With the February 2, 2026 compliance deadline approaching, medical device manufacturers must prepare for FDA’s updated regulations. The new Quality Management System Regulation (QMSR) will replace the existing Quality System Regulation (QSR), aligning with ISO 13485:2016. The transition may bring significant change to manufacturers not already compliant to ISO 13485:2016.
On February 2, 2026, medical device manufacturers must fully comply with FDA’s revamped regulations at 21 C.F.R. Part 820. The final QMSR rule, issued January 31, 2024, replaces nearly all existing QSR requirements with internationally recognized standard ISO 13485:2016 (Medical devices – Quality management systems – Requirements for regulatory purposes), which FDA incorporates by reference in the updated regulation. Both the QSR and new QMSR regulations set forth FDA’s good manufacturing practice (GMP) requirements for device manufacturers.
With less than a year and a half until the effective date, device manufacturers should be gearing up to meet the new QMSR requirements. To support this effort, this LawFlash explores commonly asked questions on QMSR implementation that our firm has received from medical device clients.
1. HOW CAN I OBTAIN A COPY OF ISO 13485:2016?
ISO 13485:2016 is available for download on the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal., but you must first register with ANSI.
2. I THOUGHT FDA WAS ONLY INCORPORATING BY REFERENCE ISO 13485:2016. WHY IS CLAUSE 3 OF ISO 9000:2015 INCLUDED?
Because ISO 13485:2016 applies the terms and definitions of ISO 9000:2015, the FDA also incorporates Clause 3 of ISO 9000:2015, as these terms and definitions are necessary to understand and apply ISO 13485:2016. ISO 9000:2015 can be accessed through the ISO Online Browsing Platform; although, it is not available for download. Moreover, while FDA is not incorporating by reference ISO 14971 (Medical devices — Application of risk management to medical devices) within the QMSR, ISO 13485:2016 does incorporate terms and principles from ISO 14971. Accordingly, manufacturers should assess the extent to which their risk management processes and procedures comply with ISO 14971 in order to demonstrate compliance with ISO 13485:2016.
3. WHAT HAPPENS IF ISO 13485 IS UPDATED?
FDA will have to initiate a new notice-and-comment rulemaking to update the QMSR to incorporate a new version. The agency will be unable to enforce the new version until the new rule becomes effective. For context, the QSR has remained relatively unchanged since the last major revision in 1996. ISO:13485 has undergone two major updates since 1996. ISO standards are routinely reviewed and updated every five years, meaning the industry should not be surprised that a new version of ISO:13485 may become available in the near future.
4. WHO MUST COMPLY WITH THE QMSR?
The QMSR will continue to apply to the same entities currently required to comply with the QSR, including:
- Medical device manufacturers, which includes any entity engaged in the design (specification development), manufacture, packaging, labeling, storage, installation, or servicing of a finished device
- Manufacturers of human cells, tissues, and cellular and tissue-based products (HCT/Ps) that are regulated as medical devices, unless they are exempt under a biological product license application
Similar to the QSR, the QMSR does not apply to device distributors, manufacturers, and suppliers of components and materials to be used in the manufacture of finished devices, as well as to manufacturers of blood and blood components used for transfusion or further manufacturing, and to device retailers/dispensers.
5. FDA EXPLAINS IN COMMENTARY TO THE QMSR THAT IT BELIEVES THE QMSR HAS A RELATIVELY LOWER BURDEN FOR COMPLIANCE THAN THE QSR. IS THAT TRUE?
In addition to changes in terminology (i.e., “Top Management” instead of “Management with Executive Responsibility”), there are substantive differences between the QSR and QMSR that will take time and resources to implement. For example, documented traceability between design inputs, outputs, design verification testing, and design validation is not required under the QSR (currently viewed only as a best practice). ISO 13485:2016 requires, as part of design planning, that traceability be established between design inputs and outputs.
6. MY QUALITY AGREEMENTS WITH SUPPLIERS ARE BASED ON THE QSR. SHOULD THEY BE UPDATED?
Yes, quality agreements will need to be revised to comply with the QMSR. References to the QSR should be removed and replaced.
7. WHAT IS A KEY DIFFERENCE BETWEEN THE QSR AND QMSR THAT I SHOULD PAY ATTENTION TO?
Under the existing QSR, the regulation prohibits FDA investigators from inspecting Management Review reports/meeting minutes, internal audit reports, and supplier quality audit reports. FDA explained in response to comments to the QSR that the purpose of exempting such records from FDA inspection is to help ensure open and honest dialogue within the company that would not be stifled from knowing that such records would be subject to government review.
Under the new QMSR, FDA eliminated the protection and notes in commentary that such records will now be subject to FDA inspection. FDA’s rationale for removing the protection is that ISO 13485:2016 does not include such protections, and since governmental authorities, including Notified Bodies and Medical Device Single Audit Program (MDSAP) auditors, are evaluating these records, thus so should FDA.
Device manufacturers should start taking steps now to adjust their culture and practices for documenting Management Review reports/meeting minutes, internal audit reports, and supplier quality audit reports. Reports should be factual and devoid of unnecessary characterizations (e.g., “The company is not compliant”).
8. MY QUALITY SYSTEM IS ISO:13485 2016 CERTIFIED. WILL I BE SUBJECT TO FDA INSPECTION?
Yes, as FDA will not recognize the certification. Only those entities that participate in MDSAP will remain exempt from FDA routine surveillance inspections. FDA plans to continue participating in MDSAP; although, the agency intends to evaluate the MDSAP program and the training needs for third-party auditors, initiating revisions if FDA deems necessary.
9. I PLAN TO SUBMIT AN HDE OR PMA APPLICATION IN 2025, WHICH MAY REQUIRE FDA PRE-APPROVAL INSPECTION. SHOULD I DEMONSTRATE QSR COMPLIANCE OR QMSR COMPLIANCE?
FDA has not provided a transition period from compliance with the QSR to the QMSR through its QMSR rulemaking or enforcement discretion. Because all quality systems must comply with the QMSR by February 2, 2026, absent direction from the FDA review team, Humanitarian Device Exemption (HDE) or Premarket Approval (PMA) applications received prior to the compliance deadline will need to demonstrate compliance with the QSR.
Applications received after February 2, 2026 will need to demonstrate compliance with the QMSR. As noted above, switching a quality management system from complying with the QSR to the QMSR will require significant effort. An applicant preparing a PMA or HDE submission for 2025 (especially Q4 2025) should carefully consider the status of its QSR-to-QMSR upgrades (and, if applicable, the status for its contract manufacturers) when determining the specific target date for its submission.
10. WHAT ACTIONS IS THE FDA TAKING IN PREPARATION FOR THE QMSR EFFECTIVE DATE?
FDA intends to assess its regulations, policies, and guidance documents affected by the QMSR. The agency will also train its personnel responsible for assessing quality management system requirements on the QMSR, as well as replace its Quality System Inspection Technique or “QSIT” (i.e., FDA’s current inspection program for medical devices) with a new inspection program that will align with the QMSR.
11. FOR YEARS, MY ISO:13485 COMPLIANT QUALITY SYSTEM HAS BEEN CERTIFIED BY A NOTIFIED BODY THAT RARELY IDENTIFIES A NONCONFORMITY. CAN I EXPECT A SIMILAR RESULT FROM AN FDA INSPECTION?
No, regulated entities should not expect similar results. FDA investigators will likely approach topics with a different set of experiences, interpretations, and expectations. When compared to FDA inspections, notified body inspections tend to be more relaxed as regulated entities have historical relationships with their notified body auditors. Moving forward, notified bodies may feel obligated to review topics with additional scrutiny, knowing FDA will review the subject matter against the same standard.
12. WHAT SHOULD I DO NOW TO PREPARE FOR THE QMSR?
To begin preparing for the QMSR now, consider taking the following actions:
- Conduct an assessment to evaluate what processes and/or procedures require adjustment to comply with the QMSR
- Prepare new draft procedures (or amendments to existing procedures) that align with the QMSR and can be implemented on February 2, 2026
- Train personnel on the key differences between the QSR and QMSR and on the new (or updated) procedures for QMSR implementation
- Work with suppliers to amend quality agreements to align with the new QMSR requirements; consider which suppliers may require updated supplier audits to assess QMSR readiness
- Identify whether there are any planned HDE/PMA manufacturing submissions being planned for 2025/early 2026 so that they can be appropriately drafted to indicate compliance with the QSR or QMSR
- Evaluate inspection readiness for new QMSR requirements for all facilities post-February 2026
[View source.]
