ISO 13485 vs FDA QMSR: What Startups Need to Understand
Share
If you are building a medical device company for the U.S. market, you are going to hear two terms repeatedly:
ISO 13485 and FDA QMSR.
At first glance, they can sound like two different quality systems your company needs to build.
They are not.
The FDA’s Quality Management System Regulation, or QMSR, now uses ISO 13485:2016 as the foundation of the U.S. medical device quality-system requirements.
That creates much greater alignment between the U.S. and international quality-system frameworks, but it does not make the two terms interchangeable.
For a startup, understanding that distinction can save a lot of confusion and unnecessary work.
What is ISO 13485?
ISO 13485:2016 is the internationally recognized quality management system standard created specifically for organizations involved with medical devices.
It provides a framework for controlling activities such as product development, risk management, suppliers, production, records, complaints, corrective action, and other processes throughout the medical-device lifecycle.
Companies operating internationally often use ISO 13485 as the backbone of their quality management system.
Depending on the markets you intend to enter, ISO 13485 certification may also become an important part of your regulatory or commercial strategy.
But the standard itself is not an FDA regulation.
That distinction matters.
What is the FDA QMSR?
The FDA Quality Management System Regulation is the U.S. regulatory requirement contained in 21 CFR Part 820.
On February 2, 2026, the QMSR became effective and replaced the previous Quality System Regulation framework.
Rather than maintaining a separate quality-system structure that largely paralleled ISO 13485, FDA incorporated ISO 13485:2016 directly into Part 820.
That means manufacturers subject to QMSR must now establish a quality management system that complies with the applicable requirements of ISO 13485:2016 along with the additional requirements contained in U.S. law and FDA regulations.
For startups, that is an important shift.
You no longer need to think about building an “FDA quality system” and an “ISO quality system” as two separate structures.
You need one well-designed quality management system that addresses the requirements that apply to your company and the markets where you intend to operate.
They are aligned, but they are not identical
This is probably the most important point to understand.
FDA incorporating ISO 13485 does not mean that ISO 13485 replaced FDA regulation.
The Federal Food, Drug, and Cosmetic Act and other applicable FDA requirements still apply.
Where an ISO requirement conflicts with U.S. law or FDA regulation, the U.S. requirement controls.
FDA also retained supplemental requirements within Part 820 to address areas where additional U.S.-specific controls are necessary.
So while the systems are now much more closely aligned, simply saying:
“We follow ISO 13485.”
is not enough to demonstrate that all applicable FDA requirements have been addressed.
FDA still has specific requirements
A medical device company operating in the United States must look beyond the ISO standard itself.
Depending on the product and organization, additional FDA requirements may apply to areas such as:
- Medical Device Reporting
- Unique Device Identification
- Device tracking
- Corrections and removals
- Complaint records
- Servicing records
- Labeling and packaging controls
- Other requirements applicable to the specific device
QMSR also contains supplemental provisions addressing certain records and labeling and packaging activities.
The practical takeaway is simple:
Use ISO 13485 as the quality-system foundation, then map the applicable FDA requirements onto that system.
You should not need two parallel processes for the same activity.
ISO 13485 certification is not the same as FDA compliance
This is another distinction startups sometimes miss.
A company can obtain ISO 13485 certification through an accredited certification body.
FDA does not issue ISO 13485 certificates.
And having an ISO 13485 certificate does not automatically mean that every FDA requirement applicable to your company has been satisfied.
Likewise, a company subject to FDA requirements does not necessarily need an ISO certificate simply because QMSR incorporates ISO 13485.
Certification and regulatory compliance are related concepts, but they are not the same thing.
The question your startup should ask is:
Which regulatory and certification requirements apply to the markets we intend to enter?
That answer should drive your quality-system strategy.
One system is better than two
Before QMSR, companies operating in both U.S. and international markets often created complicated cross-reference matrices between FDA requirements and ISO 13485.
Sometimes the processes were nearly identical but documented differently simply because the regulations used different terminology.
The newer framework gives startups an opportunity to avoid that problem from the beginning.
Instead of building one SOP for FDA and another for ISO, design one process that satisfies all applicable requirements.
For example, you should not need separate supplier-management procedures for different regulatory systems if one properly designed process can address both.
The same principle can apply to document control, training, CAPA, complaints, risk management, design and development, and many other areas.
A good quality system should reflect how the company actually works, not how many regulatory frameworks appear on a spreadsheet.
Do a requirements map before writing SOPs
One of the most valuable things a startup can do early is build a simple regulatory requirements map.
Start with your product and business model.
Identify:
Where will the device be sold?
What is the device classification?
What activities does your company perform?
Do you design the product?
Do you manufacture it internally or use a contract manufacturer?
Do you install or service the device?
Does the product contain software?
What postmarket responsibilities will the company have?
Once those questions are understood, you can determine which requirements apply and connect them to the processes in your QMS.
Then you can build procedures around actual business processes instead of blindly creating documents from a generic SOP list.
Think about inspections differently too
The QMSR transition also changed the way FDA approaches medical-device inspections.
As of February 2, 2026, FDA stopped using the old Quality System Inspection Technique, commonly known as QSIT, and began using its updated medical-device manufacturer inspection program.
For startups, the bigger lesson is not the name of the inspection model.
It is that your quality system should be able to demonstrate how your processes satisfy the applicable requirements of QMSR and the incorporated ISO framework.
That makes traceability between your requirements, procedures, records, and actual business practices increasingly important.
You should be able to explain:
Here is the requirement.
Here is how our process addresses it.
Here is the procedure that controls the process.
And here are the records showing that we actually follow it.
That is far more useful than simply producing a large binder of SOPs.
What should a startup do now?
If your company is just beginning to build its quality system, resist the temptation to create separate “FDA” and “ISO” systems.
Instead, build one quality-management architecture.
Use ISO 13485:2016 as the foundational structure.
Identify the FDA requirements that apply to your U.S. operations.
Add the requirements of any additional markets you plan to enter.
Then design each process so that one operating system supports those obligations wherever practical.
This approach reduces duplicate procedures, duplicate records, conflicting responsibilities, and unnecessary training.
More importantly, it creates a quality system that can actually grow with the company.
Build once, map carefully
The alignment between QMSR and ISO 13485 is good news for medical device startups.
It creates an opportunity to build a quality system that supports both U.S. and international regulatory strategies without maintaining two completely different ways of working.
But alignment does not mean the requirements are identical.
The strongest approach is to understand your regulatory obligations first, map them carefully, and then build processes that satisfy them together.
One company. One operating system. Multiple regulatory requirements mapped into it.
That is a much stronger foundation than building separate quality systems and trying to connect them later.
Start with the processes you need
If you are still determining which procedures belong in your initial quality system, the Medical Device Startup SOP Checklist can help you identify the processes and records you may need and think through when they should be implemented as your company grows.