QSR vs QMSR : The Best Guidance for Medical Device Manufacturers

Introduction to FDA Quality System Regulations 

Why quality systems matter in medical device manufacturing 

In the medical industry, "quality" is the only thing standing between a patient and a preventable tragedy. A robust quality system isn't just about passing an inspection; it's about ensuring that the life-saving device you engineered actually works when it counts. 

The stakes are rising. According to a 2025 report by Sedgwick, medical device recalls hit a four-year high in 2024, with over 1,000 separate events recorded. The financial toll is just as heavy, with non-routine quality events costing the industry an estimated $2.5 billion to $5 billion annually. 

Overview of FDA regulatory expectations 

The FDA’s expectation is simple: control. They don't just want a good final product; they want proof that your system can produce that product safely, every single time. The Quality System Regulation (QSR) used to be the standard for such control for many years. However, the FDA is moving to the Quality Management System Regulation (QMSR) to be in line with international standards. This change is not only about modifying the documents, but it is basically a change in the way that companies must prove their safety to the US ‍ ‌‍government. 

What Is QSR (21 CFR Part 820)? 

Purpose and scope of QSR 

For over 20 years, 21 CFR Part 820 has been the "bible" for US medical device compliance. Its purpose was to establish Current Good Manufacturing Practices (cGMP). It didn't tell you how to design your device, but it strictly governed the framework for designing, producing, and distributing it. The scope is broad, covering everyone from finished device manufacturers to contract packagers. 

Devices and manufacturers covered 

If you commercially distribute a medical device in the US, QSR applies to you. This includes giant multinationals and garage startups alike. Whether you make simple tongue depressors or complex surgical robots, you have to prove you have rigorous controls over management, design, and purchasing. 

Key compliance requirements 

The legacy QSR relied heavily on specific documentation. You lived and died by your Design History File (DHF), Device Master Record (DMR), and Device History Record (DHR). These acronyms were the language of compliance. If an inspector showed up, these were the first binders they asked for. Compliance was often viewed as "having the right documents in the right file." 

What Is QMSR (21 CFR Part 820 – Revised)? 

Why the FDA introduced QMSR 

The medical device market is worldwide, but it was unclear why US manufacturers had to keep two separate quality systems: one for the FDA (Part 820) and one for the rest of the world (ISO 13485). It was a waste of their time, and they were likely to make mistakes. In order to harmonize these requirements, the FDA brought out QMSR so that the safety standards can be still high, but the administrative burden can be‌ lessened. 

Alignment with ISO 13485:2016 

The QMSR incorporates ISO 13485:2016 by reference. Instead of writing unique US rules, the FDA is essentially saying, "Follow the international standard, with a few US-specific additions." If you are already ISO-certified, you are now much closer to FDA compliance than before. 

Key differences from legacy QSR 

The biggest shift is philosophical. The old QSR was prescriptive—it told you exactly what to document. The QMSR is risk-based. While the old QSR limited formal risk analysis mostly to design, the QMSR requires risk management to permeate every process, from supplier audits to employee training. You must now document the risk rationale behind your operational decisions. 

Key Differences Between QSR and QMSR 

Structural and terminology changes 

If you memorize Part 820, you'll need to relearn the map. The QMSR is shorter because it links to ISO text. Terminology shifts, too: "Device Master Record" is out; "Medical Device File" (MDF) is in. While you don't have to rename your files, you must understand how your current documents map to the new ISO definitions. 

Risk-based approach comparison 

This is critical operational change. 

• Legacy QSR: Risk was often treated as a checkbox during the design phase (FMEA). 

• QMSR: Risk is a system-wide requirement. You don't treat all suppliers or complaints equally; you prioritize them based on risk. 

Documentation and record-keeping requirements 

The core requirement to "write it down" remains, but the focus shifts. ISO 13485 is very particular about document control. Also, regarding "Management Responsibility," the strict title of "Management Representative" is flexible under QMSR, but the FDA retains the requirement that executive leadership is personally accountable for quality failures. 

QSR vs. QMSR: Side-by-Side Comparison Table 

The U.S. Food and Drug Administration (FDA) is transitioning the Quality System Regulation (QSR) (21 CFR Part 820) to the Quality Management System Regulation (QMSR), which largely incorporates the international standard ISO 13485:2016 by reference. This table highlights key changes in the specified areas. 

 

Feature	QSR (Quality System Regulation) - 21 CFR Part 820	QMSR (Quality Management System Regulation) - 21 CFR Part 820 (New)
Foundation	US-centric regulation (Subparts A-O)	Primarily ISO 13485:2016 incorporated by reference.
Risk Management	Addressed primarily in Design Validation (Risk Analysis, §820.30(g)) and indirectly in other areas (e.g., CAPA).	Holistically integrated throughout the entire Quality Management System (QMS) and product lifecycle, aligning with ISO 14971 principles.
Design Controls	Detailed, prescriptive requirements in Subpart C (§820.30). Includes explicit terms like Design History File (DHF).	Covered by ISO 13485:2016 Clause 7.3. The spirit of the QSR requirements remains, but the terminology changes.
CAPA (Corrective and Preventive Action)	Explicitly defined section, Subpart J (§820.100), with clear requirements for investigation, root cause, and effectiveness.	Covered by ISO 13485:2016 Clause 8.5. Requirements are substantially similar but use ISO language.
Supplier Management	Purchasing Controls in Subpart E (§820.50). Focus on ensuring purchased material/services meet requirements.	Purchasing in ISO 13485:2016 Clause 7.4. Requires more explicit procedures for supplier evaluation, selection criteria, monitoring performance, and re-evaluation.
Complaint Handling	Detailed requirements in Subpart M (§820.198) for complaint files, investigation, and linkage to Medical Device Reporting (MDR).	Covered by ISO 13485:2016 Clause 8.2.2 (Feedback/Complaint Handling) PLUS QMSR-specific additions (§820.35) for record content to retain the rigor of QSR.
Management Responsibility	Subpart B (§820.20) defines requirements for Quality Policy, Management Review, and organizational structure/resources.	ISO 13485:2016 Clause 5 (Management Responsibility). Explicitly requires a Quality Manual and focuses on management's role in the QMS.
FDA Inspection Records	Management Review, Internal Audit, and Supplier Audit Reports were exempt from routine FDA inspection (§820.180(c)).	The exemption is removed. FDA is authorized to inspect Management Review, Internal Audit, and Supplier Audit Reports.

Impact of QMSR on Medical Device Manufacturers 

Changes to existing quality management systems 

For ISO 13485-certified companies, this is a minor gap analysis exercise. For US-only companies accustomed to the old QSR, this is a massive overhaul. You will need to rewrite your Quality Manual and restructure your SOPs to align with ISO clauses. 

Operational and compliance implications 

Operationally, your teams need to start "thinking at risk." Purchasing isn't just about price; it's about risk exposure. Compliance-wise, inspectors will now speak to ISO. If they ask for your "Medical Device File" and you look confused, you lose credibility instantly. 

Effects on audits and inspections 

The FDA is retiring from the old "QSIT" inspection method. Future inspections will align with ISO 13485. Inspectors will dig deeper into your risk management files, looking for connections between complaints, risks, and supplier audits. The siloed approach of the past won't survive. 

Benefits of QMSR Adoption for Manufacturers 

Global regulatory harmonization 

The primary benefit is efficiency. Aligning with ISO 13485 removes trade barriers, allowing a single QMS to serve the US, Europe, and Canada. This opens doors for expansion without doubling your regulatory workload. 

Reduced compliance complexity 

Running two quality systems creates confusion. By moving to a single standard (QMSR), you simplify the rulebook. Training is easier; internal audits are streamlined, and the risk of employees using the wrong form drops significantly. 

Improved product quality and patient safety 

The QMSR is simply a more modern system. The risk-based approach forces you to be proactive. Scanning risks in every department—not just engineering—you catch issues before they become recalled. A proactive system is safer for patients and cheaper for businesses. 

Challenges in Transitioning from QSR to QMSR 

Common gaps in the current QMS 

The biggest gap is Risk Management. Most companies have risk files for the device but not for processes. You likely haven't assessed the risk of your training program failing. The QMSR demands this broader view. Another gap is Management Reviews, where ISO requires specific inputs/outputs the old QSR didn't explicitly demand. 

Resource and training requirements 

This transition costs time and money. You can't just email a PDF of the new rules to staff. You need to train Engineering, Manufacturing, and Purchasing on how their roles are changing. 

Documentation migration challenges 

The paperwork update is daunting. You must comb through every SOP and form to update references. If your documents cite "21 CFR 820.30," they must be changed to refer to the QMSR or the relevant ISO clause. 

Transition Timeline and FDA Expectations 

Effective date and enforcement timeline 

The FDA published the final rule on February 2, 2024. The effective date is February 2, 2026. On that day, the old Part 820 disappears, and QMSR becomes the law. 

FDA inspection approach during transition 

Until February 2026, the FDA inspects against the old rules. However, inspectors are learning about the new system now. Expect them to ask "educational" questions about your transition plans during 2025 inspections. They want to see you aren't ignoring the deadline. 

What manufacturers should do now 

Don't procrastinate. 

1. Now: Finish your gap analysis. 
2. 2025: Update documentation and train staff. 
3. Early 2026: Run a full internal audit against QMSR standards before the FDA arrives. 

How to Prepare for QMSR Compliance 

Gap analysis against ISO 13485 

Start with a side-by-side comparison of your Quality Manual and ISO 13485. Identify where you miss the mark, paying special attention to the FDA's "Supplemental Information" regarding labeling and records. 

Updating SOPs and quality manuals 

Rewrite your Quality Manual first. Then, tackle the heavy hitters: Management Responsibility, Risk Management, and Internal Audits. Ensure your forms capture the data ISO requires. 

Training teams and internal audits 

Training must explain why changes are happening, not just what. Once trained, run a mock audit. Be tough on yourself—finding a non-conformance internally is infinitely better than an FDA finding. 

QMSR and ISO 13485: What Manufacturers Need to Know 

Key overlaps and differences 

QMSR = ISO 13485 + FDA Requirements. It is not copy-paste. The FDA retained specific mandates for Labeling, Medical Device Reporting (MDR), and Corrections & Removals. You cannot ignore these. 

Can ISO 13485 certification ensure QMSR compliance? 

No. An ISO certificate is great, but the FDA does not accept it as a substitute for their inspection. They will still visit and inspect you. You must be ready to demonstrate compliance with the specific FDA additions in the QMSR, regardless of your certification status. 

Role of Digital QMS Software in QSR to QMSR Transition 

Automating compliance 

Managing this transition on paper is a nightmare. A digital EQMS is essential. Modern platforms come with pre-built workflows aligning with ISO 13485, handling version control automatically, so you never use an outdated form. 

Ensuring audit readiness 

Digital systems create an unbreakable audit trail. Every approval and change is time-stamped. When an auditor asks, "Who approved this design change?", you can show them instantly. This transparency builds trust. 

Real-time documentation and reporting 

The risk-based approach requires data. A digital QMS provides real-time dashboards to monitor complaints or supplier quality, turning compliance from a reactive scramble into a proactive strategy. 

Common Mistakes to Avoid During the QMSR Transition

Assuming ISO 13485 alone is sufficient 

Don't assume your ISO certificate is a "Get Out of Jail Free" card. If you miss the FDA-specific requirements for records or labeling, you will be non-compliant. 

Ignoring FDA-specific requirements 

The QMSR only replaces Part 820. It does not replace Part 803 (Reporting) or Part 806 (Recalls). Your new system must still feed into these existing FDA processes. 

Delaying transition planning 

Fourteen months is nothing in the corporate world. Updating a QMS takes months. If you wait until late 2025, you will be rushing, leading to errors and potential audit findings. 

Frequently Asked Questions (FAQs) on QSR vs. QMSR 

• Do legacy devices need QMSR compliance? 

Yes. There is no grandfather clause. Your device might be 20 years old, but the system manufacturing it today must comply with QMSR by February 2026. 

• How will FDA inspections change? 

Inspections will feel like ISO audits focusing on risk and management. However, the FDA retains full power to issue Warning Letters or seize products if they find violations. 

Conclusion: Choosing the Right Compliance Strategy

Key takeaways for med device manufacturers 

The shift to QMSR is the most significant regulatory change in decades, moving the US toward a global, risk-based standard. 

• Embrace Risk: Make it the heartbeat of your company. 

• Start Early: February 2026 is fast approaching. 

• Harmonize: Use this chance to unify your global strategy. 

Long-term regulatory benefits of QMSR 

This transition is hard work, but the payoff is real. A harmonized quality system lowers costs and speeds up access to global markets. By adopting QMSR, you are building a more resilient, efficient company. In the high-stakes world of medical devices, that is the ultimate competitive advantage.