With the February 2, 2026 compliance deadline approaching, medical device manufacturers must prepare for FDA’s updated regulations. The new Quality Management System Regulation (QMSR) will replace the existing Quality System Regulation (QSR), aligning with ISO 13485:2016. The transition may bring significant change to manufacturers not already compliant to ISO 13485:2016.
On February 2, 2026, medical device manufacturers must fully comply with FDA’s revamped regulations at 21 C.F.R. Part 820. The final QMSR rule, issued January 31, 2024, replaces nearly all existing QSR requirements with internationally recognized standard ISO 13485:2016 (Medical devices – Quality management systems – Requirements for regulatory purposes), which FDA incorporates by reference in the updated regulation. Both the QSR and new QMSR regulations set forth FDA’s good manufacturing practice (GMP) requirements for device manufacturers.
With less than a year and a half until the effective date, device manufacturers should be gearing up to meet the new QMSR requirements. To support this effort, this LawFlash explores commonly asked questions on QMSR implementation that our firm has received from medical device clients.
ISO 13485:2016 is available for download on the American National Standards Institute (ANSI) Incorporated by Reference (IBR) Portal., but you must first register with ANSI.
Because ISO 13485:2016 applies the terms and definitions of ISO 9000:2015, the FDA also incorporates Clause 3 of ISO 9000:2015, as these terms and definitions are necessary to understand and apply ISO 13485:2016. ISO 9000:2015 can be accessed through the ISO Online Browsing Platform; although, it is not available for download. Moreover, while FDA is not incorporating by reference ISO 14971 (Medical devices — Application of risk management to medical devices) within the QMSR, ISO 13485:2016 does incorporate terms and principles from ISO 14971. Accordingly, manufacturers should assess the extent to which their risk management processes and procedures comply with ISO 14971 in order to demonstrate compliance with ISO 13485:2016.
FDA will have to initiate a new notice-and-comment rulemaking to update the QMSR to incorporate a new version. The agency will be unable to enforce the new version until the new rule becomes effective. For context, the QSR has remained relatively unchanged since the last major revision in 1996. ISO:13485 has undergone two major updates since 1996. ISO standards are routinely reviewed and updated every five years, meaning the industry should not be surprised that a new version of ISO:13485 may become available in the near future.
The QMSR will continue to apply to the same entities currently required to comply with the QSR, including:
Similar to the QSR, the QMSR does not apply to device distributors, manufacturers, and suppliers of components and materials to be used in the manufacture of finished devices, as well as to manufacturers of blood and blood components used for transfusion or further manufacturing, and to device retailers/dispensers.
In addition to changes in terminology (i.e., “Top Management” instead of “Management with Executive Responsibility”), there are substantive differences between the QSR and QMSR that will take time and resources to implement. For example, documented traceability between design inputs, outputs, design verification testing, and design validation is not required under the QSR (currently viewed only as a best practice). ISO 13485:2016 requires, as part of design planning, that traceability be established between design inputs and outputs.
Yes, quality agreements will need to be revised to comply with the QMSR. References to the QSR should be removed and replaced.
Under the existing QSR, the regulation prohibits FDA investigators from inspecting Management Review reports/meeting minutes, internal audit reports, and supplier quality audit reports. FDA explained in response to comments to the QSR that the purpose of exempting such records from FDA inspection is to help ensure open and honest dialogue within the company that would not be stifled from knowing that such records would be subject to government review.
Under the new QMSR, FDA eliminated the protection and notes in commentary that such records will now be subject to FDA inspection. FDA’s rationale for removing the protection is that ISO 13485:2016 does not include such protections, and since governmental authorities, including Notified Bodies and Medical Device Single Audit Program (MDSAP) auditors, are evaluating these records, thus so should FDA.
Device manufacturers should start taking steps now to adjust their culture and practices for documenting Management Review reports/meeting minutes, internal audit reports, and supplier quality audit reports. Reports should be factual and devoid of unnecessary characterizations (e.g., “The company is not compliant”).
Yes, as FDA will not recognize the certification. Only those entities that participate in MDSAP will remain exempt from FDA routine surveillance inspections. FDA plans to continue participating in MDSAP; although, the agency intends to evaluate the MDSAP program and the training needs for third-party auditors, initiating revisions if FDA deems necessary.
FDA has not provided a transition period from compliance with the QSR to the QMSR through its QMSR rulemaking or enforcement discretion. Because all quality systems must comply with the QMSR by February 2, 2026, absent direction from the FDA review team, Humanitarian Device Exemption (HDE) or Premarket Approval (PMA) applications received prior to the compliance deadline will need to demonstrate compliance with the QSR.
Applications received after February 2, 2026 will need to demonstrate compliance with the QMSR. As noted above, switching a quality management system from complying with the QSR to the QMSR will require significant effort. An applicant preparing a PMA or HDE submission for 2025 (especially Q4 2025) should carefully consider the status of its QSR-to-QMSR upgrades (and, if applicable, the status for its contract manufacturers) when determining the specific target date for its submission.
FDA intends to assess its regulations, policies, and guidance documents affected by the QMSR. The agency will also train its personnel responsible for assessing quality management system requirements on the QMSR, as well as replace its Quality System Inspection Technique or “QSIT” (i.e., FDA’s current inspection program for medical devices) with a new inspection program that will align with the QMSR.
No, regulated entities should not expect similar results. FDA investigators will likely approach topics with a different set of experiences, interpretations, and expectations. When compared to FDA inspections, notified body inspections tend to be more relaxed as regulated entities have historical relationships with their notified body auditors. Moving forward, notified bodies may feel obligated to review topics with additional scrutiny, knowing FDA will review the subject matter against the same standard.
To begin preparing for the QMSR now, consider taking the following actions:
Our team stands ready to guide and provide strategic counseling to finished medical device manufacturers and suppliers on QSR/QMSR compliance. This includes support in establishing and updating quality system policies, procedures, and systems to ensure compliance with FDA’s evolving requirements and expectations. Our team is also equipped to assist with drafting and negotiating agreements, including quality agreements, with device suppliers, contractors, and vendors. Certain Morgan Lewis lawyers have been certified and trained on ISO 13485:2016, as well as FDA’s Medical Device Single Audit Program, by international certification organizations.
Our team’s deep familiarity with FDA’s quality system requirements and related regulations stems from defending regulated firms in FDA inspections, developing corrective action plans in response to FDA inspectional observations and enforcement actions, and working cooperatively with device firms to evaluate and address potential issues proactively.
If you have any questions or would like more information on the issues discussed in this LawFlash, please contact any of the following: