Quality Management System Regulation (QMSR), the FDA’s new regulation applicable to medical devices: We explain it all!

On January 31, 2024, the US Food and Drug Administration (FDA) published the Final Rule amending the current Good Manufacturing Practices (CGMP) for medical devices (MD) documented in the Quality System Regulation (QSR) and registered under 21 CFR Part 820. The new text, called the Quality Management System Regulation (QMSR), represents a major change for MD manufacturers in the US, requiring an action plan for compliance before the new regulation comes into force on February 2, 2026.

This article explains the new requirements imposed by the QMSR for companies producing and distributing medical devices on the US market and outlines the necessary compliance actions.

Why QMSR?

The QMSR reflects the FDA’s intention to harmonize and modernize regulations applicable to MD aligning them more closely with ISO 13485:2016. Effective as of February 02, 2026, the QMSR will replace the current QSR listed under 21 CFR Part 820. Although ISO 13485:2016 already shares many similarities with the QSR, the new QMSR, which incorporates the requirements of ISO 13485:2016, represents a major evolution in US MD regulation since the last major update in 1996.

Incorporation by Reference

The FDA has decided to use “Incorporation by Reference” (IBR) to revise the QSR. This process involves including a second document by reference, allowing the FDA to replace the QSR requirements by referring to:

1. ISO 13485:2016_Medical devices – Quality management systems – Requirements for regulatory purposes.
2. Chapter 3 of ISO 9000:2015_Quality management systems – Fundamentals and vocabulary.

By incorporating these references, the FDA aims to harmonize its regulations with the 2016 version of ISO 13485. This means that, even if ISO 13485 evolves, the QMSR will remain aligned with the requirements of the 2016 version.

Key Changes and New Features

The QMSR introduces important changes that must be fully understood and integrated into quality management systems (QMS):

• Definitions: The QMSR incorporates the definitions from ISO 13485:2016 and section 3 of ISO 9000:2015, while retaining certain specific definitions.
• General QMS Requirements: In addition to the clauses of ISO 13485:2016, the QMSR includes other historical FDA requirements.
• Control of Records: The QMSR introduces specific requirements for controlling records related to claims, labeling, and packaging activities.

These new requirements must be implemented by companies involved in the production and distribution of medical devices on the US market, impacting various aspects of the QMS.

1. Definitions

Section 820.3 of the QMSR incorporates by reference the definitions from ISO 13485:2016 and section 3 “Terms and Definitions” of ISO 9000:2015, while retaining specific definitions such as:

Additionally, definitions from Section 21 of FDA&C Acts will replace the corresponding terms and definitions in ISO 13485:2016. The QMSR also introduces terms such as “safety and performance” instead of “safety and effectiveness”, and removes historic terms such as DHF (Design History File), DMR (Device Master Record), DHR (Device History Record), and “Establish”.

Manufacturers and other MD companies will need to gradually integrate these new definitions into their QMS

2. General QMS Requirements

In addition to the clauses of ISO 13485:2016, section 820.10 of the QMSR imposes historical FDA requirements: 

• Identification: In addition to the requirements of clause 7.5.8 of ISO 13485:2016, manufacturers must also comply with the requirements of 21 CFR Part 830 concerning the UDI system.
• Traceability: In addition to clause 7.5.9.1 of ISO 13485: 2016, manufacturers must comply with 21 CFR Part 821 related to MD traceability. For life-sustaining devices, the requirements of clause 7.5.9.2 of ISO 13485:2016 related to implantable devices must also be applied.
• Reporting to Regulatory Authorities: Beyond clauses 7.2.3, 8.2.3, and 8.3.3 of ISO 13485:2016, manufacturers must comply with 21 CFR Parts 803 and 806 for reporting vigilance cases and batch recalls to the FDA.

As with the QSR, the QMSR offers the same exemptions from design and development requirements (clause 7.3 of ISO 13485:2016) for Class I medical devices, except for:

• MD automated with computer software
• Catheter, Tracheobronchial Suction
• Glove, Non-powdered Surgeon’s
• Restraint, Protective
• System, Applicator, Radionuclide, Manual
• Source, Radionuclide Teletherapy

Following these changes, companies involved in the production and distribution of MD on the US market must implement the requirements of ISO 13485:2016 in terms of QMS management and effectiveness, including the risk-based process approach and the need to identify applicable regulatory and normative requirements. They will also need to ensure compliance with the FDA’s specific requirements concerning identification, traceability, and reporting processes.

3. Control of Records

In addition to the requirements of clause 4.2.5 of ISO 13485:2016 for record control, sections 820.35 and 820.45 of the QMSR retain historical FDA requirements relating to claims records and the control of MD labeling and packaging activities.

It is also important to note that management reviews, internal audits and supplier audits will no longer be exempt from FDA inspection, as was the case under QSR (§ 820.180c).

Therefore, MD manufacturers operating on the US market will need to update procedures related to complaints management, production, identification, batch release and maintenance to incorporate the requirements of ISO 13485:2016. They must also adapt their FDA inspection management to make available records that were previously considered confidential and exempt from inspection.

The Final Rule of the QMSR includes a question-and-answer summary of the consultations between MD manufacturers and the FDA, which is useful for understanding the concerns of US companies and the challenges posed by the QMSR. Key points include:

1. The FDA intends to replace its current inspection approach (Quality System Inspection Technique) with one consistent with QMSR requirements, though no date of application has been provided.
2. Companies whose QMS already complies with ISO 13485:2016 will still need to be inspected by the FDA under QMSR.
3. The MDSAP program will likely need to be modified to incorporate the new QMSR requirements.

Facing the Challenges of QMSR

The changes introduced by QMSR are substantial, presenting two major challenges for companies involved in the production and distribution of medical devices on the US market.

1. The transition to ISO 13485:2016: This may require significant revisions of the existing QMS, including the adoption of a risk-based approach as outlined in ISO 14971.
2. Staff training: Manufacturers must ensure that their staff are properly trained in ISO 13485:2016 and likely ISO 14971. ISO 13485 emphasizes risk management throughout the MD lifecycle, making the implementation of a robust risk management process based on ISO 14971 highly recommended.

Getting Ready for the Application Date

The QMSR comes into force on February 2, 2026. Until then, the QSR remains applicable. The lack of a defined transition period by the FDA could disrupt planning for QMSR implementation. Nevertheless, manufacturers must start preparing now to meet the deadlines.

To prepare for the transition, follow these five key steps:

1. Gap Analysis: Perform a QMSR vs ISO 13485:2016 or QMSR vs QSR analysis to identify gaps between your current practices and the requirements of the new regulation.
2. Create an Action Plan: Develop and implement an action plan, including staff training, to address any identified discrepancies.
3. Implementation: Complete all actions in the action plan by March 2025 at the latest.
4. Internal Audit: Conduct a comprehensive internal audit of your QMS against QMSR requirements and applicable standards/regulations before the end of 2025.
5. Documentation: Document the audit results (non-conformities, remarks, areas for improvement, etc.) in a CAPA or other relevant document, depending on your QMS.

These five steps ensure that your QMS complies with the applicable requirements, achieves quality objectives, and guarantees compliance with the agreed  products and/or service requirements.

Conclusion

The QMSR reflects the FDA’s intention to align and update its regulations to comply with ISO 13485:2016, an internationally recognized standard. This new regulation requires companies involved in the production and distribution of medical devices on the US market to adapt their QMS and comply with new requirements and concepts, such as the risk-based process approach. Compliance with the new QMSR requirements, including staff training, must be planned in the very short term in order to meet the February 2, 2026.

——————

Need to understand the impact of QMSR on your existing QMS and internal processes? Our experts in Quality Management and Regulatory Affairs can support you with the following services:

• Gap Analysis and Strategic Action Plans: Tailored specifically to your company;
• Training: To help you better understand the requirements of the new regulations;
• Technical Assistance: To reinforce your efforts towards alignment with QMSR;
• Internal Audit : To verify QMS compliance with new requirements, identify and correct non-conformities, and prepare for FDA inspections.
• Expertise via Hotline: For specific questions requiring a rapid response

Contact us at : onedt@efor-group.com