The FDA Quality Management System Regulation—What’s Next?

The FDA Quality Management System Regulation (QMSR) transition timeline officially began on Feb. 2, 2024, with the final rule publication. Two years later, on Feb. 2, 2026, the mandate for full compliance became officially effective. 

The purpose of the FDA’s transition of 21 CFR 820 from Quality System Regulation (QSR) – Good Manufacturing Practices to Quality Management System Regulation (QMSR) for medical devices was to harmonize U.S. device quality requirements with the international standard ISO 13485:2016. It also incorporates by reference Clause 3 of ISO 9000:2015 for quality management system terminology. The QMSR harmonizes U.S. requirements with global standards, emphasizing risk management, design controls, and production controls in an effort to reduce regulatory burdens, promote consistency across global markets, and improve safety while maintaining specific FDA requirements for records, labeling, and post-market obligations. 

As the QMSR heavily emphasizes risk management, manufacturers must ensure the product risk management file is current, connected to the design and production controls, and reflects how decisions are made. QMSR is not solely limited to ISO 13485 by reference; rather, FDA added specific provisions with requirements including traceability per 21 CFR 821, 21 CFR 820.10(b) covering UDI system requirements (referencing 21 CFR 830), corrections and removals under 21 CFR 806, and MDR reporting under 21 CFR 803. Additional requirements around records and labeling examination are found in Sections 820.35 (Control of Records) and 820.45 (Device Labeling & Packaging Controls).

As of Feb. 2, 2026, the previous Quality System Inspection Technique (QSIT) has been retired, and FDA will utilize the inspection process described in the updated Inspection of Medical Device Manufacturers Compliance Program. FDA will no longer use documents, including the Inspection of Medical Device Manufacturers and Medical Device PMA Preapproval and PMA Postmarket Inspections.

Under QSIT, inspections were focused on subsystems; meanwhile, the new Compliance Program Manual restructures inspections around six quality management system (QMS) areas and four Other Applicable FDA Regulations (OAFRs), all influenced by product risk to patients and users. The six QMS areas are:

• Management Oversight
• Production and Service Provision
• Change Control
• Design and Development
• Outsourcing and Purchasing
• Measurement, Analysis, and Improvement

The four OAFRs are:

• Medical Device Reporting (21 CFR 803)
• Medical Device Tracking Requirements (21 CFR 821)
• Reports of Corrections and Removals (21 CFR 806)
• Unique Device Identification (21 CFR 830)

Under the previous QSR, risk management and its mitigation were primarily emphasized during design verification and validation. However, risk management has now shifted from a primarily design-focused activity to a continuous, proactive process integrated throughout the entire product lifecycle. The QMSR, with the adoption of ISO 13485:2016, now has a stronger focus on risk-based approaches throughout the entire quality system processes that influence the product lifecycle, including design, production, supplier controls, purchasing, and post-market surveillance. It applies to manufacturers, contract sterilizers, repackagers, and specification developers, among others. Risk files are now fundamental to FDA inspections. 

From product launches to M&A and manufacturing trends, the MPO Source delivers the medtech news you need twice a week. Subscribe here!

Exemptions for management review materials and internal audits from FDA inspections under QSR and QSIT no longer exist. Management review minutes and internal audits from before Feb. 02, 2026, and going forward, may now be inspected. This change, in part, is due to these documents already being provided to notified bodies under ISO 13485 and the Medical Device Single Audit Program (MDSAP). The removal of this exemption aims to more closely align global audit and inspection processes. Therefore, it is imperative to mark any confidential records as “confidential” during inspection so FDA can comply with the Freedom of Information Act. 

Although QMSR aligns more closely with ISO 13485:2016, FDA does not require ISO 13485:2016 certification for compliance, nor will a certificate be accepted as proof of compliance. Moreover, ISO 13485 certification will not exempt manufacturers from FDA inspections. FDA’s inspections will not result in the issuance of an ISO 13485 certificate either. However, the FDA continues to be a participating partner in the Medical Device Single Audit Program, which allows an MDSAP-recognized Auditing Organization to conduct a single regulatory audit of a medical device manufacturer that satisfies the relevant requirements of the regulatory authorities participating in the program. FDA may continue to accept MDSAP audit reports as a substitute for routine agency inspections. Firms with activities related to the Electronic Product Radiation Control (EPRC) provisions of the Federal Food, Drug, and Cosmetic Act will continue to be subject to FDA inspections for the EPRC activities.

Accordingly, firms already aligned with or certified under ISO 13485:2016 will face minimal impact, whereas firms solely focused on the U.S. market and the previous 21 CFR 820 regulations will require changes to their internal quality management systems. Such firms will have to adapt to new requirements with respect to management responsibilities, supplier controls, and risk management that surpass old QSR requirements. In such cases, a gap analysis assessment comparing current policies and procedures against the new QMSR and ISO 13485 is recommended. 

To comply with QMSR, manufacturers must update their quality manual, procedures, and records to align with ISO 13485 clauses. Hence, terminology must be aligned and updated where applicable. The QMSR no longer refers to Design History Files, Device Master Records, or Device History Records. These terms are now Design Development Files (DDF), Medical Device File (MDF), and batch records (or equivalent terminology), respectively. Verbiage must be aligned with ISO 13485 and the QMSR’s additional requirements in 21 CFR 820.10 (Requirements for a Quality Management System), 820.35 (Control of Records), and 820.45 (Device Labeling & Packaging Controls). It is strongly advised to update a firm’s quality system manual and procedures to reflect the new terminology and document synonyms where appropriate.

Conclusion

The FDA’s QMSR, effective as of Feb. 2, 2026, embodies a fundamental structural shift in how medical device manufacturers in the U.S. establish quality, and with a major step toward global harmonization, it introduces a “higher standard” for compliance, particularly regarding inspector access to internal records and risk management.

More from MRC Global: The Economics of a Sound Regulatory Strategy

Christine Scifert is founder and partner of MRC Global (previously Memphis Regulatory Consulting LLC), which offers medical device regulatory, quality, and clinical services. She has been consulting for 25 years and has assisted both small and large medical device companies with strategy, regulatory submissions, quality systems, training, due diligence, and other activities. Prior to consulting, Scifert spent nine years at Medtronic Spinal and Biologics directing the regulatory department. Before Medtronic, she performed evaluations of injury mechanisms associated with automobile collisions, slip and falls, and sport/recreation accidents. Scifert earned a Bachelor of Science in physics from Hamline University and a Master of Science in biomedical engineering from the University of Iowa. She also completed a Master’s course in engineering management from Christian Brothers University.

As a partner, Dawn Norman’s expertise and leadership have helped propel MRC Global’s continued growth as a leading regulatory and compliance consulting firm highly respected throughout the medical device industry. With an extensive background in the medical device and biologics industry that includes VC-funded startups to Fortune 100 device manufacturers, Norman’s depth of experience allows her to develop custom client solutions, go-to strategies for clinical studies and evaluations, and a risk-based approach related to regulatory and quality systems. Before MRC Global, Norman spent 15 years in the medical device industry working with venture capital-backed startups and larger companies alike. She focused on regulatory strategy and submissions, along with clinical study design and study execution. Norman was directly involved with early development and market entry for leading-edge medical innovation including novel diagnostic and therapeutic devices for neurosurgical, neurological, neurovascular and cardiac indications, cardiac ablation, recombinant proteins and growth factors for bone fusion and soft tissue regeneration, orthopedic trauma, infusion pumps, artificial intelligence and machine leaning devices for assistive diagnostic indications, dental, female and reproductive health, and advanced robotic and imaging technologies.

Dr. Mahjabeen Waris brings a wide spectrum of medical experience to MRC Global. Her background includes both medical practice and clinical research, which she leveraged while serving on an Institutional Review Board. This dual background provides Dr. Waris with a broad lens and unique perspective, allowing her to better assess challenges while developing more robust solutions. Dr. Waris earned her Doctor of Medicine Degree (MD) at the Dow University of Health Sciences and her International Baccalaureate Diploma (IB) at the International School, both located in Karachi, Pakistan. She has educated and trained students, authored technical/medical papers, is CITI-certified, and is bilingual.