Preparing For The FDA QMSR: Will You Be Ready?

By Fran DeGrazio, executive editor, Drug Delivery Leader

The future of quality systems and CGMPs for medical devices and combination products in the U.S. is laid out in the FDA’s Quality Management System Regulation (QMSR). Updating the long-standing Quality System Regulation (QSR) in CFR 820, this new regulation was announced by the FDA on February 2, 2024 and becomes effective in February 2026. FDA described the approach to the QMSR as taking CFR 820 and incorporating by reference an existing international standard specific to device quality management systems: ISO 13485:2016, Medical Devices —Quality management systems — Requirements for regulatory purposes. This action reflects global harmonization efforts and supports attempts to save costs across the industry. One of the major ways of improving cost management is by minimizing  resources used in needing to manage multiple processes. This move helps to streamline and impact efficiencies in a positive way.

Since the announcement, there has been much information-sharing across the industry  on the subject to raise awareness about how organizations need to prepare for the February 2026 effective date. In general, organizations will need to update their Quality System documentation to demonstrate closer alignment with ISO 13485.

Know Your Quality System Gaps

For a first stage of attack in working toward compliance, I strongly advise performing a gap analysis between whatever quality management system is currently in place and the new QMSR. The  organization’s QMS must be commensurate with risk of the device or combination product and the complexity of the manufacturing process. One of the most significant aspects of the regulation to be aware of is the requirement to incorporate risk management throughout the quality management system. Additionally, product realization is a critical area for combination product developers and manufacturers because the ISO 13485 document reinforces the planning aspect. The plan should include a description of how the company designs, develops, manufactures, tests, and distributes the product, among other details.

To assist organizations in preparing for the QMSR, we here at Drug Deliver Leader organized and hosted a webinar, “New FDA QMSR: Its Role in Part 4 Compliance for Combination Products.”  I had the pleasure of moderating the panel discussion featuring Edwin Bills, a member of the ISO Technical Committee on medical device risk management, and Laurie Auerbach of Compliance Prodigies, LLC, an expert in quality systems. Results from the initial audience poll during the live event confirmed the usefulness of having a session focused on QMSR  preparation:

Question: Are you actively performing a gap assessment between your historic quality system and the updated QMSR that incorporates ISO 13485 into CFR 820 regulations?

Result: Less than 50 % of the respondents were actively performing a gap analysis.

Know Your Gaps in Controls

To maximize the webinar audience’s learning, the expert panel focused its comments and advice on areas of greatest risk for being out of compliance with the new standards as they relate to 21 CFR Part 4. These high-risk areas include management controls, purchasing controls, risk management, design controls, and corrective actions/preventive actions (CAPA). As that range of compliance areas indicates, a foundational capability is for organizations to demonstrate a true culture of quality throughout the development and commercialization of a combination product. Equally important is demonstrating that risk management consistently drives product safety and effectiveness.

For example, one meaningful change relates to management responsibility. Top-down commitment to quality is an important piece of addressing QMSR and must be shown through evidence, as required by the ISO standard. FDA can now audit records and management records. This was not so in the past. You can hear webinar panelist Laurie Auerbach speak about management responsibility in greater detail here.

When subsequently polled about substantial gaps between their historic quality systems and QMSR compliance, webinar attendees identified the following as the gap most in need of closing:  Understanding how ISO 14971 Risk Management interfaces with QMSR. Because applicable outputs of risk management are inputs into the design development process,  risk management must be done early in the process. Accelerating this activity may be a major change for some in the industry; nevertheless, risk management is a foundational aspect that organizations must incorporate in complying with the new QMSR. You can hear more detail around this critical component from webinar panelist Ed Bills here.

Frankly, to be compliant in the future it is critical that all activities to migrate to the new QMSR be in motion now. Once organizations identify gaps, they will need to develop new processes, write and approve new procedures, and train all personnel. February 2026 will be here before you know it!