QSR to QMSR

The FDA regulation 21 CFR 820 is changing from the Quality System Regulation (QSR) to the Quality Management System Regulation (QMSR). The final rule was released on February 2, 2024.

When is it changing?

The industry is currently in a two year transition period. The QMSR will be in effect as of February 2, 2026.

Why is it changing?

It has been nearly 30 years since 21 CFR 820 was issued, and the FDA is making this change to modernize the regulation, harmonize with the internationally recognized standard, and reduce redundancy for manufacturers who already comply with ISO 13485:2016.

What is changing?

There are several significant changes, but the most impactful is the adoption of ISO 13485:2016 “by reference” which represents a more risk-based approach intended to enhance device safety and effectiveness. The updated regulation also adopts certain definitions from ISO 9001. It is important to clarify, the “NOTE” items in ISO 13485:2016 are not set forth statutory or other legal requirements. However, those NOTE explanations can be helpful in understanding the provisions.

The FDA also intends to replace its current Quality System Inspection Technique (QSIT) for medical devices with an inspection approach that will be consistent with the requirements of the QMSR. Details have not yet been announced, but it is clear that FDA inspections will not result in the issuance of a certificate of conformity to ISO 13485. The FDA also does not intend to require medical device manufacturers to obtain ISO 13485 certification. The FDA has also said an ISO 13485 certificate issued by a Notified Body will not be considered or accepted as a substitute for the FDA oversight processes.

There are key differences to note and prepare for in each company’s Quality Management System (QMS), including the following:

Definitions

• Key terms have been removed and replaced, including but not limited to:

Independent Reviewer

• An Independent reviewer is no longer explicitly required at each stage of design in Design Reviews.

Signatures for approval/reapproval of records

• Removed the requirement that the manufacturer obtain the signature for each individual who approved or reapproved a record, and the date of such approval on the record.

Unique Device Identification (UDI)

• FDA does not consider the QMSR to require an organization to assign a UDI to devices under development because the provisions in part 830 apply to a device in commercial distribution.
• Similarly, FDA does not take a position on whether an organization should incorporate UDI as part of its documented process for identification of devices that are not in commercial distribution, so long as the requirements of the QMSR are met.

Elimination of Exception regarding FDA access to specific records

• The QMSR does not include exceptions for management review, quality audits, and supplier audit reports, which formerly existed in the QSR in 820.180(c).

There are also new regulations in the QMSR beyond those included in ISO 13485:2016. This was done to ensure consistency and alignment with other requirements in the FD&C Act and implementing regulations including:

QMSR 820.35 Control of Records

There are specific requirements related to:

• Records of Complaints
• Records of Servicing activities
• Unique Device Identification
• Confidentiality

QMSR 820.46 Device Labeling and Packaging Controls

• ISO 13485:2016 does not specifically address the inspection of labeling by the manufacturer. FDA is retaining requirements from the QS regulation that strengthen controls for labeling and packaging operations.
• Note: The definitions of “Device” and “labeling” in FD&C Act superseded ISO 13485:2016 definitions of “Medical Device” and “labeling.”

Challenge

Manufacturers are always monitoring changes to regulations and must assess the impact to their specific QMS. But this change may not be getting much attention, especially for device manufacturers that already comply with ISO 13485:2016.

There is a risk companies are not as prepared for this change as they think, and time is quickly running out. The transition period is nearly half over, and many companies have not yet assessed or planned for the impact.

The changes to specific definitions and inclusion of the new 820.35 and 820.46 should be carefully reviewed for potential impact. The QSR has been in place for so long, companies may not realize how embedded certain QSR regulations and definitions are in their QMS, software systems and Quality culture. For example, many companies have included the Design History File (DHF) definition in their procedures and built the detailed required content into their software systems. Companies are certainly able to continue using those definitions and structures, but should realize they will no longer have the same basis in regulation. A ”Design and Development” file will be required, but the content requirements for that file are not as detailed.

There are also many small and medium sized companies who only sell their products in the United States, and who may not have ISO 13485:2016 requirements included in their QMS. For those companies, this change is more significant.

Approach

So what should companies be doing to prepare for the QMSR? The following actions should be considered:

• Conduct a QMS gap assessment to the requirements in 820.35 and 820.46.
• Review and update procedures that include QSR detailed requirements and definitions, such as DHF, DMR and DHR.
• Determine and address any needed software system updates, such as those based on previous definitions of DHF, DMR or DHR.
• Confirm records from management review, quality audits, and supplier audit reports are inspection ready.
• For companies with a detailed QMS trace matrix, removing references to QSR sections and add the new QMSR regulations and ISO 13485:2016 clauses.

o?? Note, the following 21 CFR 820 sections will no longer exist as of February 2, 2026:

- 820.5 Quality System

- Subpart B, 820.20, 820.30, and 820.40

- Subparts C through O

Companies not yet compliant to ISO 13485:2016 should also conduct a detailed gap assessment of their QMS to the ISO 13485:2016 requirements.

Conclusion

The remaining time to transition from QSR to QMSR is limited. Companies should establish plans to be ready for the QMSR by February 2, 2026. Medical Engineering Consultants can support these efforts by conducting Gap assessments, recommending practical updates and augmenting company resources to implement needed changes.

By Medical Engineering Consultants - Solution Delivery Director Beth Crandall

Contact Us Now!

Visit our website: www.medicalengineeringconsultants.com