As part of FDA’s Final Rule issued in January 2024, the QMSR would replace the current Good Manufacturing Practice (cGMP) Quality System Regulation under 21 CFR 820. QMSR aligns CFR 820 with International Organization for Standardization (ISO) 13485:2016, which means companies will need to review and document their Quality Management Systems are compliant with additional requirements under ISO 13485.
“[E]ven if the similarity of the requirements really doesn’t seem apparent at first glance, when you do take a deeper dive and you look at the totality of requirements … you will find that the requirements are substantially similar,” Karen Masley-Joseph, Senior Advisor in the Office of Medical Device and Radiological Health Inspectorate (OMDRHI), Medical Products Inspectorate (MPI), Office of Inspections and Investigations (OII) at FDA, told attendees.
For instance, the Device History Record requirements in 820.184 in the QS regulation have “the same intent as the QMSR requirements for medical device or batch records, even though the QMSR requirements may be found in more than one place,” Masley-Joseph said.
The requirements for the QMSR potentially being in different documents is “kind of the result of what harmonization looks like,” Masley-Joseph said, but emphasized that they are “pretty much similar to the requirements that we have today.”
Complying with QMSR
Keisha Thomas, Associate Director for Compliance and Quality in the Office of Product Evaluation and Quality (OPEQ) at the Center for Devices and Radiological Health (CDRH), said companies need to practice risk management to comply with QMSR.
“[Y]our risk management processes need to touch the total product life cycle of the device,” Thomas said. Thomas highlighted three (3) categories of comments based around risk-based decision-making addressed in the QMSR Final Rule: comment 27 focusing on a culture of quality, comment 32 concerning risk definition, and comment 19 on total lifecycle risk.
“It’s important to understand that FDA expects medical device manufacturers, led by individuals with Executive Responsibility or Top Management, to embrace culture and quality as a key component in ensuring safe and effective medical devices,” Thomas said.
A company’s Quality System should also be more than work instructions and standard operating procedures, she added. “It’s the attitude, behaviors, and culture of your Quality Management System,” she said.
Culture of quality is a fundamental part of the QMSR and in the preamble, Thomas said. “We talk about this culture of quality and how it is institutionally connected to how you actually implement your quality system,” she explained. “[T]his one’s here because, as we start to talk through your risk management activities, your risk-based decision making, all of that is directly associated with and aligned to the culture and culture of quality within your organization.”
Thomas said comment 32, which suggested FDA expand the definition of risk for the QMSR, was raised by stakeholders who believed the definition of risk “did not include the understanding that risk covers both regulatory obligations and the consequences of not meeting those regulatory obligations.”
However, there is no need for a definition of risk unique to the QMSR, she explained. “[W]hen the term risk is used, the application of the term within the scope of the standard itself pertains to safety or performance requirements of the device, or the meeting of applicable regulatory requirements,” she said.
Another common concern was raised in comment 19, which proposed that there had been a “shift in philosophy” over integration of risk management principles in ISO 13485. Thomas said that, rather than a shift in philosophy, it is a more explicit definition of FDA’s requirements for risk management. “This isn’t a new paradigm for us,” she said. “[T]here’s always been an expectation that risk management permeate through your Quality Management System. Though it wasn’t a regulatory requirement, it was listed in the preamble and is listed in the preamble of the Quality System regulation as such.”
Don’t wait on QMSR
Some companies may be waiting until the last minute to prepare for the transition to QMSR; however, Thomas encouraged anyone thinking of doing this to reconsider. “Don’t do that,” she said. While the requirements are similar and global companies may be familiar with ISO 13485, the transition itself may or may not be easy, she explained. “We’re (FDA) not going to say that it’s easy for a transition, but we think the requirements are similar enough that industry can do this,” she said.
Thomas encouraged companies with questions about the transition to contact the FDA or the Division of Industry and Consumer Education (DICE) for guidance.
REFERENCE: RAPS Regulatory Focus (News and Peer Reviewed Content); 24 APR 2025; Jeff Craven