Impact of new QMSR in US for medical device manufacturers
The revised 21 CFR part 820 is now titled the Quality Management System Regulation (QMSR). It aligns to ISO 13485:2016 ‘Medical devices - Quality management systems -Requirements for regulatory purposes” for harmonization of the Quality System regulation of medical device. The FDA will begin to enforce the QMSR requirements upon the effective date, February 2, 2026.
An interview with our US partner DP Distribution & Consulting.
1. In addition to the typical QMSR resources containing final rule commentary, what are some reliable sources to track QMSR amendments and search for specific QMSR-related information?
We recommend
Federal Register for official publications
2. Some sections, such as CFR 820.5, CFR 820.20–30, and CFR 820.40 are still reserved in the QMSR. With the new regulation set to take effect in February 2026, how can manufacturers begin preparing for QMSR compliance in general?
PART 820—QUALITY MANAGEMENT SYSTEM REGULATION
Subpart A—General Provisions
820.1
Scope.
820.3
Definitions.
820.5
[Reserved]
820.7
Incorporation by reference.
820.10
Requirements for a quality management system.
Subpart B—Supplemental Provisions
820.20-820.30
[Reserved]
820.35
Control of records.
820.40
[Reserved]
820.45
Device labeling and packaging controls.
Subparts C-O [Reserved]
As far as parts being reserved, the reality is the FDA amended 21 CFR part 820 by incorporating ISO 13485:2016 rather than directly referencing each section.
Otherwise you can book our e-Learning of QSMR with live talk and case study with our US team.
-
Gain a thorough understanding of the QMSR requirements by reading relevant materials and utilizing available resources to better grasp the FDA’s perspective.
-
Conduct a GAP Analysis.
-
Develop a plan.
-
Train your team.
-
Systematically update your quality management system.
-
Plan and conduct internal audits.
-
Prepare for the FDA.
3. Given the FDA's current system of random inspections for overseas manufacturers, do you think the agency might increase inspection frequency or potentially authorize a third party—such as a notified body in the EU—to conduct regular inspections?
The FDA’s inspection system is less random and more risk-based, which focuses resources on higher-risk establishments. Manufacturers should ensure robust risk management practices are integrated throughout their quality management systems to align with FDA expectations. To better understand what is required, we must start viewing everything through a risk-based lens. This is exactly what the FDA intends to do. The FDA amended its Quality System Regulation (QSR) to align more closely with ISO 13485:2016. This attempt to harmonize aims to streamline compliance for manufacturers operating internationally and apply a risk-based approach throughout the QMS. The FDA has always taken a risk-based approach regarding the inspection of facilities oversees, and they will continue to do so. At this point, the FDA will not utilize notified bodies to conduct regular inspections against the QMSR.
4. Will the FDA accept ISO 13485 Certifications?
It is important to note that while the FDA incorporates ISO 13485 by reference, it does not accept ISO 13485 certification as proof of compliance. Manufacturers are not required to obtain ISO 13485 certification, nor will the FDA rely on such certification for its oversight activities.
5. Are we required to submit a Quality Management Annual Report?
While the FDA does not currently mandate the submission of a quality management annual report, manufacturers must ensure their quality management systems are well-documented and align with QMSR requirements. This includes maintaining a Medical Device File (MDF) for each device type or family, containing comprehensive documentation throughout the product lifecycle and conducting regularly planned management reviews.
6. Will the FDA continue to utilize the Medical Device Singe Audit (MDSAP) Program?
The FDA will continue to participate in the MDSAP program, which allows for a single regulatory audit of a medical device manufacturer's quality management system that satisfies the requirements of multiple regulatory jurisdictions, including the FDA. Engaging in MDSAP can potentially reduce the need for routine FDA inspections, as the agency may utilize MDSAP audit reports in place of its own inspections.
7. What additional U.S. requirements are included in the QMSR compared to ISO 13485:2016?
The easiest way to describe the new QMSR is that it is essentially ISO13485:2016 + FDA-specific regulatory requirements. While the FDA's QMSR integrates many aspects of ISO 13485:2016 to promote global harmonization, manufacturers must be cognizant of the specific FDA requirements that remain in place. Below is a table to highlight the differences:
Document Terminology
ISO 13485: Utilizes terms like Medical Device File (MDF) to encompass design, production, and maintenance documentation.
QMSR: Adopts MDF terminology, replacing traditional terms such as Device Master Record (DMR), Design History File (DHF), and Device History Record (DHR). Terminology will now be using ISO 9000:2015.
Electronic Records
ISO 13485: Does not explicitly address electronic records.
QMSR: Requires compliance with 21 CFR Part 11, governing electronic records and signatures.
Labeling and Packaging
ISO 13485: Requires defined operations for labeling and packaging under general production controls.
QMSR: Introduces Section 820.45, mandating detailed procedures to ensure labeling and packaging integrity, inspection, storage, and operations.
Supplier Controls
ISO 13485: Emphasize supplier evaluation and monitoring based on risk.
QMSR: Aligns with ISO 13485 but may impose additional expectations for supplier controls, especially concerning traceability and the quality of purchased products and services.
Complaint Handling
ISO 13485: Provides general guidelines for complaint handling.
QMSR: Retains specific requirements for complaint files, including adherence to the Medical Device Reporting (MDR) regulations under 21 CFR Part 803.
Post-market Surveillance
ISO 13485: Mentions post-market surveillance in general terms.
QMSR: Requires compliance with specific FDA regulations for post-market surveillance, including 21 CFR Part 822, mandating post-approval studies for certain devices.
8. For EU manufacturers already certified to ISO 13485, what steps should they take in response to the new QMSR?
For EU manufacturers already certified to ISO 13485, the FDA’s new Quality Management System Regulation (QMSR) doesn’t require a complete overhaul, but it does call for some strategic adjustments. Since QMSR is based on ISO 13485:2016, much of the existing quality system will already align with the new FDA expectations. However, manufacturers will need to identify and address the U.S.-specific requirements described above. As discussed, it is important to conduct a gap assessment between the existing system and the QMSR to ensure full compliance. Updates may be needed to the quality manual, procedures, and internal training programs to reflect terminology and requirements specific to the FDA. One important thing here is to understand the difference in the approaches between an notified body and the FDA. The notified body is supposed to be auditing for compliance to the standard. The FDA is a US federal investigator that is there to investigate for non-compliance. There are two different approaches, and this is the reason the FDA will not accept ISO 13485 certification from a registrar.
9. For medical device start-ups without an existing ISO 13485 certification, what is your recommendation for establishing a consolidated quality management system that complies with both ISO 13485 and the QMSR?
The first step for any medical device start-up looking to establish a quality management system is to clearly define the target market. If your initial market is the United States, then aligning your quality system with ISO 13485:2016 is highly recommended, as it now serves as the foundation for the FDA’s new Quality Management System Regulation (QMSR). However, the FDA does not require formal ISO 13485 certification—compliance is what matters. On the other hand, if you plan to market in the European Union, ISO 13485 certification is typically necessary to support conformity assessments under the MDR. Once the market path is clear, our suggestion is to build a consolidated QMS that fully adopts ISO 13485 as the core framework, while layering in the additional U.S.-specific requirements from the QMSR. This dual-compliant approach ensures flexibility and long-term efficiency, especially for start-ups planning to expand globally. Begin with essential processes like design controls, risk management, document control, and complaint handling, and develop them in a way that satisfies both ISO and FDA expectations. Investing early in a harmonized QMS avoids quality issues down the line and positions the company for smoother regulatory approvals in multiple regions.
10. What are the typical SOPs and working instructions for QSR and now QMSR which EU manufacturers had deficiency or other emphasis?
The FDA currently uses the QSIT approach to investigations . The main documents reviewed are typically the Quality Manual, the Document Control SOP, the Design Control SOP, Production and Process Control documents and associated CAPA procedures. While we expect them to continue using these documents, we have been told that the agency will begin putting a greater emphasis on higher risks processes during their investigations.
What can DP Distribution & Consulting do to support foreign companies to get into the US market?
Besides typical QMSR service including mock audit, we can also offer:
-
Gap analysis from MDR to FDA (also from all other markets)
-
513g, determination of classification
-
Premarket notification, 510k
-
Premarket approval
-
Pre-sub meetings with the FDA
-
Establishment Registration and Device Listing
-
US agent
-
Search of distributor, private labeller
-
NRTL-, FCC, usability testing in EU and US
-
Establishment an entity (production) in US
