Complete QMSR Guide

FDA Quality Management System Regulation (QMSR)

On January 31, 2024, the FDA issued a final rule amending the device’s current good manufacturing practice (CGMP) requirements of the Quality System (QS) Regulation under 21 CFR 820 to align more closely with the international consensus standard for Quality Management Systems for medical devices used by many regulatory authorities worldwide – ISO 13485:2016. You can see the final rule here.

FDA Medical Device File – Content 

Medical device manufacturers will now need to contain or reference the procedures and specifications for the entire product life cycle in a document called the Medical Device File (MDF). The final design output from the design phase, which was previously maintained or referenced in the design and development file, will now form the basis of the MDF.

According to ISO 13485 4.2.3, the MDF shall include, but is not limited to:

a) a general description of the medical device, intended use, and labeling, including IFU;
b) product specifications;
c) specifications or procedures for manufacturing, packaging, storage, handling and distribution;
d) procedures for measuring and monitoring;
e) requirements for installation and/or procedures for servicing, if appropriate

The MDF should be generated for each medical device type or family. 

Medical Device Family – Definition

QMSR doesn’t define a medical device family (MD family), so we need to look for other sources. The first and most important place to look for QMSR definitions is ISO 13485:2016. ISO 13485 (3.12) defines an MD Family as a group of medical devices with the same basic design and performance characteristics related to safety, intended use, and function.

We found a useful definition of MD Family in the Guidance for the Interpretation of Sections 28 to 31: License Application Type, issued by Health Canada: An MD Family comprises devices made by the same manufacturer. They differ only in style, color, flavor, and/or size but have the same design, manufacturing process, and intended use.

A good definition for MD Family is found in the FDA guidance on Grouping of Medical Devices for Product Registration – General Grouping Criteria (2015: GN-12-1)

It states that the MD family is a collection of medical devices where each member:

• is from the same product owner;
• is of the same risk classification;
• has a common intended purpose;
• has the same design and manufacturing process; and
• has variations that are within the scope of the permissible variants.

A definition of Basic UDI-DI may also be suitable for the companies in defining MD Family.

Manufacturers that market their products in the EU under Medical Device Regulations (MDR) may consider products that fall under the same Basic UDI-DI as candidates for the single MD Family. Basic UDI-DI is the main key in the database and relevant documentation (e.g., certificates, declaration of conformity, technical documentation, and summary of safety and clinical performance) to connect devices with the same intended purpose, risk class, and essential design and manufacturing characteristics.

Therefore, devices grouped under the same Basic UDI-DI most probably fall under the same Medical Device Family; you should always consult your quality person or consultant to confirm that.

FDA QMSR Design Documentation

During the review stage of the proposed FDA Quality Management System Regulation Rule, some industry members commented that terms such as DMR (Device Master Record), DHF (Design History File), and DHR (Device History Record) do not appear in ISO 13485 and asked FDA to clarify whether those terms are included in the new rulemaking.

FDA agreed that ISO 13485 does not contain requirements for record types specified in the old QS regulation and, therefore, decided not to retain separate requirements for DMR, DHF, and DHR in the new QMSR. However, this doesn’t mean that the content of these records is not required.

Design Documentation 

FDA explained that the elements that comprise DMR, DHF, and DHR are now included in the ISO 13485 under Clause 4.2 – Documentation requirements and in Clause 7 – Product realization. For example, many of the requirements previously in the DHR are largely required to be in the medical device or batch record, as described in Clause 7.5.1 (Control of production and service provision):

a) documentation of procedures and methods for the control of production;

b) qualification of infrastructure;

c) implementation of monitoring and measurement of process parameters and product characteristics;

d) availability and use of monitoring and measuring equipment;

e) implementation of defined operations for labeling and packaging;

f) implementation of product release, delivery, and post-delivery activities.

As for the Medical Device File, the organization shall establish and maintain a record for each medical device or batch of medical devices related to traceability requirements defined in ISO 13485 (7.5.9) and will identify the amount manufactured and approved for distribution. Such records will be verified and approved.

Similarly, consistent with the former DHF, as per clause 7.3.10 (Design and development files), manufacturers should have a Design and Development File for each medical device type or MD Family. Such file shall contain or reference all the records necessary to establish compliance with design and development requirements, including the design and development plan, design and development procedures, and design and development changes. We hope to clarify the requirements for these documents in one of our future articles.

QMSR Design and Development – Devices Types

Several comments were made regarding the proposed Design and Development requirements—820.10(c). FDA explained that the proposed QMSR retains the scope of the previous 820.30(a) of the QS regulation and does not modify which devices are subject to these requirements. The manufacturers of class II and class III devices and certain class I devices must comply with the requirements in clause 7.3 (Design and Development).

The I devices types include:

• Devices automated with computer software;
• Catheter, Tracheobronchial Suction (section 868.6810)
• Glove, Non-powdered Surgeon’s (878.4460)
• Restraint, Protective (880.6760)
• System, Applicator, Radionuclide, Manual (892.5650)
• Source, Radionuclide Teletherapy (892.5740)

In addition, the device manufacturers that support or sustain life must comply with the requirements in Traceability for Implantable Devices, Clause 7.5.9.2, in addition to all other applicable requirements in this part, as appropriate. Devices that support or sustain life include devices whose failure could reasonably expected to result in a significant injury. FDA also clarified that device and development requirements apply to all finished devices.

However, the FDA is consistent with ISO 13485, which recognizes that the regulatory authority may exempt manufacturers from the Design and Development requirement, and manufacturers must document the justification for the exclusion.

Design Records for Early Development Stages 

FDA explained that manufacturers are not expected to maintain records of changes during the very early stages of the design process. The manufacturers are expected to document design changes made after the initial design inputs have been approved, and any changes made to correct design deficiencies once the design has been released to production. Therefore, we advise companies to clearly define the exact point when the design work must be documented in their Design Development procedure. The FDA further clarified that the purpose of design reviews during the design phase is to ensure that the design satisfies the design input requirements for the intended use of the device and the user’s needs.

Design Review 

Design reviews should be conducted at major decision points during the design phase and should include the review of design verification data to assess whether:

• the design outputs meet functional and operational requirements,
• the design is compatible with components and other accessories,
• the safety requirements are achieved,
• the reliability and maintenance requirements are met,
• the labeling and other regulatory requirements are met, and
• the manufacturing, installation, and servicing requirements are compatible with the design specifications.

For a large manufacturer, design review provides an opportunity for all those who may impact the quality of the device to provide input, including manufacturing, quality assurance, purchasing, sales, and servicing divisions. While small manufacturers may not have the broad range of disciplines found in a large company, and the need to coordinate and control technical interfaces may be lessened, the principles of design review still apply. The requirements under 820.30(e) allow small manufacturers to tailor a design review appropriate to their individual needs.

QMSR waives the QS regulation requirement that each stage of design review include an individual(s) who does not have direct responsibility for the design stage being reviewed—the independent reviewer. It is now left to organizations (as per 7.3.5) to select an individual(s) for each stage of the design review.

Design and Development Inputs and Outputs

FDA considers that successful quality management systems under Clauses 7.3.3 (Design and development inputs) and 7.3.4 (Design and development outputs) require a similar approach to design review and validation as those developed under the QS regulation.

Design and development inputs relating to product requirements should include:

• functional, performance, usability and safety requirements, according to intended use;
• applicable regulatory requirements and standards;
• applicable output(s) of risk management;
• as appropriate, information derived from previous similar designs;
• other requirements essential for design and development of the product and processes.

These inputs shall be reviewed for adequacy and approved. Requirements shall be complete, unambiguous, able to be verified or validated, and not in conflict with each other.

Design and development outputs should:

• meet the input requirements for design and development
• provide appropriate information for purchasing, production and service provision;
• contain or reference product acceptance criteria; and
• specify the product’s characteristics that are essential for its safe and proper use.

The design and development outputs shall be in a form suitable for verification against the design and development inputs and shall be approved before the release. Records of the design and development outputs shall be maintained. 

QMSR Suppliers Control

We advise medical device companies to establish a procedure for Supplier Control. To this end, manufacturers should carefully review ISO 13485 Clause 7.4 Purchasing, including 7.4.1 Purchasing process, 7.4.2 Purchasing information, and 7.4.3 Verification of purchased product.

In the Supplier Control SOP, companies should define the nature and extent of control for products and services provided by their suppliers. A finished medical device manufacturer should have sufficient control over suppliers. It is usually good practice to have a Quality Agreement with the major suppliers to define mutual obligations as well as individual and joint responsibilities towards the relevant regulatory authorities. Our team can draft a Quality Agreement for you or just review and improve your version.

Suppliers’ Evaluation 

A manufacturer may audit most important “critical” suppliers although FDA didn’t include “critical supplier” term in the new QMSR.

If audits are impractical, manufacturers should evaluate the supplier’s ability and performance via questionnaires or another type of assessment. All suppliers should be continuously evaluated.

In the past, many manufacturers relied on supplier quality certification (e.g., ISO 9001) as sufficient and often only proof of supplier quality. However, in the new QMSR, FDA clarifies that “certification may not provide adequate assurances of supplier quality without further evaluation”. In any case, manufacturers must control their suppliers to the extent proportionate to the risk associated with them, be it products or services. 

Management Review and Supplier Audit Report 

One of the significant changes in QMSR is the lack of an exception for management reviews and supplier audit reports, which were previously exempted from the FDA review. From the FDA perspective, the primary motive for including these documents under the review was a general intention to align QMSR with other regulatory frameworks where such exceptions are not available to manufacturers when audited or inspected by other entities (e.g., MDSAP; MDR, IVDR—Notified Bodies).

In addition, the FDA considers it would not be a large burden to the manufacturers to make these records available, as such records are maintained in the regular course of business. Also, FDA inspectors have already had access under QS to data such as nonconformances, complaints, and any corrective actions resulting from internal and supplier audits.
FDA stressed the importance of robust management review and internal and supplier audit programs and intends to modify its inspectional processes consistent with these higher expectations. If you need any assistance with management or audit process, don’t hesitate to contact us.

QMSR Complaints and Nonconforming Product

During the QMSR review process, some industry members claimed that 21 CFR 820.100(a)(6) and (7) of the QS regulation, which requires that information related to quality problems or nonconforming products be shared with the responsible quality person, is not explicitly listed in ISO 13485. In addition, relevant information on quality problems and corrective and preventative actions needed for the management review are not mentioned. FDA agreed with these remarks but disagreed that the content of such provisions is not part of ISO 13485 and, thus, it is included in QMSR.
FDA specified that medical device manufacturers or other parties that want to apply QMSR should follow ISO 13485 Clauses 8.2.2, Complaint Handling 8.5.2, Corrective Action and 8.3.1 General requirements of Control of Nonconforming product to meet the following criteria:

• Need for investigations of complaints
  • Sharing relevant information between the organization and any external party involved in the complaints
  • Determining the need to investigate nonconformities and any need to notify an external party responsible for a nonconformity and
  • Evaluating any need for actions to ensure that nonconformities do not recur.

FDA has clarified that use error may be a type of nonconformity and may require investigation, as appropriate.
Complaints are often directly reported to importers or distributors, not manufacturers. Therefore, these operators must clearly understand their duties and responsibilities. Consider consulting EU-MDR Articles 13 and 14 for general obligations of importers and distributors, respectively, especially if you are also marketing your products in the EU region.

A nonconforming medical device is a product that does not conform to product requirements and should be identified and controlled to prevent its unintended use or delivery. It is a rare but unfortunate scenario when a manufacturer doesn’t define product requirements carefully. Accordingly, all their products may fall under the definition of nonconformity.

All nonconforming products discovered before or after distribution should be investigated proportionately to the significance and risk of the identified nonconformity, consistent with Clause 8.3 of ISO 13485, Control of nonconforming product, and its subclauses.

All organizations should have a procedure to define the controls, related responsibilities, and authorities for the identification, documentation, segregation, evaluation, and disposition of nonconforming products. The records of the nature of the nonconformities and any subsequent action taken shall be properly documented and documents maintained.
According to ISO 13485 (8.3.2), if the nonconforming product is identified before delivery, the manufacturer should apply one or more of the following ways:

• act to eliminate the detected nonconformity
  • act to preclude its original intended use or application
  • authorizing its use, release or acceptance under concession

The organization shall ensure that a nonconforming product is accepted by concession only if the justification is provided, approval is obtained, and applicable regulatory requirements are met. FDA clarified that the justification should be based on scientific evidence, which a manufacturer should prepare and be ready to provide upon request. Concessions should be on a case-by-case basis, closely monitored, and not become accepted practice.
If the nonconforming product is detected after delivery, the company shall take action appropriate to the nonconformity’s effects or potential effects.

Consistent with Clauses 8.2.5 Monitoring and measurement of processes and 8.2.6 Monitoring and measurement of the product of ISO 13485, it is mentioned that the requirement for measurement and monitoring applies to process and quality system nonconformities and product nonconformities. Quality system nonconformities is an important concept and manufacturers should find an integrative approach to link detection of quality system nonconformities to Risk Management and Corrective and Preventive activities in the company.

QMSR Applicable Regulatory Requirements

In QMSR section 21 CFR 820.10, Requirements for a Quality Management System, the FDA has incorporated ISO 13485 Quality System requirements while maintaining additional FDA medical device-related regulatory requirements.
In general, the new QMSR requires that manufacturers establish and maintain a quality management system and comply, as appropriate, with all “applicable regulatory requirements,” including, but not limited to, those requirements listed in the proposed QMSR Rule.
Accordingly, manufacturers are responsible for identifying and meeting all applicable requirements, even if such requirements are not specifically mentioned in the 21 CFR 820.10 section.
FDA notes that all sections of ISO 13485 apply to device manufacturers. However, some FDA QS requirements are also required to meet ISO 13485 requirements. For example, compliance with the unique device identification (UDI) provisions (21 CFR 830) is necessary to comply with ISO 13485 Clause 7.5.8  Identification.
Similarly to ISO 13485, QMSR allows for flexibility, and manufacturers can identify and document the requirements that do not apply for them.

Joint ISO 13485 and FDA requirements 

Let’s bring some examples of joint ISO 13485 and FDA requirements.
To comply with ISO 13485 Clause 7.5.9.1 Traceability, a manufacturer must document traceability procedures in accordance with the requirements of 21 CFR Part 821, Medical Device Tracking Requirements. In addition, ISO 13485 Clause 7.5.9.2 provides traceability requirements for implantable devices and devices that support or sustain life.

To comply with Clauses 7.2.3 Communication, 8.2.3 Reporting to regulatory authorities, and 8.3.3 Actions in response to nonconforming products detected after delivery, QMSR requires manufacturers to handle advisory notices in accordance with the requirements of 21 CFR Part 806 Medical Device Correction and Removals.

FDA explained that since Parts 803 (Medical Device Reporting), 806 (Medical Device Correction and Removals), 821 (Medical Device Tracking Requirements), and 830 (Unique Device Identification) are particularly relevant to meeting the requirements outlined in the ISO 13485 Clauses listed in 820.10(b), FDA will not make any changes to the listed requirements in these 21 CFR parts.

Timelines for QMSR Implementation

Medical device manufacturers who already market their products in the U.S. or intend to do so will have two years to upgrade their quality system to include ISO 13485:2016 requirements. FDA will begin to enforce the QMSR requirements at the beginning of February 2026. Failure to comply with the new QMSR requirements in the amended 21 CFR Part 820 (and, by extension, ISO 13485) will render a device adulterated.

Our advice is – start now! One of the first tasks for manufacturers during QSR—QMSR gap analysis is to identify activities that are not relevant to the company and those that have not been addressed in the QS yet.

Frequently Asked Questions

Question: A medical device manufacturer service provider wrote that a US-based customer (medical device manufacturer that markets medical devices in the EU) was audited by a Notified Body (NB). NB told them their ISO 13485:2016 certificate was invalid as it had not been issued by an NB. They explain that non-NB parties are unaware of MDR quality issues and, therefore, they don’t accept such certificates. Is such a Notified Body approach correct?

Answer: No, such NB approach is not correct. We received similar complaints from our clients. NBs could be concerned about everything. However, such concern doesn’t give them the right to “invalidate” the ISO 13485 certificate issued by the non-NB accreditation body. If NB suspects that the non-NB party that issued the ISO 13485 certificate is unaware of MDR-related quality aspects, they should check them during their annual audit. After all, the manufacturer is expected to meet quality MDR expectations, and it can summarize them, e.g., in the Strategy for regulatory compliance procedure, which may include the control of your service providers.

BioReg Services

Don’t hesitate to contact us for assistance with FDA QMSR’s applicable requirements or QS—QMSR Gap Analysis. Our team can provide cost-effective help with all ISO 13485 Transitions or other Quality and regulatory Consulting tasks.

BioRegards,

Daniel