By Margaret Koga Ward & Mike Ziemelis
The Food and Drug Administration (FDA) has issued a final rule to amend the requirements of the existing Quality System (QS) Regulation, 21 CFR 820 (Part 820). The amended Part 820 will take effect February 3, 2026, and will be called the Quality Management System Regulation or QMSR.
QMSR incorporates by reference ISO 13485:2016, the well-established, international, quantity management system standard for medical devices. ISO 13485 is used internationally by many regulatory authorities and forms the basis for the Medical Device Single Audit Program (MDSAP). For those unfamiliar with the legal terminology, to “incorporate by reference” means to include a second document within another, in this instance, ISO 13485 will be part of the Part 820 regulation, as if it were fully written out.
FDA will begin to enforce the QMSR requirements upon the effective date, February 2, 2026. Until then, all manufacturers are required to meet the current Part 820 requirements (the QS Reg).
QMSR Supports FDA Goal of Global Harmonization
For many years the FDA has recognized the value of global harmonization and has been an active participant in programs to drive harmonization, such as international standard committees (e.g., ISO), the Global Harmonization Task Force (GHTF), and the International Medical Device Regulatory Forum (IMDRF), a voluntary group of medical device regulators from around the world who work together to harmonize medical device regulations.
QMSR Is More than Just ISO 13485 Standard
When ISO 13485:2016 was released, many medical device professionals were surprised by the similarities with the existing FDA QS Regulation, however, ISO 13485 reflected almost 20 years of progress, and placed additional emphasis on risk management and risk-based decisions throughout a manufacturer’s quality management system (QMS).
In amending the Part 820 regulations, the FDA reviewed ISO 13485 and stated:
“We have determined that the requirements in ISO 13485 are, when taken in totality, substantially similar to the requirements of the QS regulation, providing a similar level of assurance in a firm’s quality management system and ability to consistently manufacture devices that are safe and effective and otherwise in compliance with the Federal Food, Drug, and Cosmetic Act (FD&C Act).”
Industry professionals must not assume that the QMSR is the same as 13485. Although FDA has incorporated 13485 by reference, they have also published additional FDA requirements that organizations must meet. Many of these requirements are listed in QMSR Part 820.10.
Navigating the QMSR Final Rule –and Its Actual Requirements
The QMSR is available on the FDA website. The layout of the QMSR differs from the existing QS Reg:
- The first section, titled “Supplemental Information” contains the majority of the information in the QMSR, but not the actual regulations. Valuable information is contained within this section, notably the following:
- Executive Summary (a summary of the major provisions of the Final Rule).
- Table of Abbreviations and Acronyms.
- Background (why the change).
- Comments on the Proposed Rule and FDA’s Responses (the preamble).
- Effective Date and Implementation Strategy.
What is the Preamble, and Why is it Important?
To gain clarity on the FDA’s thoughts on the 13485 requirements, expectations for your Quality Management System (QMS) including risk management read the preamble (Section V. Comments on the Proposed Rule and FDA’s Responses).
FDA received feedback when the proposed rule was published. The preamble lists the comments, and the FDA response. Although the preamble is not enforceable, it clearly outlines FDA’s expectations. For example:
- What are the FDA’s expectations for a culture of quality within your organization? Refer to comments 27 and 55.
- What are FDA’s expectations for risk management in the QMS? Refer to comment 19 and 32.
- 13485 does not require an independent reviewer in design and development reviews (13485 Clause 7.3.5). FDA discusses their expectations in their response to comment 46.
- 13485 Clause 8.2.2, Complaint handling, does not require a formally designated complaint unit. The FDA discusses their expectations in their response to comment 54.
Risk Management Expectations
The word “risk” appears in the QS Reg once under section 820.30(g) “Design Validation shall include software validation and risk analysis, where appropriate.” Compare this to the work risk(s) appearing in the 2016 version of 13485 over 25 times. FDA’s expectations for risk management are now codified in 13485 and are expected to be integrated throughout the quality system. As an example, Section 4.1.2 states “The organization shall … apply a risk based approach to the control of the appropriate processes needed for the quality management system.”
While the mentioning of risk differs between the QS Reg and the 13485 standard, the FDA’s expectation that risk is applied throughout the quality system was explicitly stated in the preamble to the existing QS Reg, and in FDA guidance documents. Having the QMSR incorporate by reference the 13485 standard now explicitly states the application of risk management throughout an organization’s QMS.
Where are the Actual Regulations?
The actual regulations for combination products and medical devices are located (or referenced) towards the end of the Final Rule.
21 CFR Part 4 – Regulation of Combination Products
21 CFR Part 4 – Regulations of Combination Products: The FDA has made conforming edits to Part 4 to clarify the device QMS requirements for combination products. (For additional information refer to Supplementary Information section III. Background, C. FDA’s Current Regulatory Framework)
Part 820 – Quality Management System Regulation
Here is where you will find the amended Part 820 regulations for medical devices. There are two Subparts: The General Provisions and the Supplemental Provisions.
Subpart A – General Provisions
This section includes:
- The scope of the regulation (essentially unchanged from the QS Reg)
- The definitions – Pay attention to the definitions! The QMSR also incorporates by reference Clause 3 of ISO 9000:2015 as this is a normative reference for definitions used in 13485. However, the QMSR has a definition hierarchy as follows:
- A definition from the FD&C Act always takes precedence (e.g., manufacturer).
-
- A definition from Part 820.3 of the QMSR (these are listed in the Final Rule, for example, the term “Component” is defined in the QMSR).
- A definition from ISO 13485:2016.
- A definition from ISO 9000:2015.
- Incorporation by reference: This section contains the statement that the QMSR is incorporating by reference ISO 13485:2016, and ISO 9000:2015 Clause 3 (definitions). Note that the actual text of these standards is not included, however, this section contains information for accessing the information (although most organizations have purchased these two standards)
- Requirements for a quality management system: This is a very important section as the QMSR includes more than ISO 13485, and an organization must meet additional FDA regulations. This part clarifies some of the additional regulatory requirements! Remember, ISO 13485 is an international standard, and includes many statements such as “in accordance with applicable regulatory requirements,” when you see that term, please refer to Part 820.10 of the QMSR for guidance on the meeting the applicable FDA regulatory requirements.
Subpart B – Supplemental Provisions
FDA determined that some additional regulations are required, these regulations go above and beyond 13485:
- Part 820.35 Control of records: Includes the additional information required for complaint records, service records, unique device identification (UDI), and information for marking documents as confidential.
- Part 820.45 Device labeling and packaging controls. Contains numerous requirements for packaging and labeling, many of which have been carried over from the QS Reg.
Organizational Transition
The transition date is approaching fast, and a gap analysis should be performed to ensure your organization will be compliant!
Inspection Process
FDA will have a new inspection process From FDA’s website: “FDA will develop a new inspection process to align with the requirements of the new QMSR. The process will be developed for implementation when the rule takes effect.” This comes from the Quality Management System Regulation Frequently Asked Questions page that was last updated on August 7, 2024.
FDA will phase out the Quality System Inspection Technique (QSIT) once the QMSR is fully implemented and replace it with a new inspection program. Additionally, the MDSAP Audit model will be updated but is expected to be minimally impacted because the MDSAP program was already aligned with the requirements within 13485.
Contextual Links
AAMI has several training courses that can be taken to keep you up to date on the new requirements:
- AAMI Expert Insights: Transitioning to the FDA Quality Management System Regulation
- AAMI Quality System and Risk Management Courses.
This entry for AAMI’s new Insights into Innovation series is authored by Margaret Koga Ward, the principal engineer and owner of Teragram Consulting, and Mike Ziemelis, the Vice President of R&D for Hologic. Their insights and opinions are their own and do not represent the views of AAMI or AAMI Foundation.
