What Is FDA’s Quality Management System Regulation (QMSR)?

The FDA’s Quality Management System Regulation (QMSR) is the federal rule that has governed medical device manufacturing since February 2, 2026, replacing the Quality System Regulation that had been in place since the late 1990s. It incorporates the international standard ISO 13485:2016 directly into U.S. law and adds FDA-specific requirements on top for records, complaint handling, labeling, and adverse event reporting. Manufacturers who already followed ISO 13485 for global markets can now operate under one quality system instead of two, but the QMSR also introduces obligations that catch experienced firms off guard, particularly around management review records and risk documentation.1Federal Register. Medical Devices; Quality System Regulation Amendments

The FDA published the final rule on February 2, 2024, and allowed a two-year transition. Full compliance was required by February 2, 2026. Any firm that has not completed the transition is now operating in violation of federal law, because non-compliance renders a device adulterated under section 501(h) of the Federal Food, Drug, and Cosmetic Act.2eCFR. 21 CFR Part 820 – Quality Management System Regulation

Who Has to Comply

The regulation applies to every manufacturer of finished medical devices intended for human use that are commercially distributed in the United States, whether the manufacturer operates domestically or ships products in from abroad.1Federal Register. Medical Devices; Quality System Regulation Amendments Class I, Class II, and Class III devices all fall under QMSR requirements unless a specific FDA classification regulation exempts them. Most Class I devices are exempt from the design and development requirements in ISO 13485 Clause 7.3, with narrow exceptions for computer-software-automated devices and a short list of specific products including tracheobronchial suction catheters, non-powdered surgeon’s gloves, protective restraints, and certain radionuclide therapy devices.3eCFR. 21 CFR 820.10 – Quality Management System

Facilities that only distribute or wholesale devices without performing any manufacturing functions generally fall outside Part 820. Manufacturers of human cells, tissues, and cellular or tissue-based products must follow 21 CFR Part 1271 alongside the QMSR, with the more product-specific regulation taking precedence when the two conflict.4eCFR. 21 CFR Part 1271 – Human Cells, Tissues, and Cellular and Tissue-Based Products Drug-device combination products must comply with the QMSR for the device constituent part under 21 CFR Part 4, whether the manufacturer runs parallel drug CGMP and QMSR tracks or uses a single integrated operating system.5eCFR. 21 CFR Part 4 – Regulation of Combination Products

How ISO 13485 Became Enforceable U.S. Law

The FDA used a legal mechanism called incorporation by reference to adopt ISO 13485:2016 wholesale. Rather than rewriting every requirement into the Code of Federal Regulations, the agency gave the international standard itself the force of law.1Federal Register. Medical Devices; Quality System Regulation Amendments ISO 13485 clauses are now enforceable requirements, not best-practice guidance.

Where ISO 13485 conflicts with the FD&C Act, U.S. law wins. The most visible example is terminology. ISO 13485 frames its requirements around “safety and performance,” while U.S. law requires “safety and effectiveness.” The FDA treats these as equivalent for QMSR purposes, but the statutory standard remains the controlling legal benchmark. Definitions in section 201 of the FD&C Act for terms like “device” and “labeling” also override the ISO wording.6eCFR. 21 CFR 820.3 – Definitions

Documentation the QMSR Requires

ISO 13485 Clause 4.2.2 requires every manufacturer to maintain a quality manual covering the scope of the quality system (with justification for any exclusions), the documented procedures, and how the various quality processes interact. This is the primary roadmap an FDA investigator will use to understand how a company’s quality system is structured.

The Medical Device File

The familiar Device Master Record, Device History Record, and Design History File no longer exist as distinct regulatory categories under the QMSR. They are replaced by the Medical Device File from ISO 13485, which consolidates product specifications, labeling, intended use, risk management outputs, and manufacturing information into a single reference framework.7U.S. Food and Drug Administration. Quality Management System Regulation (QMSR) – Design and Development Production and traceability records equivalent to the old DHR remain required, but they now live within this broader structure. ISO 13485 Clause 7.3.10 separately requires a design and development file for each device type or family, functioning as the successor to the old DHF.

Records, Labeling, and Retention

The QMSR layers FDA-specific record requirements on top of the general ISO 13485 provisions. Under 21 CFR 820.35, manufacturers must maintain detailed complaint records (device name, date received, unique device identifier, complainant details, description, corrective action, and response) and parallel servicing records covering who performed the work, what was done, and any test or inspection data.8eCFR. 21 CFR 820.35 – Control of Records Under 21 CFR 820.45, labeling must be inspected before use to confirm the correct labels are matched to the correct devices as specified in the medical device file, and both the inspection results and the release of labeling must be documented.9eCFR. 21 CFR 820.45 – Device Labeling and Packaging Controls Quality records must be retained for the expected life of the device or at least two years from the date of release for commercial distribution, whichever is longer.

Risk Management Across the Lifecycle

Under the QMSR, risk management is not a standalone activity. ISO 13485 requires risk management outputs to feed into design inputs (Clause 7.3.3), design outputs to identify characteristics essential for safe use (Clause 7.3.4), and design changes to be evaluated for their effect on risk management inputs and outputs (Clause 7.3.9).10U.S. Food and Drug Administration. Quality Management System Regulation (QMSR) – Risk Management, Risk-Based Approach, and Risk-Based Decisions The FDA identifies ISO 14971:2019 as a useful standard for structuring these activities, though the QMSR does not mandate that specific standard by name.

In practice, the FDA expects a centralized risk management file that typically contains:

  • A risk management plan defining scope, responsibilities, and acceptance criteria at the start of development.
  • A risk analysis report identifying hazards and estimating their associated risks during design.
  • A risk evaluation summary justifying whether individual and overall risks are acceptable before mitigation.
  • A risk traceability matrix showing each identified risk has been addressed throughout the lifecycle.

This is where many manufacturers find the gap between their old QSR practices and QMSR expectations. Under the old system, risk documentation often lived in isolated pockets. The QMSR demands a continuous thread connecting risk inputs, design decisions, verification results, and post-market feedback.

Complaints and Adverse Event Reporting

ISO 13485 Clause 8.2.2 establishes the general complaint handling framework, and 21 CFR 820.35(a) adds FDA-specific requirements. Every complaint involving possible failure of a device, labeling, or packaging to meet specifications must be reviewed, evaluated, and investigated, with records maintained for each step. If a similar complaint has already been investigated, a new investigation can be skipped, but the justification must be documented.8eCFR. 21 CFR 820.35 – Control of Records

Separately, 21 CFR Part 803 remains fully in effect. Manufacturers must report events involving death, serious injury, or device malfunction within 30 calendar days of becoming aware of them. Events requiring remedial action to prevent an unreasonable risk to public health carry a five-work-day deadline. User facilities such as hospitals and nursing homes operate on a 10-work-day timeline for deaths and serious injuries. Manufacturers and importers must submit individual adverse event reports electronically and retain their MDR event files for two years from the event date or the expected life of the device, whichever is longer.11eCFR. 21 CFR Part 803 – Medical Device Reporting

Management Review Records Are Now Inspectable

This is the change that matters most in day-to-day practice. Under the old QSR, management review reports, internal quality audit reports, and supplier audit reports were shielded from FDA inspection by 21 CFR 820.180(c). That exemption is gone. The QMSR gives FDA investigators authority to review all of these records during an inspection.12U.S. Food and Drug Administration. Quality Management System Regulation – Frequently Asked Questions Manufacturers who treated management reviews as perfunctory, or documented internal audits assuming no outside reader would see them, need to recalibrate. These records now have to withstand regulatory scrutiny.

How FDA Inspections Work Now

The FDA retired the Quality System Inspection Technique (QSIT) on February 2, 2026, and replaced it with the process in the updated Inspection of Medical Device Manufacturers Compliance Program: 7382.850.13U.S. Food and Drug Administration. Center for Devices and Radiological Health (CDRH) Compliance Programs Investigators now evaluate manufacturers against ISO 13485 clauses and the FDA-specific additions in Part 820, not the subsystem-based approach QSIT used. The scope now extends to management reviews, internal audits, and supplier audits.

When an investigator observes conditions that may violate the FD&C Act, they issue an FDA Form 483 at the closing meeting listing the specific observations.14U.S. Food and Drug Administration. FDA Form 483 Frequently Asked Questions Responding is not legally required, but the FDA strongly recommends submitting a written corrective action plan within 15 business days of issuance.15U.S. Food and Drug Administration. Responding to FDA Form 483 Observations at the Conclusion of a CGMP Inspection Failing to respond, or responding with a vague plan, is one of the fastest routes to a warning letter.

What Non-Compliance Costs

A device made outside QMSR requirements is adulterated under section 501(h), and both the device and the responsible person face regulatory action.2eCFR. 21 CFR Part 820 – Quality Management System Regulation The FDA’s enforcement toolkit escalates:

  • Warning letters, which are formal notices identifying specific violations and requiring a corrective response. These become public records.
  • Import alerts, which allow the FDA to block foreign manufacturers’ products from entering the United States without physical examination.
  • Seizure, in which the agency seeks a court order to seize adulterated devices already in commercial distribution.
  • Injunction, a court order that can halt manufacturing operations entirely until violations are corrected.
  • Consent decree, a legally binding agreement typically following an injunction that imposes specific operational conditions and often requires third-party auditing at the manufacturer’s expense.

The progression from warning letter to consent decree can move faster than manufacturers expect, particularly when patient safety concerns are involved. Consent decrees routinely cost companies millions in third-party auditing fees, remediation, and lost production time.