ISO 13485 vs. QMSR: A Practical FDA Gap Analysis

An ISO 13485–QMSR gap analysis compares a manufacturer’s implemented quality system with the applicable FDA requirements—not simply two sets of headings. QMSR incorporates ISO 13485:2016 into 21 CFR Part 820, but FDA-specific provisions and other US regulatory obligations still require attention. The useful output is a prioritized action register with evidence-based closure criteria.

Start with what already works. A mature ISO-based system may provide much of the foundation. The task is to identify missing US-specific controls, weak interfaces and records that do not demonstrate implementation. A certificate is relevant context, not a finding that every device, site and activity meets FDA requirements.

ISO 13485 and QMSR are related, not competing systems

FDA’s QMSR overview confirms the February 2, 2026 effective date and incorporation by reference. QMSR uses the ISO framework while preserving FDA’s authority and additional provisions. FDA does not require ISO 13485 certification, and certification does not replace an FDA inspection.

Do not create a second quality system solely to carry US headings. Instead, integrate applicable requirements into controlled processes and show how those processes produce reliable evidence. Our QMSR implementation guide explains this operating-model approach; this article concentrates on evaluating and closing specific gaps.

Define the assessment boundary first

List devices, sites, manufacturer activities, outsourced work and intended US markets. Record the applicable requirements and any justified exclusions or exemptions. Confirm design-and-development applicability rather than assuming a certification scope settles the question. FDA definitions and interpretation provisions in section 820.3 also need attention.

Use a current authorized copy of ISO 13485 and the actual FDA text. This article summarizes practical topics; it does not reproduce the standard or provide a clause-by-clause legal determination. An assessment with an unclear boundary can produce a reassuring score while omitting the device or process carrying the greatest risk.

Use a requirement-to-evidence crosswalk

For each row, capture the source requirement, applicable process, accountable owner and a sample of implemented evidence. Distinguish a documentation gap from a process failure and from a justified non-applicable requirement. The table below is a starting crosswalk, not an exhaustive statement of compliance.

Keep references and evidence separate. Writing a clause number in a procedure does not prove implementation. Similarly, a sampled failure may indicate a broader control problem even where the procedure’s language appears correct.

Examine FDA-specific record details

Section 820.35 supplements incorporated record requirements. Sample complaint records, applicable service records and relevant device or batch identification. Review actual field completion and investigation handling—not only whether the electronic form contains a place for the information.

For example, a complaint about a connected device may identify a symptom but omit the configuration needed to investigate it. That problem can affect engineering analysis, reportability and risk review. Record the gap’s actual consequence, identify the responsible process and define evidence demonstrating that the repaired workflow captures usable information.

Test labeling and packaging controls at release

Section 820.45 addresses device labeling and packaging controls. Choose a released device or batch and reconstruct the examination and approval trail. Check that the relevant identifiers, labeling content and packaging configuration match the approved requirements, and that controls prevent mix-ups.

Do not treat an approved label artwork file as complete release evidence. The practical question is whether the correct label and packaging were applied under controlled conditions to the correct device. Include outsourced packaging operations in the assessment where relevant, with clear responsibilities and acceptance evidence.

Separate QMSR additions from other US obligations

Medical-device reporting, corrections/removals, registration/listing, UDI and device tracking have their own applicable regulatory requirements. They are not all new requirements created by the QMSR transition. The gap analysis should nevertheless check how they connect to quality-system processes.

A complaint workflow should route potentially reportable information for appropriate assessment. A field action should trigger an applicable corrections/removals review. Document tracking applicability rather than assuming every implant or every device is covered identically. Our compliance frameworks guide helps frame these interfaces while keeping each obligation’s source clear.

Assess record accessibility and inspection readiness

FDA’s QMSR FAQ explains the changed inspection framework. Do not carry forward an assumption that legacy exemptions from routine inspection of certain audit and management-review records remain unchanged. Prepare relevant records for applicable FDA review and seek qualified advice on specific disclosure questions.

FDA’s risk-based program evaluates connected processes, not only the presence of an ISO certificate. The six-area inspection article helps organize practical retrieval. Check both record quality and access: approved documents that staff cannot locate promptly still create preparation problems.

Rank gaps by consequence, not document count

Use a consistent internal prioritization method. Consider potential patient/user impact, the extent of affected products or processes, regulatory significance and whether the control is implemented. Explain the ranking rather than assigning unexplained red, amber and green labels.

A missing training acknowledgement and an uncontrolled process affecting released devices should not receive identical treatment simply because both appear as one spreadsheet row. Where a gap may affect ongoing safety or compliance, evaluate appropriate containment and escalation immediately; a future completion date is not an adequate interim control by itself.

Close gaps with implementation evidence

Define closure before work begins. For a record-format gap, that may include an approved form, trained users and sampled completed records. For a process-control issue, closure may require validation, investigation or an effectiveness check proportionate to the issue.

Follow the same logic for electronic records and signatures. The 21 CFR Part 11 guide helps assess applicability and evidence controls without assuming every software tool is regulated identically. Ensure revisions preserve relevant history and that any changed system is assessed for its intended use and risks.

Download the editable gap assessment

Download the ISO 13485–QMSR Gap Assessment.xlsx. Add applicability rationales, procedure references, sample evidence, owners, severity and closure records. It is an internal assessment aid, not an FDA form, certification tool or exhaustive substitute for the regulations and standard.

• Each gap states an unmet requirement or demonstrated implementation weakness.
• Non-applicable entries have a reviewed rationale.
• High-priority findings have interim controls where needed and accountable owners.
• Closed findings include sampled implementation and appropriate effectiveness evidence.

FDA primary sources

FDA’s QMSR overview and QMSR FAQ explain the incorporation, certification distinction and inspection transition. Consult current 21 CFR Part 820, especially sections 820.3, 820.10, 820.35 and 820.45. FDA’s official CP 7382.850, including Attachment A, connects inspection areas to regulatory and incorporated references. Verify other US obligations against their own applicable parts.

Move from gap lists to evidence-backed execution

Use MedTech Copilot to structure fragmented quality, risk, development, V&V and regulatory work into traceable assessment and closure tasks. Keep qualified reviewers responsible for applicability, corrective actions and approval. A useful gap analysis produces demonstrable improvements—not a generic narrative or an automated declaration of compliance.