FDA’s QMSR Is Now in Force — Five Checks for Teams Building AI-Enabled Devices

FDA’s Quality Management System Regulation (QMSR) took effect on February 2, 2026. It replaced the old Quality System Regulation in 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. Three points frame everything else:

• ISO 13485 alone is not enough. FDA kept its own provisions, including definitions, records, and labeling and packaging controls, and where ISO 13485 conflicts with the FD&C Act or FDA regulations, FDA’s requirements control.
• ISO 14971 was not incorporated by reference. The rule requires a risk-based approach through ISO 13485, and most manufacturers still use ISO 14971 as the method.
• More records are open to inspection. Internal audit, supplier audit and management review records are now within what FDA can inspect, so write them as if an investigator will read them.

Five Checks for AI-Enabled Device Teams

1. Treat models, datasets and ML platforms as suppliers. ISO 13485 clause 7.4 expects criteria for selecting, monitoring and re-evaluating suppliers. If you use a third-party model, a labelling vendor or a cloud ML service, can you show how you qualified and monitor it?
2. Validate the software that runs your quality system and production. ISO 13485 requires risk-proportionate validation of software used in the QMS, in production and service provision, and in monitoring and measurement. AI-based tools used there are included.
3. Run AI-specific failure modes through risk management. Design and development under clause 7.3 must include risk management. For an AI product that means model drift, performance gaps in subgroups, and unexpected inputs, not only hardware and software faults.
4. Make internal audits cover the AI lifecycle. An audit programme that checks document control and CAPA but never samples data management, model validation or change control will leave gaps that are now visible to an inspector.
5. Trace each release end to end. Training data, model version, validation results and release approval should link together in the design records. If the model changes after release, your change control and any predetermined change control plan should show who approved what, and why. See our earlier piece on what a PCCP actually requires.

This is general information, not legal or regulatory advice. Sources: FDA, Quality Management System Regulation (QMSR); IntuitionLabs, FDA QMSR and ISO 13485: Key Changes Effective 2026.