Skip to main content

Compliance

Medical Device Compliance: FDA QMSR (21 CFR 820) & ISO 13485

A Technical Summary of Regulatory Requirements for Connected Medical Devices

Technical summary
Share

Executive summary

Developing connected medical devices requires navigating complex regulatory frameworks including FDA 21 CFR Part 820, ISO 13485, and IEC 62304. Since 2 February 2026 the FDA's Quality Management System Regulation (QMSR) incorporates ISO 13485:2016 by reference. This guide provides a roadmap for compliance, covering design controls, risk management, software validation, and the emerging cybersecurity requirements that are reshaping medical device development.

Key findings

  • Under the QMSR, design records formerly called the Design History File form the ISO 13485 design and development file
  • Risk management is required for all device classes; ISO 14971 is the recognised way to meet it
  • IEC 62304 (FDA-recognised, EU-harmonised) is the expected lifecycle standard for device software of any device class
  • FDA now requires cybersecurity documentation in premarket submissions
  • Post-market surveillance plans are essential for IoT-connected medical devices

What the paper covers

  1. 01Medical Device Classification Overview
  2. 02FDA 21 CFR Part 820 Requirements
  3. 03ISO 13485 Quality Management System
  4. 04Design Controls and Documentation
  5. 05IEC 62304 Software Lifecycle
  6. 06Cybersecurity Requirements
  7. 07Premarket Submission Strategies
“Medical device development requires a fundamentally different approach—every line of code, every component choice must be traceable to regulatory requirements under the FDA QMSR (21 CFR Part 820) and ISO 13485.”
Rapid Circuitry engineering team, Medical Device Specialists

Related topics

  • FDA compliance
  • medical device
  • ISO 13485
  • 21 CFR Part 820
  • IEC 62304
  • healthcare IoT