FDA QMSR vs. ISO 13485: How the 2026 Quality System Alignment Affects Your Recall Obligations

The QMSR is the most significant change to U.S. medical device quality regulation in 25 years. Here is what it means for your recall system, FSCAs, and complaint handling.

The End of Dual System Maintenance — Almost

For the past 25 years, medical device manufacturers selling in both the U.S. and international markets have maintained parallel quality management systems: one designed to satisfy FDA's 21 CFR Part 820 (Quality System Regulation) and one designed to satisfy ISO 13485 (or its predecessor standards). While harmonization efforts produced substantial overlap, the regulatory language, terminology, and documentation expectations differed enough to require distinct procedural frameworks for each jurisdiction.

The FDA's Quality Management System Regulation (QMSR), published February 2, 2024 and effective February 2, 2026, represents the most significant structural change to U.S. medical device quality regulation since the original QSR was finalized in 1996. By formally incorporating ISO 13485:2016 by reference, QMSR creates a unified quality system framework where ISO 13485 compliance is substantively FDA compliance.

The "almost" qualifier matters: the QMSR does not eliminate all FDA-specific requirements. Medical Device Reports (MDRs), Unique Device Identification (UDI) requirements, and specific 510(k)/PMA regulatory pathway obligations remain FDA-specific. But for quality system procedures, CAPA, post-market surveillance, design controls, and complaint handling — which are the quality system elements most directly relevant to recall readiness — a well-implemented ISO 13485:2016 system now satisfies QMSR requirements.

This guide focuses on the QMSR changes most directly relevant to recall procedures, Field Safety Corrective Actions, complaint handling, and post-market surveillance.

What Is the QMSR, and What Changed?

Structure of the change: QMSR (21 CFR Part 820, revised) amends the old QSR by removing the prescriptive procedural requirements of the original 21 CFR Part 820 and replacing them with requirements that explicitly reference and incorporate ISO 13485:2016 by reference. Manufacturers satisfying ISO 13485:2016 satisfy QMSR requirements for the incorporated elements, subject to FDA-specific additions and clarifications.

Key terminology alignment: QMSR adopts ISO 13485 terminology where differences existed. Notably, the QMSR formally aligns on terms like "nonconforming product," "corrective action," "preventive action," and "post-market surveillance" — replacing or supplementing the older QSR terminology that had created documentation friction when maintaining dual systems.

What remains FDA-specific:

• MDR obligations (21 CFR Part 803) — mandatory reporting of deaths, serious injuries, and certain malfunctions — remain separate from QMSR
• UDI requirements (21 CFR Part 830) remain unchanged
• Design submission requirements (510(k), PMA, De Novo) remain governed by their respective regulations
• Establishment registration and device listing (21 CFR Part 807) remain unchanged

How QMSR Affects Recall Procedures

Recall as quality system output, not separate procedure:

Under the old QSR, many manufacturers maintained recall procedures as stand-alone SOP documents with limited integration into the quality management system. QMSR/ISO 13485's framework positions recall procedures as outputs of an integrated quality system — specifically, recall capability is the downstream operationalization of complaint handling (§8.2.2), nonconforming product control (§8.3), CAPA (§8.5.2), and post-market surveillance (§7.2.1 and Annex A for implantable devices).

In practical terms, an FDA QMSR inspection of your recall procedures will evaluate not just the recall SOP but the entire chain: how complaints are captured and investigated, how nonconformities are escalated to potential recall evaluation, how post-market surveillance data feeds the hazard assessment process, and how CAPA is used to both address the root cause and prevent recurrence.

Documentation of recall decision rationale:

ISO 13485:2016's emphasis on process documentation — including documented risk management integration per ISO 14971 — creates an expectation that recall decision-making is documented with reference to the risk analysis supporting the decision. The question "why did you determine this did not warrant a recall?" must now have a documented, risk-referenced answer — not just an informal judgment call.

Traceability requirements:

QMSR, through its ISO 13485 incorporation, carries the traceability requirements of §7.5.9 — requiring traceability through the entire supply chain for implantable devices and where required by risk management. For recall execution, this means the lot-level traceability that enables precise recall scope definition (rather than broad market withdrawal) must be built into the quality system as a continuous capability, not assembled reactively during a recall event.

FSCAs and MDRs: The Post-QMSR Framework

Field Safety Corrective Actions (FSCAs):

An FSCA is any corrective action taken in the field to reduce a risk of death or serious deterioration in health associated with a device already on the market. The FSCA concept is formally incorporated in ISO 13485 and EU MDR, and QMSR's harmonization formally brings FDA-regulated manufacturers into a common FSCA framework.

Under the QMSR/ISO 13485 framework, FSCA decisions are now explicitly quality system outputs — meaning the decision pathway from signal detection (complaint, post-market surveillance, CAPA) to FSCA initiation must be documented within the quality system. FDA inspectors reviewing QMSR compliance may examine FSCA decision documentation with the same scrutiny previously applied to CAPA records.

MDR Obligations Remain Unchanged:

The Medical Device Reporting requirements — 30 days for deaths and serious injuries, 5 days for malfunctions that could cause or contribute to death or serious injury if they were to recur — remain governed by 21 CFR Part 803, not QMSR. Post-QMSR, these obligations are unchanged.

However, QMSR's integration with ISO 13485's post-market surveillance requirements creates a more explicit connection between MDR-reportable events and the quality system: MDR-reportable events must now flow through the complaint handling and CAPA processes in a documented way, and the post-market surveillance system must capture MDR data as a signal input for trend analysis and field safety assessment.

Complaint Handling Under QMSR/ISO 13485

ISO 13485:2016 Section 8.2.2 (Complaint Handling) aligns with FDA's longstanding complaint handling requirements but adds specificity around:

• Written procedure for complaint handling (aligned with existing QSR requirement)
• Determination of whether the complaint is an MDR-reportable event — now explicitly required as part of complaint processing
• CAPA initiation when complaint investigation warrants it — creating a documented connection between complaint handling and CAPA that must be evident in quality system records
• Trend analysis — complaints must be analyzed for trends, not just individually, and the trend analysis output feeds post-market surveillance

For quality leaders, the QMSR/ISO 13485 integration means complaint handling procedures that existed under the old QSR may need revision to explicitly include MDR evaluation steps, CAPA linkage documentation, and trend analysis protocols — if these were not already formally documented.

Post-Market Surveillance: The QMSR Upgrade

Post-market surveillance (PMS) under ISO 13485:2016 is more explicitly defined than it was under the old QSR, and QMSR's incorporation of ISO 13485 brings FDA-regulated manufacturers into that more defined framework.

ISO 13485:2016 §7.2.1 requires manufacturers to establish a documented PMS procedure and to analyze PMS data for signals requiring CAPA or FSCA initiation. For implantable devices, additional PMS requirements apply under Annex A (which corresponds to requirements in EU MDR and IMDRF guidance).

PMS documentation that FDA inspectors will evaluate post-QMSR:

• Evidence that PMS data sources are comprehensive (not just formal complaints but adverse event databases, scientific literature, clinical data, and competitor recall signals)
• Evidence that PMS outputs are feeding risk management and CAPA processes
• Evidence that PMS trend analysis is occurring at appropriate frequency relative to the risk profile of the device

Manufacturers whose PMS systems consisted primarily of formal complaint tracking will need to assess whether their current systems satisfy the broader PMS scope that QMSR/ISO 13485 demands.

Action Priorities for Quality Leaders

Procedure gap assessment: Review recall procedures, complaint handling procedures, FSCA procedures, and PMS procedures against ISO 13485:2016 requirements — specifically the documentation of decision logic, MDR evaluation steps, CAPA linkage, and trend analysis.

Training update: Quality personnel should understand the QMSR/ISO 13485 harmonization and how it affects their specific procedure responsibilities. Inspection readiness training should reflect the new unified terminology and documentation expectations.

Records architecture review: Under QMSR, quality system records demonstrating the integrated chain from PMS signal → complaint investigation → nonconformity → CAPA → FSCA/recall decision must be traceable within the quality system. Records scattered across disconnected SOPs and spreadsheet-based systems may not satisfy this traceability expectation.

Mock inspection: Conduct a QMSR-framework mock inspection focusing on the complaint-to-CAPA-to-FSCA pathway, with particular attention to documentation of decision rationale at each escalation point.

---

SuperRecall.ai supports medical device manufacturers building QMSR and ISO 13485-aligned post-market surveillance and recall management systems. To see how our platform integrates with your quality system to support FDA QMSR compliance, request a demonstration or explore our medical device capabilities.