FDA QMSR and SOP Document Control: What Changed in 2026

The QMSR is FDA's amended quality system rule for medical device makers. It took effect on 2 February 2026 and replaced most of the Quality System Regulation in 21 CFR Part 820 with ISO 13485:2016, the international quality management standard for medical devices, incorporated by reference. In practice, the procedures a device maker writes, approves, trains on and keeps under control are now judged against a framework aligned with ISO 13485 rather than the older US-only text. Qualio's summary of the 2026 changes is linked in the sources.

No. Part 11, the FDA rule on electronic records and electronic signatures, did not change in 2026. Its controls still apply to any SOP system that holds FDA-regulated records. Section 11.10(e) requires the use of secure, computer-generated, time-stamped audit trails, and section 11.10(k) requires controls over systems documentation. For drug manufacturers, 21 CFR 211.100 still requires written procedures and requires deviations from them to be recorded and justified.

On 3 February 2026 FDA issued final guidance titled Computer Software Assurance for Production and Quality Management System Software. According to Qualio's summary, it superseded the September 2025 version, aligned expectations to the QMSR, defined cloud services (IaaS, PaaS and SaaS), and brought automation, analytics and AI or machine learning tools into scope when they are used for production or quality purposes. For SOP teams the practical point is that a SaaS tool used to control quality procedures is software in scope, and you should expect to show how you gained confidence that it works as intended for that use.

Qualio reports that with the QMSR, FDA replaced the Quality System Inspection Technique (QSIT) with a risk-based approach under Compliance Program 7382.850. Separately, a revised Compliance Program 7346.832 for pre-approval inspections took effect on 10 August 2026, replacing the October 2022 version, and formalizes a risk-based decision on whether an onsite inspection is needed. Both point in the same direction: inspectors weigh risk and evidence, so being able to produce an SOP's approval record, version history and training record quickly matters more than the format of the document.

1. An audit trail that records who created, changed, approved and retired each SOP, with time stamps, and that users cannot edit.
2. Electronic signatures on approvals that meet Part 11, if your SOPs are FDA-regulated records. Qualio states its e-signatures meet 21 CFR Part 11 and EU Annex 11.
3. An approval step with a named approver and a recorded outcome before a version takes effect.
4. Version history kept for as long as your record retention requires, on the plan you pay for. See our retention table.
5. Training records that name the version each person was trained on.
6. Evidence you can use for software assurance: the vendor's security attestations, release notes and a description of how the tool is configured for your use.

Of the nine tools we cover, Qualio is the one built for regulated document control: it describes controlled documents with review, approval and distribution, automatic version history with immutable audit trails, and Part 11 e-signatures. Process Street lists FDA, ISO 9001 and SOC 2 among the frameworks it supports and records approval outcomes. Dozuki describes digital sign-offs and audits that generate CAPA tasks on the shop floor. Capture-first tools such as Haiku, Scribe and Tango are fast for drafting; we did not find a Part 11 statement on the pages we reviewed for them, so check where the approved, signed record will live before you choose one for regulated SOPs.