Quality Management System Regulation (QMSR)

The Quality Management System Regulation (QMSR) is the updated set of current good manufacturing practice (CGMP) requirements for finished medical devices intended for human use. It was established by the FDA in 2024 to harmonize the former 1996 Quality System (QS) regulation (21 CFR Part 820) by integrating international quality management system requirements, primarily by referencing ISO 13485:2016.

The Quality Management System Regulation (QMSR) mandates requirements for medical device manufacturers, replacing the long-standing Quality System Regulation (QSR) found in 21 CFR Part 820.

The QMSR represents a significant modernization effort by the FDA to align U.S. quality requirements with international standards, particularly ISO 13485, which is the QMS standard specific to medical devices.

Regulatory Basis and Timeline

The QMSR was enacted through a final rule, formally known as the “Medical Devices; Quality System Regulation Amendments,” which was published by the FDA on February 2, 2024, in the Federal Register.

• Effective Date: The QMSR is scheduled to become effective on February 2, 2026, following a two-year transition period.
• Revision of 21 CFR Part 820: The QMSR establishes a new title for the revised 21 CFR Part 820, replacing the former Quality System (QS) regulation.
• Scope: The requirements govern the methods, facilities, and controls used for the design, manufacture, packaging, labeling, storage, installation, and servicing of all finished devices intended for human use.

Harmonization through Incorporation by Reference (IBR)

The most notable feature of the QMSR is its method of harmonization, achieved by incorporating international quality standards directly into the regulation.

The QMSR (21 CFR 820.7) incorporates by reference the following international standards:

• ISO 13485:2016: Medical devices—Quality management systems—Requirements for regulatory purposes. A manufacturer subject to the QMSR must document a quality management system that complies with the applicable requirements of ISO 13485 and other applicable requirements of Part 820.
• ISO 9000:2015, Clause 3: Quality Management systems—Fundamentals and vocabulary, specifically Clause 3 containing terms and definitions necessary for applying ISO 13485.

The QMSR includes provisions and supplemental sections to ensure consistency with other applicable FDA requirements. The incorporated material (ISO 13485 and ISO 9000) is available for inspection at the FDA and NARA, and for read-only viewing in the ANSI Incorporated by Reference (IBR) Portal.

Hierarchy and Specific Definitions

The QMSR defines a specific hierarchy of definitions to resolve potential conflicts between the international standards and U.S. law.

• FD&C Act Control: All definitions in Section 201 of the Federal Food, Drug, and Cosmetic Act (FD&C Act) apply to the regulation of QMS under Part 820 and supersede correlating terms and definitions in ISO 13485 or ISO 9000. For example, the definitions of "device" and "labeling" in the FD&C Act supersede the definitions for correlating terms in ISO 13485.
• Superseding QMSR Terms (21 CFR 820.3(b)): Certain terms defined in the QMSR supersede the correlating terms in ISO 13485 or ISO 9000. These terms include remanufacturer, rework, and organization (which takes the meaning of "manufacturer" as defined in the QMSR).
• "Safety and Performance": The QMSR uses the phrase "Safety and Performance" instead of "safety and effectiveness" in Clause 0.1 of ISO 13485. However, this terminology change does not relieve a manufacturer from any obligation to implement controls providing reasonable assurance of safety and effectiveness.
• Additional Definitions (21 CFR 820.3(a)): The QMSR defines five additional terms that are neither used nor defined in ISO 13485 or ISO 9000, Clause 3. These terms include Component, Finished device, and Remanufacturer.

Structure and Supplemental Provisions

While the QMSR relies on ISO 13485 for most general QMS requirements (such as Management Responsibility, Design Controls, CAPA, etc.), it retains specific sections to cover unique U.S. requirements.

The QMSR includes the following regulation sections:

• § 820.1 Scope: Defines the applicability of the QMSR to finished devices.
• § 820.7 Incorporation by reference: Specifies the required standards (ISO 13485:2016 and ISO 9000:2015, Clause 3).
• § 820.10 Requirements for a quality management system: Mandates that a manufacturer document a compliant QMS and comply with other applicable regulatory requirements in Title 21.
• § 820.35 Control of records: Includes supplemental requirements for specific record information beyond what is stated in ISO 13485, Clause 4.2.5.
• § 820.45 Device labeling and packaging controls: Includes supplemental requirements for device labeling and packaging controls beyond what is stated in ISO 13485.
• Enforcement: Failure to comply with any applicable requirement in the QMSR renders a device adulterated under the FD&C Act.

FDA Oversight and Implementation Activities

Despite the harmonization, the FDA maintains its full authority and inspectional rigor under the QMSR.

Inspection Authority: The FDA retains inspectional authority. The FDA will not issue certificates of conformance to ISO 13485 as a result of an FDA inspection, nor will they require manufacturers to hold ISO 13485 certificates.

FDA Preparations: To implement the QMSR, the FDA is undertaking several activities, including updating technology systems, revising relevant policies, procedures, and inspection processes (such as Compliance Programs and Guidance Documents), training FDA personnel, and conducting external education.

Future Standards Changes: The FDA will evaluate potential future changes to ISO 13485 and ISO 9000 to determine their impact on the QMSR, addressing them through rulemaking if necessary.

Analogy for Understanding QMSR

If the previous Quality System Regulation (QSR) was a detailed, custom-built construction code written only in English for U.S. contractors, the Quality Management System Regulation (QMSR) is like switching to the internationally accepted ISO 13485 standard as the universal building code. This allows architects worldwide (international manufacturers) to use familiar plans. However, the U.S. government (FDA) requires two small, non-negotiable supplements: first, a mandatory conversion chart (the QMSR definitions hierarchy) stipulating that U.S. legal terms always override international terms for safety and device definitions, and second, a short addendum (the supplemental sections 820.35 and 820.45) covering specific U.S. requirements like specialized record keeping or labeling. The FDA inspector still performs the final compliance check to the U.S. law, irrespective of any international certification held.

‍