FDA QSR vs ISO 13485: The Crucial Differences You Must Know

Navigating the regulatory landscape for medical devices can be complex, especially when comparing US requirements with other international standards. A common question is:

“What’s the difference between ISO 13485 and the FDA’s quality system requirements?”

This article addresses exactly that, highlighting the distinctions between ISO 13485 and the FDA’s 21 CFR Part 820, while also offering insights into the FDA’s upcoming shift toward the Quality Management System Regulation (QMSR).

You may be asking: “what is ISO 13485?”

ISO 13485 is an internationally recognised standard for quality management systems (QMS) specific to the medical device industry. It outlines requirements to ensure that organisations consistently meet customer and regulatory expectations throughout the lifecycle of a medical device, from design and development to production and post-market support.

While seeking ISO 13485 certification is not legally required in all jurisdictions, it is widely adopted and often a prerequisite for companies to market devices in the region; including the EU, UK, Canada, and Australia, to name a few. ISO 13485 is also commonly used to help meet regulatory requirements and is harmonised to the EU Medical Device Regulations ( EU MDR 2017/745).

Got it, but what are the key features of ISO 13485?

Okay, but how does the FDA QSR differ from ISO 13485?

In the US, medical device manufacturers are required to comply with the FDA’s Quality System Regulation (QSR), codified in 21 CFR Part 820. Like ISO 13485, the QSR is a foundational framework ensuring that devices are manufactured to a consistent level of quality and safety.

Unlike ISO 13485, which is a voluntary standard, compliance with 21 CFR Part 820 is a legal obligation for selling medical devices in the US. The FDA enforces these regulations directly through inspections and potential enforcement actions.

What are the key elements of the FDA QSR?

ISO 13485 vs FDA QSR: What are the key differences?

ISO 13485 and 21 CFR Part 820 are similar in a lot of ways, but there are several important differences:

Aspect	ISO 13485	FDA QSR (21 CFR Part 820)
Certification vs. Compliance	International, voluntary standard (often required)	US federal regulation (legally binding)
Audit vs. inspection	Audits conducted by third-party notified bodies or registrars	Inspections conducted by FDA investigators
Risk Management	Integrated and included as a requirement throughout all processes. Aligns with ISO 14971	Not mandated like in 13485. Includes specific requirements for risk analysis and management that aligns with FDA guidance documents
Supplier Controls	Required, including supplier evaluations and controls	Required, but terminology and depth vary
Complaint Handling	Required, with documentation and analysis	Required, with defined procedures and regulatory reporting
Regulatory Alignment	Harmonised with the EU MDR and other global regulatory frameworks	US-specific
Documentation and Record-keeping	Required, comprehensive	21 CFR Part 820 includes additional requirements related to device labelling, packaging, and reporting that are not explicitly covered by ISO 13485

Ultimately, ISO 13485 is more internationally harmonised, while the FDA QSR is tailored to the US market, with a particular focus on post-market oversight and regulatory enforcement.

Does my company need to follow both?
It depends; the main things to ask yourself are whether the products you sell are classified as medical devices in both the US and global markets, and where you intend to market them:

What is the FDA QMSR, and how will it impact compliance?    

Recognising the growing alignment of global regulatory systems, the FDA is in the process of updating 21 CFR Part 820 to align more closely with ISO 13485. The new regulation will be known as the Quality Management System Regulation (QMSR).

The goals of the QMSR initiative are to:

The QMSR will incorporate ISO 13485 by reference, meaning that compliance with ISO 13485 will become the foundation for meeting FDA requirements. There will still be some US-specific additions required by the QMSR on top of those in ISO 13485, such as additional requirements regarding the control of records for complaints and servicing.

Importantly, terms common to both the QSR and ISO 13485 will be removed from the QMSR, e.g. the Device Master Record is being removed, as it is covered by the Medical Device File outlined in Clause 4.2.3 of ISO 13485.

When does the new FDA QMSR take effect?
The FDA published the final rule for the QMSR on 2nd February 2024 and gave a 2-year transition period before the QMSR comes into effect on 2nd February 2026.

About the author – Alexander Madell, Quality Assurance and Regulatory Affairs Consultant at LFH Regulatory.

Alexander obtained a BSc (Hons) in Biomedical Sciences from Durham University before completing a MSc specialising in Haematology at the University of Westminster. Alexander commenced his professional career in 2020, supporting the transfer of numerous pharmaceutical Marketing Authorisations at the MHRA. From here, Alexander moved to the medical devices sector and has worked with several leading manufacturers on a range of devices, spanning from class I to class IIb.

Notably, Alexander has utilised his keen analytical skills to navigate some key complex regulatory changes, including Brexit and Swixit, to ensure seamless market access and sustained compliance. Further, his responsibilities have included the development and maintenance of device technical files, performing regulatory impact assessments and co-ordinating regulatory responses across all aspects of change management.

Connect on Linked In

FAQ’s for The Crucial Differences Between ISP 13485 and FDA QSR