From QSR and ISO 13485 to QMSR: A Review of the U.S. Medical Device Quality Transition and Its Differential Impact on OEMs, Contract Manufacturers, and Critical Component Suppliers

1. Introduction

Current good manufacturing practice (CGMP) requirements for medical devices in the United States trace back to a final rule published in the Federal Register on July 21, 1978, which took effect that December and was codified as 21 CFR Part 820 [1]. The regulation was substantially revised in 1996 to add design controls following the Safe Medical Devices Act and to draw closer to the emerging ISO 9001 and ISO 13485 quality-system standards, taking effect June 1, 1997 as the Quality System Regulation (QSR) [1]. For nearly three decades, QSR operated as a U.S.-specific regulatory text that ran in parallel to, but was not textually identical to, ISO 13485.

On February 2, 2024, the U.S. Food and Drug Administration (FDA) published a final rule amending Part 820 to incorporate ISO 13485:2016 by reference, retitling the regulation the Quality Management System Regulation (QMSR) [2]. The rule took effect two years later, on February 2, 2026 [2,3]. FDA's stated rationale is harmonization: aligning the U.S. regulatory framework with the quality-system expectations used by most other major device regulators, on the premise that ISO 13485, taken as a whole, provides an assurance of quality comparable to the legacy QSR [3].

This review asks two questions. First, what changed and what stayed the same, structurally, when FDA replaced a self-contained regulation with a framework that points to an outside standard? Second, and this is the main focus of the review, how does that structural change affect three different roles in a device's supply chain? Those three roles are the OEM, which holds the device master record; the contract manufacturer, which performs some or all of the manufacturing; and the critical component supplier, whose part may or may not count as a finished device under FDA's own definition. This distinction matters because QMSR does not treat all three roles the same way. The compliance burden the rule shifted lands unevenly across them.

2. Methodology

This article is structured as a narrative regulatory review rather than a systematic review of empirical literature, reflecting the subject matter: a single regulatory transition rather than an aggregate body of experimental studies. Evaluated sources are categorized into three distinct evidentiary tiers.

The first tier comprises primary statutory and regulatory authorities. These include the Federal Register final rule and its preamble [2], FDA's QMSR overview and guidance documentation [3,4], FDA's October 2025 draft guidance on premarket QMS information [5], FDA Compliance Program 7382.850 [11], and the incorporated consensus standards themselves: ISO 13485:2016 and Clause 3 of ISO 9000:2015 [6,7].

The second tier encompasses technical standards and industry analyses. These include AAMI technical resources, notably the FDA-cited mapping report AAMI TIR102:2019 [8], alongside published regulatory-affairs analyses [9,10,12,14,15,16]. These sources are referenced solely where they provide operational framing or practical implementation details absent from the regulatory text.

One source is treated separately from both tiers above: trade-press reporting of on-the-record remarks delivered by an FDA official at a public conference [13]. This is not FDA's own published text, but it documents a named official's direct public statements rather than a third party's interpretation of agency policy.

Finally, Section 5 draws upon peer-reviewed literature in organizational-behavior and health-services research on psychological safety and safety-relevant reporting [17,18]. These citations are used strictly to construct an analytical hypothesis about internal audit and management-review candor, not to present empirical validation of that hypothesis in a QMSR-specific setting.

Throughout this review, any operational assertion derived exclusively from secondary or trade literature is explicitly identified as industry interpretation rather than binding regulatory mandate.

3. The QSR-to-QMSR Transition: What Changed

3.1. From a Self-Contained Text to an Incorporation-by-Reference Framework

The structural change is the transition's defining feature. Under the legacy QSR, Part 820 contained its own written requirement for each element of a quality system, organized into Subparts A through O. Under QMSR, most of that text has been removed and replaced with a pointer to the corresponding clause of ISO 13485:2016 [9]. FDA incorporated by reference both ISO 13485:2016 in its entirety and Clause 3 (terms and definitions) of ISO 9000:2015, so that U.S. quality-system terminology aligns with the vocabulary used internationally [3]. Where a clause of ISO 13485 conflicts with the Federal Food, Drug, and Cosmetic Act or its implementing regulations, the Act and FDA's regulations control [3]. Incorporation by reference did not create a loophole around U.S. statutory authority.

Only six sections of Part 820 retained independent regulatory text after the rule took effect, because FDA determined that ISO 13485:2016 did not fully address the substance of those sections [9]. Table 1 summarizes them. Other legacy sections of Part 820 are now marked “Reserved”; the requirements they once contained are now satisfied through the incorporated ISO 13485:2016 standard, primarily via § 820.10's general quality-management-system documentation requirement [2,9].

3.2. Applicability: Who Is Directly Regulated

QMSR applies to finished-device manufacturers who intend to commercially distribute medical devices in the United States [4]. A finished device is defined at 21 CFR 820.3(a) as any device or accessory that is suitable for use or capable of functioning, whether or not it is packaged, labeled, or sterilized [4]. FDA has been explicit that certain components (its examples are blood tubing and diagnostic x-ray components) are themselves treated as finished devices because they qualify as accessories, meaning their manufacturers are directly subject to QMSR rather than reached only through a purchaser's supplier controls [4]. This accessory doctrine is central to the differential impact on critical component manufacturers discussed in Section 4.3: whether a given component manufacturer is a QMSR-regulated entity in its own right, or a supplier reached only contractually, turns on this classification.

Devices otherwise exempted from CGMP requirements by FDA's classification regulations (21 CFR Parts 862–892) remain subject to complaint-file and general record-keeping obligations under §820.35 [4]. Devices manufactured under an investigational device exemption are not exempt from the design and development requirements of §820.10(c) and ISO 13485 Clause 7 and its subclauses [4]. A classification exemption should therefore be checked against its specific carve-out rather than treated as blanket relief from recordkeeping.

3.3. Inspections, ISO 13485 Certification, and MDSAP

FDA retired the Quality System Inspection Technique (QSIT) on the QMSR effective date and replaced it with an updated compliance program, Inspection of Medical Device Manufacturers Compliance Program 7382.850, issued January 30, 2026 and effective February 2, 2026, which supersedes both the prior CP 7382.845 and the separate PMA inspection program CP 7383.001 [11]. Two FDA clarifications are easy to conflate and worth stating precisely. First, FDA inspections under QMSR do not track the Medical Device Single Audit Program (MDSAP) audit plan, and FDA will neither require nor issue ISO 13485 certificates of conformance as part of an inspection [4]. Second, holding an ISO 13485 certificate does not exempt a manufacturer from FDA inspection, and an FDA inspection does not confer one [10]. MDSAP participation continues to exempt a manufacturer from routine FDA inspections only; premarket and for-cause inspections still apply regardless of MDSAP status [10]. Manufacturers relying on MDSAP status as inspection insurance should confirm which inspection category applies before assuming coverage. The same certification gap applies to unique device identification (UDI): FDA has indicated that compliance with the UDI provisions of the Federal Food, Drug, and Cosmetic Act, administered under 21 CFR Part 830, is necessary to satisfy ISO 13485 Clause 7.5.8, and an ISO 13485 certificate does not by itself demonstrate that compliance [15].

Early post-implementation data corroborates CP 7382.850's design intent and gives the applicability discussion in Section 3.2 a concrete enforcement anchor. Speaking at the Food and Drug Law Institute's Annual Conference on May 6, 2026, Keisha Thomas, associate director of CDRH's Office of Product Evaluation and Quality, reported that FDA had completed just over 100 inspections under QMSR to date, and that Form 483 observations issued between February and mid-April 2026 clustered around five areas, in descending order: risk management, outsourcing and purchasing, complaint handling and feedback, unique device identification, and corrective action [13]. Thomas described risk as the regulation's organizing principle: “Risk, risk, risk, risk. That is the fundamental change to QMSR” [13]. Industry commentary characterizes the investigative approach itself as tracing risk threads across functional boundaries: a single complaint, supplier nonconformance, or design change can pull an investigator through the risk management file, purchasing records, and design documentation in one continuous inspection thread, rather than the QSIT-era practice of examining each subsystem largely in isolation [14]. That UDI already ranks among the top five observation categories in the earliest wave of QMSR inspections is a direct, current illustration of the certification gap described above.

3.4. The End of the §820.180(c) Exemption

In this review's assessment, the most consequential change for supply-chain participants is not a new requirement but the removal of an old shield. Under the legacy QSR, §820.180(c) exempted internal quality audit reports, supplier audit reports, and management-review records from FDA review during a routine inspection [3,10]. That exemption language does not appear in QMSR. FDA's FAQ confirms directly that it now has authority to inspect management review, quality audit, and supplier audit reports, and states that because manufacturers already routinely produce these documents for other regulators, making them available to FDA does not impose an additional burden [3]. Whatever the merits of that framing, the practical effect is that records many organizations treated as protected internal deliberation, including candid discussion of supplier nonconformances during management review, are now within the scope of a QMSR inspection [10].

4. Differential Impact by Supply-Chain Role

The changes described in Section 3 do not fall evenly on every organization that touches a finished device. Table 2 summarizes the differential exposure across the three roles addressed in this review; the subsections that follow discuss each in turn.

4.1. Original Equipment Manufacturers

OEMs that hold the device master record carry the fullest and most direct QMSR exposure: the complete scope of ISO 13485:2016 plus all six retained Part 820 sections. Two practical points follow, beyond the general exposure already discussed in Section 3. First, the former §820.30(e) requirement for an independent design reviewer (someone without direct responsibility for the design stage under review) does not appear in QMSR text, and ISO 13485:2016 does not use that specific term [9]. However, in the preamble to the final rule, FDA responded to public comment on this point by stating that it “considers that a successful quality management system under Clause 7.3.3 and 7.3.4 will require a similar approach to design review and validation as those developed under the QS regulation” [2] (as summarized in [9]). The explicit rule is gone; the practical expectation, on FDA's own account, is not. OEMs that quietly dropped independent design review because it is no longer named in the regulation are relying on a reading FDA has already pushed back on in the rulemaking record.

Second, FDA's October 2025 draft guidance on quality management system information for certain premarket submissions instructs manufacturers of high-risk devices to address §820.10 and §820.35 specifically when preparing PMA and Humanitarian Device Exemption submissions under QMSR [5,9]. OEMs with PMA-class products should treat this guidance as a checklist item for their next submission cycle rather than an optional reference.

Third, a documentation point specific to OEMs: the legacy Device Master Record (DMR) is not carried forward as a defined term in QMSR. ISO 13485 Clause 4.2.3 instead establishes the medical device file (MDF), which in practice consolidates what were previously the DMR, the device history record, and portions of the design history file into a single structured record [16]. The underlying content obligations persist; this is a terminology and organizational change rather than a new substantive requirement. OEMs whose document-control systems and SOPs still reference “DMR” by name should confirm those references map cleanly onto the ISO 13485 MDF structure rather than assuming the terms are interchangeable for inspection purposes.

4.2. Contract Manufacturers

A contract manufacturer's QMSR exposure is direct by regulatory definition, not merely derivative of the OEM's controls. Under 21 CFR §820.3(b) (the set of QMSR-specific definitions that supersede ISO 13485's own terminology, since ISO 13485 uses “organization” rather than “manufacturer”), a “manufacturer” is any person who designs, manufactures, fabricates, assembles, or processes a finished device, including those who perform contract sterilization, installation, relabeling, remanufacturing, repacking, or specification development [4]. A contract manufacturer that designs, manufactures, fabricates, assembles, or processes a finished device meets the definition of “manufacturer” under 21 CFR §820.3(b) and is therefore directly and fully subject to QMSR under §820.1(a), regardless of whether it or the OEM holds the 510(k) or PMA. Where a contract manufacturer's scope instead falls short of that threshold, its obligations run principally through the OEM's purchasing controls under ISO 13485 Clause 7.4 and the resulting quality agreement, which under prevailing industry practice specifies conformance to ISO 13485:2016 and 21 CFR Part 820, audit rights, change-notification triggers, and record-retention periods. Even in this indirect posture, the quality agreement functions less as a private commercial contract and more as an inspectable regulatory document defining assigned quality responsibilities [9,10].

The removal of the §820.180(c) exemption bears directly on this relationship in two ways. If FDA inspects the OEM, supplier audit reports concerning the contract manufacturer (previously shielded) are now producible records in that inspection [3,10]. If FDA inspects the contract manufacturer directly (because it independently qualifies as a manufacturer under §820.3(b), or because FDA exercises inspection authority over the contracted operations), its own internal audit and management-review records are likewise exposed. Post-implementation industry commentary on Compliance Program 7382.850 (which elevates “Outsourcing and Purchasing” to one of six core inspection areas [11]) characterizes FDA investigators as placing particular emphasis on whether a manufacturer maintains dated, ongoing supplier-performance monitoring, such as periodic reassessment and nonconformance trending, rather than relying on a static initial-qualification file alone [12]. That characterization reflects industry interpretation of investigator practice rather than compliance-program text itself, but it is consistent with the broader shift from static to continuous documentation this section describes. Contract manufacturers that historically used management-review meetings or internal audit narratives as a venue for unguarded discussion of nonconformance trends, customer disputes, or corrective-action delays should assume those records are now within the reach of an FDA inspector, whichever route FDA takes to reach them. A practical consequence follows directly: OEMs can no longer treat the quality agreement itself as a file-and-forget artifact executed once at supplier qualification. If investigators are evaluating whether supplier oversight is dated and ongoing rather than static, the agreement needs to obligate the kind of continuous performance data (periodic reassessment, nonconformance trending, documented change-impact review) that would make that oversight demonstrable during an inspection, not just contractually promised.

4.3. Critical Component Manufacturers

Of the three roles, critical component manufacturers face exposure that depends most heavily on classification. FDA's own examples (blood tubing, diagnostic x-ray components) establish that some components meet the 21 CFR 820.3(a) finished-device definition as accessories and are therefore directly QMSR-regulated, with the same full obligations as an OEM [4]. A component that does not meet that definition is reached only indirectly, through the purchasing and supplier-evaluation controls the OEM or contract manufacturer applies under ISO 13485 Clause 7.4, and through whatever quality agreement flows down from that relationship.

This bifurcation means the single most important compliance action for a critical component manufacturer is not a generic QMSR gap assessment but a specific classification exercise: determining, component by component, whether the part meets the accessory/finished-device threshold in 21 CFR 820.3(a), and therefore whether the applicable pathway is direct QMSR compliance or contractual flow-down under a purchaser's Clause 7.4 program. A component manufacturer that assumes it is out of scope because it does not sell a complete device, without testing that assumption against FDA's accessory doctrine, risks discovering the question only during an inspection or a customer's supplier audit, at which point the classification determines not just paperwork but which regulatory regime actually governs the product. Documenting that classification decision, and the reasoning behind it, is the artifact most likely to matter if the question is ever raised.

5. Discussion

5.1. What Changed, and What It Costs

Start with what actually changed. FDA has described QSR and QMSR, taken together, as “substantially similar” in the assurance they provide [3]. That framing holds at the level of aggregate stringency, but it obscures how unevenly the transition's real changes are distributed. The retained sections in Table 1 and the loss of the §820.180(c) exemption are not symmetric burdens on OEMs, contract manufacturers, and component suppliers; they concentrate new exposure precisely at the points in the supply chain (audit records and classification boundaries) that, in this review's assessment, are where documentation practices have historically been least formalized.

QMSR also resolved some open questions by silence rather than by explicit rule, and FDA has already interpreted that silence outside the regulatory text itself. The independent-design-reviewer question from Section 4.1 illustrates this: the explicit requirement disappeared from the rule, but FDA's preamble response to public comment makes clear the agency still expects functionally equivalent practice under ISO 13485 Clause 7.3. Organizations that read only the shorter regulation, without reading the preamble, are exposed to a gap between what the rule says and what FDA has already stated it will look for.

The starkest cost sits in the §820.180(c) change itself. Psychological safety, the shared belief that a team is safe for interpersonal risk-taking, including admitting error, offers a useful lens here, and it has a direct point of origin in a healthcare quality setting. In the study that introduced the construct, Edmondson found that hospital care teams independently rated as higher-performing also reported more medication errors, not because they erred more often, but because a climate of psychological safety made candid reporting and correction more likely; the units with the fewest reported errors were not necessarily the safest, but tended toward more punitive reporting climates in which staff were reluctant to disclose mistakes [17]. A later evidence synthesis across 62 studies in healthcare settings found a recurring association between low psychological safety and reduced reporting of safety-relevant information [18]. The parallel to Section 3.4 is direct: internal audits and management review are, by design, the forums where a quality organization is expected to be candid about its own weaknesses. Removing the shield that once kept those records outside FDA's routine reach does not, by itself, make an organization's quality problems more visible to the people positioned to fix them; it changes who else can read the same account, and creates an incentive to write that account more defensively. At the same FDLI panel where Thomas presented the observation data discussed in Section 3.3, Jaimi Gaffe, an attorney with Johnson & Johnson, said the company has been training staff to be “more careful” about the language used in internal audits now that FDA can read them [13], a concrete, contemporaneous instance of the dynamic this literature would predict. Whether that dynamic measurably affects the quality of reported findings at scale is an empirical question outside the scope of this review, but it is a specific, testable question the QMSR transition raises rather than resolves.

5.2. What Organizations Should Do About It

Three practical responses follow from this analysis. The first is a documentation review: organizations should treat internal audit, supplier audit, and management-review records as inspectable going forward, which means writing findings factually, tying them to root-cause investigation, and closing them out with objective evidence, not eliminating candor, but eliminating the sloppy phrasing and unclosed loops that read poorly under outside review [3,11]. The second is a quality-agreement update: because outsourcing and purchasing already rank among the earliest QMSR inspection focus areas [13], OEMs and contract manufacturers should revise quality agreements to specify audit rights, change-notification triggers, and how risk-management documentation moves across the company boundary, rather than treating certification status as passive proof of a supplier's fitness [4,10]. The third follows from how FDA appears to be conducting these inspections in practice: industry commentary on Compliance Program 7382.850 describes investigators tracing a single complaint or nonconformance across functional boundaries, from the risk-management file into purchasing records and design documentation, rather than examining each subsystem in isolation as under the former QSIT approach [14]. That characterization reflects industry interpretation of investigator behavior rather than compliance-program text itself, but organizations that structure their own internal reviews the same way, following a risk thread across departments rather than auditing each function separately, are better positioned to find what an FDA investigator would find first.

Durability is a further consideration. ISO 13485:2016 was reviewed and reconfirmed in 2025 and is not due for another periodic review until 2030 [10], which suggests the incorporated-standard baseline is stable in the near term even as FDA continues to issue implementation guidance, such as the October 2025 PMA/HDE draft guidance discussed in Section 4.1. Future work tracking how that guidance is finalized, and how FDA's compliance program 7382.850 is applied in practice across OEM, contract-manufacturer, and component-supplier inspections, would usefully extend this review once a body of post-implementation inspection findings becomes available.

6. Conclusions

The QMSR transition replaced a self-contained U.S. regulatory text with an incorporation-by-reference framework built on ISO 13485:2016, retaining independent text in only six sections of Part 820 and removing the audit-record exemption that previously shielded internal audits, supplier audits, and management reviews from FDA inspection. In this review's assessment, that removal is the most consequential change introduced by the transition: it appears to carry a wider practical reach across the device supply chain than any newly written requirement in the rule. Its effect is not uniform across industry participants.

OEMs face the fullest and most direct exposure. Although the regulation omits an explicit requirement for an independent design reviewer, FDA's rulemaking preamble indicated that it expects equivalent practice to continue under ISO 13485 Clause 7.3. OEMs should not assume the requirement has lapsed simply because the regulatory text is shorter.

Contract manufacturers face a threshold jurisdictional question: does their scope of operations meet the definition of a “manufacturer” under 21 CFR §820.3(b)? If so, QMSR applies to them directly, irrespective of who holds the premarket clearance. If not, the regulation reaches them indirectly, through the OEM's purchasing controls and the resulting quality agreement.

Critical component manufacturers face a parallel determination based on product classification: does a given component meet FDA's accessory/finished-device definition? That classification determines whether the manufacturer is subject to direct QMSR compliance or reached only through flow-down purchasing controls.

For all three roles, two steps are the most direct available: a practical crosswalk against Table 1 and Table 2, informed by resources such as AAMI TIR102, and a documentation review conducted on the assumption that internal audit and management-review records are now inspectable by FDA.