Most OEM quality teams are re-baselining their supplier audit checklists right now, and the worst way to find out your contract manufacturer isn't ready is to watch an FDA investigator discover it first. If your CM is still narrating quality-system requirements in QSR language and pointing to subpart citations that no longer carry the requirement, that gap will surface in your own supplier audit before it surfaces in an FDA inspection. It should. You do not want to learn during the audit itself that your CM is learning the QMSR during the audit itself.
The framework changed on February 2, 2026. The revised 21 CFR Part 820, now the Quality Management System Regulation (QMSR), took effect and incorporates ISO 13485:2016 by reference, meaning the standard is part of the regulation as if it were written out in full (FDA, Quality Management System Regulation). The requirements your team has audited against for years did not disappear. They moved. Knowing where they moved, and confirming your CM knows too, is the practical work of the transition.
What Actually Changed at Inspection Time
FDA retired the Quality System Inspection Technique (QSIT) and now conducts device quality-system inspections under Compliance Program 7382.850, released January 30, 2026. The agency moved from the four familiar QSIT subsystems toward a risk-based inspection strategy (FDA QMSR FAQ; Ropes & Gray LLP). Compliance Program 7382.850 governs how FDA investigators conduct themselves. It does not dictate your CM's internal procedures, so do not let a CM tell you the new program requires them to restructure their QMS a particular way. Their QMS obligation flows from ISO 13485:2016 as incorporated into Part 820.
Two points worth stating plainly to any CM that treats an ISO 13485 certificate as a shield. FDA does not require or issue ISO 13485 certificates, and holding certification does not exempt a manufacturer from FDA inspection (FDA QMSR FAQ). A certificate on the wall is evidence of a third-party assessment. It is not a substitute for inspection readiness, and it is not something you should accept in place of your own supplier audit.
Investigators may also review QMS records created before the February 2, 2026 effective date (FDA QMSR FAQ). Records made under the old QSR are fair game. The requirements those records were created under do not change retroactively, but the records themselves are inspectable. A CM that assumed its pre-2026 history was behind it has miscalculated.
Where the Familiar QSR Anchors Now Live
The most useful thing you can do with an existing supplier checklist is remap it clause by clause rather than rewrite it from scratch. The requirements you know are still the requirements. Here is the crosswalk that matters most in a CM audit.
Design controls now flow through ISO 13485:2016 Clause 7.3. If your CM performs design or development work under your agreement, this is where design inputs, outputs, verification, validation, transfer, and the design history file evidence live. The former subpart prose is Reserved under the QMSR; the operative requirement is Clause 7.3 (ISO 13485:2016). Devices under an Investigational Device Exemption remain subject to design and development requirements under ISO 13485:2016 Clause 7 (FDA, Quality Management System Regulation), so early-stage programs do not get a pass here.
Corrective and preventive action maps to Clauses 8.5.2 and 8.5.3 (ISO 13485:2016). CAPA is still CAPA. Ask your CM to walk a recent corrective action from problem identification through effectiveness verification and confirm they cite 8.5.2 and 8.5.3, not the retired subpart.
Document control maps to Clause 4.2.4, part of the broader documentation requirements in Clause 4.2 (ISO 13485:2016). This is where controlled documents, revision history, and obsolete-document handling belong.
Work environment and contamination control maps to Clause 6.4 (ISO 13485:2016). The old production and process controls environmental text is gone from the regulation. When you audit cleanroom discipline, gowning, or contamination control at your CM, the requirement you are checking against is Clause 6.4, not any 820.70 subpart. A CM that still quotes the old environmental-control prose verbatim is quoting text that no longer exists in the regulation.
Two documentation concepts also shifted names. The Device Master Record concept is now the Medical Device File under Clause 4.2.3, and Device History Record content is addressed through records of medical devices under Clause 4.2.5 (ISO 13485:2016). If your quality agreement references a DMR or DHR by the old names, update the language so both parties are describing the same artifacts.
The Terminology Shift Is Not Cosmetic
The move from Part 820's subpart structure to ISO 13485's clause-based organization introduced more than 100 material terminology updates across the total product lifecycle, including replacing "executive responsibility" with the broader concept of "top management" (AAMI, Navigating the QSR to QMSR Terminology Transition). That count is AAMI's editorial tally rather than a regulatory figure, but the direction is what matters: the vocabulary changed at scale.
This is not pedantry. If your CM's procedures still speak in QSR terms while your audit checklist speaks in ISO 13485 clauses, every audit turns into a translation exercise, and translation gaps are where findings live. When you audit, listen for whether the CM's staff speak the clause language naturally or whether they are converting on the fly. Fluency is a readiness signal. Hesitation is a flag.
The Records That Used to Be Off-Limits Are Now Inspectable
This is the single change most likely to catch an unprepared CM. Under the old QSR, FDA was barred from reviewing management-review reports, internal-audit reports, and supplier quality-audit reports. ISO 13485:2016 contains no equivalent exception, so under the QMSR these records are inspectable (Morgan Lewis; Ropes & Gray LLP). The underlying authority is the absence of a shielding clause in ISO 13485:2016 as incorporated into Part 820, not the legal commentary itself.
In practice, that means the internal-audit findings, management-review minutes, and supplier-audit reports your CM once kept confidential can now be pulled during an FDA inspection. A CM that historically wrote those records loosely, with speculative characterizations or unfinished action items left dangling, has exposure it may not have reckoned with. When you audit your CM, ask to understand how they have adjusted their internal record-keeping in light of this change. The right answer is that their management-review and internal-audit records are factual, complete, and free of unnecessary editorializing, with corrective actions tracked to closure. The wrong answer is a blank look.
What to Verify in the Quality Agreement and Audit-Prep Posture
Start with the quality agreement itself. Confirm it references the current framework and current clause structure, not retired subpart numbers. Where the agreement allocates responsibility for design activities, CAPA ownership, document control, complaint handling, and change notification, those allocations should map cleanly onto ISO 13485:2016 clauses so there is no ambiguity about which party owns which requirement.
Then pressure-test the CM's audit-prep posture directly. Ask your CM to show you that evidence organized the way an investigator will ask for it. A CM that can produce it in that structure on request is ready. A CM that has to assemble it while you wait is telling you how the FDA inspection will go.
Finally, confirm your CM is not leaning on an ISO 13485 certificate as proof of inspection readiness. The certificate is useful context. It is not the audit, and it does not exempt anyone from one (FDA QMSR FAQ). At LSO, as an FDA-registered, ISO 13485-certified contract manufacturer, our quality system is built around the ISO 13485:2016 clause structure the QMSR now incorporates, which means the evidence an OEM supplier audit asks for and the evidence an FDA investigator asks for are organized the same way.
The transition is not a reason to slow down supplier qualification. It is a reason to make sure the CM you qualify already speaks the language your auditors and FDA's investigators now use.