FDA’s Quality Management System Regulation, or QMSR, took effect on 2 February 2026.
For medical-device organizations, the immediate task is not simply to update terminology. It is to confirm that controlled procedures, training, evidence retrieval, inspection practices, and digital quality workflows reflect the amended 21 CFR Part 820.
QMSR amends FDA’s device current good manufacturing practice requirements and incorporates ISO 13485:2016 by reference. FDA describes the regulation as an effort to harmonize and modernize U.S. medical-device quality-system requirements.
The rule’s effective date also changed FDA’s device-inspection approach. On 2 February 2026, FDA stopped using the Quality System Inspection Technique, or QSIT, and began using the updated Inspection of Medical Device Manufacturers Compliance Program, CP 7382.850.
This does not make the evidence behind design, risk, manufacturing, supplier, and quality decisions less important. It makes it especially important for teams to review whether their records, procedures, and working practices can be explained clearly under the QMSR framework.
What changed under QMSR?
QMSR revises 21 CFR Part 820, now titled the Quality Management System Regulation, and incorporates ISO 13485:2016 by reference. FDA’s final rule also incorporates Clause 3 of ISO 9000:2015 by reference for certain terms and definitions.
For many organizations, the practical change is not that core quality activities disappear. Design and development, risk management, supplier controls, production controls, complaint handling, CAPA, records, and post-market responsibilities remain central to device quality.
The readiness task is to confirm that the organization’s own controlled quality system accurately reflects the current regulatory framework and the way work is actually performed.
Teams should avoid assuming that QMSR implementation is complete because a quality manual has been updated. Procedures, forms, templates, training materials, system configuration labels, internal-audit tools, supplier agreements, and inspection-response materials may still contain legacy terminology or references that require review.
Review terminology carefully
QMSR no longer uses some familiar legacy Quality System Regulation terms in the same way. For example, the former regulation’s references to “design change” and “design history file” do not appear as standalone QMSR requirements. Related design-and-development expectations are addressed through the incorporation by reference of ISO 13485:2016.
That creates a practical review task.
Identify where legacy terms appear across the quality system: the quality manual, standard operating procedures, work instructions, templates, design and change-control forms, training presentations, internal-audit checklists, supplier and quality agreements, inspection-response playbooks, and workflow names in digital systems.
Not every historical mention must be removed immediately. Some may remain appropriate in legacy records, product history, training archives, or established internal terminology. The objective is to ensure that current controlled documents, references, and processes are accurate, internally consistent, and understandable to users and inspectors.
A terminology review should therefore ask more than, “Has this phrase changed?” It should ask, “Does the process described by this document remain clear, controlled, and aligned with the organization’s current quality-system requirements?”
Test one evidence request
A productive QMSR-readiness exercise is to select one representative product change and test whether the organization can retrieve and explain the supporting evidence.
Choose a realistic example, such as a supplier component change, a software update, a manufacturing-process revision, or a design modification. Then ask a qualified reviewer who was not directly responsible for the change to retrieve the evidence behind it.
.png)
The reviewer should be able to locate the approved change request and impact assessment; affected product configuration, bill of materials, or component revision; relevant risk-management evidence; applicable design, verification, or validation records; supplier or manufacturing records; any related nonconformance, CAPA, complaint, or post-market signal; and the final approval and implementation evidence.
The purpose is not to create a new enterprise data model in one exercise. It is to establish whether an authorized person can find and explain the evidence behind a real product decision without relying on informal knowledge or extensive manual reconstruction.
This kind of retrieval test is particularly useful because a technically complete quality record can still be difficult to defend if its relationships are unclear. A change-control record without the associated risk analysis, design evidence, supplier information, or implementation record may not show the full decision story.
Review inspection readiness
QMSR implementation should include more than updates to controlled documents. Device teams should confirm that routine inspection readiness remains intact.
A useful test is to ask someone outside the immediate process team to retrieve a representative evidence set. If the answer depends on a small group of experienced people, a private tracker, email searches, or a lengthy search across systems, that is a readiness gap worth addressing.
FDA’s updated CP 7382.850 describes the QMSR-aligned inspection process and became effective on 2 February 2026.
Review digital workflow assurance
Digital workflows increasingly create, preserve, route, approve, and retrieve quality evidence. For device organizations, this includes eQMS workflows, document control, learning systems, complaint systems, product lifecycle management tools, configuration-management systems, manufacturing systems, supplier portals, and the interfaces that exchange quality-relevant data between them.
FDA’s Computer Software Assurance for Production and Quality Management System Software guidance, issued on 3 February 2026, provides recommendations for establishing and maintaining confidence that software used in production or quality-management systems is fit for its intended use.
For device teams, this is a prompt to revisit the workflows that support controlled product, production, and quality decisions.
Start with capabilities that could materially affect the quality system if they failed, produced incorrect information, or made records unavailable. Examples include change-control workflows, design-review approvals, document control, training assignments and acknowledgements, CAPA and nonconformance processes, complaint handling, configuration and release records, and interfaces that transfer quality-relevant data between systems.
For each capability, define its intended use, assess the consequence of failure or incorrect output, and retain assurance evidence proportionate to the relevant risk. The goal is not to apply identical assurance activities to every dashboard, report, or workspace. It is to focus attention on the functions that influence regulated product, production, or quality decisions.
Start with one gap
QMSR does not require an organization to redesign every digital system or rework every procedure at once.
Start with the evidence request that is currently hardest to answer. It might involve a supplier change, design update, complaint investigation, verification record, CAPA, post-market signal, or production nonconformance.
Then improve the procedure references, ownership, training, retrieval route, record relationships, and digital controls required to make that evidence accessible and intelligible.
The practical test is straightforward: Can the organization show how a representative product decision was assessed, approved, implemented, and monitored under its current quality system?
If the answer is unclear, QMSR has identified a useful starting point for improvement.
QMSR readiness is not only a regulatory mapping exercise. It is the ability to demonstrate that the organization’s quality system works in practice: that users understand the process, records can be retrieved, decisions can be explained, and the evidence remains available when FDA or another stakeholder asks for it.
.png)
.png)
.png)
