FDA’s Quality Management System Regulation, or QMSR, took effect on February 2, 2026. It replaced the old Quality System Regulation language in 21 CFR Part 820 and incorporated ISO 13485:2016 by reference. If you sell an at-home or direct-to-patient test kit that meets the definition of a finished device, the framework your quality system is measured against changed. If you outsource kit assembly, so did the framework your manufacturing partner is measured against.
Here is what changed, what did not, and what to do about it.
What QMSR actually changed
Part 820 no longer spells out its own quality system requirements in full. It points to ISO 13485:2016 and adopts that standard as the core requirement set, with additional FDA-specific provisions layered on top for things like labeling, records, and complaint files.
FDA also began using an updated inspection approach on the same date, under Inspection of Medical Device Manufacturers Compliance Program 7382.850. Investigators now work from a process that follows the structure of the standard rather than the old seven-subsystem model.
The practical effect for most kit companies is not a new pile of requirements. It is a change in vocabulary, document structure, and how an inspection conversation flows. Risk management runs through the standard as a thread rather than sitting in one clause. Design controls, purchasing controls, and process validation are all still there, expressed differently.
What QMSR did not change
Three things get confused constantly, and the confusion shows up in marketing copy across this industry.
ISO 13485 certification is not an FDA inspection. Certification is a third-party audit against a voluntary standard. FDA inspects under its own authority, on its own schedule, using its own compliance program. Holding a certificate does not exempt a facility from inspection and does not substitute for one.
Establishment registration is not clearance or approval. A facility that assembles finished kits registers with FDA as a device establishment. That is a listing obligation. It says nothing about whether any product has been reviewed, cleared, or approved. A partner who says “we are FDA registered” in a way that implies product review is telling you something misleading, and you should treat that as data about how they will describe your program to a regulator.
The Act still controls. FDA has stated plainly that where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or its implementing regulations, the Act and those regulations control. The standard did not become the ceiling.
What QMSR means when you outsource kit assembly
Assembling components into a finished collection kit is a manufacturing operation. The finished kit is generally a device, and the operation that produces it sits inside the regulated chain. That has been true for years. What QMSR did was make the language your partner uses to describe its controls either match yours or visibly fail to.
Your obligations do not transfer with the pallet. If you are the specification developer and the labeler, you own the product. Your supplier controls have to be built so that your partner’s records can support your investigation, your complaint file, your nonconformance, and your recall. If the records live only on your partner’s side and you cannot reach them quickly, you do not have a quality system. You have a hope.
Two questions decide whether an outsourcing relationship survives an inspection:
- Can you produce, on request, the complete manufacturing and distribution history of any kit lot, including component lots, build records, release decision, and every recipient?
- Can you show that changes to materials, processes, work instructions, carriers, or systems reached you for approval before they happened?
What to ask your kit manufacturer now
These are the questions worth asking in the next quarterly review, whether or not your partner has raised QMSR on its own.
| Ask | What you are testing |
|---|---|
| Show me your current ISO 13485 certificate and read me the scope line. | Whether certification covers kit assembly, storage, and distribution, or something narrower. |
| What changed in your document set for February 2, 2026? | Whether the transition was actually worked, or acknowledged and shelved. |
| How does risk management connect to your assembly work instructions? | Whether risk lives in a binder or in the process. |
| Walk me through your last nonconformance on a kit build. | Whether nonconformances get recorded at all. |
| What is your change notification trigger and lead time to me? | Whether you find out before or after a change. |
| Run a trace on one component lot while I watch. | Whether traceability is a system or a spreadsheet reconstruction. |
| What is your complaint intake path when a consumer contacts you directly? | Whether a consumer call becomes your complaint record or disappears. |
The last one matters more than it sounds. Consumers in at-home programs frequently contact whoever is on the shipping label. A fulfillment operation that improvises a response, or discards a kit that may be complaint-related, has destroyed evidence you were required to preserve.
Where the common gaps are
Across kit programs, the same weaknesses repeat.
- Scope creep in certification claims. A certificate that covers warehousing gets presented as covering manufacturing. Read the scope, not the logo.
- Returns without disposition authority. Nobody has been named as the person who decides restock, quarantine, or destroy, so the decision gets made by whoever is standing at the table.
- Traceability that stops at the kit. The partner can tell you which kit lot shipped to whom but cannot tell you which component lots went into that kit lot. That gap makes a targeted recall impossible and turns it into a total recall.
- Change control by email. A component substitution communicated in a message thread is not change control, and it will not read as change control to an investigator.
- No mock recall on record. If it has never been exercised, the recall procedure is a document, not a capability.
What this does not answer
QMSR does not classify your product for you. Whether your kit is a device, what class it falls in, whether an exemption applies, and how your specimen is regulated in transit are determinations you make with your own regulatory counsel. A manufacturing partner should build the quality file and the shipping file around your determination and should decline to make it for you. Anyone who offers to tell you your classification during a sales call is selling you a liability.
What to do in the next 90 days
If you have not touched this since the effective date, work in this order.
- Confirm your own status. Establish, with counsel, whether your product is a finished device and whether you are the specification developer, the labeler, or both. Everything downstream depends on that answer.
- Pull every partner certificate and read the scope. Not the certificate number. The scope statement. Note any gap between what the certificate covers and what the partner actually performs for you.
- Reconcile terminology in your own documents. If your quality manual still speaks only in the old subsystem language, an inspection conversation will be slower and rougher than it needs to be. This is document work, not process work.
- Test traceability cold. Pick a component lot from six months ago and ask your partner for every finished kit and recipient. Time it. A slow answer today is an unmanageable recall tomorrow.
- Close the change control loop in writing. Name the events that require notification, the lead time, and the person who approves. Put it in the quality agreement, not in an email thread.
- Run one mock recall. Measure time to quarantine and time to produce the affected recipient list. Record the result even if it is bad, because the record is the evidence you improved.
Questions we get asked
Does QMSR mean I now need ISO 13485 certification?
No. QMSR incorporates the requirements of the standard into the regulation. It does not require you to hold a third-party certificate. Certification is a separate, voluntary exercise that many companies pursue because customers and international regulators ask for it.
My contract manufacturer is ISO 13485 certified. Am I covered?
No. Your partner’s certificate covers your partner’s operation, within its stated scope. Your obligations as specification developer and labeler stay with you. What the certificate does is make it more likely that the records you need will exist.
Is a collection kit really a device?
Frequently yes, and assembling components into a finished kit is generally a manufacturing operation. The specific classification of your product depends on its intended use and its claims, and that determination belongs to you and your regulatory counsel.
Does FDA inspect kit assembly operations?
A registered device establishment is subject to inspection. Since February 2, 2026, FDA has been inspecting under compliance program 7382.850, which follows the structure of the incorporated standard.
Where Supera sits
Supera Fulfillment is an ISO 13485 certified, FDA registered device establishment in Houston, Texas. We assemble specimen collection and at-home test kits, and our registration exists because kit assembly makes the finished kit a device. Registration is not clearance and not approval, and we say so in writing because the distinction protects both sides.
More detail on how that works in practice: our ISO 13485 certified operation, our role as a specimen collection kit contract manufacturer, our at-home test kit manufacturing and fulfillment programs, and our regulatory compliance posture.
