In its latest global regulatory harmonization effort, on Feb. 2, 2024, the FDA published a final rule amending the cGMP requirements for medical devices contained in the QSR (newly named the “Quality Management System Regulation” (QMSR)) to align the regulation more closely with the ISO standard 13485:2016 (ISO 13485), the primary international consensus standard. This is the first significant revision to the QSR since 1996.

In the final rule, the FDA largely replaces the QSR by incorporating by reference ISO 13485 and Clause 3 of ISO 9000 (Quality Management Systems – Fundamentals and Vocabulary (2015)) and supplementing the changes with definitions and requirements that would maintain consistency across FDA regulations. Note, however, that in the event of conflict between ISO and the Food, Drug, and Cosmetic Act (FD&C Act) or its implementing regulations (e.g., definitions of “medical device” or “labeling”), the FD&C Act and FDA regulations control.

The final rule does not fundamentally alter the requirements for an effective quality system or the FDA’s inspection authority under section 704 of the FD&C Act. However, there are a number of key provisions of which to remain aware:

• Scope and Applicability: The QMSR’s scope and applicability is almost identical to the QSR. The final rule applies to finished medical devices and human cell, tissue, and cellular and tissue-based products (HCT/Ps) regulated as devices and applies the design provisions to Class II, Class III, and Class I devices that are either automated with computer software or are devices falling within specified product categories.¹ However, existing component and raw material exemptions and the design provision exemptions applicable to most Class I devices survive. Moreover, the QMSR, consistent with ISO 13485 and longstanding FDA positions, does not extend to third-party servicers and refurbishers, though it does extend to manufacturers and remanufacturers, contract sterilizers, installers, relabelers, repackers, specification developers, and initial distributors of foreign manufacturers.
   
• Management Reviews and Audit Reports: Unlike the QSR, the QMSR does not have a provision preventing the FDA from inspecting internal or supplier audit reports or management review records during establishment inspections; therefore, these records are now subject to review.
   
• Risk Management: The final rule also requires the establishment and implementation of risk management practices throughout the product life cycle, not only for design controls, as under the QSR. Moreover, independent reviewers in the design process, while no longer expressly required, remain strongly encouraged. Finally, the FDA recognizes ISO 14971 as a consensus standard and ISO 13485 references ISO 14971 when establishing risk management processes; therefore, although not required in the final rule, it is prudent to adopt ISO 14971 to meet the FDA’s risk management requirements.
   
• Signature and Date Requirements: In contrast to the proposed rule, the final rule does not require signatures of each individual who approved or reapproved the record or the accompanying approval date requirements, as the FDA determined the requirements were more burdensome than ISO 13485 and the QSR.
   
• ISO Certification: The FDA does not require manufacturers to become ISO 13485-certified, nor will such certification serve as a proxy for QMSR compliance.
   
• Labeling Controls: The FDA considers ISO inadequate for labeling control purposes. Therefore, the agency is maintaining its current QSR labeling control provisions, which require a designated individual, not simply an automated reader, to inspect and examine a representative sample of their labeling and packaging for accuracy.

Impact

Those firms with operations already conforming with ISO 13485, such as those in the European Union, Australia, Canada, and Japan, likely will experience little disruption as a result of the final rule, as administrative and procedural updates ensuring conformity should suffice. By contrast, however, those firms that have yet to implement ISO 13485 will need to make necessary and potentially robust changes to quality management systems, processes, and recordkeeping to comply with the QMSR.

Next Steps and Remaining Uncertainty

Medical device manufacturers and importers have until the Feb. 2, 2026, effective date to modify their quality systems. Therefore, companies, especially those that have not routinely used the ISO, should conduct reviews of their quality systems and begin the process of bringing systems into conformity with the QMSR.

However, uncertainty remains about how the FDA will approach compliance during the transition period. The FDA notes in the final rule that it expects companies to continue to comply with QSR requirements until the effective date. Therefore, it seems the FDA expects concurrent compliance with both QMS and QMSR, at least for a period.² This may prove challenging for some companies, such as those submitting premarket approval applications.