For companies, the QMSR conversation has officially moved from planning mode to execution mode.
The grace period is over. The calendar has flipped. The “we’ll circle back to it after Q3” meeting has left the building.
FDA’s Quality Management System Regulation, or QMSR, became effective on February 2, 2026, amending 21 CFR Part 820 and incorporating ISO 13485:2016 as the foundation for medical device quality management system requirements.
That means companies can no longer treat QMSR readiness as a future-state initiative, a side project, or a “quality department problem.”
This is now an executive-level compliance, operational, and inspection-readiness issue.
And for companies that delayed their transition from the old Quality System Regulation framework to the QMSR, the question is no longer:
“Have we updated our procedures?”
The real question is:
“Can our QMS withstand inspection under a globally harmonized, risk-based, lifecycle-focused framework?”
That is a very different question.
One asks whether documents exist.
The other asks whether the system works.
The Problem With Being “ISO 13485-ish”
Many companies have historically described their systems as “aligned with ISO 13485” or “based on ISO 13485.”
That may sound reassuring in a conference room.
It may even look nice in a supplier questionnaire.
But under QMSR, “ISO 13485-ish” is not a compliance strategy.
Why? Because FDA did not simply say, “Do whatever ISO 13485 says and call it a day.”
QMSR incorporates ISO 13485:2016 into Part 820, but FDA-specific requirements still matter. The FD&C Act still matters. FDA expectations still matter. Complaint handling, reporting obligations, labeling, UDI, records, risk management, and inspection authority still matter.
In other words, QMSR harmonizes the framework.
It does not eliminate FDA accountability.
So if your company has procedures that resemble ISO 13485 but do not clearly connect risk management, post-market feedback, supplier controls, CAPA, design controls, production controls, and management oversight, you may have a gap.
Possibly several gaps.
Maybe even a charming little gap family.
QSIT Is Retired. The Inspection Game Has Changed.
Another major shift: FDA has stopped using the Quality System Inspection Technique, better known as QSIT, for device inspections.
For years, many companies prepared for FDA inspections by thinking in familiar QSIT buckets. Design controls. CAPA. Production and process controls. Management controls.
Those areas still matter, but the inspection approach has changed.
FDA is now using the updated Inspection of Medical Device Manufacturers Compliance Program 7382.850, which aligns with QMSR and places greater emphasis on risk-based thinking, total product lifecycle considerations, management oversight, and interconnected quality processes.
Translation?
Inspectors are not just looking for isolated procedures sitting politely in a folder.
They are looking for evidence that your QMS functions as a connected system.
For example:
- Do complaints feed into trend analysis?
- Do risk updates influence CAPA, labeling, supplier controls, production controls, or design changes?
- Does management review include meaningful quality data, risks, resource needs, and decisions?
- Are internal audits actually identifying system weaknesses, or are they just checking boxes with a clipboard and a hopeful smile?
- Can your team explain not only what decision was made, but why?
That “why” matters.
Under QMSR, documentation should not merely prove that a task occurred. It should help demonstrate that the company used appropriate risk-based decision-making.
Internal Audits and Management Reviews Are No Longer Off-Limits
Here is one of the shifts that should get leadership’s attention:
FDA has stated that QMSR gives investigators the authority to inspect management review, quality audit, and supplier audit reports. The prior QS Regulation exception under 21 CFR 820.180(c) is not maintained in QMSR.
That means documents some companies previously treated as protected from routine FDA review may now be requested and reviewed.
This is not a reason to panic.
It is a reason to clean up the system.
Internal audits should be objective, useful, and properly documented. Management reviews should show real leadership engagement, not just a once-a-year slide deck where everyone nods at charts and then returns to the same unresolved CAPA backlog.
Supplier audits should demonstrate that supplier controls are tied to risk, performance, and product impact.
The new expectation is not perfection. The expectation is control, awareness, rationale, action, and follow-through.
In quality language: say what you do, do what you say, prove it, evaluate it, improve it, and please do not make the auditor go on a document scavenger hunt.
Remote and Off-Site Record Reviews Are Part of the New Reality
The updated inspection program also acknowledges FDA’s authority to request records or other information in advance of certain inspections.
That means inspection readiness is no longer limited to what happens when an investigator walks through the front door.
Your records may need to speak for themselves before anyone arrives on-site.
That can be a wonderful thing if your QMS is organized, current, risk-based, and inspection-ready.
It can be less wonderful if your document control system resembles a digital junk drawer named “Final_Final_Approved_USE_THIS_ONE_v7.”
Remote record review increases the importance of:
- Clear document control and complete records
- Traceable decisions
- Risk-based rationale
- Meaningful management review outputs
- Audit findings with documented follow-up
In 2026, inspection readiness is not an event.
It is a state of operational hygiene.
Like brushing your teeth, but with more acronyms.
What Medical Device Quality Teams Need to Fix Now
If your organization has not completed a QMSR readiness review, now is the time to take action.
Start with these practical questions:
1. Have we mapped our current QMS to QMSR and ISO 13485:2016 requirements?
A simple procedure update is not enough. You need to understand where the system aligns, where it partially aligns, and where it does not meet the current expectation.
2. Are our processes connected?
Complaints, CAPA, risk management, design controls, supplier quality, production controls, nonconforming product, and management review should not operate like separate islands.
3. Can we show risk-based decision-making?
Risk-based thinking should be visible in change control, supplier controls, CAPA prioritization, validation, process monitoring, complaint escalation, and management review.
4. Are internal audits meaningful?
Internal audits should identify actual system weaknesses and drive improvement. If every audit says “no findings” while the CAPA log is quietly sobbing in the background, leadership should ask harder questions.
5. Are management reviews inspection-ready?
Management review records should show quality performance, trends, risks, resource needs, decisions, and action items. They should demonstrate leadership involvement, not merely attendance.
If the answer is “yes,” excellent.
If the answer is “mostly,” that is where trouble likes to hide.
The Takeaway
QMSR is not just a regulatory update.
It is a maturity test.
It asks whether your company’s QMS is more than a collection of procedures. It asks whether your quality system is structured, integrated, risk-aware, documented, and capable of supporting safe and effective medical devices throughout the product lifecycle.
If your QMS is “ISO 13485-ish,” now is the time to make it QMSR-ready.
Not someday.
Not after the next audit.
Not once everyone has “more bandwidth,” which we all know is the corporate version of a mythical creature.
Now.
QMSR is here. If your quality system is not ready, this is the time to fix it.
📩 Contact CH House of Quality, and let’s turn “we should probably look at that” into a real action plan.
