FDA’s New QMSR Rule: What Medical Device Manufacturers Need to Know

The Food and Drug Administration (FDA) is introducing significant changes to the regulation of medical device quality management. This article explores the FDA’s Quality Management System Regulation (QMSR) and its relationship with ISO 13485, an internationally recognized standard for quality management systems. We will delve into the history of the QMSR, its key components, and the implications of harmonizing it with ISO 13485 for medical device manufacturers. 

Understanding the FDA Quality Management System Regulation (QMSR) 

What is the QMSR? 

The QMSR is a new rule introduced by the U.S. Food and Drug Administration (FDA) to amend the older Quality System Regulation (QSR) found in 21 CFR Part 820. Finalized in February 2024, QMSR will officially take effect on February 2, 2026. Its primary purpose is to harmonize FDA requirements with the international standard ISO 13485:2016, which governs quality management systems for medical devices. QMSR incorporates ISO 13485 by reference but retains certain FDA-specific requirements, such as labeling and packaging controls along with updates to terminology and an increased emphasis on a risk-based approach to quality management. 

History of the QSR 

The QSR, codified under 21 CFR Part 820, has been the cornerstone of the FDA’s approach to ensuring the safety and effectiveness of medical devices in the United States for decades. Its origins trace back to 1978, when the FDA first issued Current Good Manufacturing Practice (CGMP) requirements for medical devices under section 520(f) of the Federal Food, Drug, and Cosmetic Act. In the 1990s, the FDA began revising the regulation to incorporate design controls, a move authorized by the Safe Medical Devices Act of 1990. 

Key Components of the QSR 

The QSR established a framework of basic requirements for manufacturers, including subsystems for management responsibility, design and development controls, production and process controls, corrective and preventive actions (CAPA), and document and record controls. It emphasized a risk-based approach and required manufacturers to develop quality systems appropriate to the complexity and risk of their devices. Some of the most important sections are as follows: 

Design Controls (§820.30)
Corrective and Preventive Actions (CAPA) (§820.100)
Production and Process Controls (§820.70)
Document and Record Controls (§820.40, §820.180–198)
Management Responsibility (§820.20)
Purchasing Controls (§820.50) 

ISO 13485 and Its Importance in Medical Device Manufacturing 

What is ISO 13485? 

ISO 13485:2016 is an international standard that specifies requirements for a quality management system (QMS) tailored to the medical device industry. It is designed to help organizations consistently meet customer and regulatory requirements related to the design, development, production, installation, and servicing of medical devices. The standard places a strong emphasis on risk management and maintaining effective processes throughout the product lifecycle. It also includes requirements for documentation, traceability, CAPAs, and supplier controls. 

ISO 13485 Requirements for Medical Device Manufacturers 

The requirements of ISO 13485 are comprehensive and cover all stages of the medical device lifecycle. The standard emphasizes risk management, requiring medical device manufacturers to identify, assess, and control risks associated with their products. ISO 13485 also mandates robust document control procedures to ensure that all relevant documents are properly created, reviewed, approved, and maintained. Another key requirement is process validation, which requires manufacturers to validate their processes to ensure that they consistently produce medical devices that meet specified requirements. Clause 3 of ISO 13485 includes definitions to provide a framework for the requirements of ISO. 

The Harmonization of QMSR and ISO 13485 

Reasons for Harmonization 

The FDA is harmonizing its QMSR with ISO 13485:2016 to align U.S. medical device regulations with internationally recognized standards. This strategic move supports global harmonization, making it easier for manufacturers to comply with multiple regulatory systems through a single quality framework. ISO 13485 is already accepted by regulatory authorities in regions such as the European Union, Canada, and Japan, and is central to the Medical Device Single Audit Program (MDSAP), which allows one audit to satisfy multiple jurisdictions. By adopting ISO 13485, the FDA aims to reduce the regulatory burden on manufacturers who already follow the international standard, minimizing duplicative compliance efforts and streamlining documentation and audits. 

Additionally, ISO 13485 offers a more modern and risk-based approach to quality management, which aligns with the FDA’s goal of improving device safety and regulatory efficiency. It integrates risk management throughout the product lifecycle and ties closely to ISO 14971, the standard for medical device risk management. Harmonization also promotes consistency in inspections and regulatory expectations, even though FDA inspections will continue independently. Industry stakeholders have largely supported this transition, recognizing the benefits of global alignment while cautioning against adding excessive U.S.-specific requirements on top of ISO 13485. Overall, the harmonization reflects the FDA’s commitment to modernizing its regulatory framework and supporting innovation and safety in the medical device industry. 

Implications for Medical Device Manufacturers 

For manufacturers, one major implication is the need to review and update their quality management systems to ensure full compliance with ISO 13485. While the FDA notes that the requirements of QMSR and the previous Quality System Regulation (QSR) are substantially similar, ISO 13485 introduces more explicit and prescriptive requirements, especially around risk management and lifecycle quality assurance. Manufacturers must now demonstrate that their risk management processes span the entire product lifecycle, from design and development through post-market activities 

Another key implication is the shift in inspection and documentation practices. Although ISO 13485 certification will not exempt companies from FDA inspections, the harmonized framework will allow for more consistent and globally aligned audits. However, manufacturers must be cautious not to assume that ISO 13485 compliance alone guarantees FDA compliance, as the agency retains its own inspectional authority and may impose additional U.S.-specific requirements. 

Additionally, after the QMSR becomes effective, the FDA intends to review previously records that were previously exempt from review under QS Regulation 820.180(c), including internal audits, supplier audits, and management review reports. This is a part of their updated inspection process, outlined in a revised version of the Compliance Program (CP). The FDA recommends that firms complete comparative analyses to demonstrate documents and records created prior to the QMSR effective date meet the QMSR requirements. 

It is important to note that FDA inspections under the QMSR will not follow the MDSAP audit plan or procedures, meaning that the FDA will not require certificates of conformance to ISO 13485 and will not issue certificates of conformance to ISO 13485, and possession of this certificate will not exempt a manufacturer from an FDA inspection.  

More information on this can be found through the official FDA website, including Quality System (QS) Regulation/Medical Device Current Good Manufacturing Practices (CGMP) and Final Rule Amending the Quality System Regulation – Frequently Asked Questions. 

Future of Quality System Regulation 

The future of quality system regulation in the medical device industry is undoubtedly intertwined with the ongoing harmonization efforts between the FDA and international standards like ISO 13485. As the QMSR final rule takes effect, medical device manufacturers can expect increased scrutiny on their quality management systems, with a greater emphasis on risk management and process validation. The FDA will likely continue to issue guidance documents and refine its FDA inspection processes to ensure effective implementation of the new QMSR.