QMSR as of February 2, 2026: What the new FDA quality management regulation means for medical device manufacturers
On February 2, 2026, a regulatory change came into force in the USA that will affect medical device manufacturers worldwide: the previous Quality System Regulation (QSR) will be replaced by the Quality Management System Regulation (QMSR). With this step, the US FDA is making a long overdue paradigm shift and adopting ISO 13485:2016 as a binding reference standard for the first time. For manufacturers operating in both Europe and the USA, this initially sounds like a welcome simplification. However, while harmonization does indeed bring benefits, it also creates new requirements for documentation, risk management and QMS structure.
Find out everything you need to know now in our blog post.
What is the QMSR and why is it coming now?
The Quality Management System Regulation is the revised version of 21 CFR Part 820 and was published in the Federal Register on February 2, 2024. The core of the QMSR is the adoption of ISO 13485:2016 “by reference”. This means that the international standard is now a legally binding part of the US requirements.
The FDA justifies the change with three central objectives: firstly, harmonization with other regulatory authorities such as the EU, Canada and MDSAP countries, secondly, the reduction of duplication of work for globally active manufacturers and thirdly, the modernization of quality requirements. The previous QSR from 1996 had hardly changed for almost three decades and was increasingly at odds with internationally established standards.
The most important changes at a glance
- ISO 13485:2016 as a central reference: In future, the majority of 21 CFR Part 820 will refer directly to the corresponding sections of the ISO standard. Many sections are marked as “Reserved” and refer to ISO 13485. However, the FDA has specifically added areas in which it imposes requirements that go beyond ISO 13485, such as record-keeping obligations, labeling and supplier management. Traditional FDA terms such as Device Master Record (DMR), Device History Record (DHR) and Design History File (DHF) are replaced by the internationally used Medical Device File (MDF).
- Risk management permeates the entire QMS: Under the previous QSR, risk management was primarily located in the design and development process. The QMSR now explicitly requires a risk-based approach across all QMS processes, from supplier selection and change management to post-market surveillance. In terms of content, the FDA refers to ISO 14971 and requires risk assessments to be documented and incorporated into decision-making processes. Inspection strategies should be based on the risk profile, suppliers must be classified based on risk and CAPAs must be prioritized according to risk.
- Greater management responsibility: The QMSR significantly tightens the requirements for top management. Management responsibility, resource allocation and management assessments must be documented more clearly. There is also an increased focus on competence and training: manufacturers must prove that their personnel are qualified and understand the relevance of their own activities for product quality and patient safety. One important point: internal audits, supplier audits and management reviews are no longer exempt from FDA inspections.
- Process-oriented inspections instead of QSIT: The FDA is moving away from the classic Quality System Inspection Technique (QSIT) approach and will in future focus on ISO-typical, process-oriented audits. The focus will be on system effectiveness, process interactions and continuous improvement. “Check-the-box” compliance is no longer enough; inspectors want to understand the thinking behind the system.
International harmonization as an opportunity
One of the biggest advantages is the convergence with international standards. Manufacturers who already operate an ISO 13485-compliant QMS no longer have to maintain two parallel documentation structures. This harmonization also facilitates participation in the Medical Device Single Audit Program (MDSAP), in which a single audit is recognized by several authorities.
However, caution is advised: ISO 13485 certification alone does not guarantee QMSR compliance. The FDA has made it explicitly clear that it does not accept ISO certificates as a substitute for its own compliance assessments. Manufacturers must also fulfill FDA-specific requirements that go beyond ISO 13485.
What manufacturers should do now
When the QMSR comes into force, manufacturers should prioritize the following steps:
- Carry out a gap analysis and systematically compare your current QMS with the QMSR requirements.
- Expand your risk management processes across all QMS areas and document how risk assessments are incorporated into decisions.
- Update your documentation to reflect the new terminology and ensure that all references to 21 CFR Part 820 are correct.
- Prepare internal audits and management reviews for FDA inspections and train your staff on the changes.
The new requirements place increased demands on documentation. Manufacturers must be able to provide consistent evidence of risk assessments, supplier controls, CAPA processes and post-market data. This documentation must not only be complete, but also auditable and traceable at all times.
Conclusion: QMSR as an opportunity for more efficient quality processes
The Quality Management System Regulation presents medical device manufacturers with new challenges, but at the same time offers the opportunity to modernize and internationally harmonize quality processes. Those who see the QMSR not as a bureaucratic hurdle but as an opportunity to optimize processes can benefit from it in the long term.
Digital documentation systems such as BAYOOSOFT Themis support you in efficiently implementing the complex requirements. With process-guided document creation, end-to-end traceability and audit-proof versioning, you create the basis for a future-proof QMS that not only meets regulatory requirements, but also makes your daily work easier.
