Ä¢¹½tv

ISO 13485 alignment establishes new regulatory expectations for inspection readiness, quality system design, and risk‑based decision‑making 

On Feb. 2, the U.S. Food and Drug Administration's  (QMSR) took effect, updating the current good manufacturing practice (cGMP) requirements for medical devices in 21 CFR Part 820. The QMSR incorporates  by reference, harmonizing FDA regulations with those used by other regulatory authorities around the world.

This regulatory change represents a modernization of U.S. medical device quality system requirements, as the last effort to revise cGMPs went into effect in 1997. For medical device manufacturers, the QMSR promotes consistency across the total product lifecycle with global markets and emphasizes  through a culture of quality. FDA has stated that a culture of quality meets regulatory requirements through a set of behaviors, attitudes, activities, and processes.

The QMSR reshapes how medical device manufacturers' quality systems may be structured, how inspections will be conducted, and how long‑standing practices may need to be reconsidered or defended through documented, risk‑based rationale — particularly in areas such as management oversight, supplier controls, and internal audits.

Updated compliance program manual outlines a new risk-based inspection process

Under the QMSR, medical device manufacturers must establish and maintain a quality management system that conforms to the requirements of ISO 13485:2016, as incorporated by reference into U.S. regulations, as well as other applicable FDA requirements (OAFRs). While manufacturers are not required to obtain ISO 13485 certification for purposes of U.S. regulatory compliance, compliance with the incorporated standard is required under the new FDA regulations. Though other standards referenced in ISO 13485, such as ISO 14971, "Application of risk management to medical devices," are not incorporated by reference, FDA's expectation is that risk management is explicitly integrated throughout the quality management system (QMS).

The revised framework shifts the focus of quality system compliance away from prescriptive subsystem requirements toward management responsibility, documented risk-based decision-making, and system effectiveness. In parallel with the regulatory update, FDA has replaced the Quality System Inspection Technique (QSIT) with a revised inspection process that reflects this risk-based approach and governs how device manufacturers will be inspected going forward. Inspectors can conduct pre-inspection reviews of a firm's inspection and compliance history, which may influence the scope and depth of an inspection before arriving on site.

Highlighted changes under the QMSR and updated inspection process

Some of the most significant changes expected to impact medical device manufacturers include:

• Incorporation by reference of ISO 13485:2016 as the primary quality system framework, aligning U.S. requirements with those used by other major regulatory authorities, without requiring ISO certification.
• A risk‑based FDA inspection strategy, replacing the Quality System Inspection Technique (QSIT) subsystem model with inspection models scaled to a firm's risk profile and inspection history.
• Introduction of OAFRs, ensuring continued enforcement of FDA‑specific obligations such as medical device reporting (MDR) and reports of corrections and removals.
• Use of two inspection models, Model 1 and Model 2:
  • Model 1: At least one element in each QMS area and OAFR must be evaluated, as applicable. This inspection model is to be used for the majority of inspection types.
  • Model 2: A more comprehensive structure requiring multiple elements from each QMS area and OAFR to be inspected. This model is for firms that have not previously been inspected, are not enrolled in the Medical Device Single Audit Program (MDSAP), or are undergoing a PMA pre-approval inspection.
• Expanded inspection scope, with management reviews, internal audits, and supplier audits now explicitly subject to FDA review.
• Removal of defined regulatory terminology for records such as Device Master Records (DMR), Design History Files (DHF), and Device History Records (DHR), allowing flexibility in documentation structure while maintaining functional requirements.
• for applying an ongoing, risk-informed assessment of the ability and performance of the supplier.
• Formalized procedures for remote regulatory assessments (RRAs) in lieu of, or in advance of, an FDA inspection.

Practical considerations for medical device manufacturers

The QMSR provides medical device manufacturers with greater flexibility in how quality systems are structured, but that flexibility comes with increased responsibility to clearly define processes, terminology, and decision‑making rationale. FDA investigators are expected to apply critical thinking to perform risk-based inspections, assessing whether quality management activities are commensurate with the level of risk.

Activities such as management reviews, internal audits, and supplier audits were typically exempt from FDA inspections. With the revised QMSR and inspection program, these documents can now be evaluated to determine whether their frequency and scope are risk-based. For example, FDA may question management reviews conducted yearly without documented, risk‑based justification as to how or why that review schedule demonstrates a cadence commensurate with the level of risk associated with the product or process.

While adverse event reporting requirements under 21 CFR 820.35 are substantively aligned with ISO 13485, FDA has added definitional clarity, reinforcing expectations around record control and traceability.

Although terms such as DMR, DHF, and DHR are no longer defined in the regulations, companies may continue to use them provided they meet the underlying requirements. Clear definitions in SOPs and quality documentation are essential, particularly given the hierarchy of definitions that places statutory and regulatory requirements above ISO standards, with flexibility left to the manufacturer where terms are not explicitly defined.

While the former QSR emphasized quality planning, the QMSR framework emphasizes the development of a formal quality manual, a practical tool for explaining how regulatory requirements are met across the organization and for supporting inspection readiness. Strategies to monitor and measure QMS effectiveness are essential and should be considered as part of the quality manual and its supporting documents.

Looking ahead

As FDA begins conducting inspections under the QMSR framework, FDA will look for a culture of quality that meets regulatory requirements through behaviors, attitudes, activities, and processes. By way of the new compliance program manual for inspection of medical device manufacturers, quality systems will be evaluated holistically, with particular attention to leadership involvement, supplier oversight, and the defensibility of risk‑based decisions. Medical device companies that proactively reassess legacy quality practices, align documentation with ISO 13485 principles, and prepare internal records for inspection will be better positioned to navigate FDA oversight under the updated regulation.