FDA QMSR and ISO 13485: Training and Competence Requirements Now In Force

On 2 February 2026 the rulebook that governs how American medical device manufacturers train their people changed name, structure and underlying logic. The regulation at 21 CFR Part 820 is no longer the Quality System Regulation. It is the Quality Management System Regulation, and the clause that used to tell manufacturers what to do about personnel and training has been deleted and replaced by a reference to an international standard.

For anyone responsible for training records in a device company selling into the United States, this is not a cosmetic change. The old requirement asked whether people had been trained. The new one asks whether they are competent, whether you checked, and whether the way you checked was proportionate to the risk of the work. Those are different questions, and they are answered with different evidence.

What the QMSR actually did

The FDA published the final rule, Medical Devices; Quality System Regulation Amendments, on 2 February 2024, with a two-year runway. It became effective on 2 February 2026. Rather than rewrite Part 820, the FDA incorporated ISO 13485:2016 into it by reference, together with clause 3 of ISO 9000:2015 for definitions.

Structurally, most of Part 820 is now empty. Subparts C to O are marked reserved, and the requirements that used to sit there are found in ISO 13485 instead. What survives is a short regulation:

• 820.1 scope
• 820.3 definitions, including the definition of a finished device
• 820.7 incorporation by reference
• 820.10 quality management system requirements, which cross-refer to other FDA rules
• 820.35 control of records, including complaint and servicing records
• 820.45 labelling and packaging controls, retained because the FDA took the view that ISO 13485 does not specifically address manufacturer labelling inspection

Where an ISO 13485 clause conflicts with the Federal Food, Drug, and Cosmetic Act or its implementing regulations, the Act and the regulations control. The standard is layered underneath American law, not substituted for it.

The clause that disappeared

The old 820.25 Personnel was two short paragraphs, and it is worth remembering what it asked for, because it shaped a generation of training files. It required manufacturers to have sufficient personnel with the necessary education, background, training and experience to ensure that required activities were correctly performed. It required procedures for identifying training needs, and it required that training be documented. It also required something quite specific: personnel had to be made aware of device defects that could result from improper performance of their jobs, and personnel performing verification and validation had to be made aware of the defects and errors they might encounter.

That section is gone. Its replacement is ISO 13485 clause 6.2, and the mapping is one-to-one in the FDA crosswalk: 820.25 maps to 6.2, just as management responsibility at 820.20 maps to clause 5 and design controls at 820.30 map to clause 7.3.

What clause 6.2 asks for instead

Clause 6.2 opens from the same premise, that personnel whose work affects product quality must be competent on the basis of education, training, skills and experience. From there it sets out a short cycle that a training function has to be able to evidence:

• Determine the competence needed for the personnel doing that work. This is role-specific, not a generic induction list.
• Provide training, or take other actions, to achieve or maintain that competence. The standard does not insist the answer is a course. Coaching, supervision, reassignment and recruitment are all legitimate actions.
• Evaluate the effectiveness of whatever action was taken.
• Ensure awareness of the relevance and importance of the person’s activities and how they contribute to the quality objectives.
• Maintain records of education, training, skills and experience.

The organisation is also required to document the processes by which it establishes competence, provides training and ensures awareness. In other words, the procedure itself is an auditable artefact, not just the completed records it generates.

Effectiveness, not attendance

The single most consequential line in clause 6.2 is a note attached to the effectiveness requirement: the methodology used to check effectiveness is proportionate to the risk associated with the work for which the training or other action was provided.

Two things follow from that. First, a completion record is not an effectiveness check. A signature confirming attendance evidences that an action was taken, not that competence resulted. Second, the standard deliberately declines to prescribe a method, which means the burden of justifying the method sits with the manufacturer. A ten-question quiz may be a defensible check for an awareness topic and an indefensible one for a sterile fill operator or a software validation engineer. The higher the risk of the work, the more the check has to look like observed performance, supervised sign-off or qualification against a defined standard.

This is the same architecture that European pharmaceutical manufacturers have worked under for years. EU GMP Chapter 2 requires continuing training with its effectiveness periodically assessed, and the assessment approved at a defined level of seniority. If you have built a training system to that expectation, the QMSR will feel familiar. If you have built one around completion percentages, it will not. Our guide to GMP training requirements under EU GMP Chapter 2 sets out how that assessment obligation is usually discharged in practice.

Records that can no longer be withheld

One change deserves separate attention because it alters the stakes of everything above. The old Part 820 contained an exception at 820.180(c) that allowed manufacturers to withhold management review records, internal quality audit reports and supplier audit reports from FDA investigators. That exception has been removed.

Internal audit reports are where a training system’s weaknesses are usually written down most honestly. Under the previous regime, a candid internal finding about inconsistent competence assessment stayed internal. It does not any more. Quality teams who have treated the internal audit as a safe space for frank findings need to decide, deliberately, how they will write them now, and more importantly how quickly they will close them.

Inspections have changed too

The FDA stopped using the Quality System Inspection Technique for device inspections on 2 February 2026. QSIT had been the de facto script for a generation of inspection-readiness programmes, and it has been replaced by the updated Inspection of Medical Device Manufacturers compliance programme, 7382.850. The two earlier programmes it supersedes, 7382.845 and 7383.001, were withdrawn at the same time.

Any inspection-readiness training built around the four QSIT subsystems is now training people for an exercise that no longer happens in that form. That is a straightforward content refresh, but it is one that quality training owners have to initiate themselves, because nothing in the regulation prompts it.

Certification is not compliance

A point that has caused real confusion: the QMSR does not require ISO 13485 certification, and holding a certificate does not by itself satisfy the regulation. The FDA added requirements on top of the incorporated standard, so a conformant ISO 13485 quality system can still fall short of Part 820. The direction of travel is the opposite of what certification instinct suggests. Certification evidences conformity to the standard; the regulation asks for conformity to the standard plus the retained American requirements.

The same distinction applies to any management system standard being adopted for regulatory purposes rather than commercial reassurance, which is the pattern we traced in our explainer on ISO/IEC 42001 and AI management systems.

The European overlap

Most device manufacturers are not choosing between regimes. Under the EU Medical Device Regulation, manufacturers must put a quality management system in place, and EN ISO 13485:2016/A11:2021 is cited as a harmonised standard in the Commission lists for both the MDR and the IVDR, published through implementing decisions in January 2022. A single ISO 13485 quality system can therefore serve both an EU conformity assessment and an FDA inspection, provided the manufacturer layers the jurisdiction-specific requirements on top.

The European regime also puts a named individual behind the paperwork. MDR Article 15 requires a Person Responsible for Regulatory Compliance with defined qualifications and five statutory duties, an appointment we examined in detail in our guide to the PRRC under MDR Article 15. That pattern of attaching regulatory accountability to a person rather than a department runs across regulated sectors; it is the same design as the COLP and COFA roles in regulated law firms.

What a compliant training function looks like now

Practically, the work splits into four pieces. Define competence by role rather than by course catalogue, in writing. Choose and document an effectiveness method for each role, with the risk justification stated so that an inspector does not have to infer it. Keep records of education, training, skills and experience that can be produced per person, not per course. And review the procedure itself, because the documented process for establishing competence is now part of what is assessed.

None of this is unfamiliar to professionals who already work under an audited competence regime. Statutorily registered health and social care professionals have been maintaining and defending competence records of this kind for years, as our guide to CORU CPD requirements for medical scientists describes. What is new in the device sector is that the obligation now reads as a management system requirement rather than a personnel rule, and the evidence that satisfies it has moved from the attendance sheet to the assessment.