Quality System Regulation (QSR)

Introduction

For decades, medical device manufacturers selling into the U.S. market have relied on the Quality System Regulation (21 CFR Part 820) as the foundation for their quality management systems (QMS). Introduced in 1996, the QSR established the essential requirements manufacturers must meet to ensure that medical devices are safe, effective, and fit for their intended purpose.

However, as technology, global markets, and regulatory science have evolved, the QSR has remained essentially unchanged. In contrast, many other jurisdictions, most notably the European Union and Canada, have moved towards standards-based quality system frameworks, based on the ISO 13485:2016 standard.

Recognising the benefits of global harmonisation, the U.S. Food and Drug Administration (FDA) have announced a plan to modernise 21 CFR 820. This plan will replace the existing QSR with the Quality Management System Regulation (QMSR), a regulation that aligns closely with ISO 13485:2016, with certain FDA-specific additions.

In this article, we explore the history and content of the QSR, what’s changing under the QMSR, and what manufacturers need to do to prepare for the transition.

The Quality System Regulation (QSR): A legacy framework

The Quality System Regulation (21 CFR Part 820) provides the regulatory requirements for manufacturers of finished medical devices intended for commercial distribution in the United States. The QSR requires that manufacturers establish and maintain a QMS covering design, manufacturing, packaging, labelling, storage, installation, and servicing.

Key components of the QSR include:

• Design controls (820.30): Requirements for planning, input, output, verification, validation, review, and change control during device development.
• Document controls (820.40): Systems for managing QMS documentation.
• Purchasing controls (820.50): Requirements for supplier evaluation and purchasing procedures.
• Production and process controls (820.70): Requirements to ensure that manufacturing processes produce devices meeting specifications.
• Corrective and preventive action (CAPA) (820.100): Requirements for investigating, addressing, and preventing nonconformities.
• Recordkeeping (820.180–820.198): Requirements for device history records, device master records, and complaint files.

The QSR is enforced through FDA inspections, and compliance is mandatory for any manufacturer wishing to legally market a device in the U.S.

Why change now?

Although the Quality System Regulation (21 CFR Part 820) has served as a robust regulatory framework, there are several drivers for its update:

• Global alignment: The current QSR is not formally harmonised with ISO 13485:2016, the internationally recognised standard for medical device quality systems. This lack of alignment means manufacturers with global operations often have to maintain two similar but distinct QMS frameworks. Harmonisation with ISO 13485 allows companies to maintain a more unified QMS, reducing complexity and administrative burden.
• Efficiency for regulators and industry: Aligning the FDA’s QMS requirements with ISO 13485 allows both manufacturers and FDA inspectors to benefit from a unified approach, reducing duplication of effort.
• Modernisation of requirements: The new regulation provides an opportunity to reflect current industry best practices and advances in manufacturing, technology, and risk management. The QMSR reflects current best practices in device design, manufacturing, and post-market monitoring, supporting innovation while ensuring safety. The integrated risk management approach supports improved product safety and performance over the total product life cycle.
• Support for the FDA’s participation in the Medical Device Single Audit Program (MDSAP): The MDSAP is based on ISO 13485:2016, and aligning U.S. regulations will strengthen the FDA’s role in this international audit model. Companies participating in the MDSAP program will benefit from greater alignment between the FDA and other regulatory audits.

The Quality Management System Regulation (QMSR): What’s changing?

The proposed Quality Management System Regulation (QMSR) will incorporate ISO 13485:2016 by reference as the foundation of U.S. device quality requirements. This means compliance with ISO 13485:2016, with certain FDA-specific additions, will be considered compliance with the QMSR.

Key features of the QMSR include:

• ISO 13485 at its core: The FDA will incorporate ISO 13485:2016 into U.S. law, meaning manufacturers must adopt this standard’s risk-based approach to quality management, supplier controls, process validation, and post-market surveillance.
• FDA-specific requirements: The QMSR will include additional requirements or clarifications to ensure alignment with U.S. law. Examples include:
  • Device labelling and packaging requirements specific to FDA expectations.
  • Complaint handling and reporting aligned with U.S. post-market surveillance systems (e.g., Medical Device Reporting, MDR).
  • U.S.-specific records retention periods.
• Terminology adjustments: Some terms and definitions will be clarified to align with ISO 13485 and U.S. law, avoiding conflicts in interpretation.
• Focus on risk management: The QMSR emphasises the integration of risk management throughout the product life cycle, consistent with ISO 13485’s requirements and the FDA’s total product life cycle (TPLC) approach.

FDA inspection and enforcement under the QMSR

The FDA’s inspection program will continue under the authority of 21 CFR Part 820 , but inspections will assess compliance with the QMSR (and therefore ISO 13485:2016). The FDA will provide updated inspection guidance to investigators to ensure consistency in applying the QMSR.

Importantly, the transition to QMSR does not mean an ISO 13485:2016 certificate from a notified body or registrar will automatically satisfy FDA requirements. Manufacturers will still need to demonstrate compliance through FDA inspections, which may examine how ISO 13485 processes are implemented consistent with U.S. legal and regulatory requirements.

Timeline for transition

As of mid-2025, the final QMSR rule is expected soon, with an effective date proposed 1 year after publication. The FDA has indicated that the transition period will provide manufacturers time to:

• Assess gaps between their current QSR-based QMS and ISO 13485:2016.
• Update procedures, records, and training.
• Engage with suppliers to ensure their controls align with the updated expectations.

Manufacturers already certified to ISO 13485:2016 will generally be well-positioned for the change, though they will need to ensure they address the FDA-specific components of the QMSR.

What should manufacturers do to prepare?

While the long-term benefits are clear, the transition will require upfront effort to update systems, documentation, and training. Here are some practical steps medical device manufacturers should consider as the transition approaches:

• Conduct a gap analysis: Evaluate your current QMS against ISO 13485:2016 and the proposed QMSR to identify differences. Pay particular attention to risk management, supplier controls, and post-market processes.
• Update procedures and documentation: Revise your QMS procedures, work instructions, and records to close identified gaps. Ensure that U.S.-specific requirements are clearly integrated.
• Training: Shifting from a QSR-focused system to a risk-based ISO 13485 framework may require significant retraining and mindset adjustments. Provide training on ISO 13485:2016 and the new QMSR requirements to quality, regulatory, manufacturing, and design teams.
• Engage with suppliers: Assess your supplier controls to ensure they meet the risk-based requirements of ISO 13485 and the QMSR. Enhanced supplier controls may require new contracts, audits, and oversight activities.
• Plan for inspection readiness: Update your internal audit program and management review processes to reflect the new requirements, and ensure you are ready for FDA inspections under the QMSR framework.

Conclusion

The FDA’s transition from the QSR to the QMSR represents a major milestone in modernising U.S. medical device regulation. By aligning with ISO 13485:2016, the FDA is helping manufacturers reduce duplication, streamline operations, and focus on what matters most: delivering safe, effective, and high-quality medical devices to patients.

Manufacturers that act early to understand and implement the new requirements will not only ensure compliance but will also position themselves for success in an increasingly globalised and competitive market.

Resources