The Transition from Medical Device GMP to QSR: Background and Rationale

Introduction

This article explains the background behind the transition from Good Manufacturing Practice (GMP) to Quality System Regulation (QSR) for medical devices in the United States.

Medical devices are highly diverse, and the pace of technological innovation is rapid. Consequently, traditional GMP requirements alone became insufficient to adequately address quality management challenges. To address this issue, the U.S. Food and Drug Administration (FDA) implemented a phased transition to achieve more comprehensive and effective quality management:

Year	Milestone
1990	Enactment of the Safe Medical Devices Act (SMDA)
1993	FDA proposes revision to GMP
1996	Publication of QSR Final Rule (21 CFR Part 820)
1997	QSR implementation
2024	FDA publishes final rule for Quality Management System Regulation (QMSR), incorporating ISO 13485:2016 by reference
2026	QMSR becomes effective (scheduled for February 2, 2026)

Note on Current Regulatory Status: As of January 2026, the current regulation is still 21 CFR Part 820 Quality System Regulation (QSR). However, on January 31, 2024, FDA published a final rule amending Part 820 to incorporate ISO 13485:2016 by reference. This amended regulation, referred to as the Quality Management System Regulation (QMSR), will become effective on February 2, 2026. Until that date, manufacturers must continue to comply with the existing QSR requirements.

Fundamental Differences Between Quality Assurance for Medical Devices and Pharmaceuticals

Medical devices possess characteristics that are fundamentally different from pharmaceuticals.

In the case of pharmaceuticals, quality is assured if they are manufactured correctly according to specifications. The chemical composition and manufacturing process determine product quality, and batch testing can verify consistency.

However, for medical devices, even if the manufacturing process is perfect, the product will not be safe and effective if there are problems with the underlying design. A well-manufactured device based on a flawed design remains an unsafe device. This difference is one of the key reasons why design controls are critically important in medical device quality assurance. Unlike pharmaceuticals, where the formulation itself defines the product, medical devices require that both design intent and manufacturing execution be correct.

GMP Focused on Manufacturing Processes

As the name suggests, GMP was designed to establish standards for manufacturing processes, focusing on management methods and process controls to ensure that products were manufactured according to design specifications. However, it became clear that ensuring medical device quality requires quality management not only in manufacturing but also from the design stage.

The traditional GMP approach assumed that if a device was manufactured according to approved specifications, it would be safe and effective. This paradigm worked reasonably well for pharmaceuticals and some simple devices. However, as medical devices became more complex—incorporating software, electronic components, and sophisticated mechanical systems—the limitations of manufacturing-focused quality control became apparent.

In particular, design deficiencies can have serious implications for product safety and effectiveness, making it increasingly necessary to institutionalize quality assurance starting from the design stage. Manufacturing excellence cannot compensate for design inadequacies, especially when devices interact directly with patients or are used in critical medical procedures.

Design Deficiencies Accounted for a Significant Proportion of Recalls

Even when medical devices are properly manufactured according to design specifications, they will not be safe products if the design itself is flawed. For example, if risk assessment is inadequate during the design phase or if the usage environment is not properly considered, serious safety and effectiveness problems can occur.

According to an FDA study conducted from October 1983 to September 1989, approximately 44% of medical device recall cases were attributed to design-related problems. This finding is documented in the Federal Register publication “Device Recalls: A Study of Quality Problems” (55 FR 21108, May 22, 1990) and subsequently referenced in the QSR Final Rule (61 FR 52602, October 7, 1996).

Study Period	Design-Related Recalls	Significance
October 1983 – September 1989	Approximately 44%	Established the need for design controls
FY 2003 – FY 2012	Design, software, and non-conforming materials/components remained the most frequent causes	Continued relevance of design control requirements

These results clearly demonstrated the impact of design deficiencies on medical device safety, and in the transition from GMP to QSR, quality management from the design stage, not just manufacturing management, came to be emphasized. This data provided compelling evidence that manufacturing controls alone were insufficient and that a comprehensive quality system encompassing the entire product lifecycle was necessary.

Furthermore, subsequent FDA data from FY 2003 to FY 2012 confirmed that design issues, along with software problems and non-conforming materials/components, continued to be among the most frequent causes of recalls, reinforcing the ongoing importance of robust design controls.

Legislative Reform Based on the Safe Medical Devices Act

The Safe Medical Devices Act (SMDA), enacted in 1990, brought about the following significant changes:

1. Authority to Include Design Controls in Medical Device GMP: The SMDA granted FDA explicit authority under section 520(f) of the Federal Food, Drug, and Cosmetic Act to require design controls as part of the current good manufacturing practice requirements for medical devices. This was a crucial legislative change, as the original 1976 Medical Device Amendments did not explicitly authorize FDA to regulate the design phase.
2. Establishment of Adverse Event Reporting System: The act established the Medical Device Reporting (MDR) system, requiring manufacturers, importers, and user facilities to report certain device-related adverse events and product problems to FDA. This created a systematic mechanism for identifying potential design and manufacturing defects through post-market surveillance.
3. Strengthening of Quality System Requirements for Manufacturers: The SMDA strengthened the statutory basis for comprehensive quality system requirements, moving beyond traditional manufacturing controls to encompass the entire product lifecycle from concept through post-market surveillance.

This legislation was a legal reform aimed at improving the safety and effectiveness of medical devices and laid the foundation for the introduction of QSR in 1996. The SMDA recognized that ensuring device safety required regulatory oversight of design processes, not merely manufacturing compliance.

QSR Characteristics: Comprehensive Quality Management

GMP was a standard focused on manufacturing processes, primarily concentrating on manufacturing methods and process controls to ensure products were made according to specifications.

In contrast, QSR includes the following distinctive elements that represent a paradigm shift in medical device quality management:

Key Elements of QSR

1. Introduction of Design Controls (21 CFR 820.30)

Design controls represent perhaps the most significant innovation in QSR. These requirements mandate a structured, documented design and development process that includes:

• Design and development planning
• Design input requirements
• Design output specifications
• Design review at appropriate stages
• Design verification to ensure outputs meet input requirements
• Design validation to ensure devices meet user needs and intended uses
• Design transfer to ensure the design is correctly translated to production specifications
• Design changes and modification controls
• Design history file (DHF) documentation

2. Corrective and Preventive Action (CAPA) System Requirements (21 CFR 820.100)

The CAPA system requires manufacturers to:

• Establish and maintain procedures for implementing corrective and preventive actions
• Analyze processes, work operations, concessions, quality audit reports, quality records, service records, complaints, returned product, and other sources of quality data to identify existing and potential causes of nonconforming product
• Investigate the cause of nonconformities relating to product, processes, and the quality system
• Identify actions needed to correct and prevent recurrence of nonconforming product
• Verify or validate the corrective and preventive action to ensure effectiveness
• Implement and record changes in methods and procedures resulting from corrective and preventive actions

3. Emphasis on the Importance of Management Review (21 CFR 820.20)

Management with executive responsibility must review the suitability and effectiveness of the quality system at defined intervals and with sufficient frequency to ensure that the quality system satisfies the requirements of the regulation and the manufacturer’s established quality policy and objectives. This requirement ensures top management engagement and accountability for quality system performance.

4. Integration of Risk Management

While QSR does not explicitly mandate a specific risk management standard, it establishes the foundation for risk-based thinking throughout the product lifecycle. This approach has been further developed through FDA guidance documents and international standards such as ISO 14971:2019 (Application of risk management to medical devices).

GMP Focus	QSR Enhancement
Manufacturing process controls	Design controls from concept through production
Batch-level quality	Product lifecycle quality management
Reactive problem-solving	Proactive CAPA system
Limited management involvement	Mandatory management review
Process-based compliance	Risk-based quality systems

Through these elements, medical device quality assurance evolved from “ensuring quality during manufacturing” to “quality assurance throughout the entire product lifecycle.” This comprehensive approach recognizes that device safety and effectiveness must be built in from the earliest stages of development and maintained through post-market surveillance and continuous improvement.

Quality Improvement Through the Introduction of Design Controls

The emphasis on Design Controls in QSR is critical because ensuring quality from the design stage is essential for medical device safety and effectiveness. Design controls provide a systematic framework for managing the design and development process.

Core Elements of Design Control

Risk Assessment

Risk assessment is fundamental to design controls and must be performed throughout the design and development process. This includes:

• Identification of known and foreseeable hazards associated with the device
• Estimation of risks for each hazardous situation
• Evaluation of the acceptability of risks
• Implementation of risk control measures
• Assessment of residual risk acceptability
• Risk management file documentation

Risk assessment should follow internationally recognized standards such as ISO 14971:2019 and should be integrated with design verification and validation activities.

Design Verification

Design verification confirms that design outputs meet design input requirements. Verification activities may include:

• Design reviews and evaluations
• Testing and analysis of design outputs
• Comparison of design outputs against design inputs
• Alternative calculations and simulations
• Qualification testing

The extent and rigor of verification activities should be commensurate with the complexity of the device and the risks associated with its use.

Design Validation

Design validation ensures that devices conform to defined user needs and intended uses under actual or simulated use conditions. Validation is performed on the final design and typically includes:

• Clinical evaluation or clinical trials
• Usability testing and human factors validation
• Testing under actual or simulated use conditions
• Performance testing with representative users
• Validation of software functions and features

Design validation must be performed on initial production units, lots, or batches, or their equivalents. Where validation of a device cannot be fully performed prior to release, such as when clinical data collection is ongoing, the validation plan should specify the conditions under which the device may be released.

Change Management

All design changes and modifications must be:

• Identified and documented
• Validated or verified as appropriate before implementation
• Reviewed and approved by designated individuals
• Incorporated into the design history file

Change management ensures that modifications do not adversely affect device safety or effectiveness and that the design documentation remains current and accurate.

Through these processes, it became possible to more reliably ensure the safety and effectiveness of medical devices. Design controls transformed device development from an ad hoc process to a structured, documented, and auditable system that builds quality into products from conception.

The Evolution Toward QMSR: Global Harmonization

Recent Regulatory Development: On January 31, 2024, FDA published a final rule amending 21 CFR Part 820 to incorporate by reference ISO 13485:2016, “Medical devices—Quality management systems—Requirements for regulatory purposes.” This amended regulation is referred to as the Quality Management System Regulation (QMSR) and represents a significant step toward global regulatory harmonization.

Key Features of QMSR

1. Incorporation by Reference of ISO 13485:2016

The QMSR fundamentally restructures Part 820 by:

• Withdrawing most existing QSR requirements
• Retaining certain scope provisions and definitions
• Incorporating ISO 13485:2016 by reference, making compliance with this international standard a legal requirement
• Including Clause 3 of ISO 9000:2015 for quality management system terminology
• Adding FDA-specific requirements to ensure consistency with other U.S. regulations

2. FDA-Specific Supplementary Requirements

While substantially aligned with ISO 13485:2016, QMSR retains or adds specific FDA requirements in the following areas:

Area	QMSR Section	Additional FDA Requirements
Control of Records	§820.35	MDR information (21 CFR 803), UDI requirements (21 CFR 830), confidentiality provisions
Control of Device Labeling and Packaging	§820.45	Enhanced labeling inspection and control requirements
Quality Management System Requirements	§820.10	Links to device reporting, UDI, corrections and removals, tracking, and design control applicability

3. Implementation Timeline and Transition

• Final Rule Published: January 31, 2024
• Effective Date: February 2, 2026 (two-year implementation period)
• Current Status: As of January 2026, manufacturers must continue complying with existing QSR while preparing for QMSR transition
• Post-Implementation: FDA will update inspection procedures; Quality System Inspection Technique (QSIT) will be replaced with a new inspection process aligned with QMSR

4. Relationship with ISO 13485 Certification

Important considerations regarding certification:

• FDA does not recognize ISO 13485 certification as proof of conformity with QMSR requirements
• ISO 13485 certification does not exempt manufacturers from FDA inspections
• FDA will not issue certificates of conformance to ISO 13485:2016 following inspections
• Manufacturers may choose to pursue third-party ISO 13485 certification independently
• The Medical Device Single Audit Program (MDSAP) allows demonstration of compliance with both QMSR and ISO 13485:2016

5. Benefits of Harmonization

The alignment with ISO 13485:2016 provides several advantages:

• Reduced regulatory burden for manufacturers operating in multiple markets
• Consistency with quality management systems recognized by major regulatory authorities worldwide
• Facilitation of international trade and device availability
• Promotion of innovation through regulatory predictability
• Enhanced focus on risk management and continuous improvement

This evolution from GMP to QSR to QMSR reflects FDA’s ongoing commitment to modernizing its regulatory framework while maintaining rigorous standards for medical device safety and effectiveness. The incorporation of internationally recognized standards demonstrates the agency’s recognition that global harmonization benefits both industry and patients by enabling more efficient development and distribution of safe, effective medical devices.

Conclusion

The transition from GMP to QSR represented a fundamental shift in medical device quality management philosophy—from manufacturing-focused compliance to comprehensive lifecycle quality assurance. The introduction of design controls addressed the critical finding that nearly half of device recalls were attributable to design deficiencies, establishing that quality must be built into devices from the earliest stages of development.

The QSR established a framework that emphasized proactive quality management through design controls, CAPA systems, management review, and risk management integration. This comprehensive approach recognized that medical device safety and effectiveness require systematic attention throughout the entire product lifecycle, from initial concept through post-market surveillance.

The forthcoming transition to QMSR, effective February 2, 2026, continues this evolution by aligning U.S. requirements with the international ISO 13485:2016 standard. This harmonization maintains the rigor and patient safety focus of the original QSR while facilitating global consistency in medical device regulation. Manufacturers benefit from reduced complexity when operating in multiple markets, while patients benefit from timelier access to safe and effective medical devices.

As the medical device industry continues to innovate with increasingly complex technologies—including software as a medical device (SaMD), artificial intelligence and machine learning applications, and connected devices—the principles established in the transition from GMP to QSR remain foundational. Quality must be designed in, not inspected in, and manufacturers must maintain robust quality management systems that adapt to new technologies while ensuring patient safety remains paramount.

References

1. Federal Food, Drug, and Cosmetic Act, Section 520(f)
2. Safe Medical Devices Act of 1990
3. 21 CFR Part 820 Quality System Regulation
4. FDA, “Device Recalls: A Study of Quality Problems,” 55 FR 21108 (May 22, 1990)
5. FDA, “Quality System Regulation,” 61 FR 52602 (October 7, 1996)
6. FDA, “Quality Management System Regulation: Final Rule Amending the Quality System Regulation” (January 31, 2024)
7. ISO 13485:2016, Medical devices—Quality management systems—Requirements for regulatory purposes
8. ISO 14971:2019, Medical devices—Application of risk management to medical devices
9. FDA, “Medical Device Recalls Data,” Center for Devices and Radiological Health
10. FDA Guidance Documents on Design Controls and Quality Systems