Denne side er offentlig.
On 2 February 2026, FDA's Quality System Regulation for medical devices became the Quality Management System Regulation (QMSR). Part 820 now incorporates the international standard ISO 13485:2016 by reference instead of spelling out its own requirements. For a small device company, the change reaches the everyday work of keeping procedures, approving changes and producing records for an inspector. This page sets out what changed for documents and records, from the final rule's own text (89 FR 7496) and FDA's QMSR pages, read on 3 November 2026. It is published by Hub Nexus (hubnx, hubnx.com), whose workspaces carry controlled documents. The end of the page says what that does and does not cover.
This is not legal or regulatory advice. The rule applies to your device, your records and your quality system as you validate them. Check it with your regulatory lead.
The short answer
- Part 820 is now short. It has six live sections: scope (820.1), definitions (820.3), incorporation by reference (820.7), requirements (820.10), control of records (820.35) and labeling and packaging (820.45). Everything else is ISO 13485:2016, which has "the same force and effect as language explicitly stated" in the regulation.
- "Approved" still means signed and dated. The old line in 820.35 requiring each approver's signature and date was removed. But FDA says that where ISO 13485 uses "approved", the document "has a signature and date". Electronic signatures are acceptable.
- Inspectors may now read more. Management reviews, quality audits and supplier audits are no longer exempt from inspection.
- Records must be on hand. Records are made available during an inspection, and records kept elsewhere "by the next working day or two, at the latest".
- QSIT is retired. FDA inspects under Compliance Program 7382.850. An ISO 13485 certificate does not exempt you from an FDA inspection.
What the rule now says, section by section
| Section | What it does |
|---|---|
| 820.1 Scope | Anyone who designs, makes, packages, labels, stores, installs or services a finished device "must establish and maintain a quality management system that is appropriate for its specific device(s)". Where ISO 13485 conflicts with the FD&C Act or FDA's regulations, the Act and the regulations win |
| 820.3 Definitions | ISO 13485's definitions and Clause 3 of ISO 9000 apply. The regulation itself does not define "document" or "record" |
| 820.7 Incorporation by reference | ISO 13485:2016 as a whole, including its introduction, and ISO 9000:2015 Clause 3 only |
| 820.10 Requirements | Document a quality management system that meets ISO 13485, plus FDA's own parts: unique device identification (part 830), traceability (part 821), reporting complaints (part 803), corrections and removals (part 806); design controls (ISO 13485 Clause 7.3) for class II and III devices and the class I devices listed |
| 820.35 Control of records | ISO 13485 Clause 4.2.5, plus required fields for complaint records, servicing records and the UDI, and a way to mark records confidential |
Documents and records, under the QMSR
Documents are controlled under ISO 13485 Clause 4.2.4, records under Clause 4.2.5. In FDA's words: "Records are a special type of document and shall be controlled according to the requirements given in 4.2.5." The clauses themselves are ISO's text. You can read them free, read-only, through ANSI's incorporation-by-reference portal.
Approval needs a signature and a date. The final rule removed 820.35's old requirement to "obtain the signature for each individual who approved or re-approved the record". It then explains: "where ISO 13485 uses the term ‘approved,’ that term means that an approved document, or certain record of a type that requires approval by ISO 13485, has a signature and date." So every approval of a controlled document still needs both.
Electronic is fine. FDA "will consider signatures that utilize the method the Agency determines fulfills electronic signature requirements to be compliant", and manufacturers "can choose to develop electronic records and electronic methods for denoting approval. Our focus is on whether the substance of the requirements is met and not the physicality of the record or signature methodology." The rule does not name Part 11. FDA's electronic-signature requirements are in 21 CFR Part 11 (what it asks of a document system).
Records come out at inspection. Records are made available during an inspection. If they are kept at another site, they "will be produced by the next working day or two, at the latest".
More of your records are in scope. The old exemption at 820.180(c) is gone. Management review, quality audit and supplier audit reports can now be read by an inspector.
How long to keep them. The regulation's own text sets no period; ISO 13485's records clause, which it incorporates, does.
What an inspector will ask your document system
- Who approved this version, and when? A name, a date and an approval for each issued document and each change.
- What did it say before, and why did it change? Every earlier version, with the reason for each change.
- Is this the current one? People must work from current documents, not superseded copies.
- Can you produce it now? Records during the inspection; remote ones within a working day or two.
- Show me your management reviews and audits. These are no longer exempt.
Where a Hub Nexus workspace fits
A Hub Nexus workspace keeps a team's controlled documents as pages, and every edit to one is a change that is reviewed before it is published:
- Approval with a signature and a date. A workspace can require signed approvals. The approver chooses what the signature means — review, approval or responsibility — and enters a code emailed at that moment, or signs in again through your single sign-on. Their name as it was then, the meaning and the time are written before the vote and never changed.
- Someone other than the author approves. A group you name, such as Quality, or each page's other maintainers; a page nobody else maintains goes to the workspace's owner, and the owner's own page to another administrator.
- Every version kept, with who changed what and why. A version can be compared with any other, or restored through a new reviewed change.
- One current version. Readers see the published page; drafts and changes in review are kept apart.
- An audit log of every consequential act — review steps, signatures, membership, settings — append-only, kept while the workspace exists, downloadable as CSV.
- Everything out on request: every page, version, change, comment and signature, as Markdown and JSON with the files.
What it is not: a full quality management system. It does not run complaints, CAPA, training records, device history or supplier management, and you validate it for your own use. If your documents live on a shared drive and approvals in email, a workspace is a step up from that, smaller than a quality suite. Quality (signed approvals) is $750 a month for up to 50 members, and two workspaces are free (plans).
Sources, read on 3 November 2026
- Federal Register: Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (codified text, 89 FR 7523–7525; comments 35, 53, 55 and 58)
- FDA: Quality Management System Regulation (QMSR), QMSR frequently asked questions
- ANSI: ISO standards incorporated by reference, read-only
- Hub Nexus: 21 CFR Part 11 e-signatures for a small team, Workspaces, every screen, plans
About Hub Nexus (hubnx, hubnx.com)
Hub Nexus — written hubnx for short, and found at hubnx.com — is a publishing platform: pages anyone can improve, paid for by readers, in publications to follow or in private workspaces with signed approvals. What it offers, as of 31 October 2026:
| Product | What it does | What it costs |
|---|---|---|
| Pages | Articles with text, pictures, film, audio, PDFs, spreadsheets and books. Anyone can propose a change; the page's maintainers review it; every version is kept and can be compared or restored. Free to read, in 16 languages. | Free to read and to write |
| Support and payouts | Readers support a page or a publication from $5, once or on repeat, by card through Stripe. Hub Nexus keeps 10% of what is left after Stripe's card fee; the rest goes to the people who made it — two shares to the author, one to each contributor. | 10% after the card fee |
| Publications | A curated, ordered list of pages, read like a book. Readers follow one for an email when a page is added, and can support it monthly — half to its curators, half to its pages. | Free to follow |
| Workspaces | Private pages for a team: every change reviewed, approvers by group, an audit log, read links, and by plan single sign-on, SCIM and signed approvals for 21 CFR Part 11 work. | Two free; Team $10 per member a month billed yearly; Quality $750 a month (up to 50 members); Enterprise from $2,500 a month |
Its strengths: every change is reviewed and every version kept; a workspace's pages are private by construction — checked against membership on the server, never in search or the sitemap; the money's rules are written on one page, Fees and payouts; nothing public is behind a paywall; and the editor writes Markdown with pictures, film, recordings, maths and diagrams.
Start: press Create at hubnx.com and choose a page, a publication or a workspace. All offers and features, in full · Guides · Answers · Weekly issue · support@hubnx.com
I disse publikationerHub Nexus Answers
Licens: CC BY 4.0
Kommentarer
