The FDA's new Quality Management System Regulation (QMSR), which replaces the 21 CFR Part 820 Quality System Regulation (QSR) and incorporates ISO 13485:2016 by reference, represents a significant harmonization effort in the medical device industry. While viewed by some as a mere streamlining, the change is mandatory, with an effective and fully enforceable date of February 2, 2026. The episode addresses industry complacency and details critical steps manufacturers must take immediately.
The episode debunks the myth that familiar quality documents like the DHF, DMR, and DHR are being eliminated. While the specific terms are removed from the regulation's language, their substance is retained and mapped to new, ISO-aligned conceptual requirements: the Device Master Record (DMR) becomes the Medical Device File (MDF), the Design History File (DHF) becomes the Design and Development File (DDP), and the Device History Record (DHR) is captured in the Batch or Lot Record. The host emphasizes that internal documents can retain the old terminology, provided a clear regulatory mapping is established.
Crucially, compliance requires more than just an ISO 13485 certificate. Two major philosophical shifts must be addressed: the explicit requirement for integrating lifecycle risk management as the DNA of the entire QMS, and the loss of the audit privilege, which makes internal audit reports, supplier audit reports, and management review records inspectable regulatory evidence. Furthermore, manufacturers must comply with retained, US-specific requirements under the QMSR's prevalence rule, especially concerning mandatory record content (§ 820.35) and specific labeling and packaging controls (§ 820.45).
Love this episode? Leave a review on iTunes!
Have suggestions or topics you’d like to hear about? Email us at podcast@greenlight.guru.
[0:50] QMSR: The biggest shakeup to US quality requirements since 1996.
[2:00] Effective Date: February 2, 2026—the clock is ticking.
[2:42] The Goal: Harmonization with ISO 13485:2016 to reduce redundancy for global manufacturers.
[3:50] Myth 1 Busted: The FDA is eliminating the DHF, DMR, and DHR (Documentation Dissolution).
[5:10] Terminology Shift: DMR > Medical Device File (MDF, ISO 13485 Clause 4.2.3).
[6:30] Terminology Shift: DHF > Design and Development File (DDP, ISO 13485 Clause 7.3.10).
[7:40] Terminology Shift: DHR > Batch or Lot Record (ISO 13485 Clause 7.5.1).
[8:40] The Practical Takeaway: Internal naming is fine, but regulatory mapping is mandatory.
[10:30] Critical Shift 1: Risk Management is the DNA of the QMS—Explicitly required across all clauses.
[13:00] Critical Shift 2: Loss of the Audit Privilege—Internal audit and management review records are now inspectable.
[17:00] Critical Shift 3: Retained FDA Specifications (Prevalence Rule).
[17:35] Retained Req. A: Mandatory Record Keeping Content (21 CFR Part 820.35)—UDI/UPC in complaint/service records.
[19:00] Retained Req. B: Extended Record Retention Period (Device life, no less than two years).
[20:10] Retained Req. C: Specific Labeling and Packaging Controls (21 CFR Part 820.45)—Inspection for accuracy.
[22:00] Immediate Action Plan: Gap analysis and restructuring to the new terminology.
Mandatory Regulatory Mapping: Manufacturers must conduct a thorough mapping exercise to ensure their existing DMR, DHF, and DHR content fulfills the new requirements of the Medical Device File (MDF), Design and Development File (DDP), and Batch/Lot Records, respectively.
Embed Lifecycle Risk Management: The QMSR requires a holistic, lifecycle approach to risk management, making it an explicit core component of all QMS clauses (e.g., supplier controls, design and development), moving beyond isolated, perfunctory steps.
Prepare for Full Documentation Exposure (Regulatory): Recognize that the former privilege is gone; internal audit reports, supplier audit reports, and management review records are now subject to routine FDA inspection. Draft these documents with the utmost rigor and awareness of their new status as regulatory evidence.
Confirm Compliance with FDA Retained Sections: ISO 13485 certification is not enough. You must address the US-specific requirements retained under the prevalence rule, particularly the mandatory inclusion of UDI/UPC in complaint records (§ 820.35) and the strict labeling/packaging inspection controls (§ 820.45).
Transition is Immediate: The compliance date of February 2, 2026, is a hard deadline. Proactive gap analysis, process restructuring, and staff training based on the QMSR's requirements and the FDA's preamble are essential for uninterrupted market access.
MedTech 101 Section
What is the "Prevalence Rule"?
The Prevalence Rule is a key concept in the new Quality Management System Regulation (QMSR) that clarifies which set of rules takes priority. Since the FDA is incorporating the international standard ISO 13485:2016 by reference, a conflict could arise between the ISO standard and existing U.S. law. The Prevalence Rule dictates that in any area of conflict, the U.S. Federal Food, Drug, and Cosmetic Act (FD&C Act) and its implementing regulations (like those retained in 21 CFR Part 820) will always supersede the ISO 13485 requirement. Think of it like a recipe: ISO 13485 is the main set of instructions, but the retained 21 CFR sections are non-negotiable, mandatory additions or modifications that must be followed regardless of what the main instructions say. This is why mere ISO certification does not guarantee QMSR compliance.
"Your internal audit reports, your management review minutes, if you were expecting to keep those shielded from any outside eyes, they are now inspectable regulatory evidence." - Etienne Nichols
Feedback Call-to-Action
Did this episode help clarify your QMSR transition plan? We value your input and are dedicated to providing the most relevant, actionable content for MedTech professionals. Please send your feedback, questions, or topic suggestions directly to the host at podcast@greenlight.guru. We read every message and offer personalized responses, ensuring the Global Medical Device Podcast continues to serve your regulatory and quality needs. Also, take a moment to rate, review, and subscribe on your favorite podcast platform.
Sponsors
This episode is brought to you by Greenlight Guru. As the medical device industry faces the significant shift to the QMSR, your QMS needs to be audit-ready and easy to update. Greenlight Guru offers an all-in-one MedTech lifecycle excellence platform with specialized QMS and EDC solutions. Our electronic Quality Management System (eQMS) is built to facilitate the traceability and document control necessary to manage the new ISO-aligned terminology and retained FDA requirements, while our Electronic Data Capture (EDC) software helps manage high-quality data for clinical trials. Don't let scattered documentation hold you back from the February 2026 deadline. Visit www.greenlight.guru to learn how we can help you streamline your quality system and get back to innovating.
Etienne Nichols: Hey, everyone. Welcome back to the Global Medical Device Podcast. My name is Etienne Nichols. I'll be the host for today's episode. And today I'd like to talk to you about one what some are considering the biggest shakeup to US quality requirements in nearly three decades, and that's the FDA's new Quality Management System regulation, or QMSR.
Now, if you're familiar with this, you might be laughing a little bit because you think one of the biggest shakeups. Are you kidding me? Have you not paid attention to cybersecurity and some of the requirements?
There's what's interesting about this is this is the core quality system regulation that's changing.
Hasn't changed since 1996 when design controls were introduced.
So, and it's a very, it's a large scale if you focus on it and you have only focused on the FDA, QMS or QSR. But as far as in reality, what's actually changing? Well, we're going to get into that in a little bit, and we'll let you decide for yourself how big a shakeup this is.
But the clock is ticking. Regardless, if you look at this as a minor change or a hugely impactful change, it's coming up very quickly. The QMSR, if you haven't paid attention lately, is replacing the former Quality System Regulation, formerly known as QSR 21 CFR Part 820, and CFR standing for the Code of Federal Regulations, 21 CFR Part 820 was finalized in February 2024, or at least the update to it was, meaning the regulation, that is the final rule of QMSR becomes fully effective and fully enforceable on February 2, 2026.
If your company already operates under the international standard of ISO 1345:2016, this transition should really be viewed as nothing more than a streamlining effort, not a radical overhaul. The FDA determined that the requirements in ISO 1345 are, when taken in totality, substantially similar to the old QS regulation.
The entire goal here is harmonization, reducing the redundancy of effort for global manufacturers and ultimately saving the industry theoretically hundreds of millions of dollars annually.
Despite this substantial similarity, sources indicate and by sources, whenever I travel all over the world, all over the globe, talk to the different medical device manufacturers, talking to different vendors who are helping medical device Manufacturers, it seem that many companies haven't made the necessary alignment changes yet, which means complacency right now is probably the biggest risk.
So today we're going to bust three big QMSR myths and detail the specific updates you need to make before the enforcement deadline.
All right, so the first one is the myth of the documentation dissolution.
Our first myth relates to the old school quality documents we all know, we all love. If you've been working with devices that are going to go through the FDA, the DHF, the DMR, the DHR, the design history file, the Device Master record, and the device history record.
So, the first myth is that the FDA is eliminating the DHF, DMR and DHR. So, we have to, as a result of that, we have to rewrite our QMS structure entirely.
Well, the truth is that, yes, the FDA is eliminating those three specific familiar terms from the language of the regulation.
It's absolutely retaining the substance of what those records require.
This terminology shift is a part of the move toward incorporating ISO 1345 by reference. So, here's how the old documentation aligns with new conceptual requirements. The DMR, the Device Master record is now the medical device file or the MDF.
The DMR served as the essential recipe for manufacturing. It contained specifications, quality assurance procedures. And that role is now fulfilled by the medical device file, which is referenced in ISO 1345 clause 4.2.3.
The MDF must contain or reference all current procedures and specifications needed on the manufacturing floor. So DMR is going to MDF.
Device Master Record is now the medical Device file.
The DHF or the design history file is now the DDP or Design and Development file.
The DHF documented how the device was designed and tested and this is replaced by design and development files or records.
And this comes from ISO 1345, clause 7.3.10.
This change is already seen in technical amendments across FDA regulations. So, this isn't me drawing my own conclusions. There are actually reference that are going to be modified that used to reference the old design history file or DHF.
They're changing that to the design and development file in the QMSR. Specifically, 21 CFR Part 801.45, paragraph E.
It used to reference the design history file. There is scheduled change to modify that and change that to the design and development file. So DHF is going to DDP.
Design history file is now going to be design and development file.
The DHR or the device history record is now going to be captured in the Batch or lot record? Batch record I think is, is what little bit more official term I suppose from ISO 1345.
But the DHR or the device history record documented the manufacturing specific batches or units. So, this is like the birth certificate of your device, I suppose this documentation is now contained largely in the medical device, like I said, or batch record.
This comes from ISO 1345, clause 7.5.1.
In fact, the FDA explicitly corrected the final rule to ensure the definition of batch or lot was retained in 21 CFR Part 820.3, the definitions highlighting its continued importance for manufacturing traceability.
So really, if there was a takeaway here, it would be practicality.
There's some debate in the industry about the best practice here, but I'm just going to come out and say it. You're allowed to keep calling your internal documents DHF, DMR, DHR if you want, provided the content still complies with the new QMSR and ISO 1345 requirements and provided that you map whatever you are calling the old DHF, DMR, DHR to what those new requirements are.
So, if you have a DHF, you need to be able to map it to when an inspector comes in or an investigator comes in and says, okay, I need to look at your design and development files.
And you're like, what's that? You need to know that what you call a DHF is now a DDP to that investigator.
So really the task is a mapping exercise, ensuring your old records seamlessly fulfill the requirements of this new file structure. Now, best practice may be to eliminate those entirely and to sanitize your language so that you're using the most up to date language.
But oftentimes, you know, humans, it's, it's kind of hard to, to get rid of that language immediately.
So, knowing that you can transition, provided you have that mapping exercise taking place and that you can justify that you are still fulfilling the requirements of the new QMSR and ISO 1345 requirements.
That is the, that is the task that lays ahead of us.
The second thing is there are certain critical shifts that you really can't afford to ignore.
So, the terminology changes, they should be manageable, I hope. But there are two major philosophical and regulatory shifts that simply having an ISO 1345 certificate is not enough to guarantee QMSR compliance.
So, this is where the FDA's prevalence rule comes in. This is where the QMSR requirements supersede ISO requirements in areas of conflict.
So, one of the critical shifts that I would say that you can't afford to ignore is that risk management is now the DNA of the QMS.
The QMSR formally requires you to integrate a holistic lifecycle risk management approach throughout the entire quality system. Under the old QSR, risk was often addressed in isolated steps like if you look at 21 crash part 820.30 where it can cover design controls. It was mentioned in design validation.
But the QMSR, by adopting ISO 1345 explicitly emphasizes risk-based decision making in almost every single clause. This means applying risk principles to supplier controls. Clause 7.4 the level of control applied to outsourced activities and suppliers must be proportionate to the risk that the product or service proposes to the finished device.
It applies to design and development. Clause 7.3 risk must be integrated from the beginning, linking user needs and design inputs to identified risks and corresponding mitigations.
So, the FDA views this explicit integration of risk management as key to enhancing device safety and effectiveness. So that's probably one of the biggest philosophical shifts. Although the FDA has been pushing a risk-based decision-making process for years now it's explicit.
One of the other critical shifts that I would say is important to think about is the loss of the audit privilege.
This is arguably the most significant legal change in the QMSR because it alters the stakes of internal quality documentation.
If you're familiar under the previous QSR, internal quality reports, supplier audit records or reports and the management review records were legally protected from routine FDA inspections under former 21 CFR part 820.180, paragraph C.
Now there's argument that people investigators could get around and find that, but that 21 CFR Part 820.180 specifically exempted internal audit reports, supplier audit reports and management review report records from those investigations or inspections.
The QMSR eliminates that exemption entirely.
And if you read the preamble, the FDA explicitly stated that since manufacturers already provide these documents to other regulators like those participating in MDSAP, which is the medical device Single Audit Program, they will not be additionally burdened by making these records available to FDA investigators.
So, the implication here, if you think about it, is a bit profound.
Your internal audit reports, your management review minutes, if you were expecting to keep those shielded from any outside eyes, they are now inspectable regulatory evidence.
So, if your records document a significant quality problem, they can be used to show the FDA management was aware of a deficiency.
This demands immediate heightened rigor and how those critical documents are drafted and maintained. Now you could make the argument well, hopefully good medical device companies were doing things correctly anyway. So, what do they have to hide? Well, sometimes when we know we don't have to show anything to authorities, we may not word them as well as maybe we should have. Maybe we weren't as explicit as we should have or as aggressive in chasing down the problems.
So regardless of the change, or I'm not going to tell you exactly how it is you should change this because this is going to vary from company to company. But you need to be aware that this is now inspectable regulatory evidence, and you need to plan accordingly.
So that's one thing to think about.
The third critical shift I would say from a philosophical and regulatory standpoint is that the retained FDA specifications, and I'll mention what those are in a minute. Again, this is the prevalence rule. In practice, the prevalence rule being if there's a conflict, the FDA rules out over ISO 1345.
So, remember I mentioned that compliance with ISO 1345 alone does not guarantee QMSR compliance.
You also have to adhere to the US specific requirements that the FDA retained. And those are first of all; I'll go at ABC because I'm doing a lot of numberings here. So, A is mandatory record keeping content. This is from 21 CFR Part 820.35.
The QMSR maintains specific content requirements for complaint and servicing records that go beyond ISO 1345.
Most importantly, these records must include the device's unique device identifier or UDI or Universal Product Code UPC, if you call it that way, for each medical device or batch of medical devices.
So, if a complaint is not investigated, the manufacturer has to document the reason why there are additional UDI requirements. So definitely check out 21 CFR Part 820.35.
That's one of the above and beyond aspects of the new QMSR over ISO 1345.
B secondly or B ly, I guess if that's the terminology here, is extended record retention period. So, if you were only ISO 1345:2016, you never did anything with the FDA and now you're going over to QMSR. The QMSR retains the FDA's unique long standing record retention requirement, which is that all required records must be kept for the device's expected life, but in no case less than two years from the date of release for commercial distribution.
So just keep those record retention requirements in mind and then c these the third prevalence rule in practice, if we want to call this is the specific labeling and packaging Controls.
And this is from ISO 13.
This is from 21 CFR Part 820.45.
The FDA held onto this section because it believes ISO 1345 does not adequately address the inspection of labeling by the manufacturer. So, this section requires manufacturers to document procedures ensuring the inspection of labeling and packaging for accuracy, including UDI, UPC expiration dates, handling instructions, all prior to release or storage.
So, an additional packaging and labeling requirement over ISO 1345:2016.
So, the effective date of the QMSR is February 2, 2026.
The FDA granted a full two-year transition period for manufacturers to align their internal processes, train staff, update documentation. I think when they first came out with the proposed rule, they were proposing one year because there was an expectation that this was not going to be a huge regulatory lift to meet these requirements.
But the industry sort of pushed back, so they gave those two years.
We are very close to coming up on that two years. We're I think six weeks away at this point at the time of this recording.
For Companies already following ISO 1345, this shift is one of adaptation. It's increased regulatory rigor, perhaps particularly in documentation exposure and risk management integration. For domestic companies that have only followed the QMSR, the burden is proportionately higher than those who are already following ISO 1345.
And really the time to start the transition is immediate.
So, remember, while The QMSR incorporates ISO 1345, ISO 1345 certification is not required for compliance.
And even if you get certified, it's not going to exempt you from routine FDA inspections.
So, your immediate plan should be to center on a thorough gap analysis, restructuring your quality manual and records to the new ISO QMSR terminology and addressing those three critical shifts that I mentioned.
Deeply embedded embedding lifecycle risk management, preparing your internal audit records for regulatory review, and confirming compliance with the unique FDA requirements under 820.35 and 820.45, those UDI packaging and labeling requirements and complaint handling.
So proactive change really is the only way to ensure uninterrupted market access and compliance come February 2026. It is a on, off, it is going to turn on February 2nd.
There's no gradual introduction into this. You are previously under QSR. February 2nd, you're going to be under QMSR.
Definitely look at the preamble.
That is something that you should be reading to make sure that you are understanding the FDA's thinking behind how it is going to interpret its own requirement. So that's what the preamble is good for.
It tells you how the FDA thinks about this and how it's approaching the interpretation of this standard.
If you are still overwhelmed and you're still wondering, oh, how am I? My QMS, you, I've already done the gap analysis, I've done this. But there are other problems. We're really after digging into things, we need an overall and it's not because of QMSR, it's just, you know, just the way it is right now.
We haven't done a good job. Whether you have scattered documentation across multiple Dropbox, SharePoint paper, whatever the case may be, and it's time to get everything together, call us at Greenlight Guru.
We can help you figure out how it is we can make your life easier with an eQMS. Now, an eQMS is not by itself going to get you ready for any regulation.
There are so many company specific things that go into a QMS, but an eQMS can make it easier to make those changes, makes it easier to make that traceability, that document that traceability and to show auditors that you are adhering to the standard. So, we can make your life a whole lot better, make you able to sleep better at night knowing that an investigator is coming, but that you're ready for that investigation from the FDA.
If you're interested in learning how we can help you with an eQMS or our electronic data capture for clinical trials and clinical investigations, reach out to us at www.greenlight.guru. we'd be happy to help in whatever way we can. Or reach out to me on LinkedIn. I answer a lot of questions about the podcast from the podcast.
A lot of questions from listeners.
Love to hear from you all. My name is Etienne Nichols. Look me up on LinkedIn. I'd love to hear from you as well.
Either one reach out. Let us know what you're thinking. And we are. We will do everything we can to make life a little bit easier for you as a MedTech professional and to help you get back to doing what you do best, which is improving the life, improving the quality of life for patients everywhere. Thank you so much for listening. We'll see you later. Take care.
Thanks for tuning in to the Global Medical Device Podcast. If you found value in today's conversation, please take a moment to rate, review, view and subscribe on your favorite podcast platform.
If you've got thoughts or questions, we'd love to hear from you. Email us at podcast@greenlight.guru. Stay connected for more insights into the future of MedTech innovation. And if you're ready to take your product development to the next level. Visit us at www.greenlight.guru. Until next time, keep innovating and improving the quality of life.
The Global Medical Device Podcast powered by Greenlight Guru is where today's brightest minds in the medical device industry go to get their most useful and actionable insider knowledge, direct from some of the world's leading medical device experts and companies.