QMSR is Coming: How to Prepare for FDA’s Alignment with ISO 13485
|
In this blog, we recap our recent blog, “QMSR is Coming: How to Prepare for FDA’s Alignment with ISO 13485”
QMSR is Coming: How to Prepare for FDA’s Alignment with ISO 13485
Prepare for QMSR: Step-by-Step Guidance for FDA’s ISO 13485 Alignment
The FDA’s long-anticipated Quality Management System Regulation (QMSR) goes into effect in February 2026, marking a major shift by aligning FDA requirements with ISO 13485. This update presents both challenges and opportunities to streamline your quality processes while meeting new compliance expectations.
In this webinar, Steve Keverline, Principal Advisor at RQM+, and Tom Rish, Senior Product Marketing Manager at Jama Software, break down key changes, share strategies for companies at all stages of ISO 13485 adoption, and provide actionable tools to help you prepare.
Whether you’re just beginning your QMSR journey or fine-tuning a mature system, this session will equip you with the clarity and direction needed for QMSR success.
Key Takeaways:
- What is QMSR, why is the FDA aligning with ISO 13485, and what does this mean for your business?
- The key elements of ISO 13485 that are critical to QMSR-readiness.
- Strategies for both early adopters and seasoned organizations adjusting to QMSR-specific requirements.
- Best practices to align design control and risk management activities.
- Step-by-step insights, including leveraging integrated software tools to enhance risk management and traceability.
Don’t wait for 2026. Start preparing now to reduce risk, increase efficiency, and confidently lead your team through this regulatory shift.
Steve Keverline: Thanks to everyone in attendance of today’s webinar. My name’s Steve Keverline, I’m a principal advisor at RQM+, and today I’ll be walking through how to prepare for FDA’s alignment with ISO 13485. This is the QMSR initiative with an effective date of February 2026, so roughly six months away, quickly coming upon us and just highlighting that this shift really represents one of the most significant regulatory updates in, I’ll say, decades. So, really, the US medical device manufacturer was updated. Well, in 1996 was the large update. So, today’s goal is really to help understand what’s changing, what to expect, and how to prepare effectively for the transition to QMSR.
And what I have up here on the screen is an outline of what I will be covering today. I’ll be doing a little bit of background on the QMSR, well, more specifically, a little background on the QSR and 13485, just how they came about, and why they’re relevant to what we’ll talk about today. Why is FDA aligning with 13485, key elements to watch or maybe watch out for, and the transition timeline. Next, we’ll talk about the QMSR impact and adoption, so impact of this change will really vary greatly depending on the markets you currently sell into and really the maturity of your quality management system. So, we’ll touch on that. Certainly, if you’re selling into the US and not currently certified as ISO 13485, you have a heavy lift. If you’re already ISO 13485 certified currently selling in the US, then probably a little bit more administrative but we’ll cover those two scenarios.
And then just some implementation guidance, so just some thoughts on implementation best practices. So, one of the key pieces is integration of risk management and design control so we’ll spend some time on that, just really looking at how best to do that. Some common pitfalls, how to avoid them, and, finally, some tips on preparation and planning.
All right, QMS refresher. Yeah, so for those newer to medical devices or not yet familiar with the quality management system regulation, I thought it’d be beneficial just to step back a little bit and start with some background information on the quality system regulation, otherwise known as QSR or FDA 21 CFR Part 820. Compliance for the QSR is mandatory for commercializing a medical device in the US unless your product is identified or referred to as GMP-exempt. GMP-exempt is really applicable, really, only to lower risk, non-sterile medical devices, examples would be a tongue depressor, elastic bandage, manual toothbrush, bedpans, those type of low-risk devices. And even if GMP-exempt, there still are a subset of requirements like record keeping and complaint requirements.
The original, I’ll say original, the initial QSR took effect in 1978 and had significant revisions in 1996. And if you go back to those revisions, they were primarily due to product recalls that occurred in the field since the initial effective date back in … When it was originally released. And those recalls were primarily due to insufficient design controls and supplier controls so it became a big emphasis in 1996 to incorporate those elements within the QSR. Also, at the same time, ISO was starting to form, so the ISO committee had a draft of ISO 13485, and, go figure, the two just missed each other. So, the QSR came out, the ISO 13485 revision was published a little thereafter, so missed there in 1996. But you’ll see, and we’ll get into this a little bit more often as we go through this, but the ISO 13485 has evolved over time since then, there was a major update in 2003 and then a significant update in 2016. So, you can see that, while the QSR was a little stagnant, 13485 has been keeping up and has evolved over the last 30 years.
RELATED: Buyer’s Guide: Selecting a Requirements Management and Traceability Solution for Medical Device & Life Sciences
Keverline: When looking at the key set of requirements, the QSR tends to be a higher level set of requirements and not very prescriptive. When I’m challenged with interpreting the QSR, I have a colleague I work closely with, and she always says, “Well, let’s go to the preamble. Let’s really try to understand what FDA was thinking at the time.” So, not always obvious or intuitive, requires a little bit of what were they thinking, how do I interpret this with the QSR. [inaudible 00:07:19] come back here. And then 13485.
So, I touched on that a little bit in the last slide, 13485 provides a little more context regarding the requirements, is more prescriptive than the QSR. ISO, ISO stands for the International Organization for Standardization, so it’s different, it’s an independent non-governmental international organization. ISO publishes 13485 standards as well as other numerous system process product technical standards. Like I mentioned, the current version is March 2016, was published in March 2016, it’s titled Quality Management System requirements for medical devices intended for regulatory purposes and really covers the full product lifecycle. So, design and development, transfer, production, installation, servicing, really, throughout that full medical device useful life including post-market and decommissioning.
And also, ISO 13485 serves as really the foundation for most QMS frameworks outside the United States and certainly, in the European Union, it’s most recognized in specific to support CE marketing. So, key motivations, really, for FDA aligning with ISO 13485, it is the concept of harmonization. So, it didn’t happen back in 1996, had the best intent but it didn’t come together so here we are today with this initiative to align these two. And again, over the years, they’ve become more and more aligned with 2003 and then 2016 version. So this really means that manufacturers don’t need to maintain two sets of requirements. The regulations I mentioned a little bit earlier, a little outdated. So, QSR largely unchanged since 1996, a little static, 13485, definitely more dynamic and indescriptive, don’t need to go back to the preamble.
And there’s actually a really great … AAMI publishes a really great 13485 practical guide so, those that are new to 13485, really excellent, provides great examples and gives you a little bit more description on what the intent is. Efficiency for industry and FDA, so harmonization streamlines compliance, eliminating redundant efforts, this ultimately enables FDA to focus on risk-based oversight rather than duplicate inspections. Number four, regulatory clarity, so incorporating 13485 by reference provides a clearer, more direct international recognized framework. And it’s also important to note that there are some FDA specific requirements so, in some cases, there’s still FDA will take precedence over some of the 13485 requirements and we’ll get into that in a little bit.
Finally, number five, patient safety remains central. So, the FDA emphasizes the shift is not about relaxing standards, some may have perceptions that ISO 13485 audits are not as rigorous as FDA inspections. Certainly, these are coming together here and you can’t take any audit or inspection lightly. So, still very much about enhancing regulatory effectiveness while maintaining high standards for patient and user safety.
And this is it, tada, this is the QMSR, built that up for this slide. But on the left-hand side, you’ll see the QMSR, I’m sorry, the QS, the quality system regulation, QSR, so this is 820 as we know it and love it today. On the right-hand side, you’ll see a more abbreviated version, not to be perceived as a lighter lift. So, if you really start to dig into the details, the QMSR on the right, well, it’s smaller, it doesn’t look as scary, what you don’t see in any detail is section 820.7 which is incorporation by references so that is basically pointing to 13485 and ISO 9001 which contains terms and definitions but also 820.10 which contains a lot of the details, detailed requirements. So, there it is.
RELATED: Application of Risk Analysis Techniques in Jama Connect® to Satisfy ISO 14971
Keverline: Yeah. Under QMSR 820.10, so briefly mentioned that, it basically, again, points to the applicable requirements of ISO 13485:2016. QMSR 820.10(b) gets into additional requirements beyond ISO 13485; these are defined as unique device identification, which is more explicit than ISO clause 7.5.8. Medical device tracking which is applicable to implantables, so more explicit than ISO clause 7.5.81. Adverse event reporting, more explicit than ISO clause 8.2.3. And corrections removals, which ISO 13485 refers to as advisory notices, more explicit as it relates to clause 8.3.3. These don’t necessarily equate to new US requirements; rather, I’ll say, putting the hooks into ISO 13485 and, overall, the QMSR.
Certain existing QSI provisions will still remain in effect. For example, for lower risk devices, FDA has chosen to exempt some of those devices from design controls. So, that still remains in effect. Complaint and servicing records, device labeling and packaging requirements, these still stay in effect as well, they are really augmenting the 13485 as it relates to specific information that’s required on those records. And as it relates to labeling and packaging, FDA did not believe ISO 13485 covered these requirements fully and a lot of that’s based on labeling which is frequently associated with recalls, mislabeling, mix-ups, that kind of thing. So, they expanded on 13485 requirement here.
And because we like exceptions, so there’s some new definitions to the QMSR, you see that on the left. So, component, Federal Food, Drug and Cosmetic Act, finished device, HCT/Ps, and remanufacture. And on the right, these terms are different in the QMSR than what you’ll find in ISO 13485 or ISO 9001 so, again, this is the case where they would take precedence. Implantable medical device, manufacturer, organization, rework, safety, and performance.
While expectation by FDA is that you’re looking at risks in your processes and prioritizing accordingly, it’s not explicitly stated in the QSR for many processes; this is a big part of 13485. So, 13485 really emphasizes a process-based approach, risk management throughout the product cycle, more prescriptive supplier management, and proactive post-market surveillance. And these are really the key areas to watch if you don’t currently have 13485 in place and are moving forward with the QMSR, just a few areas that could be a heavy alert, for sure.
So, the exhortation for documented procedures, ISO requires more formal documentation and some legacy A20 systems. Risk-based decision making, this really needs to be embedded throughout your quality manual system, not just in product design. Supplier management, ISO requires evaluation, selection, monitoring and re-evaluation of suppliers based on risk. So, that adds a little more level of scrutiny than what’s currently in the QSR. And post-market surveillance, so ISO expects a proactive approach, not just reactive complaint healing. So, these are areas where we’ll be under scrutiny, for sure, as it relates to QMSR.
And here’s the timeline. So, final rule was published January 31st, 2024; there was a comment period prior to that, similar to the preamble. There’s some good stuff in there if you want to read some of the pushback. We’ll get to a couple of those later, but it’s a good read. There was a two-year transitional period; the QMSR becomes effective and enforceable February 2nd, 2025. Here we are, sitting in August 2025, so roughly six months away. If you’ve not started yet, you really need to get going, especially if you do not have ISO 13485 in your QMS today.
To Watch the Entire Webinar, Including An Info-Filled Q&A Session, Visit:
QMSR is Coming: How to Prepare for FDA’s Alignment with ISO 13485
Senior Product Marketing Manager at Jama Software
Tom Rish is a biomedical engineer with over 15 years of experience developing medical devices. His work has spanned the entire MedTech product lifecycle, from initial concept through market launch. He is passionate about helping others navigate the complex journey of bringing a device to market so that patients around the world can benefit from life-changing technologies. Tom is currently a member of the Product Marketing team at Jama Software.
Latest posts by Tom Rish (see all)
- [Webinar Recap] How to Write Unambiguous Design and Development Inputs and Meet ISO 13485 Requirements - November 4, 2025
- Mergers and Acquisitions in MedTech: Positioning Your Company for Success - October 21, 2025
- How to Master Traceability in Medical Device Development - October 7, 2025