QA/RA Consulting, Auditing & Training


Let's get started

FDA QSR vs. QMSR: What Medical Device Manufacturers Need to Know

For years, US FDA has been talking about aligning the existing FDA Quality System Regulation (QSR) with ISO 13485. FDA has finally taken concrete steps to do so by issuing the new Quality Management System Regulation (now called “QMSR”). Here is what you need to know to transition from QSR to QMSR.

Why Is FDA Changing the Quality System Regulation (21 CFR Part 820)?

FDA’s mission is to promote and protect the safety of patients and users, not to make life easier for medical device manufacturers. However, this is a rare case where FDA recognizes the inefficiency of having manufacturers comply with two nearly identical quality system requirements. This was not always the case though. ISO 13485 was introduced in 1996, which happens to be the last time a major update to 21 CFR Part 820 (QSR) occurred. Since that time, ISO 13485 has been modified a few times, and the most recent version – ISO 13485:2016 – is very similar to FDA QSR. FDA says it is now time to harmonize the two by replacing the QSR with the QMSR. The primary change here is that Subpart A of the new proposed QMSR makes reference to ISO 13485:2016 as the basis for compliance with the QMSR but with some minor modifications as discussed below. This means that all companies required to comply with the QMSR will essentially be following ISO 13485:2016 even if not certified by a third-party. Where differences exist between ISO 13485; the Food, Drug, and Cosmetic Act (FD&C Act); and QMSR; the QMSR will prevail.

From FDA QSR to QMSR: The Big Changes

OK, so it is all well and good that the QMSR will essentially be the same as ISO 13485:2016, but what if you do not know the requirements of ISO 13485? What do you need to do? First, it would be a good idea to buy a copy of ISO 13485:2016. The standard is copyrighted, so FDA cannot simply post the standard on its website because all content on US federal websites is in the public domain and not protected by copyright. This is why FDA “incorporate(s) by reference” the standard.
Here are the most significant changes that manufacturers need to be aware of:

1. Terminology - See QMSR 820.3

In most cases, FDA is adopting the terminology used in ISO 13485:2016 as-is where a corresponding definition or requirement exists in the standard. This means that some common terms you have been using for many years are being eliminated and replaced by those used in ISO 13485. Examples include device master record (DMR), device history record (DHR), and design history file (DHF). In the current QSR, these terms are used to define specific documents and records that are required as evidence that a company has designed products in accordance with design control requirements (DHF), documented the way to manufacture a product (DMR), and manufactured the product following the documented methods (DHR). While the specific terms would be eliminated, you will still be required to maintain and retain these types of documentation through the ISO 13485:2016 requirements for the medical device file, design and development files, and product realization records, including those that show the product meets its requirements (ISO 13485:2016 clauses 4.2.3, 7.3.10, 7.5.1, and 8.2.6). The good news is that you do not need to change how you are keeping your DHF, DMR, and DHR documentation – you just will not see those names in the regulation anymore.
Some current Part 820 definitions (like process validation or remanufacturer) will be retained as part of the QMSR because they are not defined in ISO 13485:2016. Others (like manufacturer and product) are being kept because FDA’s definitions supersede the ISO 13485:2016 definition for legal reasons. All these terms are defined today in the Federal FD&C Act – the law that governs FDA regulations. In fact, all the terms and definitions in FD&C Act section 201 will apply to the new QMSR and will supersede any correlating terms and definitions in ISO 13485:2016 (like labeling and device). Plus, if the new QMSR did not include these definitions, the FD&C Act would have to be changed by US Congress to make this all work – and that is not going to happen anytime soon.

You can see which terms are being carried into the QMSR in section 820.3 of the QMSR.

2. Records Control - See QMSR 820.35 - NEW!

After the proposed QMSR is implemented, FDA will adopt the records control requirements found in clause 4.2.5 of ISO 13485 as well as some additional signature and date requirements for regulatory compliance. FDA-proposed QMSR also includes specific content requirements for complaints and service records to ensure these records continue to meet the requirements that are in the current QSR sections 820.198 and 820.200. A particular item still required under QMSR 820.35 for both types of records is the related device’s unique device identifier (UDI), unique product code (UPC), or any other device identification. This section of the QMSR also clarifies that the UDI must be recorded for each device or batch of devices (under the ISO 13485 applicable clauses 7.5.1, 7.5.8, and 7.5.9). One last important thing that the agency includes in this section of the proposed rule is the requirement around the confidentiality of your documents. Since FDA is a US federal agency, it is subject to the Freedom of Information Act (FOIA). The Public Information section in 21 CFR Part 20 is the set of rules that FDA follows in this area, including the protection of trade secrets and proprietary information. So, this last part of the QMSR 820.35 is for manufacturers to mark any of their documents as “confidential” prior to providing them to the agency during an inspection, in a submission, etc.
Records can be retained on paper or electronically as best fits the company requirements. The QMSR is not focusing on the electronic records requirements (21 CFR Part 11). The focus of addressing this in the QSMR is on clarity of the records and to help ensure validity for FDA. Also, physical documents are not required onsite and may be stored online in the cloud. If this is done, the records must be produced within 1 to 2 business days.

3. Labeling and Packaging - See QMSR 820.45

In the eyes of FDA, ISO 13485 does not adequately “address the inspection of labeling by the manufacturer.” As such, FDA will be retaining its provisions from the existing QSR as it believes them to be superior. This means that manufacturers will need to follow ISO 13485 clause 7.5.1 and section 820.45 of the QMSR. As noted earlier, where conflicts exist between the two, the QMSR wins.

4. Risk Management

FDA acknowledges that “ISO 13485 has a greater emphasis on risk management activities and risk-based decision making than the current part 820.” Currently, the QSR only addresses risk management in the risk analysis requirements within design validation in 820.30(g), but it is far more integrated throughout ISO 13485. ISO 13485 simply places more emphasis on risk management throughout the entire life cycle of the device. Risk management compliance can be tricky and is one area of the QMSR where manufacturers may want to seek outside help from a consultant experienced with ISO 14971:2019 risk management requirements and ISO 13485 compliance.

*See Table 1 on this webpage outlining proposed QMSR changes.

Will FDA Inspections Change Under the QMSR?

(21 CFR PART 820)
Subpart A - General Provisions Clause 1 (Scope)
Clause 4 (Quality Management System)
Subpart B - QS Requirements Clause 4 (Quality Management System)
Clause 5 (Management Responsibility)
Clause 6 (Resource Management)
Clause 8 (Measurement, Analysis and Improvement)
Subpart C - Design Controls Clause 7 (Product Realization)
Subpart D - Document Controls Clause 4 (Quality Management System) + QMSR 820.35
Subpart E - Purchasing Controls Clause 7 (Product Realization)
Subpart F - Identification and Traceability Clause 7 (Product Realization)
Subpart G - Production and Process Controls Clause 4 (Quality Management System)
Clause 6 (Resource Management)
Clause 7 (Product Realization)
Subpart H - Acceptance Activities Clause 7 (Product Realization)
Clause 8 (Measurement, Analysis and Improvement)
Subpart I - Nonconforming Product Clause 8 (Measurement, Analysis and Improvement)
Subpart J - Corrective and Preventive Action Clause 8 (Measurement, Analysis and Improvement)
Subpart K - Labeling and Packaging Control Clause 7 (Product Realization) + QMSR 820.45
Subpart L - Handling, Storage, Distribution, and Installation Clause 7 (Product Realization)
Subpart M - Records Clause 4 (Quality Management System) + QMSR 820.35
Subpart N - Servicing Clause 7 (Product Realization) + QMSR 820.35
Subpart O - Statistical Techniques Clause 7 (Product Realization)
Clause 8 (Measurement, Analysis and Improvement)
Maybe. FDA uses an inspection approach called the Quality System Inspection Technique (QSIT). This is being eliminated under the QMSR and will be replaced by a new inspection approach yet to be determined. We do not yet know whether these inspections will be planned and predictable (as with European Notified Bodies for example) or whether they will remain random with little advanced notice. In any case, you should not assume that FDA inspections will be any less strenuous or that companies that have existing ISO 13485 certificates will be exempt from inspections. FDA will not be issuing QMSR compliance certificates.

Do We Need ISO 13485 Certification to Comply with the QMSR?

NO! Even though the FDA is emulating ISO 13485 with the QMSR, you are not required to have ISO 13485 certification to comply with the QMSR. Yes, you will still need to modify your QMS to meet ISO 13485:2016, but you are not required to seek certification if you only sell in the US market. Here’s the thing: if you plan to sell in Canada, Europe or Australia as well, in most cases you will need to seek ISO 13485 certification.

Your Next Step

As of January 2024, the QMSR is nearing publication in the Federal Register. After that occurs, FDA has proposed a 1-year transition but given that the workload (even by FDA estimates) disproportionately falls upon companies that do NOT have ISO 13485 certification, do not be surprised if the implementation period stretches to 2 years.

This does not mean that you should adopt a wait-and-see attitude. Even if you are not interested in getting ISO 13485 certification, you should modify your QMS now to comply with ISO 13485. Conduct a thorough gap analysis (or have us do it for you) to get a much clearer understanding of what needs to happen to get your QMS in conformance with ISO 13485. The new QMSR demands it so resistance is futile.

The good news is that although changes need to be made, US FDA QMSR will eventually be more harmonized with other global QMS requirements, making access to new markets less burdensome for small medical device companies.
Our team is here to help. Contact us online
Get answers right now. Call

US OfficeWashington DC


EU OfficeCork, Ireland

+353 21 212 8530