The FDA’s Shift from QSR to QMSR: What Manufacturers, Attorneys, and Insurers Need to Know
For nearly three decades, medical device manufacturers built their quality systems around the FDA’s Quality System Regulation (QSR), codified at 21 CFR Part 820. That era ended on February 2, 2026, when the Quality Management System Regulation (QMSR) took effect, amending 21 CFR Part 820 and incorporating ISO 13485:2016, the international standard for medical device quality management systems, by reference.
What Changed: From QSR to QMSR
The QMSR applies to the full range of entities involved in bringing a device to market: manufacturers, specification developers, contract manufacturers, repackagers, relabelers, remanufacturers, sterilizers, installers, servicers, and initial U.S. distributors performing regulated activities. If your organization touches a finished device before it reaches a patient, the QMSR applies to you.
Rather than rewriting Part 820 from scratch, FDA used a legal mechanism called incorporation by reference (IBR), which allows an agency to cite an existing standard rather than reproduce its content in the Code of Federal Regulations. ISO 13485:2016, along with the terms and definitions in Clause 3 of ISO 9000:2015, now forms the backbone of the regulation. Where ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or FDA’s implementing regulations, the Act and FDA’s rules still control. Manufacturers can review FDA’s summary of the QMSR and the final rule as published in the Federal Register for the full regulatory history.
The move to QMSR wasn’t cosmetic. FDA’s stated goals were to harmonize U.S. requirements with ISO 13485:2016, reduce duplicative regulatory systems for manufacturers who already hold ISO 13485 certification, support the Medical Device Single Audit Program (MDSAP), and improve consistency across global regulatory frameworks. For multinational manufacturers already managing ISO 13485 certification, MDSAP audits, and EU MDR obligations, the alignment should reduce, not eliminate, the compliance burden.
Risk-Based Thinking Is Now the Standard
The most consequential shift in the QMSR isn’t a single new requirement. It’s a philosophy. Under ISO 13485, risk management is no longer confined to design controls. It’s woven throughout the quality system: CAPA, internal audits, management review, post-market surveillance, change management, supplier controls, purchasing decisions, process validation, production controls, and complaint investigations all now carry an expectation of proportionate, risk-based decision-making.
Notably, the QMSR does not require compliance with ISO 14971, the medical device risk management standard, since it is not currently incorporated by reference. But as the FDA’s own inspection findings below show, the absence of a mandatory risk management standard hasn’t lowered the bar for documented, risk-based justification. Standards change, and manufacturers should expect FDA to continue tightening this expectation over time.
FDA’s Expanded Access to Quality Records
The QMSR’s supplemental provisions give FDA investigators broader access to certain quality records than they had under the legacy QSR. Under § 820.35, Control of records, complaint files and servicing records, along with unique device identification and confidentiality provisions, are subject to expanded review. Section 820.45 similarly addresses device labeling and packaging controls, including a requirement that manufacturers designate an individual to examine a sample of labels checked by automatic readers.
Practically, this means manufacturers should remove outdated internal practices such as marking documents “Do Not Show to FDA,” document CAPA and complaint findings objectively, and demonstrate follow-up and effectiveness rather than just closure. Confidential or privileged material should be marked and redacted where appropriate, not simply withheld. Assume that quality records may receive regulatory scrutiny, and build documentation practices accordingly.
Inspections Have Changed Also
The FDA has retired the Quality System Inspection Technique (QSIT) that governed device inspections for more than two decades. In its place, investigators now follow Compliance Program 7382.850, a risk-driven, patient-and-user-focused, evidence-based inspection model.
Under this approach, investigators are trained to apply critical thinking, understand a manufacturer’s specific products and processes, identify risks to patients and users, review risk management documentation, and evaluate selected QMS areas against FDA requirements, expanding the inspection’s scope wherever additional risk is identified. As Denise Holliday explained during Capwell Consulting Group’s recent webinar on the transition: “FDA is no longer inspecting whether you have a quality system. They’re inspecting whether your quality system actually manages risk.”
Manufacturers can track ongoing enforcement trends through FDA’s Compliance Dashboard.
What This Means for Manufacturers and Their Legal Exposure
For manufacturers, attorneys, risk managers, and insurance professionals, the QMSR transition is not just a compliance exercise. It’s a shift in how regulatory risk translates into legal and financial exposure. FDA Form 483 observations under the new framework increasingly document gaps in risk-based reasoning rather than simple procedural noncompliance, which changes how those observations may be interpreted in product liability litigation, warning letter responses, and insurance underwriting.
A few practical priorities stand out.
- Replace QSR references with QMSR references and align terminology with ISO 13485 and ISO 9000 throughout internal documentation.
- Review every clause referencing risk to confirm a documented, risk-based approach genuinely supports the process, rather than a checkbox reference to the term.
- Clearly identify top management by name, title, and responsibility within the QMS, since accountability is now more visible to investigators.
- Strengthen, not just approve, oversight of outsourced processes and suppliers because manufacturers remain responsible for ensuring those processes are properly controlled and validated.
Organizations that start with their highest-risk products or processes and work backward to verify that controls, documentation, and objective evidence are actually in place will be better positioned for both FDA inspection and, if it comes to that, litigation defensibility.
A Compliance Question Is Also a Legal One
The QMSR transition illustrates something easy to lose sight of in the day-to-day work of quality management: an effective quality system does more than satisfy FDA. It manages organizational risk, the kind that surfaces in product liability litigation, regulatory enforcement actions, and insurance disputes long after an inspection closes.
When that risk does surface in litigation, having an expert who understands both the regulatory framework and how quality systems function in practice matters. Capwell Consulting Group’s medical device quality expert witness services provide attorneys and organizations with objective, defensible analysis of design controls, manufacturing processes, risk management documentation, and FDA compliance history, grounded in decades of hands-on experience implementing and auditing these very systems. If your case involves a QMSR-era compliance question, connect with Capwell Consulting Group to discuss how our expertise can help.
Watch the full webinar below.
About The Author
Denise Holliday leads the medical device regulatory consulting division at Capwell Consulting Group. She offers strategic support and expert testimony for medical device litigation. Ms. Holliday is widely respected for her deep expertise in quality management systems, international regulatory compliance, and medical device risk management.
About Capwell Consulting Group
Capwell Consulting Group is a nationally recognized litigation support and risk mitigation consulting firm specializing in highly regulated industries. Our firm provides industry-leading guidance, research, reporting, and expert witness testimony for legal proceedings involving employment screening & negligent hiring, FCRA litigation, drug & alcohol testing, and medical device quality and regulatory compliance matters. With over three decades of industry experience, Capwell Consulting Group is a trusted advisor to employers, attorneys, and consumers around the globe.
The information published within is provided for general education purposes only. Its content should not be interpreted as a definitive statement of regulatory policy or as the author’s opinion on any specific factual or legal matter. Opinions expressed are based on the information available at the time of the article and may change as regulations evolve or additional facts become known. Nothing in this article should be construed as creating an expert opinion for purposes of litigation or other legal proceedings. The information is not intended to or constitute legal advice; instead, all information, content, and materials are published for general informational purposes only and not considered the views of a particular expert or consultant of Capwell Consulting Group, LLC. © 2026