QMSR in practice: how FDA cites ISO 13485 in device warning letters since February 2026
The QMSR took effect on February 2, 2026. Here is what the first device warning letters written under it cite, clause by clause, and how to read device trends now.
Six warning letters have now been written to device makers from inspections that started after the Quality Management System Regulation took effect. None of them cites a section of the old Quality System Regulation. Five of the six cite ISO 13485:2016 clause 7.1. This article reads those letters, shows which clauses FDA reached for, and explains how to read device warning letter trends without the switch fooling you.
What changed on February 2, 2026
The QMSR replaced the Quality System Regulation at 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. The familiar sections, 820.30 for design controls, 820.100 for CAPA, 820.198 for complaints, no longer exist as requirements of their own. Part 820 now holds a short set of FDA-specific sections: 820.10 (the requirement to comply with ISO 13485 and the additions), 820.35 (control of records, including complaint and servicing records) and 820.45 (device labeling and packaging controls).
FDA did not publish an official crosswalk from the old sections to the new clauses. The final rule says so directly, in its response to comments. That matters for anyone tracking enforcement, because a count of "letters citing 820.100" now measures two things at once: how often FDA finds CAPA problems, and how many of the letters still come from inspections that started before the switch.
What the first six QMSR letters cite
The FDA Warning Letter Explorer reads every letter on FDA's public index and extracts each citation. Six device letters so far cite ISO 13485 clauses. None cites a section of the old Part 820; one, Koven, cites the new 820.35 alongside the clauses.
| Letter | Inspection | Issued | ISO 13485 clauses cited | Old 820 sections |
|---|---|---|---|---|
| Linemaster Switch Corporation | Feb 4 to Mar 6, 2026 | May 27, 2026 | 6.4.1, 7.1, 7.6, 8.3.4, 8.5.2 | none |
| Koven Technologies | Feb 2 to Feb 6, 2026 | Jul 21, 2026 | 7.1, 7.3.9, 7.4.1 | none (cites the new 820.35, complaint records) |
| Nipro Renal Solutions USA | Feb 2 to Jul 16, 2026 | Jul 24, 2026 | 6.3, 7.1, 7.3.1, 7.3.9, 7.4.1, 7.5.6, 7.6, 8.3.1, 8.5.2 | none |
| Pensar Medical (Lion Street Medical) | Apr 14 to Apr 28, 2026 | Aug 21, 2026 | 7.1, 7.3.9, 8.5.2 | none |
| O.N. Diagnostics | began Mar 12, 2026 | Sep 1, 2026 | 7.4.1, 8.5.2 | none |
| Unilam Co., LTD | May 18 to May 22, 2026 | Sep 22, 2026 | 7.1, 7.3.1, 7.4.1, 7.4.2, 7.6, 8.2.6 | none |
Two inspections began on the first business day the rule was in force. Koven's ran four days and produced a letter five and a half months later, which is the normal gap in this dataset. Unilam, a Korean laser device maker, is the first foreign site cited under the new rule; its letter also carries the radiation safety sections of Parts 1010 and 1040, which the QMSR did not touch.
Which clauses FDA reached for first
| Clause | Title | Letters (of 6) | Old section it replaces in practice |
|---|---|---|---|
| 7.1 | Planning of product realization | 5 | No single one; risk management was folded into 820.30(g) design validation |
| 7.4.1 | Purchasing process | 4 | 820.50 purchasing controls |
| 8.5.2 | Corrective action | 4 | 820.100 CAPA |
| 7.3.9 | Control of design and development changes | 3 | 820.30(i) design changes |
| 7.6 | Control of monitoring and measuring equipment | 3 | 820.72 calibration |
| 7.3.1 | Design and development, general | 2 | 820.30(a) design controls |
| 7.5.6 | Validation of processes for production | 1 | 820.75 process validation |
| 7.4.2 | Purchasing information | 1 | 820.50(b) purchasing data |
| 8.2.6 | Monitoring and measurement of product | 1 | 820.80 acceptance activities |
| 8.3.1, 8.3.4 | Control of nonconforming product, rework | 1 each | 820.90 nonconformances |
| 6.3, 6.4.1 | Infrastructure, work environment | 1 each | 820.70 production and process controls |
Clause 7.1, in five of the six letters, is the finding to notice. Under the old rule, risk analysis was one requirement inside design validation. Under ISO 13485, clause 7.1 requires documented risk management across product realization, and FDA is citing it as a standalone gap: a risk management file that does not cover the whole lifecycle, or that does not follow ISO 14971, is now its own finding rather than a footnote to design validation.
The other pattern is continuity. Purchasing controls, corrective action and design change control were three of the most cited device sections under the old rule, and they are the three clauses cited most often under the new one after 7.1. The requirements moved; the failures did not.
See the ISO 13485 clauses and what FDA said under each
The mixed period will last into 2027
Of the 28 device warning letters issued in 2026 through October 6, 23 were issued after February 2. Nine of those 23 still cite old sections of Part 820, because the inspections behind them started before the switch. With a five-to-six-month gap between inspection and letter, and inspections that can run for months, old-rule citations will keep arriving through 2027. Until then, every section-level count for devices reads as a decline that is partly real and partly a change of vocabulary.
How to read device trends now: by topic, not by section
The explorer joins each old Part 820 section, each new 820 section and each ISO 13485 clause to one of 22 device topics, so a topic such as corrective action keeps one continuous count across the switch. The mapping is Botable's, checked against the current text of Part 820, the ISO 13485:2016 clause structure and the pairings in FDA's own MDSAP audit approach. It is not an FDA document.
| Device topic | Old QSR sections | ISO 13485:2016 clauses | New FDA-only sections |
|---|---|---|---|
| Design controls | 820.30 | 7.3.1 to 7.3.9 | |
| Corrective and preventive action | 820.100 | 8.4, 8.5.1 to 8.5.3 | |
| Complaints and feedback | 820.198 | 8.2.1 to 8.2.3 | 820.35(a) |
| Process and software validation | 820.75, 820.70(i) | 7.5.6, 7.5.7, 4.1.6 | |
| Purchasing and suppliers | 820.50, 820.80(b) | 7.4.1 to 7.4.3 | |
| Nonconforming product | 820.90 | 8.3.1 to 8.3.4 | |
| Acceptance activities | 820.80 | 8.2.6 | |
| Production and environment controls | 820.70, 820.184 (DHR) | 7.5.1, 7.5.2, 7.5.5, 6.3, 6.4, 8.2.5 | |
| Records and device files | 820.180, 820.181, 820.186 | 4.2.3, 4.2.5, 7.3.10 | 820.35(c), 820.35(d) |
| Internal audit | 820.22 | 8.2.4 | |
| Management and quality system | 820.20, 820.5 | 4.1, 4.2.1, 4.2.2, 5.1 to 5.6, 6.1 | 820.10 |
| Training and personnel | 820.25 | 6.2 | |
| Document control | 820.40 | 4.2.4 | |
| Equipment and calibration | 820.72 | 7.6 | |
| Labeling and packaging | 820.120 | none (7.5.1 stays in production) | 820.45 |
| Product planning and risk management | none (folded into 820.30(g)) | 7.1 |
Read this way, the year-to-date picture for device letters is: design controls down from 21 letters to 14, complaints and feedback from 15 to 9, process and software validation from 9 to 3, purchasing and suppliers from 9 to 6, nonconforming product from 6 to 3. Product planning and risk management appears for the first time, in 5 letters. Overall device letter volume is lower too (61 letters from CDRH in 2025, 27 so far in 2026), so the topic view separates a genuinely quieter year from a change of citation form.
See device letters by topic, with old and new citations combined
What this means for a device QMS
Three practical consequences follow from the letters so far.
Risk management is now inspected as its own requirement. Clause 7.1 appeared in five of the six letters. A risk management file that lives inside the design history file and stops at design transfer will not satisfy it.
Records are where FDA added its own rules. 820.35 is the one section FDA wrote rather than borrowed, and Koven's letter cites it alongside the ISO clauses. Complaint records, servicing records, UDI in the device history record and the handling of confidential information are the places where an ISO 13485 certificate does not cover the FDA requirement.
Procedures should cite the clause, not the old section. Every one of these letters was written against clause numbers. A quality manual and procedure set that still maps to 820.30 and 820.100 will be translated on the fly by the investigator. That is a gap analysis worth doing before the inspection rather than during it.
Frequently asked questions
When did the QMSR take effect? February 2, 2026. Inspections that started on or after that date are conducted against ISO 13485:2016 as incorporated by 21 CFR 820.10, plus the additional requirements in 820.35 and 820.45.
What is the difference between the QSR and the QMSR? The QSR was FDA's own quality system regulation, written as 21 CFR 820.1 through 820.250. The QMSR replaces those sections with ISO 13485:2016 by reference and keeps a small number of FDA-specific requirements. The underlying expectations are close; the citations, the vocabulary and some record-keeping rules changed.
Does an ISO 13485 certificate mean I comply with the QMSR? No. The QMSR incorporates the standard but adds FDA requirements for records, labeling and packaging, and FDA inspects; it does not audit for certification. The six letters above all went to firms making devices in scope of the standard.
Has FDA published a crosswalk from 21 CFR 820 to ISO 13485? No. FDA declined to in the final rule. The topic mapping used here is Botable's, built from the regulation text, the standard's clause structure and FDA's MDSAP audit approach, and it is documented in the explorer.
Source: FDA warning letter index, read through the Botable FDA Warning Letter Explorer, as of October 6, 2026. ISO 13485:2016 clause titles are used with the standard's numbering; the standard's text is copyrighted and is not reproduced.
