FDA Issues Quality Management System Regulation (QMSR)

Introduction of QMSR

The U.S. Food and Drug Administration (FDA) issued the Quality Management System Regulation (QMSR) Final Rule to amend the current Good Manufacturing Practice (cGMP) requirements of the Quality System Regulation (QSR) under 21 CFR Part 820. This final rule incorporates by reference the international standard specific for medical device quality management systems, ISO 13485:2016 “Medical devices – Quality management systems – Requirements for regulatory purposes,” established by the International Organization for Standardization (ISO).

This final rule represents the FDA’s latest action to promote consistency in medical device regulation. This measure harmonizes the FDA’s cGMP regulatory framework with that used by other regulatory authorities worldwide, advancing global alignment in device regulation.

The QMSR was published in the Federal Register on February 2, 2024, and will become effective two years later on February 2, 2026. Until that effective date, manufacturers must continue to comply with the QSR.

Background and Historical Context

Manufacturers must establish and follow quality systems to ensure that products consistently meet applicable requirements and specifications. Quality systems for FDA-regulated products (food, drugs, biologics, and medical devices) are known as current Good Manufacturing Practices (cGMPs).

The cGMP requirements for medical devices under 21 CFR Part 820 were first authorized by Section 520(f) of the Federal Food, Drug, and Cosmetic Act (FD&C Act). Under Section 520(f), FDA issued a final rule in the Federal Register on July 21, 1978 (43 FR 31508), prescribing cGMP requirements for medical devices. This regulation became effective on December 18, 1978, and was codified as Part 820.

In 1990, FDA undertook the revision of the cGMP regulation to add design controls authorized by the Safe Medical Devices Act. FDA also determined that it would be beneficial to the public and the medical device industry for the cGMP regulation to be consistent, to the extent possible, with quality system requirements contained in applicable international standards. The primary standards at that time were ISO 9001:1994 “Quality systems – Model for quality assurance in design, development, production, installation, and servicing” and the Committee Draft (CD) revision of ISO/CD 13485 “Quality systems – Medical devices – Supplementary requirements to ISO 9001.”

As a result of extensive efforts, the revised Part 820 was published on October 7, 1996 (61 FR 52602) and became effective on June 1, 1997. For additional information regarding the revision history and international harmonization with international standards and the Global Harmonization Task Force (GHTF), please refer to the preamble (pages 52602 to 52654) of the Quality System Regulation (61 FR 52602).

This preamble contains public comments received during the development of the QSR and the FDA Commissioner’s decisions on those comments. Therefore, the preamble contains valuable insights regarding the meaning and intent of the QMSR.

Flexibility of the QMSR

The QMSR adopts the same “umbrella” approach as the original cGMP regulation. Because the regulation must apply to a wide variety of different types of devices, it does not prescribe in detail how manufacturers should manufacture specific devices. Rather, the regulation provides a framework that all manufacturers must follow by requiring that manufacturers develop procedures and follow them, and by requiring manufacturers to fill in the details appropriate for the specific device in accordance with the current state-of-the-art for manufacturing that specific device.

Manufacturers should exercise appropriate judgment in developing their quality systems and apply the applicable sections of 21 CFR 820.5 of the QMSR to their specific products and operations. Operating within this flexibility, it is the responsibility of each manufacturer to establish requirements for each type or family of devices that will result in safe and effective medical devices, and to establish methods and procedures to design, produce, and distribute devices that meet quality system requirements. The responsibility for meeting these requirements and maintaining objective evidence of compliance must not be delegated, even though the actual work may be delegated.

While FDA identifies in the QMSR the essential elements that a quality system must embody, it does not prescribe specific ways to establish these elements. Because the QMSR covers a broad spectrum of devices, manufacturing processes, and other variables, it allows some flexibility in the details of quality system elements. It is left to manufacturers to determine the necessity for, or extent of, certain quality elements and to develop and implement specific procedures tailored to their particular processes and devices.

Key Changes in the QMSR

Incorporation by Reference of ISO 13485:2016

The QMSR fundamentally restructures Part 820 by incorporating by reference (IBR) ISO 13485:2016, “Medical devices – Quality management systems – Requirements for regulatory purposes.” Most of the existing text of 21 CFR Part 820 has been withdrawn and replaced with references to the corresponding sections of ISO 13485:2016. The definitions in Clause 3 of ISO 13485:2016 and ISO 9000:2015 now apply to the QMSR, except for those terms specified in §820.3(b) or provided as statutory definitions in Section 201(h) of the FD&C Act (such as device and labeling) that supersede those in the standards.

Additional FDA Requirements

While incorporating ISO 13485:2016, the QMSR maintains certain FDA-specific requirements that are not fully covered by the international standard. Section 820.10 of the QMSR imposes the following additional requirements:

Requirement Area	ISO 13485:2016 Reference	Additional FDA Requirement
Identification	Clause 7.5.8	Compliance with 21 CFR Part 830 (Unique Device Identification system)
Traceability	Clause 7.5.9.1	Compliance with 21 CFR Part 821 (device traceability). For life-sustaining devices, requirements of Clause 7.5.9.2 for implantable devices also apply
Reporting to Regulatory Authorities	Clauses 7.2.3, 8.2.3, 8.3.3	Compliance with 21 CFR Parts 803 and 806 (adverse event reporting and recall reporting)
Records Control	Clause 4.2.5	Sections 820.35 and 820.45 retain FDA requirements for complaint records and control of device labeling and packaging activities

Enhanced Emphasis on Risk Management

ISO 13485:2016 integrates risk management principles throughout its requirements, representing a more explicit emphasis compared to the QSR. While the QSR addressed risk management primarily in the design control section (§820.30(g)), ISO 13485:2016 embeds risk-based decision making throughout the entire quality management system. This integration reinforces the framework for sound decision-making within a QMS and provides assurance that devices will be safe and effective, as required by Section 520(f) of the FD&C Act. Risk management considerations are now explicitly incorporated in multiple clauses including 4.1, 7.1, 7.3, 7.4, 7.5, 7.6, and 8.2 and their subclauses.

Changes in Audit Documentation Accessibility

A significant change in the QMSR affects the inspection of certain quality system records. Under the QSR, management reviews, internal audits, and supplier audits were exempt from FDA inspection per §820.180(c). This exemption is not maintained in the QMSR. As stated in the preamble to the final rule, since manufacturers are required to provide such documents to other regulatory authorities around the world, making them available to FDA will not create an additional burden. This change enhances FDA’s ability to assess the effectiveness of a manufacturer’s quality management system comprehensively.

Electronic Records and Signatures

ISO 13485:2016 does not specifically require signatures and dates on approvals. However, FDA clarifies in the QMSR that the term “approved” implies that an approved document or record must bear a signature and date. This means that compliance with 21 CFR Part 11, which covers Electronic Records and Electronic Signatures, remains applicable for companies using electronic systems to manage documents, records, and electronic signatures.

Scope of Application of the QMSR

The QMSR applies to finished device manufacturers who intend to commercially distribute medical devices. A finished device is defined in 21 CFR 820.3(l) as any device or accessory to any device that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized.

Certain components, such as blood tubing and diagnostic X-ray components, are considered by FDA to be finished devices because they are accessories to finished devices. Manufacturers of accessories are subject to the QMSR.

GMP Exemptions

FDA has determined that certain medical devices are exempt from GMP requirements. These medical devices are exempted by FDA classification regulations published in the Federal Register and codified in 21 CFR 862 through 892. The GMP requirement exemption does not exempt finished device manufacturers from maintaining complaint files (21 CFR 820.35, which replaced the former §820.198) or from general requirements for records under the QMSR.

As of the QMSR effective date, the references to exempted activities for Class I devices have been updated from the former §820.180 (Records – General requirements) and §820.198 (Records – Complaint files) in the QSR to the equivalent requirement in the QMSR (§820.35, Control of Records).

Design Controls for Investigational Devices

Medical devices manufactured under an Investigational Device Exemption (IDE) are exempt from most of the QMSR requirements. However, they are not exempt from design control requirements. Under 21 CFR 812, sponsors of IDEs are exempt from the Quality System Regulation except for the requirements for design controls specified in 21 CFR 820.30 (under the QSR) and now under Clause 7.3 of ISO 13485:2016 as incorporated in the QMSR. This ensures that even investigational devices undergo appropriate design control processes to ensure specified design requirements are met and to provide the foundation for safe and effective device development.

Implementation Considerations

Transition Period

The FDA has provided a two-year transition period from the publication date (February 2, 2024) to the effective date (February 2, 2026). During this transition period, manufacturers must continue to comply with the existing QSR while preparing for QMSR compliance. As noted in the preamble to the final rule, the requirements of the QSR and the QMSR are substantially similar, which should facilitate the transition. To demonstrate compliance with the QMSR, FDA investigators may review records that are part of the manufacturer’s QMS, including those created before February 2, 2026. Manufacturers may find it useful to complete a comparative analysis (gap assessment) to demonstrate that documents and records created prior to the QMSR effective date meet the QMSR requirements.

Impact on Different Manufacturers

The impact of the QMSR varies depending on a manufacturer’s current quality system:

• Manufacturers already compliant with ISO 13485:2016: These manufacturers will experience minimal impact, as their existing systems already align with the core requirements of the QMSR. However, they must ensure compliance with the additional FDA-specific requirements outlined in §820.10 and address the changes in audit record accessibility.
• Manufacturers focused solely on the U.S. market and currently complying only with 21 CFR Part 820: These manufacturers will need to make more substantial updates to their quality systems. Key areas requiring attention include:
  • Adopting the enhanced risk-based approach embedded throughout ISO 13485:2016
  • Updating procedures related to complaints management, production, identification, batch release, and maintenance
  • Implementing robust risk management processes aligned with ISO 14971 (highly recommended)
  • Training staff on ISO 13485:2016 requirements and risk management principles
  • Preparing management review, internal audit, and supplier audit documentation for FDA inspection

ISO 13485 Certification

It is important to note that FDA will not require ISO 13485 certification, and manufacturers with ISO 13485 certificates are not exempt from FDA inspections. FDA inspections under the QMSR will not result in the issuance of certificates of conformance to ISO 13485:2016. However, manufacturers may choose to pursue ISO 13485 certification if they are selling or planning to sell their devices into other jurisdictions where such certification may be beneficial or required.

Medical Device Single Audit Program (MDSAP)

The Medical Device Single Audit Program (MDSAP) will likely need to be modified to incorporate the new QMSR requirements. Manufacturers participating in MDSAP should monitor updates to the program as it adapts to align with the QMSR.

Conforming Edits to Combination Product Regulations

The QMSR includes conforming edits to 21 CFR Part 4, which addresses current Good Manufacturing Practice (cGMP) requirements for combination products. These edits clarify the medical device quality management system requirements for combination products and align them with ISO 13485:2016 and the QMSR final rule. However, these edits do not impact the cGMP requirements for the drug or biological product components of combination products.

Relationship to Future ISO 13485 Revisions

FDA recognizes that ISO 13485 will likely be updated in the future. However, the agency has stated that the QMSR final rule is not the appropriate instrument for addressing how FDA will handle future revisions to the standard. Any future revisions to ISO 13485 would need to be evaluated to determine the impact of the changes and whether the QMSR should be amended accordingly. If deemed appropriate, FDA will update the regulation in accordance with Federal law, including the Administrative Procedure Act (5 U.S.C. 553), and obtain approval of any changes to the incorporation by reference in accordance with 1 CFR Part 51. FDA actively participates in the ISO technical committee responsible for ISO 13485 (ISO TC 210) and is actively monitoring and engaged in the process of making changes to the standard.

Conclusion

The QMSR represents a significant step forward in harmonizing U.S. medical device quality system requirements with international standards. By incorporating ISO 13485:2016 by reference while maintaining essential FDA-specific requirements, the QMSR facilitates global consistency in device regulation, reduces regulatory burden for manufacturers operating in multiple markets, and maintains the high level of quality assurance necessary to ensure device safety and effectiveness.

Manufacturers should use the two-year transition period to:

1. Conduct a thorough gap analysis comparing their current QMS to the QMSR requirements
2. Develop and implement a quality plan for the transition
3. Train personnel on ISO 13485:2016 and enhanced risk management principles
4. Update quality system documentation as needed
5. Engage with suppliers to ensure alignment with the new requirements
6. Prepare for changes in FDA inspection procedures, particularly regarding audit documentation

The QMSR continues FDA’s longstanding commitment to ensuring that medical devices are manufactured under quality systems that support the consistent production of safe and effective devices, while advancing the agency’s efforts to align with the international regulatory community for the benefit of patients worldwide.