The FDA’s long-awaited QMSR will be released in February 2026. The amended 21 CFR 820 will incorporate by reference the Quality Management System (QMS) requirements of the 2016 edition of ISO 13485.

We will explore the key differences between an FDA inspection and a notified body audit as well as the distinctions between ISO 13485 and the QMSR. We will also discuss the perceived regulatory challenges and the new insights that the FDA will gain from these changes.

 

Do medical device manufacturers have anything to worry about if they are certified compliant with ISO 13485 via the notified body?

Medical device manufacturers may have a false sense of security if they have been passing their notified body audits in recent years. FDA inspectors and notified body auditors differ greatly in their approaches to inspections/audits.

  • The U.S. Food and Drug Administration (FDA) is a regulatory agency that does have certain enforcement powers for ensuring compliance with laws related to drugs, medical devices, and other products that it oversees. The Agency will issue citations if companies violate regulatory requirements, such as not complying with the QMSR. The FDA can escalate enforcement actions through Warning Letters, seizures, injunctions, recalls, criminal prosecutions, civil penalties, and import alerts.
  • The notified body provides companies with conformity assessments as well as quality and regulatory services. Some of the notified bodies are very collaborative.

 

ISO 13485, the original QSR 21 CFR 820, and what the new QMSR will bring

This amendment of 21 CFR 820 is referred to as the QMSR and it will incorporate by reference the QMS requirements of the 2016 version of ISO 13485.

Medical device manufacturers that are in the U.S. market or looking to gain access to the U.S. market must comply with the current Quality System Regulation (QSR), 21 CFR 820.

The FDA has communicated that February 2026 will be the implementation date for medical device companies to comply with the QMSR. The QMSR harmonizes with ISO 13485; however, there are some key differences from 21 CFR 820 (this is not an exhaustive list):

  • The FDA will now be able to inspect:
    • Internal audits
    • Supplier audits
    • Management reviews

This is a substantial change as the FDA could not directly review these key records before implementation of the QMSR.

  • Device Master Record (DMR) is replaced with the term “medical device file” (MDF). DMR and Device History Record (DHR) have not gone away; they are now part of MDF.
  • There will be greater focus on risk management in the QMSR as ISO 13485 places a strong emphasis on risk management throughout the product lifecycle. The QMSR will integrate this risk-based approach requiring manufacturers to identify, assess, and control risks associated with medical devices. ISO 13485 references ISO 14971 as this is the international standard that defines how to apply risk management to medical devices and it aims to ensure the safety of patients and products.
  • “Correction” is added to the term “corrective action,” which aligns the QMSR with ISO 13485.
  • Definitions detailed in Clause 3 of ISO 13485 apply now except for terms listed in 21 CFR 820.3. QMSR also includes additional terms not defined in ISO 13485 such as “Component,” “Finished Device,” “Human cell, tissue, or cellular or tissue-based product (HCT/P) regulated as a device,” and “Remanufacturer.”
  • QMSR 21 CFR 820.35, Control of Records, lists requirements in addition to those in ISO 13485 with regard to complaint handling and Unique Device Identification (UDI).
  • QMSR 21 CFR 820.45, Device Labeling and Packaging Control, lists requirements in addition to those in ISO 13485 Clause 7.5.1, Control of Production and Service Provision.

The FDA continues its efforts to align its regulatory framework with those used by other regulatory bodies. This should benefit patients with the introduction of safe, effective, and high-quality devices.

The FDA has made conforming edits to 21 CFR Part 4 to clarify the device QMS requirements for combination products. These edits do not impact the CGMP requirements for combination products.

 

Next steps for medical device and combination product manufacturers

  • Review the QMSR and the preamble
  • Transition project planning
  • Baseline gap assessment
  • Get started ASAP

 

Conclusion

This impending change brings obvious apprehension amongst medical device manufacturers that market or distribute products in the U.S. From a combination product perspective, 21 CFR Part 4 will be updated within this timeframe as well.

Compliance with ISO 13485 per notified body does not mean that you comply with the QMSR. However, the original QSR and ISO 13485 were similar. The QMSR requirements, when taken in totality, are substantially similar to the requirements of ISO 13485. The FDA’s hope is simplification, thus taking a step towards global regulatory harmonization in the medical device industry. The FDA’s belief is that “harmonizing differing regulations removes unnecessary duplicative regulatory requirements and impediments to market access and removed barriers to patient access and lowers costs.”

The FDA believes that the integration of risk management throughout ISO 13485 and incorporation into the QMSR will help medical devices companies best meet the needs of patients and users.

FDA inspections are well recognized as being strenuous and the FDA will perform its own inspections (as opposed to using audits completed by notified bodies). The FDA will not issue QMS certificates of compliance.

While both FDA inspections and notified body audits are crucial for ensuring compliance and quality, the potential risks associated with FDA inspections are notably higher. The FDA’s stringent standards carry the potential for significant penalties. Companies must prioritize their understanding and adherence to FDA requirements to mitigate these risks effectively as the repercussions of non-compliance can be far more severe than those from a notified body audit.

It is recommended that mock Pre-Approval Inspections (PAIs) are completed every eighteen to twenty-four months. Medical device companies should test their QMS frequently, using independent third parties to properly test their QMS.

Lachman Consultants has many seasoned medical device professionals, including former FDA personnel, and provides mock PAI inspection services among other FDA-related support. If you have questions related to the GMSR or any of the above topics, Lachman Consultants can help! Remember, February 2026 is right around the corner. Please contact us at LCS@lachmanconsultants.com.

 

Lachman Consultants Ireland Logo