March 31, 2025

Less Than A Year! FDA's QMSR Is Getting Closer

The new Quality Management System Regulation (QMSR) – FDA’s long-awaited update to the medical device quality system requirements in 21 CFR Part 820 – is just one year away from becoming effective. The two-year transition period ends on February 2, 2026, when the Agency will begin enforcing the QMSR requirements.

The major change coming for those organizations who fall within the scope of the Regulation is the “incorporation by reference” of the requirements of ISO 13485:2016 Medical devices—Quality management systems—Requirements for regulatory purposes. ISO 13485 was introduced in 1996, which happens to be the last time a major update to 21 CFR Part 820 (QSR) occurred. Since that time, ISO 13485 has been modified a few times, and the most recent version – ISO 13485:2016 – is very similar to FDA QSR. In fact, many people with knowledge of the QSR and ISO 13485:2016 talk about the two containing nearly the same requirements.

This incorporation of ISO 13485:2016 by reference in the QMSR makes the ISO 13485:2016 requirements the basis for quality system compliance for manufacturers of medical devices, in-vitro diagnostics, and combination products with a device constituent marketed in the US. This approach means that all companies required to comply with the QMSR will essentially be following ISO 13485:2016 – even if they are not certified to the standard by a third party.

What Should You Do First?

Of course, first you should read the QMSR and become familiar with the new structure and content of 21 CFR Part 820. The entire Regulation has been replaced with a new structure in QMSR – it is not just a revision of the existing QSR with sections taken out or replaced.

You also need to make sure you understand the full requirements of ISO 13485:2016. Even though it is “substantially similar” (in FDA’s opinion), there are still details within the standard that are not included explicitly in the QSR today.

If you are new to ISO 13485:2016 and need a copy quickly, you can view the standard content online via the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal. However, this online version is a read-only format, and you must register on the site each time you wish to see the document – not very convenient for your day-to-day work. For longer-term use, you need to purchase the standard for your organization. Once you have the standard, read it through from beginning to end, including the introduction (Clause 0).

From FDA QSR to QMSR: Changes and Questions

One of the first questions you may have when you’re looking through the ISO 13485:2016 requirements is about the phrase “applicable regulatory requirements.” That phrase is used throughout the standard to require organizations to identify all of the global regulatory requirements that are relevant to their organization’s quality system. But if FDA is following this requirement, does that mean they will be asking you about how you meet the quality system requirements for all the countries where you market your devices? Fortunately, no. FDA has made it clear in QMSR 820.10(b) that the “applicable regulatory requirements” for FDA will be only other US regulations (e.g., 21 CFR Part 803 for reporting to regulatory authorities).

Check out our previous QMSR blog that walks through the big changes from the QSR to the QMSR:

Audit vs. Inspection: How We Need to Shift Our Thinking About ISO 13485:2016 Requirements Under the QMSR

Your QMS may be certified already in some way to the requirements of ISO 13485:2016 by a recognized auditing organization for MDSAP (Medical Device Single Audit Program), by a designated Notified Body as part of your conformity assessment for CE Marking in the EU, or by an accredited certification body for a stand-alone ISO 13485:2016 certification. All of these certifications are achieved through audits, but FDA will be doing regulatory inspections. The reality is that a regulatory authority inspection has a different objective and “feel” than a certification audit.

For starters, an FDA inspection can be more thorough than an audit – remember, an FDA investigator is not limited by a contracted audit plan like the person who conducted your certification audit. If the investigator has identified potential issues with your QMS, they can extend the inspection (by days or even weeks) until they have collected the objective evidence needed to complete their assessment of your facility.

An FDA inspection also can have specific regulatory implications for your organization that you would not experience from a certification audit. If you are not meeting the QMSR requirements, FDA could use their available tools (warning letters, import alerts, injunctions, seizures, civil money penalties) to address the observed issues with your company.

Taking all of this into consideration, everyone who is comfortable with their current ISO 13485:2016 QMS audits needs to assess how well their existing processes and documentation will fare under this different type of scrutiny.

How Can We Help?

If you are looking for more information related to the QMSR or the requirements of ISO 13485:2016, our ELIQUENT experts have done the work to identify all the details you need to know about the shift from the QSR to the QMSR and ISO 13485:2016. We offer two different instructor-led training courses focused on the QMSR to meet your needs. The first is a one-day high-level course on QMSR, which you can find here. The second is an in-depth course on both QMSR and ISO13485:2016, which you can find here. Both of these courses include the information that you need to jumpstart your transition to the QMSR.

We also can help you evaluate your initial readiness for next February when QMSR goes into effect by assisting with a gap analysis (have us do it for you) to get a much clearer understanding of what needs to happen to get your QMS in conformance with the new QMSR.