Feb 2, 2026·FDA · Final RuleActiveHigh impact
FDA Quality Management System Regulation (QMSR) takes effect
The QMSR formally aligns 21 CFR Part 820 with ISO 13485:2016. Cybersecurity design controls, risk management, and supplier controls must now be documented under the harmonized framework.
What changed
- Part 820 is restructured to reference ISO 13485:2016 directly.
- Cybersecurity activities (threat modeling, SBOM, postmarket surveillance) must trace into the QMS - not live in a parallel binder.
- Address third-party software components through applicable supplier and risk-management controls. VEX communication is optional, not a QMSR-mandated cadence.
Action for manufacturers
Map your cybersecurity SOPs, threat models, and SBOM/VEX processes into the QMSR clause structure. Any cyber activity that isn't traceable into design controls or supplier management is a gap.