The Quality Management System Regulation (QMSR), which amends 21 CFR Part 820, sets the quality-system standard for selling a medical device in the U.S. Here’s what emerging teams need to know.
For emerging companies and early-stage development teams laser-focused on proving innovations, securing funding, and accelerating time-to-market, compliance can feel like a distant obligation. But for any startup intending to commercialize a complex medical device or life science instrument in the U.S. market, the QMSR isn’t something to schedule for later.
Inspections by the U.S. Food & Drug Administration (FDA) can halt production, and gaps in quality documentation can unravel pre-submission or investment due diligence in a matter of hours.
The good news is that teams who understand the framework are far better positioned to move efficiently from prototype to clinical deployment and into patients’ hands.
What Is the QMSR?
The QMSR is the section of the Code of Federal Regulations (CFR) that establishes current good manufacturing practice (CGMP) requirements for medical device manufacturers in the United States. Enforced by the FDA, it governs the methods, facilities, and controls used across the full product lifecycle — from design and manufacturing through labeling, packaging, storage, and servicing.
In plain terms: if you make a finished medical device intended for human use and want to sell it in the U.S., this regulation sets out the quality system you must have in place.
On February 2, 2026, the FDA’s revised rule — now officially titled the Quality Management System Regulation (QMSR) — became effective. This is the first major revision to Part 820 since 1996, and it fundamentally changes the regulation’s structure by incorporating ISO 13485:2016 by reference.
Critically, the QMSR also retains U.S.-specific provisions that ISO 13485 does not cover, including Medical Device Reporting (MDR) requirements, Unique Device Identification (UDI) obligations, and specific complaint-handling records.
Key Takeaway:
The QMSR is a federally enforceable standard. Noncompliance doesn’t just mean poor documentation; it means a significant barrier to market access.
Key QMSR Requirements to Prepare For
Rather than spelling out each requirement directly, the QMSR now incorporates ISO 13485:2016 by reference. Only Subparts A and B of Part 820 remain operative; the former Subparts C-O are now reserved and point readers to the corresponding ISO 13485 clauses.
The regulation still covers virtually every aspect of how a medical device is designed, manufactured, and supported throughout volume production and distribution. For emerging companies, the following areas are the highest-impact requirements to understand early on.
Document & Record Control
Every quality decision must be captured in controlled, version-managed documents. The regulation requires that manufacturers establish procedures for approving, distributing, and updating documentation, and that records remain accessible, legible, and traceable throughout the device lifecycle. For startups accustomed to collaborative but informal workflows, this is often the first culture shift required.
Under the QMSR, the records central to compliance are organized within the Medical Device File (MDF), the construct defined in ISO 13485. The MDF is a single, device-type–level compilation of the documentation needed to demonstrate that a device conforms to applicable requirements. It absorbs the substance of two record types that U.S. manufacturers previously maintained separately under the legacy Quality System Regulation (QSR):
- The specifications and procedures needed to produce the device (formerly the Device Master Record (DMR)) now form the core of the MDF.
- The production and traceability records documenting the actual manufacturing history of each device or batch (formerly the Device History Record (DHR)) remain required as production and service records, even though the “DHR” label is no longer used in the regulation.
The terminology has changed, but the underlying obligation has not: records must be maintained with enough fidelity that an FDA inspector could reconstruct the story of any device from design through distribution.
Corrective & Preventive Actions (CAPA)
Manufacturers must also establish procedures to investigate the root cause of quality problems, implement corrections, and — most importantly — verify that those corrections actually worked. Simply closing a CAPA without demonstrating that the problem did not recur is one of the most common inspection findings across the industry.
Note: as of February 2, 2026, the FDA also retired the Quality System Inspection Technique (QSIT) and replaced it with a new inspection process under Compliance Program 7382.850, aligned with the QMSR/ISO 13485 structure
Supplier & Purchasing Controls
Every supplier or contractor providing components or materials that could affect device quality and, in turn, patient safety must be qualified and monitored. This means evaluating supplier capabilities, defining acceptance criteria, and maintaining records of supplier performance over time. For startups relying on external vendors (often multiple vendors) for critical materials or subassemblies, this requirement has direct implications for how partnerships are structured from the outset.
Production & Process Controls
Manufacturing processes that cannot be fully verified by downstream inspection, meaning the output cannot be tested to prove quality, must be validated before use. Process validation establishes that a process consistently produces results that meet predetermined specifications. Equipment used in production must also be maintained, calibrated, and qualified on a defined schedule.
Complaint Handling
Any information received after distribution suggesting a device may have failed, malfunctioned, or caused injury must be formally reviewed and investigated by the manufacturer. Complaints that meet specific thresholds must be reported to the FDA under the MDR regulation. Companies must maintain complete complaint files and be able to demonstrate that every complaint received was evaluated, and that decisions about investigation were documented and justified.
Key Takeaway:
These requirements aren’t independent checkboxes — they are an interconnected system that can quickly disrupt uptime and distribution strategy. A gap in one area (weak CAPA, unqualified suppliers, an under documented process, etc.) can cascade into findings across multiple subparts during an inspection.
Any delay due to a failed inspection can threaten time-to-market and market share, so it’s important to optimize resources to address compliance and risk from the earliest stages of design.
Medical Device Design Controls Explained Simply
Of all the QMSR’s requirements, design controls are often the most consequential for early-stage companies — and the most misunderstood. Design controls apply to manufacturers of Class II, Class III, and certain Class I devices, and they require that the design and development process itself be structured, documented, and reviewable. Controlled elements include:
- Design Inputs: The device’s intended use and user needs must be translated into documented, measurable requirements. These become the benchmark against which everything else is evaluated.
- Design Outputs: The documented results of the design process — drawings, specifications, software code, manufacturing instructions, etc. — must demonstrably satisfy the design inputs. The connection between what was required and what was produced must be traceable.
- Design Reviews: At defined stages in the development process, a formal review must occur. Critically, this review must include at least one individual who was not directly involved in the design work. This is a built-in mechanism to catch assumptions that the development team might be too close to see.
- Design Verification: Before finalizing a design, the manufacturer must confirm that design outputs meet design inputs. This is typically accomplished through testing, analysis, inspection, or demonstration, and all of it must be documented.
- Design Validation: Verification proves the design was built correctly. Validation proves the correct design was built. Validation confirms that the finished device, under actual or simulated conditions of use, performs as intended for the target user population. This is distinct from verification and cannot be substituted.
- Design Transfer: The validated design must be translated into production specifications in a controlled manner, ensuring that manufacturing consistently produces devices that reflect the approved design, regardless of the number of design transfers.
- Design Changes: Any modification to a previously reviewed and approved design requires formal evaluation, documentation, and — depending on the nature of the change — re-verification or re-validation.
All of this activity is captured in the Design and Development Files (formerly DHF), which serves as the complete, organized record of the design and development process for a device. The Design and Development File is one of the primary documents reviewed during an FDA inspection. Poorly maintained Design and Development Files are among the most common sources of Inspection Observations listed in Form 483 and Warning Letters.
Building design controls into the development process from the start — not reconstructing them retroactively — is both a regulatory requirement and a practical safeguard against costly redesigns.
Key Takeaway:
Design controls are not administrative overhead. They are required for regulatory submission, partner due diligence, and FDA inspection readiness.
How Manufacturing Partners Support QMSR Compliance
For early-stage companies with lean teams and constrained resources, achieving and sustaining QMSR compliance from scratch is a significant undertaking. The most efficient path for many startups is not to build compliance infrastructure independently, but to leverage a contract manufacturing partner whose quality systems are already established, certified, and inspection-ready.
A capable manufacturing partner provides several compliance advantages that are difficult and time-consuming to replicate internally:
Ready-Made Quality Infrastructure
Experienced contract manufacturers operate under certified, audit-ready quality systems. Rather than building document control, supplier qualification, and production validation processes from scratch, a startup working with such a partner can inherit validated infrastructure and adapt it to their specific program needs.
Design for Manufacturability Feedback
Manufacturing partners with integrated engineering capabilities can identify compliance risks during the design phase rather than after transfer. Designs that are difficult to produce consistently, materials that create traceability challenges, or novel device specifications that complicate process validation are far less expensive to address at the design stage than after scale-up begins.
Process Development & Validation Support
Bringing a device from prototype to production requires documented IQ/OQ/PQ validation for critical processes. Contract manufacturers with dedicated process engineering teams can execute and document this validation work in alignment with regulatory expectations, reducing the time and cost burden on the development team.
Supply Chain & Supplier Qualification
Managing a compliant supplier base is one of the more resource-intensive requirements under the QMSR. Partners with established supplier networks and qualification programs can extend those capabilities to a startup’s program, reducing the risk of supply chain gaps that become obstacles to compliance.
Scalable, Multi-Site Consistency
As programs grow from initial production runs to commercial scale, quality systems must scale with them. Manufacturing partners with multi-site capabilities can maintain consistent quality documentation and practices across geographies, reducing the risk of system fragmentation during transitions.
Key Takeaway:
Choosing the right manufacturing partner is not just about operational support. The partner’s quality infrastructure becomes part of your compliance posture and market position.
Build Compliance Into the Development Workflow, Not Onto It
The QMSR is not designed to slow innovation — it is designed to protect patients and ensure that the devices reaching them are safe and consistently built. For early-stage companies, the practical challenge is implementing these requirements at a scale appropriate to each stage of development while remaining credible to regulators, investors, and partners.
The companies that struggle most are the ones that treat compliance as a downstream task. They build devices first and document later, resulting in gaps that are expensive and time-consuming to close. Regulatory compliance delays can create rework costs that further compress already-thin runways.
The companies that succeed build traceability into daily workflows, engage regulatory and quality expertise early, and choose manufacturing partners whose systems are ready to support the full product lifecycle.
Accelerate compliance and market entry, and focus on what your team does best: building innovations that improve patients’ lives.
Find the Right Partner to Bring Superior Medical Innovations to Market Efficiently
To avoid common pitfalls while building toward QMSR compliance, work with Ascential, a partner that regularly adds data capture into manufacturing systems to streamline regulatory documentation and has proven its ability to support global, multi-site manufacturing programs.
Get Your 15-Minute Consultation