On January 31, 2024, the US Food and Drug Administration (FDA) published its long-anticipated final rule to amend its existing medical device good manufacturing practice (CGMP) expectations under the Quality System Regulation (QSR) 21 CFR Part 820 with the internationally recognized standard ISO 13485:2016. ISO 13485:2016 is already being utilized in regulatory harmonization programs such as the Medical Device Single Audit Program (MDSAP).
In this blog post, we will inform you about the newly issued FDA final rule, what it implicates for manufacturers and how QbD can help you to become compliant with the QMSR.
Introducing the QMSR
The upcoming revision of 21 CFR Part 820 is referred to as the Quality Management System Regulation (QMSR) and aims to streamline regulatory expectations for device manufacturers, fostering consistency across diverse regulatory landscapes.
By incorporating ISO 13485:2016 by reference, the FDA modernizes its regulatory framework and addresses the redundancy and inefficiency associated with simultaneous compliance with the QSR and ISO 13485.
Device manufacturers marketing products in the US, face a transition period of 2 years to align with the new rule by the effective date, February 2, 2026. In the meantime, they need to continue complying with the existing QSR.
QSR to QMSR: FDA Aims to Streamline Compliance for Manufacturers
When diving into the final rule, one does not find the complete wording that will be documented in 21 CFR Part 820; rather, the rule only provides an indication of the content that will be included in 21 CFR Part 820. This clearly shows that the existing wording will undergo substantial changes. Upon examining these changes, it becomes apparent that most QSR content will be replaced with references to the ISO 13485:2016 standard, resulting in a leaner structure and a simplified table of contents.
The streamlined structure arises from the high degree of similarity between the QSR requirements and ISO 13485:2016. By incorporating ISO 13485 by reference, the volume of material published in the Code of Federal Regulations (CFR) will be reduced. This reduction is evident when comparing the structures of QSR and QMSR alongside each other, as depicted in the table below.
For readers under the impression that compliance with ISO 13485:2016 will meet all QMSR requirements, it’s important to note a key point of clarification: complying with ISO 13485 does not fully satisfy all the requirements of the QMSR. The FDA has recognized the potential for inconsistencies between reliance on ISO 13485 alone and the FDA’s statutory and regulatory framework. As a result, additional definitions and provisions have been incorporated into the QMSR.
The additional definitions are listed in § 820.3 – Definitions of the QMSR. It contains terms (i.e. component, finished device, remanufacturer), which are either not used or not defined in ISO 13485. The Definitions section also includes clarification of concepts to explain the meaning of certain terms (i.e. manufacturer, safety and performance) used in ISO 13485.
The additional provisions are supplemental requirements on top of ISO 13485:2016. The QMSR describes such supplemental provisions relating to Device labelling and packaging controls (§ 820.45), and relating to Control of Records (§ 820.35) for records of complaints and records of servicing activities. These requirements find their origin in the existing requirements of the QSR.
Impact of FDA’s QMSR on Manufacturers
We want to emphasize that internal audits offer more benefits to your company:
The FDA expects that the administrative load for manufacturers will decrease. Nevertheless, manufacturers only supplying to the US might lack the experience with ISO 13485 resulting in challenges when adapting their processes to align with the QMSR. Manufacturers with an ISO 13485 certification might find it easier to market in the US under the QMSR than the QSR, but the difference is not significant that it needs to drive a delay in your go-to-market strategy.
Note that the ISO 13485 certificate is not a golden ticket. The certificate will not replace an FDA Inspection and neither will an ISO 13485 certificate be granted by the FDA after an inspection. For now, the Medical Device Single Audit Program (MDSAP) voluntary certification program is the only possibility where the FDA may accept an audit report instead of their own routine surveillance inspection.
Key Considerations in Preparation for QMSR
The introduction of QMSR offers opportunities for medical device manufacturers to streamline their operations and compliance. By kickstarting the preparations for achieving QMSR compliance, manufacturers can strengthen their position in the competitive market. Please take the following considerations into account during your QMSR preparation activities:
- Transition period: Align with QMSR by the effective date of February 2, 2026, whilst continuing to comply with QSR.
- Incorporation by reference: The legal effect of an incorporation by reference is that the referenced material is treated as if it were published in the Code of Federal Regulations (CFR).
- ISO 13485 certification: FDA inspections will not result in the issuance of certificates of conformance to ISO 13485:2016; ISO 13485 certification is not required by QMSR and won’t exempt manufacturers from FDA inspections.
- MDSAP: Medical device manufacturers might want to consider voluntary participation in the FDA’s Medical Device Single Audit Program (MDSAP). MDSAP is a certification program that allows for a single QMS audit based on ISO 13485 in addition to other applicable FDA device regulatory requirements, which the FDA may accept instead of routine surveillance inspections conducted by FDA investigators.
- ISO 13485 version: QMSR incorporates the 2016 version of ISO 13485, requiring the FDA to evaluate any future changes to the standard to determine the impact on the QMSR and, if necessary, implement amendments through rulemaking.
How Can QbD Group Assist Medical Device Manufacturers?
Even though February 2, 2026, seems far away, medical device manufacturers with products in the US or with the intention of marketing in the US, should assess their existing quality management system for compliance with the new QMSR. The QbD Group can assist in that exercise and offer support during the remediation of potential gaps.
- QbD Group has a proven track record of implementing Quality Management Systems in compliance with both ISO 13485:2016 and FDA 21 CFR Part 820. We can set you up in time for the effective date of February 2, 2026!
- QbD Group can provide tailored regulatory consultancy & training regarding ISO 13485:2016, current FDA 21 CFR Part 820 QSR and upcoming QMSR.