from QSR §820.30(j) is retained in QMSR. ISO 13485 requires design and development records but uses different terminology.

Complaint handling with MDR interface: FDA's §820.198 complaint handling requirements include specific obligations tied to Medical Device Reporting (21 CFR Part 803) that have no ISO 13485 counterpart. The requirement to evaluate every complaint for MDR reportability, and the MDR-specific timelines, remain FDA-specific requirements in QMSR.

Records retention: FDA specifies minimum retention periods for quality system records that differ from ISO 13485 guidance. QMSR retains FDA-specific retention requirements.

Understanding which requirements are ISO-derived and which are FDA-specific matters for multinational manufacturers: ISO 13485 certification addresses the ISO-derived requirements, but FDA inspection readiness requires attention to the FDA-specific overlay requirements as well.

Building a Harmonized QMS Under QMSR

For manufacturers that already hold ISO 13485:2016 certification, the QMSR transition is primarily about identifying and filling the gaps between your current ISO 13485 QMS and the FDA-specific overlay requirements in QMSR. The good news is that a rigorous ISO 13485:2016 certification already satisfies the majority of QMSR requirements.

Gap analysis approach: Map your current QMS procedures against each QMSR section. For each requirement, determine whether your existing procedure fully satisfies it, partially satisfies it, or does not address it. Pay particular attention to FDA-specific requirements that may not have been prioritized in your ISO 13485 certification.

Documentation update: Procedures that reference "21 CFR Part 820" or "QSR" by section number will need to be updated to reference QMSR. This is also an opportunity to consolidate ISO and FDA procedures that have been maintained separately.

Training: QMSR training for quality system personnel is not optional — FDA inspectors will ask whether staff understand the QMSR requirements applicable to their functions. Training records must document the content covered and demonstrate that key personnel have been assessed for competency.

The QMSR compliance date is February 2, 2027. That is not far away. Manufacturers that start their gap analysis now will have time to address findings before the compliance date. Manufacturers that wait until 2026 will be managing QMSR transitions under time pressure.