Skip to content
The FDA’s new Quality Management System Regulation (QMSR) comes into effect on 2nd February 2026. Thisreplaces the previous Quality System Regulation (QSR) and brings the FDA’s approach and expectations to Medical Device Quality Management Systems into alignment with the ISO 13485 International Standard. While this may sound like an enormous overhaul, this blog will outline how you’re already meeting many of these requirements, even if the new terminology may not look familiar.
Is your company impacted?
This change affects companies that sell or plan to sell products on the US market. It may require businesses that haven’t adopted an ISO 13485-compliant format for their QMS, such as those that have only exclusively engaged with the FDA, to adjust their management system and regulatory documentation. However, it’s important to note that it does not impact requirements outside of the US or affect the contents of ISO 13485 itself for other markets.
The FDA have determined that ISO 13485 is “substantially similar” to their previous Quality System Regulations, but they have also “establishe[d] additional requirements that clarify certain expectations and certain concepts used in ISO 13485.”
This does not mean that manufacturers are required to be certified to ISO 13485 to meet the QMSR requirements, and in practice, this is not a big change.
This change is on the scale of a new guidance document – or a localised version of a standard like the UK NHS-specific version of ISO 14971 called DCB0129 – something your regulatory intelligence activities should be identifying and reviewing, but not something on the scale of a new set of regulations (like the transition from EU MDD to EU MDR).
Why do these changes matter?
Any manufacturer providing medical devices to the US market – whether you are based in the US or not – is subject to an unannounced audit from the FDA at any time. As anyone who has experienced one of these audits will tell you, an FDA audit is a big deal.
FDA warnings and enforcement actions are rare, but a major audit finding could block US market access. Failing to adopt the QMSR likely won’t cause immediate exclusion; however, it could exacerbate other compliance issues, potentially leading to a warning letter or enforcement action.
On the flip side, for companies looking to enter the US market, the regulatory hurdles just got a bit easier – application of ISO 13485 is now 90-95% of what the FDA expect and some small tweaks to your existing system could give you access to the US market (for some Class I devices) or make your application to the FDA easier.
1. The FDA will review more records
Previously, the FDA would not review management review records, internal audit records or supplier audit records as part of their auditing; their concern was that staff might hold back in these activities, fearing that an FDA auditor might raise a Non-Conformity based on the information they share. The switch to QMSR brings FDA in line with the cooperative auditing philosophy – that an auditor creating a Non-Conformity is an opportunity to improve instead of a punishment to be avoided.
Concerned about Privacy implications?
The FDA is subject to the Freedom of Information Act, so documents provided to it with confidential information still need to be marked as confidential, or they will be subject to public access requests.
2. Removal of DHF, DHR and DMR
Design History File (DHF), Device History Record (DHR) and Device Master Record (DMR) – the three-letter acronyms that regulatory professionals love to confuse – are not present in ISO 13485 and have not been specifically retained in the FDA’s additions to the QMSR, so you’ll no longer find them in US regulations. However, this doesn’t mean that you’ll need to rename your existing files – if you want to keep these in your QMS, no problem!
3. Risk-based approaches across the QMS
While the old QSR mentions risk specifically in the Design Controls section, whereas ISO 13485 requires a risk-based approach across the QMS; for example, when considering controls on supplier products and processes, software validation and CAPA prioritisation. This doesn’t just mean increasing the resources and prioritisation – low-risk areas can be deprioritised as much as high-risk areas are prioritised.
4. Top Management Engagement
Top management must understand Medical Device Regulations for an effective Quality Management System (QMS). ISO 13485 requires Top Management Accountability, unlike the QSR, which only required a Management Representative. QMSR now forces active participation by top management in Management Reviews to demonstrate this commitment.
5. Customer Communications Procedure
ISO 13485 includes a requirement to have procedures to address:
- sending product information to customers
- customer enquiries
- customer feedback that is not a complaint (such as positive feedback or suggestions)
- contracting with customers and order handling
While these were not QSR requirements, they are commonly already included in QMSs, so hopefully, you’ll find you already have much of this.
6. Validation of QMS Software
While the FDA has led the world with their guidance documents on Computer Software Validation and the more recent Computer Software Assurance, QSR wasn’t 100% explicit in making this a requirement. By incorporating ISO 13485, QMSR makes it explicit that QMS software validation is required to access the US market – Clause 4.1.6 of ISO 13485:
“The organisation shall document procedures for the validation of the application of computer software used in the quality management system.”
Where can we help?
While small, there are some subtle differences between QSR and QMSR which can have a significant impact on future regulatory approvals and the ability to scale beyond the US. Ensuring these changes are reflected is essential and can often accelerate compliance and certification with ISO 13485.
If you’re looking for reassurance that your Quality Management System will meet the new requirements or if you’re interested in ISO 13485 certification to expand into Europe, we can help. Get in touch to speak to a member of our expert team.
Frequently Asked Questions.
What is the FDA Quality Management System Regulation or QMSR?
The QMSR (Section 820 of Title 21 of the Code of Federal Regulations in the USA) are the regulations that the FDA has established for medical device manufacturers to ensure their company operates in a way that supports the creation of safe and effective medical devices.
When was it introduced?
The FDA’s new Quality Management System Regulation (QMSR) was introduced in 2024 and comes into effect on 2nd February 2026.
What does it require of Medical Device manufacturers?
It requires that medical device manufacturers apply the international standard ISO 13485 to the operations – it includes a wide range of requirements across areas such as development, production, training, complaint handling and improvement.
How will QMSR impact AI Medical Device manufacturers?
The FDA found QMSR to be “substantially similar” to their previous regulations and there are no changes in the regulations that would specifically impact on AIaMD manufacturers more than others.
How similar is it to ISO 13485?
Incredibly similar – the FDA have done the legal equivalent of copying and pasting ISO 13485 into the regulation. There are only a few additional comments and clarifications that provide extra guidance on how the FDA interprets ISO 13485.
Does ISO 13485 certification mean I am automatically QMSR compliant?
Almost – there are a few additional comments and clarifications that provide extra guidance on how the FDA interprets ISO 13485. However, the FDA does not recognise or require ISO 13485 certification and it will not impact whether they choose to perform an audit on you themselves.
Do I need a Quality Manual?
Yes, ISO 13485 requires a Quality Manual – and in a small change to the old US regulations, you’ll now need to illustrate how your processes interact with each other. We recommend creating a process interactions map for the full QMS in the Quality Manual.
How does QMSR handle Risk Management?
ISO 13485 (and so QMSR) requires risk to be considered across the entire Quality Management System, not just in design and development. This doesn’t just mean increasing the resources and prioritisation – low-risk areas can be deprioritised as much as high-risk areas are prioritised.
Is ISO 14971 (Risk Management) now mandatory?
ISO 14971 was already a recognised consensus standard by the FDA – while not mandatory, it is strongly recommended (and recognised internationally as well). QMSR doesn’t change this.
Will the FDA still use QSIT?
As of 2nd February 2026, QSIT will be withdrawn, and the FDA will be using a new set of inspection guidelines.
What are the key differences between ISO 13485 and QMSR?
- The FDA will now look at records like management reviews and internal audits that they previously would not have.
- The terms DHF, DHR and DMR no longer appear in the regulation – although the concepts are still there.
- Risk must be considered across the QMS, not just in design controls.
- Extra requirements for top management engagement and customer communication.
- Explicit requirement to validate software used in the QMS.
Do we have to adopt QMSR to sell in the US market?
QMSR is mandatory for all Medical Device manufacturers selling in the US market; however, not all of QMSR applies to all manufacturers – application of a Quality Management System is dependent on the risk classification of the device – for example, only class I medical devices on this list need to apply design controls.
Do we have to maintain Design History File (DHF), Device History Record (DHR) and Device Master Record (DMR) as part of QMSR?
Through ISO 13485, QMSR requires manufacturers to maintain similar concepts of Design and Development Records, Product Realisation Records and Medical Device File. So no one will be asking you for a DHF, DHR or DMR, but you can keep calling them that if you want to.
Does QMSR still require Computer Software Validation and Assurance as part of the requirements?
By incorporating ISO 13485, QMSR makes it explicit that software used in the QMS must be validated prior to use.
We’re the experts that have your back.
Speak to a member of our expert team about how you can adopt QMSR in your Quality Management System
