QSR to QMSR: What the 2026 Transition Means
On February 2, 2026, the framework that governed U.S. medical device manufacturing for nearly three decades changed names and structure. The FDA replaced the legacy Quality System Regulation (QSR) with the Quality Management System Regulation (QMSR), amending 21 CFR Part 820 to incorporate ISO 13485:2016 by reference (FDA, Quality Management System Regulation). This is not a narrow update to one clause. It is a horizontal event, and it touches finished-device manufacturers across every operation, including sterilization, packaging, labeling, and assembly.
Most of the coverage so far has explained the rule in regulatory terms. That is useful, but it stops short of the question a quality or operations lead actually has to answer: what changes in the way you build, sterilize, package, and release product, and how do you keep your supplier base aligned to the new framework. This article works through the transition from that angle.
What Actually Changed on February 2, 2026
The QMSR incorporates ISO 13485:2016 by reference for finished-device manufacturers, and its scope explicitly includes packaging, labeling, and sterilization operations (FDA, Quality Management System Regulation). If you held ISO 13485:2016 certification before the transition, much of the underlying quality-system structure will feel familiar. The regulation now points to the international standard rather than restating its own subpart prose.
That point is worth stating plainly because it is the source of most confusion. Under the old QSR, 21 CFR Part 820 contained standalone subpart text: design controls, production and process controls, acceptance activities, and so on. The QMSR removed most of that standalone prose and replaced it with a reference to ISO 13485:2016, then layered FDA-specific requirements on top (FDA, QMSR Frequently Asked Questions). So the requirements did not disappear. They moved. A design-control obligation that used to live in 21 CFR 820.30 now runs through 21 CFR 820.10(c), which points to ISO 13485:2016 Clause 7.3. A process-validation obligation flows through Clause 7.5.6. Contamination and work-environment control flows through Clause 6.4. The framework is the QMSR; the technical clauses are ISO 13485:2016.
The QMSR is not identical to ISO 13485:2016 standing alone. FDA layered its own requirements on top of the incorporated standard (MD+DI, Future Changes to 21 CFR 820: Transition from QSR to QMSR), and the explicit integration of risk management across the entire quality system, not just product design, is the substantive difference between the QSR and the QMSR (FDLI, The QMSR Transition, New FDA Guidance, and Their Impacts on Active Implantable Medical Devices). Treating certification to the standard as automatic QMSR compliance is a mistake. The two overlap heavily, but they are not the same document.
The inspection model changed too
The regulation is only half the story. FDA also retired the Quality System Inspection Technique (QSIT) that inspectors used under the QSR and replaced it with Compliance Program 7382.850 (FDA, QMSR Frequently Asked Questions). If your internal audit program, mock-inspection playbook, or supplier-audit checklist was built around the four QSIT subsystems, that scaffolding needs to be rebuilt around the new compliance program.
One clarification from FDA deserves emphasis because it is easy to get wrong: ISO 13485 certification does not exempt a manufacturer from FDA inspection (FDA, QMSR Frequently Asked Questions). Holding a certificate from a notified body does not put you outside FDA's inspectional reach. FDA inspects to the QMSR, which includes the incorporated standard plus FDA's layered requirements, using its own compliance program.
MDSAP is a separate question, and it is worth stating precisely because conflating it with certification is a common error. FDA accepts MDSAP audit reports as a substitute for routine Agency inspections (FDA, Medical Device Single Audit Program). That substitution does not extend to for-cause inspections, compliance follow-up inspections, or the pre-approval and post-approval inspections tied to a PMA, and the QMSR transition did not change the policy. So an MDSAP audit report can stand in for a routine surveillance inspection. An ISO 13485 certificate on its own cannot.
Why This Is a Horizontal Event, Not a Localized One
The word horizontal is doing real work here. When FDA finalized the QMSR, it did not stop at Part 820. A December 2025 technical amendment conformed references across 18 parts and 179 CFR sections to the new regulation, and FDA characterized those changes as editorial, imposing no new substantive obligations (Federal Register, QMSR Technical Amendments). That breadth is the point. The cross-references that other regulations made to the old quality-system language all had to be updated, which tells you how deeply the QSR was woven through the device regulatory framework.
For a manufacturer, the practical consequence is that the transition does not sit inside one department. It reaches design, purchasing, production, process validation, acceptance activities, complaint handling, and CAPA at the same time. There is no single owner and no single document to revise. That is precisely why a coordinated readiness effort beats a piecemeal one, and it is where the structure of your supply base starts to matter.
Where the Transition Lands in Practice
The abstract regulatory shift becomes concrete in a handful of operations that most device programs depend on. Three of them, sterilization, packaging, and assembly, sit squarely in the space LSO works in every day, and each carries a validation and supplier-control burden under the QMSR.
Sterilization and other special processes
Under ISO 13485:2016, which the QMSR now incorporates, processes whose output cannot be fully verified by later monitoring or measurement must be validated (ISO 13485:2016 Clause 7.5.6). Terminal sterilization is the textbook example. You cannot inspect sterility into a finished lot after the fact, so the sterilization process itself has to be validated and controlled. The obligation did not change with the transition. What changed is where you cite it: not a removed QSR subpart, but Clause 7.5.6 of the incorporated standard.
That has an operational implication for anyone outsourcing sterilization. The validated state of your ethylene oxide or radiation process, the dose-setting rationale, the bioburden data supporting it, and the ongoing controls all have to hold up under a QMSR inspection conducted through Compliance Program 7382.850. If those records live with a supplier, your quality system has to reach them.
Packaging and the sterile barrier system
Sterile barrier system design and validation are governed by ISO 11607-1:2019 (materials and system requirements) and ISO 11607-2:2019 (validation of forming, sealing, and assembly processes) (ISO 11607-1:2019 and ISO 11607-2:2019). These standards support the process-validation obligation retained under the QMSR through Clause 7.5.6, because sealing is another process whose output you cannot fully verify by inspecting every unit.
A sealing process that has not been validated to ISO 11607-2:2019, or a sterile barrier material that has not been qualified to ISO 11607-1:2019, is a gap that a QMSR inspection can surface the same way a QSR inspection would have. If you want a deeper treatment of that validation work, LSO's packaging validation guidance covers accelerated aging, seal strength, and distribution simulation in detail. The transition does not add new packaging requirements so much as re-anchor the existing ones to the incorporated standard.
Assembly, environment, and contamination control
Assembly operations for sterile and non-sterile devices carry their own controls. Work-environment and contamination control, which used to be described in standalone QSR production-and-process-control prose, now flows through ISO 13485:2016 Clause 6.4 under the QMSR. For cleanroom assembly, that clause sits alongside the cleanroom classification and monitoring practices defined in the ISO 14644 family. The requirement to control the environment where product is built is intact. Its regulatory home moved.
The Supplier-Control Problem the Transition Sharpens
Here is the part that is easy to miss in the regulatory summaries. ISO 13485:2016 requires manufacturers to establish purchasing controls and to evaluate and monitor suppliers based on the supplier's effect on product quality (ISO 13485:2016 Clause 7.4). That is the mechanism that governs outsourced sterilization, packaging, and assembly under the QMSR. If you send devices out for ethylene oxide sterilization, buy a validated pouch-sealing service, or use a contract assembler, Clause 7.4 makes their performance your responsibility to control and monitor.
The more suppliers sit in that chain, the more purchasing controls, quality agreements, supplier audits, and monitoring records you maintain, and the more interfaces have to stay aligned to the same QMSR framework. A sterilization vendor, a separate packaging validation lab, a separate contract assembler, and a separate cleaning and decontamination provider is four supplier files, four sets of quality-agreement terms, four audit cycles, and four places where a process-validation record has to be current and reachable during an inspection.
That coordination load is not hypothetical. Trade coverage published as the QMSR took effect flagged the transition as more difficult for smaller, U.S.-focused firms with limited ISO 13485 experience and for combination-product manufacturers, precisely the organizations with the least slack to absorb multi-supplier coordination (RAPS, QMSR is Live). The regulation does not care whether you have a large regulatory-affairs team. The records still have to be there.
How a Single-Partner Model Reduces the Coordination Load
LSO runs sterilization validation, packaging validation, cleanroom assembly and kitting, and cleaning and decontamination inside one ISO 13485-certified quality system across facilities in Brea CA, Somersworth NH, and Costa Rica. For a manufacturer working through QMSR readiness, consolidating those operations under one partner changes the supplier-control math in a few concrete ways.
First, it collapses the number of Clause 7.4 supplier relationships you manage for these operations. One quality agreement, one supplier-audit relationship, and one set of monitoring records replaces several. That does not remove your responsibility under the QMSR, but it reduces the number of interfaces where records can drift out of sync.
Second, it keeps the process-validation records that Clause 7.5.6 requires under one roof and one document-control system, governed by ISO 13485:2016 Clause 4.2. When sterilization validation, sealing validation, and assembly process controls all live in the same quality system, the traceability an inspector asks for during a Compliance Program 7382.850 inspection is easier to assemble, because you are not stitching together records from separate vendors with separate formats and separate revision histories.
Third, it removes handoffs between the operations most likely to interact. Post-sterilization seal integrity is the clearest example: sterilization and sterile barrier packaging are validated processes that affect each other, and when they sit with the same partner the interface between them is managed inside one system rather than across a contract boundary.
None of this is a claim that a single partner is right for every program or that consolidation is a compliance shortcut. Your quality system still owns the supplier controls, the validations, and the inspection readiness regardless of how many partners you use. The argument is narrower and, we think, defensible: fewer supplier interfaces mean fewer places for QMSR-relevant records to fall out of alignment, and that matters more now that the inspection model and the underlying framework have both changed at once.
A Practical Readiness Checklist for the QMSR Era
The transition is done as a matter of law, but readiness is an ongoing state, not a one-time event. A few areas warrant a direct look for any manufacturer that outsources sterilization, packaging, or assembly.
Start with citation hygiene. Any procedure, protocol, or quality-system document that references an old QSR subpart by number now points to text that was removed. Those references should be remapped to the ISO 13485:2016 clause the requirement flows through: design controls to Clause 7.3, process validation to Clause 7.5.6, purchasing controls to Clause 7.4, work environment and contamination control to Clause 6.4, CAPA to Clause 8.5.2 and 8.5.3, document control to Clause 4.2. Leaving stale subpart citations in a controlled document is an avoidable finding.
Next, confirm your process validations are current and reachable. For every outsourced special process, sterilization and sterile barrier sealing in particular, verify that the validation records exist, are current, and can be produced during an inspection even though the process runs at a supplier. Clause 7.5.6 does not distinguish between processes you run and processes you buy.
Then review your supplier files against Clause 7.4. Purchasing controls, quality agreements, evaluation criteria, and monitoring records should reflect each supplier's actual effect on product quality. A sterilization provider and a packaging validation provider affect product quality directly, and their files should show that they are evaluated and monitored accordingly.
Finally, rebuild your internal audit and mock-inspection materials around Compliance Program 7382.850 rather than the retired QSIT subsystems (FDA, QMSR Frequently Asked Questions). If your audit program still walks the four QSIT subsystems, it is auditing to a framework FDA no longer uses.
The Bottom Line
The QSR-to-QMSR transition did not invent new obligations so much as relocate existing ones into ISO 13485:2016 and add an FDA-specific layer on top (MD+DI, Future Changes to 21 CFR 820: Transition from QSR to QMSR). The requirements to validate sterilization, to validate sterile barrier sealing, to control the assembly environment, and to control your suppliers all survived the transition intact. What changed is the framework they live in, the clauses you cite, and the compliance program FDA inspects against.
The horizontal reach of the change, across 18 parts and 179 CFR sections (Federal Register, QMSR Technical Amendments), is what makes coordination the real challenge rather than any single new rule. The fewer disconnected supplier interfaces you maintain across sterilization, packaging, and assembly, the fewer places your QMSR-relevant records can drift, and the more straightforward your inspection readiness becomes.
Talk Through Your QMSR Readiness
If you are consolidating contract manufacturing partners as part of your QMSR readiness, our team can walk through your sterilization, packaging, and assembly specs in a 30-minute technical review and map them against the ISO 13485:2016 clauses that now govern each process.