FDA QMSR Training: 21 CFR Part 820 and ISO 13485 Since February 2026

Opens with a self-check: how well do you know US device quality rules, what changed on 2 February 2026, and what would an FDA investigator ask to see first? Then recent cases: the July 2025 early alert on Baxter's Novum IQ large-volume infusion pump, which could underinfuse after a large rate increase and was corrected in place, and one of the first warning letters under the QMSR, dated May 2026, citing ISO 13485 clauses directly. Draws lessons on complaints and risk, changes, procedures and reporting. Explains that Part 820 now builds in ISO 13485:2016 with FDA's own additions, and the law controls where they conflict. Introduces XYZ Medical Inc. in Boston, an infusion pump maker with about 350 staff, a board supplier in Toronto and a contract steriliser in Chicago. Outlines the fourteen modules and exam, and closes with a recap.

What you will be able to do

• Explain what changed for US device makers on 2 February 2026
• Describe how the QMSR builds on ISO 13485:2016
• Recognise the lessons recent FDA device cases hold for your site

Why it matters

FDA now measures your quality system against a new regulation; knowing what changed tells you where to look first.

Practice: Practice: Welcome: why the QMSR matters · 3 questions

Starts with XYZ Medical before the change, running one set of procedures for the QSR and a second layer for its ISO 13485 certificate, with two vocabularies for the same work, which FDA itself called inefficient. Walks through five dates, from the first device GMP rule in 1978 under section 520(f) of the FD&C Act to the QSR in effect from 1 June 1997, the final QMSR rule published in February 2024 and its effect on 2 February 2026. Explains FDA's reasons: harmonise with ISO 13485, modernise, cut duplicated effort and make risk management explicit. Covers who the rule covers, including specification developers and contract sterilisers, with a New York catheter start-up and a Los Angeles contract maker, and who it does not. Shows XYZ Medical's scope map of every operation and who controls it, and closes with a recap.

What you will be able to do

• Explain why FDA replaced the QSR with the QMSR
• Identify which operations and companies Part 820 applies to
• Build a scope map showing each operation and how it is controlled

Why it matters

Knowing exactly what you do tells you which parts of the rule apply, including to suppliers and sterilisers you use.

Practice: Practice: From QSR to QMSR: why and who · 3 questions

Opens with a new quality engineer at XYZ Medical asking where the device master record is: withdrawn and ownerless in one answer, moved to the medical device file under clause 4.2.3 of ISO 13485 in the other. Reads section 820.7, which incorporates ISO 13485:2016 for sections 820.1, 820.3, 820.10, 820.35 and 820.45, and clause 3 of ISO 9000:2015 for definitions. Explains what incorporation by reference means, why FDA's definitions win where they differ, and how the FD&C Act controls in any conflict, with a Chicago dental implant maker reading implant with FDA's meaning. Shows XYZ Medical's term map, one medical device file per product family, recording why a requirement does not apply, and its quality manual naming both texts. Covers a Sydney bed maker's old records and closes with a recap: ISO's words, read with FDA's meanings.

What you will be able to do

• Explain what incorporation by reference means in Part 820
• Map old QSR record terms to their new homes under ISO 13485
• Apply FDA's definitions where they differ from ISO's

Why it matters

The terms changed but the content still has to exist; mapping old records avoids gaps FDA can still ask about.

Practice: Practice: Incorporation by reference · 3 questions

Starts with two management reviews at XYZ Medical on the same rising complaints about the pump's occlusion alarm: one noted and forgotten, the other approving a design change with a budget, owner and date. Explains that under the QMSR, management review reports are no longer exempt from FDA inspection. Covers clause 4.1: documenting the system and roles, a risk-based approach to process control, outsourcing and validating quality system software. Then clause 5 and top management's six duties, the management representative role held by XYZ's Director of Quality, and the culture of quality FDA expects. Shows XYZ Medical's quality objectives for the year and part of its review record, including a revised supplier procedure due in April, and a Los Angeles catheter contract maker feeding customer complaints into its own review. Closes with a recap: a review is worth the decisions it makes.

What you will be able to do

• Explain what clause 4.1 and clause 5 ask of top management
• Write management review records that show decisions and resources
• Set quality objectives that management can act on

Why it matters

FDA can now read your management review; one that records decisions shows a culture of quality.

Practice: Practice: Management responsibility and the QMS · 3 questions

Opens with the May 2026 warning letter to a foot pedal control maker whose risk procedure did not say how risk work was done, who approved it, when documents were updated, or how complaints fed in. Contrasts it with XYZ Medical, where an occlusion alarm complaint reaches the risk file within days. Explains the two separate requirements: a risk-based approach to controlling quality system processes in clause 4.1.2 b), and documented risk management processes for product realisation in clause 7.1, and how FDA reads them. Follows one hazard through XYZ's quality system, with a mandatory change request field naming affected risk file entries and two complaints in one week. Looks at side-rail entrapment at a Sydney bed maker and a wrong result at a New York diagnostic software start-up. Ends with a practice exercise, what investigators review, and a recap.

What you will be able to do

• Tell the two levels of risk management in ISO 13485 apart
• Set triggers that update risk files from complaints and changes
• Explain what FDA investigators look for in risk files

Why it matters

FDA inspections now start from your risk documents; a risk process that keeps running is what they expect to see.

Practice: Practice: Risk management across the QMS · 3 questions

Begins on XYZ Medical's final test line, where one tester signed a training record but misread a new acceptance limit for a week, while a supervisor's practical check caught the same error for another. Covers clauses 6.1 and 6.2 on resources and competence, and FDA's April 2026 view that training effectiveness is checked in proportion to the risk of the work. Shows XYZ's competence matrix, final testers at the high-risk end, and the patient story every new assembler hears. Explains infrastructure and maintenance, including test benches, cleanroom air handling and the complaint database, and clause 6.4.1 cited in the May 2026 letter. Covers the controlled room for administration sets, robot welding in Sydney and a Los Angeles cleanroom. Ends with clause 7.6 on measuring equipment, XYZ tracing 212 pumps tested since the last good check, and a recap.

What you will be able to do

• Check training effectiveness in proportion to the risk of the work
• Identify infrastructure and work environment that need control
• Reassess earlier results when measuring equipment fails calibration

Why it matters

A signed training record does not show competence; checking that training worked stops errors before release.

Practice: Practice: Resources, competence and infrastructure · 3 questions

Opens with the July 2026 warning letter to a Doppler device maker that added fetal heart sounds as a use in its manual with no design change records, validation, review or 510(k) evaluation. Contrasts it with XYZ Medical raising a design change, updating the risk file and planning validation to add a new patient group. Reads section 820.10(c): clause 7.3 applies to class two and three devices, class one devices automated with software and five listed class one types, such as gloves made by a maker in Mumbai. Walks through clause 7.3 from planning and inputs to outputs, review, verification, validation, transfer and changes, with XYZ's weekly change board. Shows the index of the design file for XYZ's second-generation pump, which replaces the former design history file, and how FDA inspects design. Closes with a recap: a new intended use is a design change.

What you will be able to do

• Decide whether a device must follow design controls under 820.10(c)
• Explain the steps of ISO 13485 clause 7.3 from planning to changes
• Treat labelling and intended use changes as design changes

Why it matters

A change to a manual can be a design change; seeing how far design controls reach avoids a warning letter.

Practice: Practice: Design and development controls · 3 questions

Starts with XYZ Medical's circuit board supplier in Toronto switching to a cheaper capacitor without notice, which caused field alarm faults, against a purchase agreement requiring notice before any change. Covers outsourced processes as the organisation's responsibility under clause 1 of ISO 13485, and written quality agreements under clause 4.1.5. Explains supplier selection, monitoring and re-evaluation proportionate to the device's risk, with lighter incoming checks for good suppliers and audit findings followed up. Shows part of XYZ's approved supplier list and what it puts in a quality agreement. Covers FDA's April 2026 note on outsourced design and manufacture, a New York specification developer using a Los Angeles contract maker, and a Sydney bed maker relying on a supplier's certificate, which FDA has said may not be enough. Ends with a practice exercise classifying suppliers by risk and a recap.

What you will be able to do

• Set supplier controls proportionate to the device's risk
• Write a quality agreement that requires notice of changes
• Explain why a supplier's ISO 13485 certificate may not be enough

Why it matters

Your supplier's change is your device's change; one sentence in a purchase agreement can stop a field problem.

Practice: Practice: Purchasing and supplier controls · 3 questions

Opens with XYZ Medical's pouch sealer for sterile administration sets: drifting unnoticed in one version, validated and monitored on every cycle in the other, with affected packs located within a day through the UDI. Covers clause 7.5.1 on planned, monitored and controlled production with a verified record for each device or batch. Explains validation of processes that cannot be fully verified, such as XYZ's pouch sealing and tubing bonds, sterilisation at a contract steriliser whose reports sit in XYZ's files, and production software validated in proportion to risk. Then identification, with serial numbers and lot numbers in the UDI, screened repair reports, and FDA's additions: UDI under Part 830, tracking under Part 821 and traceability for life-supporting devices, such as home ventilators made in Singapore. Shows the batch record for one lot of sets and a Los Angeles tip-bonding validation, and closes with a recap.

What you will be able to do

• Identify processes that must be validated because they cannot be fully tested
• Check that each batch record carries its unique device identifier
• Explain FDA's additions for UDI, tracking and implant traceability

Why it matters

If a batch proves faulty, validated processes and traceable records let you find every affected unit within a day.

Practice: Practice: Production, validation and traceability · 3 questions

Begins with a complaint file at XYZ Medical about an occlusion alarm that sounded late: a good investigation, but no UDI and no record of what the hospital was told, against a second file with all the items section 820.35(a) lists. Explains the baseline in clause 4.2.5 of ISO 13485 on control of records, then FDA's additions in section 820.35: specific content for complaint and servicing records, UDIs for each device or batch, and confidential marking. Shows how a repeat report can refer to the first investigation with a recorded reason, XYZ's updated complaint record and its servicing records for pumps repaired in hospitals. Covers section 820.45 on labelling and packaging procedures, accuracy checks, documented release and inspection to prevent mix-ups, with XYZ's label check for one lot. Notes that a Chicago maker exempt from good manufacturing practice still keeps complaint files, and closes with a recap.

What you will be able to do

• Check that a complaint record holds every item section 820.35 lists
• Apply section 820.45 labelling and packaging checks before release
• Explain which record rules apply even to exempt devices

Why it matters

A good investigation can still fail inspection if the record is incomplete; complete records and correct labels avoid that.

Practice: Practice: Records, complaints and labelling · 3 questions

Opens with two field actions: the June 2021 Philips Respironics recall of sleep apnea machines and ventilators, followed by an April 2024 consent decree that included allegations of unreported corrections or removals, and Baxter's July 2025 correction of its Novum IQ pumps in place. Covers clause 8.2.1 on a documented feedback process and how Part 820 plugs in FDA's reporting rules. Explains that the reporting clock starts when any employee becomes aware of a reportable event, and the Part 803 deadlines of thirty calendar days and five work days. Shows XYZ Medical's reportability record for the late alarm complaint, then a software fix to every pump in the field under Part 806 and its ten working day report. Looks at a side-rail latch in Sydney and a Tokyo scanner importer's duties. Ends with a practice exercise, MDR event files and a recap.

What you will be able to do

• Decide whether a complaint is a reportable medical device event
• Apply the Part 803 and Part 806 reporting deadlines
• Record the reasons behind a decision not to report

Why it matters

The clock starts at awareness, not when the investigation ends; knowing the deadlines keeps reports on time.

Practice: Practice: Feedback, complaints and reporting · 3 questions

Returns to the May 2026 warning letter, where a customer's corrective action request for six failed foot pedals came back with the root cause blank, citing clause 8.5.2, and rework lacked documentation, citing clause 8.3.4. Explains the difference between a correction and corrective action. Covers clause 8.3.1 on identifying, segregating, evaluating and disposing of nonconforming product, concessions such as a pump housing with a cosmetic mark, and rework to approved procedures. Shows XYZ Medical trending complaint, service and test data together, and its corrective action record for the late alarm. Explains corrective and preventive action reviewed for effectiveness, and internal audits where nobody audits their own work, covering sections 820.35 and 820.45 and the reporting rules. Adds a Los Angeles contract maker's customer requests, a practice exercise and a recap: close the loop, and show it closed.

What you will be able to do

• Tell a correction from a corrective action
• Write a CAPA record from root cause to effectiveness check
• Plan internal audits that cover the full QMSR, not only ISO 13485

Why it matters

When a problem comes back, the system that chose the fix usually failed; a closed loop stops repeat findings.

Practice: Practice: CAPA, audits and nonconforming product · 3 questions

Opens with day one of an FDA inspection at XYZ Medical: no host and scattered risk files in one version, a trained host, a back room team and ready risk files in the other. Explains that from 2 February 2026 FDA stopped using QSIT and follows the risk-based process in compliance programme 7382.850, starting from patient risk. Covers the six quality system areas and the four other FDA requirements, including medical device reports and reports of corrections and removals, and the two inspection models, with a Los Angeles maker awaiting a pre-approval inspection and a Chicago contract maker expecting Model 1. Explains the three outcomes, No, Voluntary or Official Action Indicated, and audits under the Medical Device Single Audit Program. Shows XYZ's readiness plan and a question from the investigator to test your trail, and closes with a recap: FDA starts from risk.

What you will be able to do

• Explain how FDA's risk-based inspection process replaced QSIT
• Describe the six areas and two models of a QMSR inspection
• Prepare hosts, a back room and records for an FDA inspection

Why it matters

Preparation does not change your quality system, it shows it well; knowing how FDA inspects helps you answer with evidence.

Practice: Practice: How FDA inspects under the QMSR · 3 questions

Starts with FDA's April 2026 statement that records made before 2 February 2026 need not be recreated, but processes needing change should be identified and planned, with its example of feedback never fed into risk management. Sets out a six-step method: scope your roles, sites and devices, map every requirement in ISO 13485, Part 820 and Parts 803, 806, 821 and 830, compare with real records, rate the gaps, act and verify. Shows what XYZ Medical records on each line of its gap register, then runs the method from start to finish, with XYZ's own rating rule and how it closed a gap. Covers four mistakes to avoid, starting your own first line, and a Sydney bed maker with forty staff. Ends with the road map, a checklist, the takeaways and the final exam of scenario-based questions.

What you will be able to do

• Run a six-step QMSR gap assessment against real records
• Rate gaps by risk and give every action an owner and a date
• Verify the transition with an audit and a mock inspection

Why it matters

A gap register and verified action plan are what you hand FDA to show your transition; find your gaps before FDA does.

Practice: Practice: Your gap assessment and action plan · 3 questions