FDA’s QMSR Final Rule Now in Effect

The FDA’s Quality Management System Regulation (QMSR) is effective as of Feb. 2, 2026, two years after publication of the QMSR final rule. This new regulatory framework requires that manufacturers employ risk management practices across the full spectrum of their in-house quality management activities and thus increases the likelihood that a site inspection will lead to an adverse inspectional outcome.

The QMSR provides a limited degree of harmonization between the FDA’s regulatory system and ISO 13845, the quality management framework adopted by numerous regulators worldwide. ISO 13845 is also incorporated into the Medical Device Single Audit Program (MDSAP), although MDSAP audits are typically conducted with some provisions that are specific to the national regulatory system in force for that manufacturing site.

The FDA released the QMSR final rule Feb. 2, 2024, at which point the agency offered little insight as to how inspections would proceed after the effective date. Previously the FDA’s Center for Devices and Radiological Health (CDRH) had used the Quality System Inspection Technique (QSIT) as an inspectional roadmap, but CDRH stated unequivocally that the QSIT approach to inspections will expire the date on which the QMSR becomes effective.

Under the QMSR, future inspections will focus on indicators that the manufacturer’s quality system incorporates risk management throughout the quality system in place at the manufacturing site. The FDA inspection will also focus on whether risk management practices in one area of a quality system are demonstrably tied to risk management practices in other areas. As was the case with the legacy Quality System Regulation (QSR), the QMSR is described in Title 21, Part 820 of the Code of Federal Regulations.

The FDA’s  new approach to inspections also allows the agency’s field investigator to examine internal audit reports pertaining to device malfunctions. Prior to the effective QMSR date, inspections were largely limited to documents related to corrective and preventive actions. Supplier audit reports are also now completely within the scope of an inspection.

Perhaps the most significant addition to the scope of inspections is the FDA’s ability to examine the minutes generated by management meetings, including meetings for the manufacturing site’s quality system. This is already routine practice under ISO 13485 inspections, suggesting that many manufacturers are already prepared for these reviews, although those reviews were conducted by notified bodies rather than by the FDA.

One of the potential pitfalls for the FDA’s use of the ISO standard is that 13485 is subject to review every five years and may undergo a significant revision in the next review. Any substantive changes to the standard could force the FDA to amend the QMSR to maintain alignment through the notice-and-comment process required for FDA rulemaking

The QMSR does not represent a copy-and-paste approach to adoption of the related provisions of ISO 13485. The FDA relied on incorporation by reference to specific provisions in ISO 13485 to achieve some degree of harmonization. The FDA could use this incorporation-by-reference approach to create further alignment with ISO 13485 in future rulemaking, although it is not clear whether  the agency has any specific plans to do so. The agency formally recognizes ISO13485, but inspections conducted by other parties under the ISO standard will not exempt that facility from an FDA inspection.

Manufacturing establishments that have traditionally used ISO 13485 for their quality management practices are less likely to experience significant difficulty in the transition to the QMSR. Staff at these facilities should nonetheless be prepared to rewrite their SOPs to explicitly comply with the QMSR if only to ensure that FDA inspections go as smoothly as possible.