The FDA’s final rule for the Quality Management System Regulation (QMSR) represents a significant rework of the Agency’s medical device regulation, but while it has stated that the existing inspection framework will not carry over, it has not yet communicated how it will handle inspections under the fledgling QMSR.
The preamble for the final rule states that the expected net cost savings will be $532 million for industry and will provide quicker patient access to newly developed medical devices. Despite those claims, the QMSR presents a number of quandaries by virtue of its incorporation of a select group of elements of the international medical device quality system standard, ISO 13485, such as the question of how future changes to the 2016 version of the standard might affect the related portions of the QMSR.
One of the more immediate concerns about the new regulation is that the FDA declared it will phase out the Quality System Inspection Technique (QSIT) once the QMSR is in force as of Feb. 2, 2026. The agency declined to describe the QSIT’s successor in the final rule, which states little more than that the successor will “involve the collection of information to support observations noted during the inspection” in a manner that is similar to the approach described in the QSIT manual. The FDA stated also that it sees the final rule as an inappropriate mechanism for describing any future activities related to inspectional processes. The Q&A document for the QMSR transition offers even less insight, and no additional information has been forthcoming in the meantime.
While the QMSR would seem to constitute an endorsement of ISO 13485, the FDA will give limited credence to the results of inspections based on the ISO standard, including inspections and audits under the Medical Device Single Audit Program (MDSAP). This is an interesting stance for the Agency to adopt, given that it is one of the regulatory authorities that engineered the MDSAP program. While the FDA avoided making an outright declaration that it would never accept a quality management system (QMS) audit based on ISO 13485, the Agency said it is concerned that several requirements of the U.S. regulatory framework would be absent from a 13485-based inspection/audit. Among these are medical device reporting requirements under Part 803, reports of corrections/removals under Part 806, and unique device identifier (UDI) requirements under Part 830.
Management Records Now Fair Game for Inspections
There are several key inspectional changes in the QMSR that may lead to an entirely new set of 483 citations and warning letter findings. Subsection c of Part 820.180 of the QSR exempts management reviews, quality audits and supplier audit reports from the documents that are subject to inspectional review, exceptions that will expire in 2026. The comments for the draft rule included the observation that these exceptions are necessary to ensure that these records will continue to be complete and useful, but the Agency stated that these exceptions are absent from ISO 13485 and the MDSAP inspection framework. The Agency stated also that management reviews are essential to the formation of a culture of quality.
Manufacturers know to pay close attention to the requirements of corrective and preventive action (CAPA) as seen in Part 820.100 of the regulation, which provides general recommendations about when a non-conformity should be elevated to a CAPA. However, the QMSR final rule seems to have endorsed a uniquely specific benchmark regarding this process.
One of the commenters on the draft rule argued that the QMSR should retain Part 820.100’s text regarding notification of quality issues and non-conforming product to both the quality management staff and to those responsible for management review of the quality system. The retention of those features of 820.100 would account for a purported absence of these considerations in ISO 13485, the commenter said. The FDA responded that three clauses in ISO 13485 incorporate such considerations, including clause 8.3, which recommends that an investigation into non-conforming product be proportional to the significance and risk of the non-conformity. Should a process known to normally produce a rejection rate of 5% unexpectedly produce a doubling of that rate to 10%, the manufacturer would be required to investigate the source of the non-conformance, according to the QMSR.
It is not clear whether the Agency intended that a doubling of non-conformance rates be prescriptive regarding a company’s compliance with CAPA requirements, with or without taking the underlying risk of the non-conformance into consideration. Either way, the message may be that the manufacturer should set and document a threshold non-conformity rate when establishing a quality system for a product. The QMSR final rule states also that a concession regarding non-conforming product is permitted only when the manufacturer can justify the concession based on scientific evidence and that this justification should be made available to an FDA investigators during the inspection.
Structural, Definitional Issues Abound in QMSR
Manufacturers may experience implementation problems in shifting from the QSR to the QMSR on several fronts, not solely because of the differences in inspections. The FDA stated that it is unable to provide advice about how a manufacturer should revise specific documents or otherwise update an existing QMS to come into compliance with the new regulation. The process of revising internal standard operating procedures (SOPs) may be more demanding than is readily apparent, particularly given that the Agency declined a request to map the requirements of the QSR onto the QMSR or ISO 13485. There is also the matter of sub-regulatory guidance documents that refer to the QSR, documents the FDA is unlikely to revise to align with the QMSR until a guidance is reissued for substantive rather than editorial reasons.
The Agency acknowledged that the ISO standard and the QMSR present differences in structure relative to the QSR, such as that 13485 treats corrective action and preventive action as separate functions while they are merged into a single function under the QSR. Thus, even a manufacturer that had already incorporated some aspects of 13485 into their QMS will have to engage in a substantial rewrite and cross-referencing of that QMS by February 2026.
The complexity of the shift from the QSR to the QMSR doesn’t end there, however, because the QMSR incorporates terms and their related definitions not just from ISO 13485, but also from ISO 9000. We advise our clients to waste no time in preparing for the advent of the QMSR as the compliance date is a mere 18 months away, and this change in quality management regimes promises to be more complex than might be widely understood.
