Navigating the new FDA’s QMSR
By Maria Dolores Granados Ruiz, Medical Device Regulatory and Quality Senior Consultant at Rephine
On February 2, 2024 the U.S. Food and Drug Administration (FDA) published the Final Rule for the new Quality Management System Regulation in the Federal Register, which amends the current requirements of the Quality System Regulation (known as ‘QS regulation’ or ‘QSR’) codified in 21 CFR part 820 and established in 1996. The revised part 820 is now titled the Quality Management System Regulation (‘QMSR’).
The objective of the amendment is to align the FDA regulatory framework with the international consensus standard used by regulatory authorities in other jurisdictions. This change aims to remove unnecessary duplicative regulatory requirements, eliminate impediments to market access, reduce barriers to patient access and lower costs.
FDA has primarily achieved this objective by incorporating by reference (IBR) the International Standard ISO 13485:2016, Medical devices—Quality management systems—Requirements for regulatory purposes into the new regulation. Incorporating by reference means that the FDA formally recognizes and applies the requirements of ISO 13485:2016 to 21 CFR Part 820 by citing the standard rather than reproducing its full text. Congress authorized incorporation by reference to reduce the volume of material published in the Federal Register and the Code of Federal Regulations (CFR).
The rule amends the title of the regulation and establishes additional requirements that clarify certain expectations and certain concepts used in ISO 13485:2016. These additions ensure that the incorporation by reference of ISO 13485:2016 does not create inconsistencies with other applicable FDA requirements.
Transition period
The FDA will begin to enforce the QMSR requirements upon the effective date, February 2, 2026. Until then manufacturers are required to comply with the current QSR.
The FDA intends to engage in a variety of implementation activities including updating information technology systems, revising relevant regulations and other documents impacted by the new requirements (Compliance Programs and Guidance Documents) and communicating and educating stakeholders on the change.
Also. during this time, the FDA will also revise its inspection process (Quality System Inspection Technique known as QSIT) to reflect the new QMSR requirements and FDA staff will be trained to ensure they are well-prepared to implement the updated inspection process.
Background on the Need to Change the QSR to QMSR
The QSR was introduced in 1996 as 21 CFR Part 820 to establish Current Good Manufacturing Practice (CGMP) requirements for medical devices in the United States. This revision incorporated design controls as a response to the Safe Medical Devices Act (SMDA) which had highlighted that a significant number of medical device recalls were caused by design-related deficiencies, providing a robust regulatory framework for ensuring the safety and effectiveness of medical devices. However, in the decades that followed, the global regulatory landscape evolved, making the need for modernization increasingly evident.
During the 1990s, regulatory bodies worldwide began working toward harmonization of quality system requirements to reduce inefficiencies and facilitate international trade. In 1996, the ISO 13485 standard was first published as a globally recognized Quality Management System (QMS) standard for medical devices. Over the years, ISO 13485 has become the benchmark for medical device QMS requirements, with widespread adoption in Europe, Canada, Japan, Australia, and many other markets.
While the FDA’s QSR remained unchanged, ISO 13485 underwent major revisions in 2003 and 2016, incorporating risk-based approaches, enhanced supplier controls, and stronger regulatory alignment. The 2016 version of ISO 13485 became the global gold standard, prompting the need for regulatory convergence between U.S. and international requirements.
As ISO 13485 gained prominence, U.S. manufacturers operating internationally faced a significant compliance burden. They were required to comply with both QSR (for FDA approval) and ISO 13485 (for international markets). Although the two frameworks were similar in many ways, differences in structure and specific requirements meant that manufacturers had to undergo separate audits, maintain dual documentation, and conduct redundant training programs. This situation created inefficiencies, added costs, and posed challenges in maintaining compliance across different regulatory environments. Recognizing this issue, the FDA began participating in international harmonization efforts.
Acknowledging the growing divergence between QSR and ISO 13485, the FDA announced in 2018 its intent to modernize 21 CFR Part 820 by aligning it with ISO 13485:2016. In February 2022, the FDA published a proposed rule to amend 21 CFR Part 820, replacing the QSR with the QMSR. Following industry feedback, stakeholder consultations, and review by the Device Good Manufacturing Practice (DGMP) Advisory Committee, the final rule was published in February 2024.
General Overview of the Final Rule
While the QSR provided sufficient and effective requirements for the establishment and maintenance of a QMS, regulatory expectations for QMS have evolved since the QSR was implemented over 20 years ago. By incorporating ISO 13485:2016 by reference, the FDA is explicitly requiring current internationally recognized regulatory expectations for QMS for devices subject to FDA’s jurisdiction.
However, the FDA acknowledges that relying on ISO 13485 without clarification or modification could create inconsistencies with FDA’s statutory and regulatory framework. To address this, the FDA has introduced additional definitions and provisions within the new QMSR.
One of the primary goals of the QMSR was to simplify and streamline the regulation. Therefore, where possible, the FDA has adopted the ISO 13485 requirement without modification or has created a requirement that supersedes the correlating requirement in ISO 13485. There are a few exceptions where FDA has clarified concepts or augmented specific clauses in ISO 13485 but overall, FDA is not modifying the clauses in ISO 13485.
Major Provisions of the QMSR
21CFR820 has been amended primarily through IBR the QMS requirements of ISO 13485:2016.
Amended regulation title, from QSR to QMSR.
QMSR retains the same scope of QSR: manufacturers of finished medical devices. The provisions are applicable to any finished device, intended for human use, that is manufactured, imported, or offered for import in any State or Territory of the United States, the District of Columbia, or the Commonwealth of Puerto Rico.
QMSR has amended many of the provisions and has established additional requirements and provisions that clarify certain expectations and certain concepts used in ISO 13485.
QMSR retains specific requirements specific to U.S. regulations: Unique Device Identification (UDI), Medical Device Tracking Requirements (traceability), complaint handling, Medical Device Reporting and advisory notices.
By adopting ISO 13485:2016, the QMSR incorporates risk management throughout all of its requirements and explicitly emphasizes risk management activities and risk-based decision-making as important elements of an effective quality system. Integration of the risk management process throughout all the device lifecycle is now clearer.
The FDA has made conforming edits to 21 CFR part 4 to clarify the device QMS requirements for combination products. These edits do not impact the CGMP requirements for combination products.
From FDA QSR to QMSR: The Big Changes
The FDA has been a strong participant in the development of ISO 13485, so it is not surprising that the requirements between the QSR (current 21CFR820) and ISO 13485:2016 were already substantively similar and QMSR changes does not fundamentally alter the requirements for the QSR.
Nevertheless, there are some significant changes that manufacturers need to be aware of to ensure an effective transition from QSR to QMSR:
- Structure of the QMSR: the titles and subparts of the QMSR have been revised to align with ISO 13485:2016, and removes those subparts that the FDA has determined to be substantively similar.
[Reserved] means that there is currently no mandatory content in that section, but in the future, the FDA could establish new requirements there.
Incorporation by reference: FDA has incorporated by reference the current 2016 version of ISO 13485 and the current 2015 version of Clause 3 of ISO 9000.
- Terminology (QMSR 820.3):
- The definitions in Clause 3 of ISO 13485 and ISO 9000 now apply to the QMSR, except for those terms specified in §820.3(b) or provided as statutory definitions in section 201(h) of the FD&C Act (21 USC 321). The included terms are implantable medical device, manufacturer, organization, rework and safety and performance.
- The QMSR defines five additional terms which are not defined in ISO 13485 and Clause 3 of ISO 9000: Component, FD&C Act, Finished device, Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device, Remanufacturer.
- All references to the Device Master Record have been removed, in favour of the ISO 13485 term ‘medical device file’.
- Additional requirements (QMSR 820.10): Section §820.10(b)(i) through (iv) (Requirements for a quality management system) links corresponding ISO 13485 clauses with the additional applicable FDA requirements for medical device:
- 21 CFR Part 830: Unique Device Identification (UDI) (Clause 7.5.8 ISO 13485 :2016)
- 21 CFR Part 821: Medical Device Tracking Requirements (traceability) (Clause 7.5.9.1 ISO 13485 :2016)
- 21 CFR Part 803: Medical Device Reporting (Clause 8.2.3 ISO 13485 :2016)
- 21 CFR 806: Medical Devices; Reports of Corrections and Removals (Clauses 7.2.3, 8.2.3 and 8.3.3 ISO 13485 :2016)
- Records control (QMSR 820.35):
- QMSR adopts the records control requirements found in clause 4.2.5 of ISO 13485:2016.
- In addition to meeting the requirements in ISO 13485:2016, Clause 4.2.5, manufacturers must also meet the additional requirements in Section §820.35, Control of Records:
- Information required by 21 CFR Part 803 related to complaint and servicing activities.
- Documentation required to meet Unique Device Identification (UDI) requirements of 21 CFR Part 830.
- Confidentiality of records sent to and received by the FDA.
- Labelling and Packaging (QMSR 820.45): in the eyes of FDA, ISO 13485:2016 does not adequately “address the inspection of labelling by the manufacturer.” As such, FDA has retained its provisions from the existing QSR as it believes them to be superior. This means that manufacturers will need to follow ISO 13485 clause 7.5.1 and section 820.45 of the QMSR.
- Risk management: QMSR aligns with ISO 13485:2016 emphasizing proactive risk management throughout the entire product lifecycle, from design and development to production and post-market activities.
What happens if the ISO 13485:2016 is revised?
ISO standards are routinely reviewed and can be updated every five years. Any future revisions to ISO 13485 would need to be evaluated to determine the impact of the changes and whether the QMSR should be amended. If needed, amendments to the QMSR will be implemented through rulemaking.
Which companies are impacted by this regulatory change?
The following type of companies may be impacted by this change:
– U.S. manufacturers of finished medical devices and in vitro medical devices.
– Foreign companies of medical devices and in vitro medical devices exporting to the U.S.
– Suppliers of materials, components or parts of finished devices and third-party servicers and refurbishers critical to the safety, performance or regulatory compliance of the finished device.
Although these companies are not under the scope of the 21CFR820 (820.1-Scope) the same regulation encourages them to comply with the applicable requirements of the QMSR and the FDA has legal authority to inspect any company involved in the production or control of medical devices, if their work is critical to the safety, performance or regulatory compliance of the final device.
Additionally, these companies may have a technical quality agreement in place with the finished device manufacturer which establishes the obligation to comply with the applicable parts of the regulation and/or ISO 13485.
How can Rephine help companies to adapt to the new QMSR?
As the effective transition date approaches, February 2, 2026, it is essential to properly plan and implement the necessary changes. Rephine, as a quality and regulatory consulting company for the medical device industry, can support companies affected by the changeover from QSR to QMSR throughout all the recommended phases:
- Identify and understand regulatory changes. Familiarize with QMSR, ISO 13485:2016 and Clause 3 of ISO 9000:2015.
- Conduct gap analysis of your current QMS and procedures to identify the gaps in meeting regulatory requirements. Identify the differences.
- Revise processes and procedures to incorporate the necessary changes.
- Train employees on revised processes and procedures.
- Internal audits for evaluating the implementation of the QMSR requirements.