The FDA's transition from the long-standing Quality System Regulation (QSR, 21 CFR Part 820) to the new Quality Management System Regulation (QMSR) represents one of the most significant regulatory shifts in decades. By harmonizing with ISO 13485:2016, the FDA aims to align U.S. requirements more closely with global expectations, reduce redundancy, and modernize quality system oversight.
Manufacturers that market medical devices in the United States are subject to FDA's device current good manufacturing practice requirements under 21 CFR Part 820. Effective February 2, 2026, the revised regulation incorporates ISO 13485:2016 by reference. The ISO standard demands a much more risk-based approach to maintaining quality in medical devices, and ProPharma experts can guide manufacturers through the entire process.
Key Changes from QSR to QMSR
The most fundamental change is structural: the FDA has incorporated ISO 13485 by reference into U.S. regulation. Rather than maintaining a separate, prescriptive framework, QMSR embeds ISO's risk-based and lifecycle-oriented approach.
Major changes include
- Incorporation of ISO 13485: The QMSR largely replaces Part 820 requirements with ISO 13485 provisions, supplemented by FDA-specific clauses.
- Reduced duplication: Companies no longer need to maintain parallel systems for FDA and international markets.
- Lifecycle approach: Product realization now explicitly spans design, production, storage, and post-market activities under a unified structure.
- Enhanced traceability expectations: More emphasis is placed on linking risk controls, design inputs, and outputs.
While many QSR concepts remain (CAPA, design controls, complaint handling), they are reframed within a more integrated, risk-focused system.
Corrective Action (CA) vs. Preventive Action (PA)
One of the most notable conceptual shifts is how QMSR treats CAPA. For review:
- Corrective Action: Reactive — addressing existing nonconformities.
- Preventive Action: Proactive — eliminating potential issues.
Under the legacy QSR, Corrective Action (CA) and Preventive Action (PA) were a combined process, with corrective and preventive actions existing as sub steps of an overall CAPA workflow.
Under QMSR / ISO 13485 alignment
- The distinction between CA and PA becomes clearer; each has separate triggers, inputs, and documentation requirements.
- Preventive action is embedded into risk management and quality planning rather than treated as a standalone process.
- CA and PA systems are expected to be data-driven and risk-based, integrating signals from post-market surveillance and test or clinical results (for corrective action); and from data analysis, trend reviews, and risk assessment activities before a potential event occurs (for preventive action).
Key takeaway
Organizations should shift from a checkbox-style preventive program to a continuous process of risk identification and mitigation. Preventive thinking is now part of everyday quality management, not a separate procedural step.
Changes in FDA Inspection Approach
The FDA's inspection methodology is also evolving in response to QMSR.
Under QMSR
- Inspections follow a risk-based approach aligned with the QMSR, focusing on how an organization’s QMS ensures products consistently meet customer and regulatory requirements while managing risks to patients and users.
- Inspectors seek to evaluate the QMS as an integrated system of interconnected processes, recognizing that assessment of one requirement may require review of related processes across multiple areas of the QMS.
- Management responsibility is a key focus, with FDA expecting top management to not only ensure regulatory compliance, but drive QMS process integration, and foster a strong culture of quality throughout the organization.
- Inspections increasingly resemble ISO-style audits.
- There is greater emphasis on process effectiveness and system integration, not just procedural compliance.
- Investigators are expected to evaluate how well quality systems function across the product lifecycle.
What's changing in practice
- More emphasis on outcomes: Are processes effective in controlling risk and ensuring product quality?
- Cross-functional traceability: Inspectors will follow a "thread" (e.g., a complaint) across CAPA, risk management, and design controls.
- Global harmonization: FDA inspections may align more closely with Notified Body audits, reducing conflicting expectations for multinational firms.
Companies should expect fewer siloed questions and more holistic system-level assessments.
Increased Focus on Risk Management
Risk management is no longer a supporting activity—it is the backbone of QMSR.
Under the QSR
- Risk management was primarily emphasized in design controls.
- It was often treated as a discrete exercise (e.g., FMEA during product development).
Under QMSR
- Risk management is fully integrated throughout the QMS.
- It applies to:
- Supplier controls
- Production processes
- CAPA prioritization
- Post-market surveillance
- ISO 14971 principles are implicitly reinforced, even though not directly incorporated.
Practical implications
- Every quality system process must demonstrate risk-based decision-making.
- Documentation should clearly show how risks are identified, controlled, and monitored over time.
- Risk management is dynamic, requiring continuous reassessment based on real-world data.
Organizations that treat risk management as a one-time design activity will struggle under QMSR expectations.
Inspection Readiness vs. SOP-Centric Audits
Perhaps the most operationally impactful change is the shift in the philosophy of regulatory inspection preparation.
Under the old QSR model
- Companies often prepare by ensuring SOPs are complete, compliant, and readily available.
- Audits are frequently centered on document review.
Under QMSR
- The focus shifts to records and evidence of execution, not just written procedures.
- Inspectors are more interested in:
- What happened (records)
- How effectively processes worked to ensure product quality (metrics, outcomes)
- Whether decisions were risk-based and justified
Key expectations
- Companies should always maintain inspection-ready records, not scramble to create documentation just before audits.
- Evidence should demonstrate:
- CA and PA effectiveness
- Risk controls in action
- Real-time data analysis and decision-making
- SOPs still matter—but they are no longer the centerpiece.
Best-practice shift: Move from "Do we have a procedure?" to "Can we prove this process consistently works and mitigates risk?"
What Manufacturers Should Do Now
With QMSR having been in effect since February 2, 2026, manufacturers should now be focused on confirming that implementation is effective—not simply that transition plans were completed.
- Verify that QMSR gap-assessment actions have been completed, implemented, and supported by objective evidence.
- Confirm that procedures, forms, training, and quality records consistently reflect the revised QMSR and ISO 13485 framework.
- Review management review, internal audit, and supplier audit records for inspection readiness, because FDA may now review records that were previously exempt from routine inspection under the former QSR.
- Evaluate whether risk management is meaningfully connected to supplier controls, production, complaints, CAPA, design changes, and post-market information.
- Conduct a focused QMSR mock inspection or readiness assessment that tests process effectiveness, record traceability, and the organization’s ability to explain risk-based decisions.
- Monitor early FDA inspection experience and update inspection-readiness practices as FDA’s application of the new framework continues to mature.
Conclusion
The transition from QSR to QMSR is more than a regulatory update—it's a philosophical shift toward global harmonization, risk-based thinking, and system effectiveness.
Organizations that successfully adapt to the QMSR will:
- Integrate risk management across all processes
- Maintain real-time, audit-ready records
- Focus on outcomes rather than documentation alone
- Align CA and PA with continuous improvement rather than isolated events
For organizations with a mature ISO 13485 quality management system, QMSR may simplify aspects of global quality system alignment. Organizations without that foundation may need more substantial process, documentation, and training changes. In either case, a focused gap assessment and evidence-based inspection-readiness review can help prioritize the transition.
Ultimately, QMSR raises the bar—but it also simplifies global compliance for companies willing to modernize their quality systems accordingly.