Most hardware founders found out the rulebook changed from a consultant’s invoice. As of February 2, 2026, the quality system every FDA device maker answers to is governed by a different regulation than it was a year ago, and the usual reaction is to hand the whole transition to a brand-name firm and pay whatever it quotes. The change is real and worth understanding. Paying someone else to understand it for you is the expensive mistake.
What changed on February 2
The FDA retired the Quality System Regulation, the Part 820 framework that governed device manufacturing for nearly thirty years, and replaced it with the Quality Management System Regulation. The QMSR keeps the 21 CFR Part 820 citation but rewrites what sits underneath it. It folds in ISO 13485:2016, the international quality standard, by reference, so the structure US device makers run on is now the one the rest of the world was already using. The agency kept its own provisions on top. Where an FDA definition conflicts with an ISO one, the FDA definition wins, and the US requirements for device registration, listing, and distribution records stay in force. It applies to every finished device manufacturer marketing in the United States, foreign firms included.
The enforcement side moved too. The FDA dropped the inspection technique it had used for years and adopted a new compliance program, numbered 7382.850, retiring the two older inspection programs that came before it. An investigator walking your floor this year reads your quality system against ISO 13485, not the old checklist.
Why founders overpay to get ready
This is where founders bleed cash. A quality system is not exotic. ISO 13485 is a published standard you can read, and mapping your processes to it is work your own team understands better than any outside firm, because they are the ones running those processes. The costly pattern is paying a specialist to build the whole thing end to end, when the leverage is in using them to tell you what to figure out and to refine what you produce.
I learned the price of the other approach on Galen’s De Novo. Our bill with a brand-name law firm came to close to half a million dollars. Our own people wrote the documentation. The regulatory work product was produced inside the company. What the board wanted was the firm’s signature on the file, because it changes how the next investor reads it. That signature had real value. It was also a separate value from the thinking, and we paid premium rates for both when we only needed to buy one. A former FDA reviewer later put it to me plainly: that firm was the right lawyer and the wrong regulatory consultant. The same split applies to a quality system. Buy the polish and the sign-off if your board demands it. Do not buy someone else’s understanding of how your own company makes things.
What the transition actually asks of you
The QMSR is not a new discipline to learn. If you already built to ISO 13485, which most teams with any ambition outside the US did, the gap is small and the work is documentation and definitions. If you built only to the old regulation, the structure is familiar but the emphasis shifts, and the honest move is to read the standard yourself before anyone quotes you to interpret it. A quality system has also stopped being a back-office artifact. Investigators read it differently now, and so do the diligence teams on the far side of a financing or an acquisition. A device maker who can walk an inspector or an investor through its own system without a consultant in the room is signaling something a binder never will.
This is device law, so it lands hardest on the MedTech and diagnostics founders who are my deepest vertical and the people this regulation actually governs. The wider lesson still travels. For any founder building regulated or safety-critical hardware, the quality and design-control system is becoming the first thing a serious buyer or regulator inspects, and the founder who owns it rather than rents it holds an edge that grows over time.
Dave’s take
The founders who handle this well are not the ones who spend the most on it. They are the ones who read the standard, mapped it to how they already work, and brought in a specialist only to pressure-test the result and put a name on it. A rule change is a poor reason to outsource your understanding of your own company, and a good reason to finally learn the part of it you have been avoiding.
I’m here to help you scale.
Work With DavePrefer a smaller first step? Book a $500 one-hour consultation →
Dave Saunders is the founder of Base Reality Group and a Fractional CPO for hard-tech founders. He was a founder and operator at Galen Robotics, where the surgical-robotics platform earned FDA De Novo authorization in 2023, and he managed a 35-patent portfolio licensed from Johns Hopkins. He wrote Founders Who Finish and publishes The Build. More about Dave →