The 2026 Changes
The FDA rewrote the rule your device quality system is built on. ISO rewrote 9001. And the post-market obligations most small manufacturers under-build have not moved an inch. None of these is a drill, and two of them already have a date behind them.
What Changed, and When
If you make a medical device for the US market, the first one has already passed. If you hold an ISO 9001 certificate, the second one is now on your clock.
February 2, 2026
21 CFR Part 820 now incorporates ISO 13485:2016 by reference, with ISO 9000:2015 for terminology. The FDA retired the QSIT inspection technique the same day and replaced compliance programs 7382.845 and 7383.001 with 7382.850.
In Force — No Transition Period
September 2029
The sixth edition of ISO 9001 replaces the 2015 version. Certified organizations get a three-year transition from publication. The changes are evolutionary — climate, ethics, and quality culture — but they touch clauses 4 through 10.
Transition Ends September 2029
Articles 83–92
Not new, and that is the problem. The PMS system, the PMS plan, the PSUR, trend reporting and vigilance have been enforceable for years, and they are where small manufacturers are most often found short.
Standing Obligation — Audited Now
One System, Three Faces
These are not three quality systems. They are three faces of one system, and a good many tiles sit on more than one face. Build it once, correctly, and each regulator sees the face it came for. Select a face to see what it asks of you.
Shared Requirement ISO Only FDA Only EU Only
The sixth edition keeps the Harmonized Structure and the core requirements, and puts more weight on areas that were hard to audit before: climate relevance, ethical behavior, and a quality culture that top management must be able to demonstrate.
Post-Market Surveillance
A medical-grade thermometer or an oxygen mask does not stop being your problem when it leaves the dock. Every regulator now asks the same three questions, and expects the evidence in writing.
Under EU MDR Article 83 the surveillance system has to be proportionate to the device's risk class and actively fed — not a complaints inbox nobody reads. Under ISO 13485 clause 8.2.1, now the basis of US law through the QMSR, feedback from production and post-production is a required input to your quality system.
Sales volume, population characteristics and real-world use, gathered proactively — not inferred. The PSUR asks for this by name.
Complaints, user feedback, clinician reports, and returns — routed, coded and trended, with a threshold that triggers action before an authority sets one for you.
A PMS plan with named indicators and benefit-risk thresholds, a PMS report or PSUR on schedule, and a CAPA trail that closes with an effectiveness check.
2 calendar days
Serious Public Health Threat
MDR Article 87
10 calendar days
Death, or Unanticipated Serious Deterioration in Health
MDR Article 87
15 calendar days
Any Other Serious Incident
MDR Article 87
Those are days from awareness, not days from confirmation
Which means the date someone in your company first heard about it is a record you need to be able to produce. Partial reports are permitted; silence is not.
| Class | Report | Minimum Frequency | Goes To |
|---|---|---|---|
| Class I | PMS Report | Updated When Necessary | Authorities on Request |
| Class IIa | PSUR | Every Two Years | Authorities on Request |
| Class IIb | PSUR | Annually | Authorities on Request |
| Class III & Implantable | PSUR | Annually | Notified Body, via Eudamed |
ISO 9001:2026
Evolutionary, not revolutionary — but every clause below needs evidence, and "we have always done that" is not evidence.
Clause 4
You must assess whether climate change is relevant to your quality management system, and act where it is. A recorded conclusion of "not relevant" is a valid answer; no conclusion is not.
Clause 5
Top management has to demonstrate commitment to quality culture, integrity, and ethical behavior — through shared values, attitudes and observed behaviors — and the quality policy has to reflect the organization's strategic direction.
Clause 6
6.1 is subdivided so that addressing risk and pursuing opportunity are no longer treated as one activity. Change planning is expanded. Quality objectives stay measurable, but now "where practical".
Clause 7
A distinct awareness requirement: your people have to understand the organization's quality culture and what ethical behavior means in their role. That is a training record you probably do not have yet.
Clauses 8–10
Minimal substantive change to operation, performance evaluation, and improvement — but clause numbering and terms move, which means every cross-reference in your manual and SOPs needs checking.
FDA QMSR
21 CFR 820
The standard your notified body already audits to is now the substance of the US regulation. Where a clause of ISO 13485 conflicts with the FD&C Act or its regulations, the Act controls — so this is harmonization, not substitution.
Inspections
From February 2, 2026, the FDA stopped using the Quality System Inspection Technique and replaced compliance programs 7382.845 and 7383.001 with 7382.850. If your audit-readiness pack was built around the four QSIT subsystems, it is now describing an inspection that no longer happens.
820.35
CGMP exemptions for certain device types do not waive complaint file or record-keeping obligations. Technical amendments effective the same day moved Class I exemptions from §§ 820.180 and 820.198 to § 820.35.
Risk
Risk-based thinking runs through ISO 13485 and therefore through the QMSR. If risk management has been living in a spreadsheet beside the file rather than inside it, that gap is now a regulatory one.
“An auditor will find the gap in the first hour. You would rather I found it first.”
Marcia M. Weeden — MS, ASQ CQE, ASQ CQT
Where to Start
A fixed-price gap assessment — two days on your floor and in your files, from $4,200 — produces a clause-by-clause table of what you have, what the standard now requires, and what has to be written — with an owner and a date against each line. You get the findings whether or not you engage further.
Sources. ISO 9001:2026 status, publication, and scope — ISO; transition period and clause-level changes — TÜV Rheinland and SGS. FDA QMSR effective date, ISO 13485 incorporation, QSIT retirement, and compliance program 7382.850 — US FDA; technical amendments — Federal Register, December 4, 2025. EU MDR post-market surveillance articles, reporting deadlines, and PSUR frequencies — Regulation (EU) 2017/745, Articles 83–92. Verify against the published texts before relying on any of it for a submission.